| Offset 1, 6 lines modified | Offset 1, 6 lines modified | ||
| 1 | · | 1 | ·8bb5aace142414ae554deb708f6c6573·182188·admin·optional·ssg-applications_0.1.65-1_all.deb |
| 2 | ·f7bae0738ce4e633a16dbb487c1b30d5·27788·admin·optional·ssg-base_0.1.65-1_all.deb | 2 | ·f7bae0738ce4e633a16dbb487c1b30d5·27788·admin·optional·ssg-base_0.1.65-1_all.deb |
| 3 | ·15dd06e9f234fb55e8e749b52fd73aa1·3396536·admin·optional·ssg-debderived_0.1.65-1_all.deb | ||
| 4 | ·356b964c4499e5a97707c63bfe2d807c·831640·admin·optional·ssg-debian_0.1.65-1_all.deb | ||
| 5 | · | 3 | ·b69db45ed040404786042bb1b1b4ff34·3394152·admin·optional·ssg-debderived_0.1.65-1_all.deb |
| 4 | ·0d407fcd7d4d59ce12841fe4c1ce6413·831460·admin·optional·ssg-debian_0.1.65-1_all.deb | ||
| 5 | ·e1e078ddf3dd030ee4a4ab81d0ea572d·40453244·admin·optional·ssg-nondebian_0.1.65-1_all.deb | ||
| Offset 1, 3 lines modified | Offset 1, 3 lines modified | ||
| 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary | 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary |
| 2 | -rw-r--r--···0········0········0·····17 | 2 | -rw-r--r--···0········0········0·····1740·2022-12-20·09:54:05.000000·control.tar.xz |
| 3 | -rw-r--r--···0········0········0···180 | 3 | -rw-r--r--···0········0········0···180256·2022-12-20·09:54:05.000000·data.tar.xz |
| Offset 14334, 16 lines modified | Offset 14334, 16 lines modified | ||
| 00037fd0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00037fd0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00037fe0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00037fe0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00037ff0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00037ff0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00038000:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00038000:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00038010:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00038010:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00038020:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00038020:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00038030:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038030:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038040:·2020·2020·2028·6173·206f·6620·3230·323 | 00038040:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00038050:·2d30·3 | 00038050:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00038060:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00038060:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00038070:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00038070:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00038080:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00038080:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00038090:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00038090:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 000380a0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 000380a0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 000380b0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 000380b0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 000380c0:·5f67·726f·7570·5f63·6872·6f6d·6975·6d22··_group_chromium" | 000380c0:·5f67·726f·7570·5f63·6872·6f6d·6975·6d22··_group_chromium" |
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | *****·Profile·Information·***** | 50 | *****·Profile·Information·***** |
| 51 | Profile·Title·Upstream·STIG·for·Google·Chromium | 51 | Profile·Title·Upstream·STIG·for·Google·Chromium |
| 52 | Profile·ID····xccdf_org.ssgproject.content_profile_stig | 52 | Profile·ID····xccdf_org.ssgproject.content_profile_stig |
| 53 | ***·CPE·Platforms·*** | 53 | ***·CPE·Platforms·*** |
| 54 | ····*·cpe:/a:google:chromium-browser | 54 | ····*·cpe:/a:google:chromium-browser |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·Chromium | 59 | ···1.·Chromium |
| 60 | *****·Checklist·***** | 60 | *****·Checklist·***** |
| 61 | Group ·Guide·to·the·Secure·Configuration·of·Chromium· Group·contains·1·group·and·37 | 61 | Group ·Guide·to·the·Secure·Configuration·of·Chromium· Group·contains·1·group·and·37 |
| 62 | rules | 62 | rules |
| 63 | Group ·Chromium· Group·contains·37·rules | 63 | Group ·Chromium· Group·contains·37·rules |
| 64 | [ref] ·Chromium·is·an·open-source·web·browser,·powered·by·WebKit·(Blink),·and | 64 | [ref] ·Chromium·is·an·open-source·web·browser,·powered·by·WebKit·(Blink),·and |
| Offset 14331, 15 lines modified | Offset 14331, 15 lines modified | ||
| 00037fa0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037fa0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037fb0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037fb0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037fc0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037fc0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037fd0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037fd0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037fe0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037fe0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037ff0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037ff0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00038000:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00038000:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00038010:·3032·3 | 00038010:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00038020:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00038020:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00038030:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00038030:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038040:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038040:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00038050:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00038050:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00038060:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00038060:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00038070:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00038070:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00038080:·656e·745f·6772·6f75·705f·6f70·656e·7368··ent_group_opensh | 00038080:·656e·745f·6772·6f75·705f·6f70·656e·7368··ent_group_opensh |
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | Profile·ID····xccdf_org.ssgproject.content_profile_cis-node | 44 | Profile·ID····xccdf_org.ssgproject.content_profile_cis-node |
| 45 | ***·CPE·Platforms·*** | 45 | ***·CPE·Platforms·*** |
| 46 | ····*·cpe:/a:amazon:elastic_kubernetes_service_node:1.21 | 46 | ····*·cpe:/a:amazon:elastic_kubernetes_service_node:1.21 |
| 47 | ····*·cpe:/o:amazon:elastic_kubernetes_service_node:1 | 47 | ····*·cpe:/o:amazon:elastic_kubernetes_service_node:1 |
| 48 | ····*·cpe:/a:amazon:elastic_kubernetes_service:1 | 48 | ····*·cpe:/a:amazon:elastic_kubernetes_service:1 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·Kubernetes_Settings | 53 | ···1.·Kubernetes_Settings |
| 54 | ·········1.·Kubernetes_Kubelet_Settings | 54 | ·········1.·Kubernetes_Kubelet_Settings |
| 55 | ·········2.·Kubernetes_-_Worker_Node_Settings | 55 | ·········2.·Kubernetes_-_Worker_Node_Settings |
| 56 | *****·Checklist·***** | 56 | *****·Checklist·***** |
| 57 | Group ·Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service· Group | 57 | Group ·Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service· Group |
| 58 | contains·3·groups·and·7·rules | 58 | contains·3·groups·and·7·rules |
| Offset 14330, 15 lines modified | Offset 14330, 15 lines modified | ||
| 00037f90:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037f90:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037fa0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037fa0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037fb0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037fb0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037fc0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037fc0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037fd0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037fd0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037fe0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037fe0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037ff0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037ff0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038000:·6173·206f·6620·3230·323 | 00038000:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00038010:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00038010:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00038020:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00038020:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00038030:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00038030:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00038040:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00038040:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00038050:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00038050:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00038060:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00038060:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038070:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038070:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group |
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | Profile·ID····xccdf_org.ssgproject.content_profile_cis | 44 | Profile·ID····xccdf_org.ssgproject.content_profile_cis |
| 45 | ***·CPE·Platforms·*** | 45 | ***·CPE·Platforms·*** |
| 46 | ····*·cpe:/a:amazon:elastic_kubernetes_service_node:1.21 | 46 | ····*·cpe:/a:amazon:elastic_kubernetes_service_node:1.21 |
| 47 | ····*·cpe:/o:amazon:elastic_kubernetes_service_node:1 | 47 | ····*·cpe:/o:amazon:elastic_kubernetes_service_node:1 |
| 48 | ····*·cpe:/a:amazon:elastic_kubernetes_service:1 | 48 | ····*·cpe:/a:amazon:elastic_kubernetes_service:1 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·Kubernetes_Settings | 53 | ···1.·Kubernetes_Settings |
| 54 | ·········1.·Kubernetes_-_Account_and_Access_Control | 54 | ·········1.·Kubernetes_-_Account_and_Access_Control |
| 55 | ·········2.·Authentication | 55 | ·········2.·Authentication |
| 56 | ·········3.·Kubernetes_-_General_Security_Practices | 56 | ·········3.·Kubernetes_-_General_Security_Practices |
| 57 | ·········4.·Kubernetes_Kubelet_Settings | 57 | ·········4.·Kubernetes_Kubelet_Settings |
| 58 | ·········5.·OpenShift_-_Logging_Settings | 58 | ·········5.·OpenShift_-_Logging_Settings |
| Offset 14331, 15 lines modified | Offset 14331, 15 lines modified | ||
| 00037fa0:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037fa0:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037fb0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037fb0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037fc0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037fc0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037fd0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037fd0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037fe0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037fe0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037ff0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037ff0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00038000:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00038000:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038010:·6173·206f·6620·3230·323 | 00038010:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00038020:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00038020:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00038030:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00038030:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00038040:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00038040:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00038050:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00038050:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00038060:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00038060:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00038070:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00038070:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038080:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038080:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group |
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | *****·Profile·Information·***** | 50 | *****·Profile·Information·***** |
| 51 | Profile·Title·Mozilla·Firefox·STIG | 51 | Profile·Title·Mozilla·Firefox·STIG |
| 52 | Profile·ID····xccdf_org.ssgproject.content_profile_stig | 52 | Profile·ID····xccdf_org.ssgproject.content_profile_stig |
| 53 | ***·CPE·Platforms·*** | 53 | ***·CPE·Platforms·*** |
| 54 | ····*·cpe:/a:mozilla:firefox | 54 | ····*·cpe:/a:mozilla:firefox |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·Firefox | 59 | ···1.·Firefox |
| 60 | *****·Checklist·***** | 60 | *****·Checklist·***** |
| 61 | Group ·Guide·to·the·Secure·Configuration·of·Firefox· Group·contains·1·group·and·33·rules | 61 | Group ·Guide·to·the·Secure·Configuration·of·Firefox· Group·contains·1·group·and·33·rules |
| 62 | Group ·Firefox· Group·contains·33·rules | 62 | Group ·Firefox· Group·contains·33·rules |
| 63 | [ref] ·Firefox·is·an·open-source·web·browser·and·developed·by·Mozilla.·Web·browsers·such·as | 63 | [ref] ·Firefox·is·an·open-source·web·browser·and·developed·by·Mozilla.·Web·browsers·such·as |
| 64 | Firefox·are·used·for·a·number·of·reasons.·This·section·provides·settings·for·configuring | 64 | Firefox·are·used·for·a·number·of·reasons.·This·section·provides·settings·for·configuring |
| Offset 28, 15 lines modified | Offset 28, 15 lines modified | ||
| 28 | ········<cpe-dict:title·xml:lang="en-us">Google·Chromium·Browser</cpe-dict:title> | 28 | ········<cpe-dict:title·xml:lang="en-us">Google·Chromium·Browser</cpe-dict:title> |
| 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-chromium-cpe-oval.xml">oval:ssg-installed_app_is_chromium:def:1</cpe-dict:check> | 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-chromium-cpe-oval.xml">oval:ssg-installed_app_is_chromium:def:1</cpe-dict:check> |
| 30 | ······</cpe-dict:cpe-item> | 30 | ······</cpe-dict:cpe-item> |
| 31 | ····</cpe-dict:cpe-list> | 31 | ····</cpe-dict:cpe-list> |
| 32 | ··</ds:component> | 32 | ··</ds:component> |
| 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-chromium-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-chromium-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_CHROMIUM"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_CHROMIUM"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 35 | ······<xccdf-1.2:status·date="202 | 35 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Chromium</xccdf-1.2:title> | 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Chromium</xccdf-1.2:title> |
| 37 | ······<xccdf-1.2:description> | 37 | ······<xccdf-1.2:description> |
| 38 | ········This·guide·presents·a·catalog·of·security-relevant | 38 | ········This·guide·presents·a·catalog·of·security-relevant |
| 39 | configuration·settings·for·Chromium.·It·is·a·rendering·of | 39 | configuration·settings·for·Chromium.·It·is·a·rendering·of |
| 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 41 | in·order·to·support·security·automation.··The·SCAP·content·is | 41 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 42 | is·available·in·the | 42 | is·available·in·the |
| Offset 2477, 463 lines modified | Offset 2477, 463 lines modified | ||
| 2477 | ······<ocil:generator> | 2477 | ······<ocil:generator> |
| 2478 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 2478 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 2479 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 2479 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 2480 | ········<ocil:schema_version>2.0</ocil:schema_version> | 2480 | ········<ocil:schema_version>2.0</ocil:schema_version> |
| 2481 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 2481 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 2482 | ······</ocil:generator> | 2482 | ······</ocil:generator> |
| 2483 | ······<ocil:questionnaires> | 2483 | ······<ocil:questionnaires> |
| 2484 | ········<ocil:questionnaire·id="ocil:ssg-chromium_d | 2484 | ········<ocil:questionnaire·id="ocil:ssg-chromium_default_block_plugins_ocil:questionnaire:1"> |
| 2485 | ··········<ocil:title>Block·Plugins·by·Default</ocil:title> | ||
| 2485 | ··········<ocil:title>Disable·Data·Synchronization·to·Google</ocil:title> | ||
| 2486 | ··········<ocil:actions> | ||
| 2487 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_google_sync_action:testaction:1</ocil:test_action_ref> | ||
| 2488 | ··········</ocil:actions> | ||
| 2489 | ········</ocil:questionnaire> | ||
| 2490 | ········<ocil:questionnaire·id="ocil:ssg-chromium_enable_safe_browsing_ocil:questionnaire:1"> | ||
| 2491 | ··········<ocil:title>Enable·the·Safe·Browsing·Feature</ocil:title> | ||
| 2492 | ··········<ocil:actions> | ||
| 2493 | ············<ocil:test_action_ref>ocil:ssg-chromium_enable_safe_browsing_action:testaction:1</ocil:test_action_ref> | ||
| 2494 | ··········</ocil:actions> | ||
| 2495 | ········</ocil:questionnaire> | ||
| 2496 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_password_manager_ocil:questionnaire:1"> | ||
| 2497 | ··········<ocil:title>Disable·Chromium·Password·Manager</ocil:title> | ||
| 2498 | ··········<ocil:actions> | 2486 | ··········<ocil:actions> |
| 2499 | ············<ocil:test_action_ref>ocil:ssg-chromium_d | 2487 | ············<ocil:test_action_ref>ocil:ssg-chromium_default_block_plugins_action:testaction:1</ocil:test_action_ref> |
| 2500 | ··········</ocil:actions> | 2488 | ··········</ocil:actions> |
| 2501 | ········</ocil:questionnaire> | 2489 | ········</ocil:questionnaire> |
| 2502 | ········<ocil:questionnaire·id="ocil:ssg-chromium_po | 2490 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_protocol_schemas_ocil:questionnaire:1"> |
| 2503 | ··········<ocil:title> | 2491 | ··········<ocil:title>Disable·Insecure·And·Obsolete·Protocol·Schemas</ocil:title> |
| 2504 | ··········<ocil:actions> | 2492 | ··········<ocil:actions> |
| 2505 | ············<ocil:test_action_ref>ocil:ssg-chromium_po | 2493 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_protocol_schemas_action:testaction:1</ocil:test_action_ref> |
| 2506 | ··········</ocil:actions> | 2494 | ··········</ocil:actions> |
| 2507 | ········</ocil:questionnaire> | 2495 | ········</ocil:questionnaire> |
| 2508 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2496 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_search_suggestions_ocil:questionnaire:1"> |
| 2509 | ··········<ocil:title>Disable· | 2497 | ··········<ocil:title>Disable·Search·Suggestion</ocil:title> |
| 2510 | ··········<ocil:actions> | 2498 | ··········<ocil:actions> |
| 2511 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2499 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_search_suggestions_action:testaction:1</ocil:test_action_ref> |
| 2512 | ··········</ocil:actions> | 2500 | ··········</ocil:actions> |
| 2513 | ········</ocil:questionnaire> | 2501 | ········</ocil:questionnaire> |
| 2514 | ········<ocil:questionnaire·id="ocil:ssg-chromium_d | 2502 | ········<ocil:questionnaire·id="ocil:ssg-chromium_default_search_provider_name_ocil:questionnaire:1"> |
| 2515 | ··········<ocil:title> | 2503 | ··········<ocil:title>Set·the·Default·Search·Provider's·URL</ocil:title> |
| 2516 | ··········<ocil:actions> | 2504 | ··········<ocil:actions> |
| 2517 | ············<ocil:test_action_ref>ocil:ssg-chromium_d | 2505 | ············<ocil:test_action_ref>ocil:ssg-chromium_default_search_provider_name_action:testaction:1</ocil:test_action_ref> |
| 2518 | ··········</ocil:actions> | 2506 | ··········</ocil:actions> |
| 2519 | ········</ocil:questionnaire> | 2507 | ········</ocil:questionnaire> |
| 2520 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disa | 2508 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disallow_location_tracking_ocil:questionnaire:1"> |
| 2521 | ··········<ocil:title>Disable· | 2509 | ··········<ocil:title>Disable·Location·Tracking</ocil:title> |
| 2522 | ··········<ocil:actions> | 2510 | ··········<ocil:actions> |
| 2523 | ············<ocil:test_action_ref>ocil:ssg-chromium_disa | 2511 | ············<ocil:test_action_ref>ocil:ssg-chromium_disallow_location_tracking_action:testaction:1</ocil:test_action_ref> |
| 2524 | ··········</ocil:actions> | 2512 | ··········</ocil:actions> |
| 2525 | ········</ocil:questionnaire> | 2513 | ········</ocil:questionnaire> |
| 2526 | ········<ocil:questionnaire·id="ocil:ssg-chromium_block_desktop_notifications_ocil:questionnaire:1"> | 2514 | ········<ocil:questionnaire·id="ocil:ssg-chromium_block_desktop_notifications_ocil:questionnaire:1"> |
| 2527 | ··········<ocil:title>Prevent·Desktop·Notifications</ocil:title> | 2515 | ··········<ocil:title>Prevent·Desktop·Notifications</ocil:title> |
| 2528 | ··········<ocil:actions> | 2516 | ··········<ocil:actions> |
| 2529 | ············<ocil:test_action_ref>ocil:ssg-chromium_block_desktop_notifications_action:testaction:1</ocil:test_action_ref> | 2517 | ············<ocil:test_action_ref>ocil:ssg-chromium_block_desktop_notifications_action:testaction:1</ocil:test_action_ref> |
| 2530 | ··········</ocil:actions> | 2518 | ··········</ocil:actions> |
| 2531 | ········</ocil:questionnaire> | 2519 | ········</ocil:questionnaire> |
| 2532 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2520 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_metrics_reporting_ocil:questionnaire:1"> |
| 2533 | ··········<ocil:title>Disable· | 2521 | ··········<ocil:title>Disable·Metrics·Reporting</ocil:title> |
| 2534 | ··········<ocil:actions> | 2522 | ··········<ocil:actions> |
| 2535 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2523 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_metrics_reporting_action:testaction:1</ocil:test_action_ref> |
| 2536 | ··········</ocil:actions> | 2524 | ··········</ocil:actions> |
| 2537 | ········</ocil:questionnaire> | 2525 | ········</ocil:questionnaire> |
| 2538 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2526 | ········<ocil:questionnaire·id="ocil:ssg-chromium_extension_whitelist_ocil:questionnaire:1"> |
| 2539 | ··········<ocil:title> | 2527 | ··········<ocil:title>Enable·Only·Approved·Extensions</ocil:title> |
| 2540 | ··········<ocil:actions> | 2528 | ··········<ocil:actions> |
| 2541 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2529 | ············<ocil:test_action_ref>ocil:ssg-chromium_extension_whitelist_action:testaction:1</ocil:test_action_ref> |
| 2542 | ··········</ocil:actions> | 2530 | ··········</ocil:actions> |
| 2543 | ········</ocil:questionnaire> | 2531 | ········</ocil:questionnaire> |
| 2544 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2532 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_background_processing_ocil:questionnaire:1"> |
| 2545 | ··········<ocil:title>Disable· | 2533 | ··········<ocil:title>Disable·Background·Processing</ocil:title> |
| 2546 | ··········<ocil:actions> | 2534 | ··········<ocil:actions> |
| 2547 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2535 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_background_processing_action:testaction:1</ocil:test_action_ref> |
| 2548 | ··········</ocil:actions> | 2536 | ··········</ocil:actions> |
| 2549 | ········</ocil:questionnaire> | 2537 | ········</ocil:questionnaire> |
| 2550 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2538 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_network_prediction_ocil:questionnaire:1"> |
| 2551 | ··········<ocil:title>Disable· | 2539 | ··········<ocil:title>Disable·Network·Prediction</ocil:title> |
| 2552 | ··········<ocil:actions> | 2540 | ··········<ocil:actions> |
| 2553 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2541 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_network_prediction_action:testaction:1</ocil:test_action_ref> |
| 2554 | ··········</ocil:actions> | 2542 | ··········</ocil:actions> |
| 2555 | ········</ocil:questionnaire> | 2543 | ········</ocil:questionnaire> |
| 2556 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2544 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_incognito_mode_ocil:questionnaire:1"> |
| 2557 | ··········<ocil:title>Disable· | 2545 | ··········<ocil:title>Disable·Incognito·Mode</ocil:title> |
| 2558 | ··········<ocil:actions> | 2546 | ··········<ocil:actions> |
| 2559 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2547 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_incognito_mode_action:testaction:1</ocil:test_action_ref> |
| 2560 | ··········</ocil:actions> | 2548 | ··········</ocil:actions> |
| 2561 | ········</ocil:questionnaire> | 2549 | ········</ocil:questionnaire> |
| 2562 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2550 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_cloud_print_sharing_ocil:questionnaire:1"> |
| 2563 | ··········<ocil:title> | 2551 | ··········<ocil:title>Disable·Cloud·Print·Sharing</ocil:title> |
| 2564 | ··········<ocil:actions> | 2552 | ··········<ocil:actions> |
| 2565 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2553 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_cloud_print_sharing_action:testaction:1</ocil:test_action_ref> |
| 2566 | ··········</ocil:actions> | 2554 | ··········</ocil:actions> |
| 2567 | ········</ocil:questionnaire> | 2555 | ········</ocil:questionnaire> |
| 2568 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2556 | ········<ocil:questionnaire·id="ocil:ssg-chromium_policy_file_ocil:questionnaire:1"> |
| 2569 | ··········<ocil:title> | 2557 | ··········<ocil:title>Ensure·the·Chromium·Policy·Configuration·File·Exists</ocil:title> |
| 2570 | ··········<ocil:actions> | 2558 | ··········<ocil:actions> |
| 2571 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2559 | ············<ocil:test_action_ref>ocil:ssg-chromium_policy_file_action:testaction:1</ocil:test_action_ref> |
| 2572 | ··········</ocil:actions> | 2560 | ··········</ocil:actions> |
| 2573 | ········</ocil:questionnaire> | 2561 | ········</ocil:questionnaire> |
| 2574 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2562 | ········<ocil:questionnaire·id="ocil:ssg-chromium_http_authentication_ocil:questionnaire:1"> |
| 2575 | ··········<ocil:title> | 2563 | ··········<ocil:title>Set·Chromium's·HTTP·Authentication·Scheme</ocil:title> |
| 2576 | ··········<ocil:actions> | 2564 | ··········<ocil:actions> |
| 2577 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2565 | ············<ocil:test_action_ref>ocil:ssg-chromium_http_authentication_action:testaction:1</ocil:test_action_ref> |
| 2578 | ··········</ocil:actions> | 2566 | ··········</ocil:actions> |
| 2579 | ········</ocil:questionnaire> | 2567 | ········</ocil:questionnaire> |
| 2580 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disa | 2568 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_google_sync_ocil:questionnaire:1"> |
| 2581 | ··········<ocil:title>Disable· | 2569 | ··········<ocil:title>Disable·Data·Synchronization·to·Google</ocil:title> |
| 2582 | ··········<ocil:actions> | 2570 | ··········<ocil:actions> |
| 2583 | ············<ocil:test_action_ref>ocil:ssg-chromium_disa | 2571 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_google_sync_action:testaction:1</ocil:test_action_ref> |
| 2584 | ··········</ocil:actions> | 2572 | ··········</ocil:actions> |
| 2585 | ········</ocil:questionnaire> | 2573 | ········</ocil:questionnaire> |
| 2586 | ········<ocil:questionnaire·id="ocil:ssg-chromium_check_cert_revocation_ocil:questionnaire:1"> | 2574 | ········<ocil:questionnaire·id="ocil:ssg-chromium_check_cert_revocation_ocil:questionnaire:1"> |
| Max diff block lines reached; 65006/77098 bytes (84.32%) of diff not shown. | |||
| Offset 28, 15 lines modified | Offset 28, 15 lines modified | ||
| 28 | ········<cpe-dict:title·xml:lang="en-us">Google·Chromium·Browser</cpe-dict:title> | 28 | ········<cpe-dict:title·xml:lang="en-us">Google·Chromium·Browser</cpe-dict:title> |
| 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-chromium-cpe-oval.xml">oval:ssg-installed_app_is_chromium:def:1</cpe-dict:check> | 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-chromium-cpe-oval.xml">oval:ssg-installed_app_is_chromium:def:1</cpe-dict:check> |
| 30 | ······</cpe-dict:cpe-item> | 30 | ······</cpe-dict:cpe-item> |
| 31 | ····</cpe-dict:cpe-list> | 31 | ····</cpe-dict:cpe-list> |
| 32 | ··</ds:component> | 32 | ··</ds:component> |
| 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-chromium-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-chromium-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_CHROMIUM"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_CHROMIUM"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 35 | ······<xccdf-1.2:status·date="202 | 35 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Chromium</xccdf-1.2:title> | 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Chromium</xccdf-1.2:title> |
| 37 | ······<xccdf-1.2:description> | 37 | ······<xccdf-1.2:description> |
| 38 | ········This·guide·presents·a·catalog·of·security-relevant | 38 | ········This·guide·presents·a·catalog·of·security-relevant |
| 39 | configuration·settings·for·Chromium.·It·is·a·rendering·of | 39 | configuration·settings·for·Chromium.·It·is·a·rendering·of |
| 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 41 | in·order·to·support·security·automation.··The·SCAP·content·is | 41 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 42 | is·available·in·the | 42 | is·available·in·the |
| Offset 2477, 463 lines modified | Offset 2477, 463 lines modified | ||
| 2477 | ······<ocil:generator> | 2477 | ······<ocil:generator> |
| 2478 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 2478 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 2479 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 2479 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 2480 | ········<ocil:schema_version>2.0</ocil:schema_version> | 2480 | ········<ocil:schema_version>2.0</ocil:schema_version> |
| 2481 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 2481 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 2482 | ······</ocil:generator> | 2482 | ······</ocil:generator> |
| 2483 | ······<ocil:questionnaires> | 2483 | ······<ocil:questionnaires> |
| 2484 | ········<ocil:questionnaire·id="ocil:ssg-chromium_d | 2484 | ········<ocil:questionnaire·id="ocil:ssg-chromium_default_block_plugins_ocil:questionnaire:1"> |
| 2485 | ··········<ocil:title>Block·Plugins·by·Default</ocil:title> | ||
| 2485 | ··········<ocil:title>Disable·Data·Synchronization·to·Google</ocil:title> | ||
| 2486 | ··········<ocil:actions> | ||
| 2487 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_google_sync_action:testaction:1</ocil:test_action_ref> | ||
| 2488 | ··········</ocil:actions> | ||
| 2489 | ········</ocil:questionnaire> | ||
| 2490 | ········<ocil:questionnaire·id="ocil:ssg-chromium_enable_safe_browsing_ocil:questionnaire:1"> | ||
| 2491 | ··········<ocil:title>Enable·the·Safe·Browsing·Feature</ocil:title> | ||
| 2492 | ··········<ocil:actions> | ||
| 2493 | ············<ocil:test_action_ref>ocil:ssg-chromium_enable_safe_browsing_action:testaction:1</ocil:test_action_ref> | ||
| 2494 | ··········</ocil:actions> | ||
| 2495 | ········</ocil:questionnaire> | ||
| 2496 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_password_manager_ocil:questionnaire:1"> | ||
| 2497 | ··········<ocil:title>Disable·Chromium·Password·Manager</ocil:title> | ||
| 2498 | ··········<ocil:actions> | 2486 | ··········<ocil:actions> |
| 2499 | ············<ocil:test_action_ref>ocil:ssg-chromium_d | 2487 | ············<ocil:test_action_ref>ocil:ssg-chromium_default_block_plugins_action:testaction:1</ocil:test_action_ref> |
| 2500 | ··········</ocil:actions> | 2488 | ··········</ocil:actions> |
| 2501 | ········</ocil:questionnaire> | 2489 | ········</ocil:questionnaire> |
| 2502 | ········<ocil:questionnaire·id="ocil:ssg-chromium_po | 2490 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_protocol_schemas_ocil:questionnaire:1"> |
| 2503 | ··········<ocil:title> | 2491 | ··········<ocil:title>Disable·Insecure·And·Obsolete·Protocol·Schemas</ocil:title> |
| 2504 | ··········<ocil:actions> | 2492 | ··········<ocil:actions> |
| 2505 | ············<ocil:test_action_ref>ocil:ssg-chromium_po | 2493 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_protocol_schemas_action:testaction:1</ocil:test_action_ref> |
| 2506 | ··········</ocil:actions> | 2494 | ··········</ocil:actions> |
| 2507 | ········</ocil:questionnaire> | 2495 | ········</ocil:questionnaire> |
| 2508 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2496 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_search_suggestions_ocil:questionnaire:1"> |
| 2509 | ··········<ocil:title>Disable· | 2497 | ··········<ocil:title>Disable·Search·Suggestion</ocil:title> |
| 2510 | ··········<ocil:actions> | 2498 | ··········<ocil:actions> |
| 2511 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2499 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_search_suggestions_action:testaction:1</ocil:test_action_ref> |
| 2512 | ··········</ocil:actions> | 2500 | ··········</ocil:actions> |
| 2513 | ········</ocil:questionnaire> | 2501 | ········</ocil:questionnaire> |
| 2514 | ········<ocil:questionnaire·id="ocil:ssg-chromium_d | 2502 | ········<ocil:questionnaire·id="ocil:ssg-chromium_default_search_provider_name_ocil:questionnaire:1"> |
| 2515 | ··········<ocil:title> | 2503 | ··········<ocil:title>Set·the·Default·Search·Provider's·URL</ocil:title> |
| 2516 | ··········<ocil:actions> | 2504 | ··········<ocil:actions> |
| 2517 | ············<ocil:test_action_ref>ocil:ssg-chromium_d | 2505 | ············<ocil:test_action_ref>ocil:ssg-chromium_default_search_provider_name_action:testaction:1</ocil:test_action_ref> |
| 2518 | ··········</ocil:actions> | 2506 | ··········</ocil:actions> |
| 2519 | ········</ocil:questionnaire> | 2507 | ········</ocil:questionnaire> |
| 2520 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disa | 2508 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disallow_location_tracking_ocil:questionnaire:1"> |
| 2521 | ··········<ocil:title>Disable· | 2509 | ··········<ocil:title>Disable·Location·Tracking</ocil:title> |
| 2522 | ··········<ocil:actions> | 2510 | ··········<ocil:actions> |
| 2523 | ············<ocil:test_action_ref>ocil:ssg-chromium_disa | 2511 | ············<ocil:test_action_ref>ocil:ssg-chromium_disallow_location_tracking_action:testaction:1</ocil:test_action_ref> |
| 2524 | ··········</ocil:actions> | 2512 | ··········</ocil:actions> |
| 2525 | ········</ocil:questionnaire> | 2513 | ········</ocil:questionnaire> |
| 2526 | ········<ocil:questionnaire·id="ocil:ssg-chromium_block_desktop_notifications_ocil:questionnaire:1"> | 2514 | ········<ocil:questionnaire·id="ocil:ssg-chromium_block_desktop_notifications_ocil:questionnaire:1"> |
| 2527 | ··········<ocil:title>Prevent·Desktop·Notifications</ocil:title> | 2515 | ··········<ocil:title>Prevent·Desktop·Notifications</ocil:title> |
| 2528 | ··········<ocil:actions> | 2516 | ··········<ocil:actions> |
| 2529 | ············<ocil:test_action_ref>ocil:ssg-chromium_block_desktop_notifications_action:testaction:1</ocil:test_action_ref> | 2517 | ············<ocil:test_action_ref>ocil:ssg-chromium_block_desktop_notifications_action:testaction:1</ocil:test_action_ref> |
| 2530 | ··········</ocil:actions> | 2518 | ··········</ocil:actions> |
| 2531 | ········</ocil:questionnaire> | 2519 | ········</ocil:questionnaire> |
| 2532 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2520 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_metrics_reporting_ocil:questionnaire:1"> |
| 2533 | ··········<ocil:title>Disable· | 2521 | ··········<ocil:title>Disable·Metrics·Reporting</ocil:title> |
| 2534 | ··········<ocil:actions> | 2522 | ··········<ocil:actions> |
| 2535 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2523 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_metrics_reporting_action:testaction:1</ocil:test_action_ref> |
| 2536 | ··········</ocil:actions> | 2524 | ··········</ocil:actions> |
| 2537 | ········</ocil:questionnaire> | 2525 | ········</ocil:questionnaire> |
| 2538 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2526 | ········<ocil:questionnaire·id="ocil:ssg-chromium_extension_whitelist_ocil:questionnaire:1"> |
| 2539 | ··········<ocil:title> | 2527 | ··········<ocil:title>Enable·Only·Approved·Extensions</ocil:title> |
| 2540 | ··········<ocil:actions> | 2528 | ··········<ocil:actions> |
| 2541 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2529 | ············<ocil:test_action_ref>ocil:ssg-chromium_extension_whitelist_action:testaction:1</ocil:test_action_ref> |
| 2542 | ··········</ocil:actions> | 2530 | ··········</ocil:actions> |
| 2543 | ········</ocil:questionnaire> | 2531 | ········</ocil:questionnaire> |
| 2544 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2532 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_background_processing_ocil:questionnaire:1"> |
| 2545 | ··········<ocil:title>Disable· | 2533 | ··········<ocil:title>Disable·Background·Processing</ocil:title> |
| 2546 | ··········<ocil:actions> | 2534 | ··········<ocil:actions> |
| 2547 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2535 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_background_processing_action:testaction:1</ocil:test_action_ref> |
| 2548 | ··········</ocil:actions> | 2536 | ··········</ocil:actions> |
| 2549 | ········</ocil:questionnaire> | 2537 | ········</ocil:questionnaire> |
| 2550 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2538 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_network_prediction_ocil:questionnaire:1"> |
| 2551 | ··········<ocil:title>Disable· | 2539 | ··········<ocil:title>Disable·Network·Prediction</ocil:title> |
| 2552 | ··········<ocil:actions> | 2540 | ··········<ocil:actions> |
| 2553 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2541 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_network_prediction_action:testaction:1</ocil:test_action_ref> |
| 2554 | ··········</ocil:actions> | 2542 | ··········</ocil:actions> |
| 2555 | ········</ocil:questionnaire> | 2543 | ········</ocil:questionnaire> |
| 2556 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 2544 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_incognito_mode_ocil:questionnaire:1"> |
| 2557 | ··········<ocil:title>Disable· | 2545 | ··········<ocil:title>Disable·Incognito·Mode</ocil:title> |
| 2558 | ··········<ocil:actions> | 2546 | ··········<ocil:actions> |
| 2559 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 2547 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_incognito_mode_action:testaction:1</ocil:test_action_ref> |
| 2560 | ··········</ocil:actions> | 2548 | ··········</ocil:actions> |
| 2561 | ········</ocil:questionnaire> | 2549 | ········</ocil:questionnaire> |
| 2562 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2550 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_cloud_print_sharing_ocil:questionnaire:1"> |
| 2563 | ··········<ocil:title> | 2551 | ··········<ocil:title>Disable·Cloud·Print·Sharing</ocil:title> |
| 2564 | ··········<ocil:actions> | 2552 | ··········<ocil:actions> |
| 2565 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2553 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_cloud_print_sharing_action:testaction:1</ocil:test_action_ref> |
| 2566 | ··········</ocil:actions> | 2554 | ··········</ocil:actions> |
| 2567 | ········</ocil:questionnaire> | 2555 | ········</ocil:questionnaire> |
| 2568 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2556 | ········<ocil:questionnaire·id="ocil:ssg-chromium_policy_file_ocil:questionnaire:1"> |
| 2569 | ··········<ocil:title> | 2557 | ··········<ocil:title>Ensure·the·Chromium·Policy·Configuration·File·Exists</ocil:title> |
| 2570 | ··········<ocil:actions> | 2558 | ··········<ocil:actions> |
| 2571 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2559 | ············<ocil:test_action_ref>ocil:ssg-chromium_policy_file_action:testaction:1</ocil:test_action_ref> |
| 2572 | ··········</ocil:actions> | 2560 | ··········</ocil:actions> |
| 2573 | ········</ocil:questionnaire> | 2561 | ········</ocil:questionnaire> |
| 2574 | ········<ocil:questionnaire·id="ocil:ssg-chromium_ | 2562 | ········<ocil:questionnaire·id="ocil:ssg-chromium_http_authentication_ocil:questionnaire:1"> |
| 2575 | ··········<ocil:title> | 2563 | ··········<ocil:title>Set·Chromium's·HTTP·Authentication·Scheme</ocil:title> |
| 2576 | ··········<ocil:actions> | 2564 | ··········<ocil:actions> |
| 2577 | ············<ocil:test_action_ref>ocil:ssg-chromium_ | 2565 | ············<ocil:test_action_ref>ocil:ssg-chromium_http_authentication_action:testaction:1</ocil:test_action_ref> |
| 2578 | ··········</ocil:actions> | 2566 | ··········</ocil:actions> |
| 2579 | ········</ocil:questionnaire> | 2567 | ········</ocil:questionnaire> |
| 2580 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disa | 2568 | ········<ocil:questionnaire·id="ocil:ssg-chromium_disable_google_sync_ocil:questionnaire:1"> |
| 2581 | ··········<ocil:title>Disable· | 2569 | ··········<ocil:title>Disable·Data·Synchronization·to·Google</ocil:title> |
| 2582 | ··········<ocil:actions> | 2570 | ··········<ocil:actions> |
| 2583 | ············<ocil:test_action_ref>ocil:ssg-chromium_disa | 2571 | ············<ocil:test_action_ref>ocil:ssg-chromium_disable_google_sync_action:testaction:1</ocil:test_action_ref> |
| 2584 | ··········</ocil:actions> | 2572 | ··········</ocil:actions> |
| 2585 | ········</ocil:questionnaire> | 2573 | ········</ocil:questionnaire> |
| 2586 | ········<ocil:questionnaire·id="ocil:ssg-chromium_check_cert_revocation_ocil:questionnaire:1"> | 2574 | ········<ocil:questionnaire·id="ocil:ssg-chromium_check_cert_revocation_ocil:questionnaire:1"> |
| Max diff block lines reached; 65006/77098 bytes (84.32%) of diff not shown. | |||
| Offset 3, 463 lines modified | Offset 3, 463 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-chromium_d | 10 | ····<ocil:questionnaire·id="ocil:ssg-chromium_default_block_plugins_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>Block·Plugins·by·Default</ocil:title> | ||
| 11 | ······<ocil:title>Disable·Data·Synchronization·to·Google</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_google_sync_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-chromium_enable_safe_browsing_ocil:questionnaire:1"> | ||
| 17 | ······<ocil:title>Enable·the·Safe·Browsing·Feature</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-chromium_enable_safe_browsing_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_password_manager_ocil:questionnaire:1"> | ||
| 23 | ······<ocil:title>Disable·Chromium·Password·Manager</ocil:title> | ||
| 24 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg-chromium_d | 13 | ········<ocil:test_action_ref>ocil:ssg-chromium_default_block_plugins_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg-chromium_po | 16 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_protocol_schemas_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 17 | ······<ocil:title>Disable·Insecure·And·Obsolete·Protocol·Schemas</ocil:title> |
| 30 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg-chromium_po | 19 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_protocol_schemas_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 22 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_search_suggestions_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Disable· | 23 | ······<ocil:title>Disable·Search·Suggestion</ocil:title> |
| 36 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 25 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_search_suggestions_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-chromium_d | 28 | ····<ocil:questionnaire·id="ocil:ssg-chromium_default_search_provider_name_ocil:questionnaire:1"> |
| 41 | ······<ocil:title> | 29 | ······<ocil:title>Set·the·Default·Search·Provider's·URL</ocil:title> |
| 42 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg-chromium_d | 31 | ········<ocil:test_action_ref>ocil:ssg-chromium_default_search_provider_name_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disa | 34 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disallow_location_tracking_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Disable· | 35 | ······<ocil:title>Disable·Location·Tracking</ocil:title> |
| 48 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg-chromium_disa | 37 | ········<ocil:test_action_ref>ocil:ssg-chromium_disallow_location_tracking_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg-chromium_block_desktop_notifications_ocil:questionnaire:1"> | 40 | ····<ocil:questionnaire·id="ocil:ssg-chromium_block_desktop_notifications_ocil:questionnaire:1"> |
| 53 | ······<ocil:title>Prevent·Desktop·Notifications</ocil:title> | 41 | ······<ocil:title>Prevent·Desktop·Notifications</ocil:title> |
| 54 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg-chromium_block_desktop_notifications_action:testaction:1</ocil:test_action_ref> | 43 | ········<ocil:test_action_ref>ocil:ssg-chromium_block_desktop_notifications_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 46 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_metrics_reporting_ocil:questionnaire:1"> |
| 59 | ······<ocil:title>Disable· | 47 | ······<ocil:title>Disable·Metrics·Reporting</ocil:title> |
| 60 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 49 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_metrics_reporting_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-chromium_ | 52 | ····<ocil:questionnaire·id="ocil:ssg-chromium_extension_whitelist_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 53 | ······<ocil:title>Enable·Only·Approved·Extensions</ocil:title> |
| 66 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg-chromium_ | 55 | ········<ocil:test_action_ref>ocil:ssg-chromium_extension_whitelist_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 58 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_background_processing_ocil:questionnaire:1"> |
| 71 | ······<ocil:title>Disable· | 59 | ······<ocil:title>Disable·Background·Processing</ocil:title> |
| 72 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 61 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_background_processing_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 64 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_network_prediction_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>Disable· | 65 | ······<ocil:title>Disable·Network·Prediction</ocil:title> |
| 78 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 67 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_network_prediction_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_ | 70 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_incognito_mode_ocil:questionnaire:1"> |
| 83 | ······<ocil:title>Disable· | 71 | ······<ocil:title>Disable·Incognito·Mode</ocil:title> |
| 84 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_ | 73 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_incognito_mode_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-chromium_ | 76 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_cloud_print_sharing_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 77 | ······<ocil:title>Disable·Cloud·Print·Sharing</ocil:title> |
| 90 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-chromium_ | 79 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_cloud_print_sharing_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-chromium_ | 82 | ····<ocil:questionnaire·id="ocil:ssg-chromium_policy_file_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 83 | ······<ocil:title>Ensure·the·Chromium·Policy·Configuration·File·Exists</ocil:title> |
| 96 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg-chromium_ | 85 | ········<ocil:test_action_ref>ocil:ssg-chromium_policy_file_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-chromium_ | 88 | ····<ocil:questionnaire·id="ocil:ssg-chromium_http_authentication_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 89 | ······<ocil:title>Set·Chromium's·HTTP·Authentication·Scheme</ocil:title> |
| 102 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg-chromium_ | 91 | ········<ocil:test_action_ref>ocil:ssg-chromium_http_authentication_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disa | 94 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_google_sync_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Disable· | 95 | ······<ocil:title>Disable·Data·Synchronization·to·Google</ocil:title> |
| 108 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg-chromium_disa | 97 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_google_sync_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg-chromium_check_cert_revocation_ocil:questionnaire:1"> | 100 | ····<ocil:questionnaire·id="ocil:ssg-chromium_check_cert_revocation_ocil:questionnaire:1"> |
| 113 | ······<ocil:title>Enable·Online·OCSP/CRL·Certificate·Checks</ocil:title> | 101 | ······<ocil:title>Enable·Online·OCSP/CRL·Certificate·Checks</ocil:title> |
| 114 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg-chromium_check_cert_revocation_action:testaction:1</ocil:test_action_ref> | 103 | ········<ocil:test_action_ref>ocil:ssg-chromium_check_cert_revocation_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg-chromium_ | 106 | ····<ocil:questionnaire·id="ocil:ssg-chromium_enable_browser_history_ocil:questionnaire:1"> |
| 119 | ······<ocil:title>Enable· | 107 | ······<ocil:title>Enable·Saving·the·Browser·History</ocil:title> |
| 120 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg-chromium_ | 109 | ········<ocil:test_action_ref>ocil:ssg-chromium_enable_browser_history_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg-chromium_ | 112 | ····<ocil:questionnaire·id="ocil:ssg-chromium_disable_session_cookies_ocil:questionnaire:1"> |
| 125 | ······<ocil:title> | 113 | ······<ocil:title>Disable·Session·Cookies</ocil:title> |
| 126 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 127 | ········<ocil:test_action_ref>ocil:ssg-chromium_ | 115 | ········<ocil:test_action_ref>ocil:ssg-chromium_disable_session_cookies_action:testaction:1</ocil:test_action_ref> |
| 128 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| Max diff block lines reached; 60212/71883 bytes (83.76%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_CHROMIUM"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_CHROMIUM"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Chromium</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Chromium</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Chromium.·It·is·a·rendering·of | 7 | configuration·settings·for·Chromium.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | ········<cpe-dict:title·xml:lang="en-us">Amazon·Elastic·Kubernetes·Service·Node</cpe-dict:title> | 36 | ········<cpe-dict:title·xml:lang="en-us">Amazon·Elastic·Kubernetes·Service·Node</cpe-dict:title> |
| 37 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-eks-cpe-oval.xml">oval:ssg-installed_app_is_eks_node:def:1</cpe-dict:check> | 37 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-eks-cpe-oval.xml">oval:ssg-installed_app_is_eks_node:def:1</cpe-dict:check> |
| 38 | ······</cpe-dict:cpe-item> | 38 | ······</cpe-dict:cpe-item> |
| 39 | ····</cpe-dict:cpe-list> | 39 | ····</cpe-dict:cpe-list> |
| 40 | ··</ds:component> | 40 | ··</ds:component> |
| 41 | ··<ds:component·id="scap_org.open-scap_comp_ssg-eks-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 41 | ··<ds:component·id="scap_org.open-scap_comp_ssg-eks-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 42 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_EKS"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 42 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_EKS"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 43 | ······<xccdf-1.2:status·date="202 | 43 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 44 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service</xccdf-1.2:title> | 44 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service</xccdf-1.2:title> |
| 45 | ······<xccdf-1.2:description> | 45 | ······<xccdf-1.2:description> |
| 46 | ········This·guide·presents·a·catalog·of·security-relevant | 46 | ········This·guide·presents·a·catalog·of·security-relevant |
| 47 | configuration·settings·for·Amazon·Elastic·Kubernetes·Service.·It·is·a·rendering·of | 47 | configuration·settings·for·Amazon·Elastic·Kubernetes·Service.·It·is·a·rendering·of |
| 48 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 48 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 49 | in·order·to·support·security·automation.··The·SCAP·content·is | 49 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 50 | is·available·in·the | 50 | is·available·in·the |
| Offset 87, 22 lines modified | Offset 87, 22 lines modified | ||
| 87 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 87 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 88 | ······</xccdf-1.2:front-matter> | 88 | ······</xccdf-1.2:front-matter> |
| 89 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 89 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 90 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 90 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 91 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 91 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 92 | respective·companies.</xccdf-1.2:rear-matter> | 92 | respective·companies.</xccdf-1.2:rear-matter> |
| 93 | ······<cpe-lang:platform-specification> | 93 | ······<cpe-lang:platform-specification> |
| 94 | ········<cpe-lang:platform·id="eks | 94 | ········<cpe-lang:platform·id="eks"> |
| 95 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ············<cpe-lang:fact-ref·name="cpe:/ | 96 | ············<cpe-lang:fact-ref·name="cpe:/a:amazon:elastic_kubernetes_service:1"/> |
| 97 | ··········</cpe-lang:logical-test> | 97 | ··········</cpe-lang:logical-test> |
| 98 | ········</cpe-lang:platform> | 98 | ········</cpe-lang:platform> |
| 99 | ········<cpe-lang:platform·id="eks"> | 99 | ········<cpe-lang:platform·id="eks-node"> |
| 100 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ············<cpe-lang:fact-ref·name="cpe:/ | 101 | ············<cpe-lang:fact-ref·name="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> |
| 102 | ··········</cpe-lang:logical-test> | 102 | ··········</cpe-lang:logical-test> |
| 103 | ········</cpe-lang:platform> | 103 | ········</cpe-lang:platform> |
| 104 | ······</cpe-lang:platform-specification> | 104 | ······</cpe-lang:platform-specification> |
| 105 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service_node:1.21"/> | 105 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service_node:1.21"/> |
| 106 | ······<xccdf-1.2:platform·idref="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> | 106 | ······<xccdf-1.2:platform·idref="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> |
| 107 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service:1"/> | 107 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service:1"/> |
| 108 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 108 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| Offset 7562, 479 lines modified | Offset 7562, 479 lines modified | ||
| 7562 | ······<ocil:generator> | 7562 | ······<ocil:generator> |
| 7563 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 7563 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 7564 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 7564 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 7565 | ········<ocil:schema_version>2.0</ocil:schema_version> | 7565 | ········<ocil:schema_version>2.0</ocil:schema_version> |
| 7566 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7566 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 7567 | ······</ocil:generator> | 7567 | ······</ocil:generator> |
| 7568 | ······<ocil:questionnaires> | 7568 | ······<ocil:questionnaires> |
| 7569 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_ | 7569 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_client_cert_rotation_master_ocil:questionnaire:1"> |
| 7570 | ··········<ocil:title>kubelet·-· | 7570 | ··········<ocil:title>kubelet·-·Enable·Client·Certificate·Rotation</ocil:title> |
| 7571 | ··········<ocil:actions> | 7571 | ··········<ocil:actions> |
| 7572 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_ | 7572 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_client_cert_rotation_master_action:testaction:1</ocil:test_action_ref> |
| 7573 | ··········</ocil:actions> | 7573 | ··········</ocil:actions> |
| 7574 | ········</ocil:questionnaire> | 7574 | ········</ocil:questionnaire> |
| 7575 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_ | 7575 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_anonymous_auth_worker_ocil:questionnaire:1"> |
| 7576 | ··········<ocil:title> | 7576 | ··········<ocil:title>Disable·Anonymous·Authentication·to·the·Kubelet</ocil:title> |
| 7577 | ··········<ocil:actions> | 7577 | ··········<ocil:actions> |
| 7578 | ············<ocil:test_action_ref>ocil:ssg-kubelet_ | 7578 | ············<ocil:test_action_ref>ocil:ssg-kubelet_anonymous_auth_worker_action:testaction:1</ocil:test_action_ref> |
| 7579 | ··········</ocil:actions> | 7579 | ··········</ocil:actions> |
| 7580 | ········</ocil:questionnaire> | 7580 | ········</ocil:questionnaire> |
| 7581 | ········<ocil:questionnaire·id="ocil:ssg-file_permissions_kubelet_conf_ocil:questionnaire:1"> | ||
| 7582 | ········ | 7581 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_ocil:questionnaire:1"> |
| 7582 | ··········<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> | ||
| 7583 | ··········<ocil:actions> | 7583 | ··········<ocil:actions> |
| 7584 | ············<ocil:test_action_ref>ocil:ssg- | 7584 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_action:testaction:1</ocil:test_action_ref> |
| 7585 | ··········</ocil:actions> | 7585 | ··········</ocil:actions> |
| 7586 | ········</ocil:questionnaire> | 7586 | ········</ocil:questionnaire> |
| 7587 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_s | 7587 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_ocil:questionnaire:1"> |
| 7588 | ··········<ocil:title>kubelet·-· | 7588 | ··········<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> |
| 7589 | ··········<ocil:actions> | 7589 | ··········<ocil:actions> |
| 7590 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_s | 7590 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_action:testaction:1</ocil:test_action_ref> |
| 7591 | ··········</ocil:actions> | 7591 | ··········</ocil:actions> |
| 7592 | ········</ocil:questionnaire> | 7592 | ········</ocil:questionnaire> |
| 7593 | ········<ocil:questionnaire·id="ocil:ssg- | 7593 | ········<ocil:questionnaire·id="ocil:ssg-configure_tls_ocil:questionnaire:1"> |
| 7594 | ··········<ocil:title> | 7594 | ··········<ocil:title>Encrypt·Traffic·to·Load·Balancers·and·Workloads</ocil:title> |
| 7595 | ··········<ocil:actions> | 7595 | ··········<ocil:actions> |
| 7596 | ············<ocil:test_action_ref>ocil:ssg- | 7596 | ············<ocil:test_action_ref>ocil:ssg-configure_tls_action:testaction:1</ocil:test_action_ref> |
| 7597 | ··········</ocil:actions> | 7597 | ··········</ocil:actions> |
| 7598 | ········</ocil:questionnaire> | 7598 | ········</ocil:questionnaire> |
| 7599 | ········<ocil:questionnaire·id="ocil:ssg- | 7599 | ········<ocil:questionnaire·id="ocil:ssg-file_owner_worker_kubeconfig_ocil:questionnaire:1"> |
| 7600 | ··········<ocil:title> | 7600 | ··········<ocil:title>Verify·User·Who·Owns·The·Worker·Kubeconfig·File</ocil:title> |
| 7601 | ··········<ocil:actions> | 7601 | ··········<ocil:actions> |
| 7602 | ············<ocil:test_action_ref>ocil:ssg- | 7602 | ············<ocil:test_action_ref>ocil:ssg-file_owner_worker_kubeconfig_action:testaction:1</ocil:test_action_ref> |
| 7603 | ··········</ocil:actions> | 7603 | ··········</ocil:actions> |
| 7604 | ········</ocil:questionnaire> | 7604 | ········</ocil:questionnaire> |
| 7605 | ········<ocil:questionnaire·id="ocil:ssg- | 7605 | ········<ocil:questionnaire·id="ocil:ssg-audit_logging_ocil:questionnaire:1"> |
| 7606 | ··········<ocil:title>Ensure· | 7606 | ··········<ocil:title>Ensure·Audit·Logging·is·Enabled</ocil:title> |
| 7607 | ··········<ocil:actions> | 7607 | ··········<ocil:actions> |
| 7608 | ············<ocil:test_action_ref>ocil:ssg- | 7608 | ············<ocil:test_action_ref>ocil:ssg-audit_logging_action:testaction:1</ocil:test_action_ref> |
| 7609 | ··········</ocil:actions> | 7609 | ··········</ocil:actions> |
| 7610 | ········</ocil:questionnaire> | 7610 | ········</ocil:questionnaire> |
| 7611 | ········<ocil:questionnaire·id="ocil:ssg- | 7611 | ········<ocil:questionnaire·id="ocil:ssg-secret_encryption_ocil:questionnaire:1"> |
| 7612 | ··········<ocil:title> | 7612 | ··········<ocil:title>Ensure·Kubernetes·Secrets·are·Encrypted</ocil:title> |
| 7613 | ··········<ocil:actions> | 7613 | ··········<ocil:actions> |
| 7614 | ············<ocil:test_action_ref>ocil:ssg- | 7614 | ············<ocil:test_action_ref>ocil:ssg-secret_encryption_action:testaction:1</ocil:test_action_ref> |
| 7615 | ··········</ocil:actions> | 7615 | ··········</ocil:actions> |
| 7616 | ········</ocil:questionnaire> | 7616 | ········</ocil:questionnaire> |
| 7617 | ········<ocil:questionnaire·id="ocil:ssg- | 7617 | ········<ocil:questionnaire·id="ocil:ssg-file_owner_kubelet_conf_ocil:questionnaire:1"> |
| 7618 | ··········<ocil:title> | 7618 | ··········<ocil:title>Verify·User·Who·Owns·The·Kubelet·Configuration·File</ocil:title> |
| 7619 | ··········<ocil:actions> | 7619 | ··········<ocil:actions> |
| 7620 | ············<ocil:test_action_ref>ocil:ssg- | 7620 | ············<ocil:test_action_ref>ocil:ssg-file_owner_kubelet_conf_action:testaction:1</ocil:test_action_ref> |
| 7621 | ··········</ocil:actions> | 7621 | ··········</ocil:actions> |
| 7622 | ········</ocil:questionnaire> | 7622 | ········</ocil:questionnaire> |
| 7623 | ········<ocil:questionnaire·id="ocil:ssg- | 7623 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_read_only_port_secured_ocil:questionnaire:1"> |
| 7624 | ··········<ocil:title> | 7624 | ··········<ocil:title>kubelet·-·Ensure·that·the·--read-only-port·is·secured</ocil:title> |
| 7625 | ··········<ocil:actions> | 7625 | ··········<ocil:actions> |
| 7626 | ············<ocil:test_action_ref>ocil:ssg- | 7626 | ············<ocil:test_action_ref>ocil:ssg-kubelet_read_only_port_secured_action:testaction:1</ocil:test_action_ref> |
| 7627 | ··········</ocil:actions> | 7627 | ··········</ocil:actions> |
| 7628 | ········</ocil:questionnaire> | 7628 | ········</ocil:questionnaire> |
| 7629 | ········<ocil:questionnaire·id="ocil:ssg-dedicated_service_accounts_ocil:questionnaire:1"> | ||
| 7630 | ········ | 7629 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_ocil:questionnaire:1"> |
| 7630 | ··········<ocil:title>kubelet·-·Allow·Automatic·Firewall·Configuration</ocil:title> | ||
| 7631 | ··········<ocil:actions> | 7631 | ··········<ocil:actions> |
| 7632 | ············<ocil:test_action_ref>ocil:ssg- | 7632 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_action:testaction:1</ocil:test_action_ref> |
| 7633 | ··········</ocil:actions> | 7633 | ··········</ocil:actions> |
| 7634 | ········</ocil:questionnaire> | 7634 | ········</ocil:questionnaire> |
| 7635 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_ | 7635 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_authorization_mode_ocil:questionnaire:1"> |
| 7636 | ··········<ocil:title> | 7636 | ··········<ocil:title>Ensure·authorization·is·set·to·Webhook</ocil:title> |
| 7637 | ··········<ocil:actions> | 7637 | ··········<ocil:actions> |
| 7638 | ············<ocil:test_action_ref>ocil:ssg-kubelet_ | 7638 | ············<ocil:test_action_ref>ocil:ssg-kubelet_authorization_mode_action:testaction:1</ocil:test_action_ref> |
| 7639 | ··········</ocil:actions> | 7639 | ··········</ocil:actions> |
| 7640 | ········</ocil:questionnaire> | 7640 | ········</ocil:questionnaire> |
| 7641 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_ | 7641 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_configure_client_ca_worker_ocil:questionnaire:1"> |
| 7642 | ··········<ocil:title> | 7642 | ··········<ocil:title>kubelet·-·Configure·the·Client·CA·Certificate</ocil:title> |
| 7643 | ··········<ocil:actions> | 7643 | ··········<ocil:actions> |
| 7644 | ············<ocil:test_action_ref>ocil:ssg-kubelet_ | 7644 | ············<ocil:test_action_ref>ocil:ssg-kubelet_configure_client_ca_worker_action:testaction:1</ocil:test_action_ref> |
| 7645 | ··········</ocil:actions> | 7645 | ··········</ocil:actions> |
| 7646 | ········</ocil:questionnaire> | 7646 | ········</ocil:questionnaire> |
| 7647 | ········<ocil:questionnaire·id="ocil:ssg- | 7647 | ········<ocil:questionnaire·id="ocil:ssg-file_permissions_kubelet_conf_ocil:questionnaire:1"> |
| Max diff block lines reached; 132371/144895 bytes (91.36%) of diff not shown. | |||
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | ········<cpe-dict:title·xml:lang="en-us">Amazon·Elastic·Kubernetes·Service·Node</cpe-dict:title> | 36 | ········<cpe-dict:title·xml:lang="en-us">Amazon·Elastic·Kubernetes·Service·Node</cpe-dict:title> |
| 37 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-eks-cpe-oval.xml">oval:ssg-installed_app_is_eks_node:def:1</cpe-dict:check> | 37 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-eks-cpe-oval.xml">oval:ssg-installed_app_is_eks_node:def:1</cpe-dict:check> |
| 38 | ······</cpe-dict:cpe-item> | 38 | ······</cpe-dict:cpe-item> |
| 39 | ····</cpe-dict:cpe-list> | 39 | ····</cpe-dict:cpe-list> |
| 40 | ··</ds:component> | 40 | ··</ds:component> |
| 41 | ··<ds:component·id="scap_org.open-scap_comp_ssg-eks-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 41 | ··<ds:component·id="scap_org.open-scap_comp_ssg-eks-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 42 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_EKS"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 42 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_EKS"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 43 | ······<xccdf-1.2:status·date="202 | 43 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 44 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service</xccdf-1.2:title> | 44 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service</xccdf-1.2:title> |
| 45 | ······<xccdf-1.2:description> | 45 | ······<xccdf-1.2:description> |
| 46 | ········This·guide·presents·a·catalog·of·security-relevant | 46 | ········This·guide·presents·a·catalog·of·security-relevant |
| 47 | configuration·settings·for·Amazon·Elastic·Kubernetes·Service.·It·is·a·rendering·of | 47 | configuration·settings·for·Amazon·Elastic·Kubernetes·Service.·It·is·a·rendering·of |
| 48 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 48 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 49 | in·order·to·support·security·automation.··The·SCAP·content·is | 49 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 50 | is·available·in·the | 50 | is·available·in·the |
| Offset 87, 22 lines modified | Offset 87, 22 lines modified | ||
| 87 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 87 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 88 | ······</xccdf-1.2:front-matter> | 88 | ······</xccdf-1.2:front-matter> |
| 89 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 89 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 90 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 90 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 91 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 91 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 92 | respective·companies.</xccdf-1.2:rear-matter> | 92 | respective·companies.</xccdf-1.2:rear-matter> |
| 93 | ······<cpe-lang:platform-specification> | 93 | ······<cpe-lang:platform-specification> |
| 94 | ········<cpe-lang:platform·id="eks | 94 | ········<cpe-lang:platform·id="eks"> |
| 95 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ············<cpe-lang:fact-ref·name="cpe:/ | 96 | ············<cpe-lang:fact-ref·name="cpe:/a:amazon:elastic_kubernetes_service:1"/> |
| 97 | ··········</cpe-lang:logical-test> | 97 | ··········</cpe-lang:logical-test> |
| 98 | ········</cpe-lang:platform> | 98 | ········</cpe-lang:platform> |
| 99 | ········<cpe-lang:platform·id="eks"> | 99 | ········<cpe-lang:platform·id="eks-node"> |
| 100 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ············<cpe-lang:fact-ref·name="cpe:/ | 101 | ············<cpe-lang:fact-ref·name="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> |
| 102 | ··········</cpe-lang:logical-test> | 102 | ··········</cpe-lang:logical-test> |
| 103 | ········</cpe-lang:platform> | 103 | ········</cpe-lang:platform> |
| 104 | ······</cpe-lang:platform-specification> | 104 | ······</cpe-lang:platform-specification> |
| 105 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service_node:1.21"/> | 105 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service_node:1.21"/> |
| 106 | ······<xccdf-1.2:platform·idref="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> | 106 | ······<xccdf-1.2:platform·idref="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> |
| 107 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service:1"/> | 107 | ······<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service:1"/> |
| 108 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 108 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| Offset 7562, 479 lines modified | Offset 7562, 479 lines modified | ||
| 7562 | ······<ocil:generator> | 7562 | ······<ocil:generator> |
| 7563 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 7563 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 7564 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 7564 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 7565 | ········<ocil:schema_version>2.0</ocil:schema_version> | 7565 | ········<ocil:schema_version>2.0</ocil:schema_version> |
| 7566 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7566 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 7567 | ······</ocil:generator> | 7567 | ······</ocil:generator> |
| 7568 | ······<ocil:questionnaires> | 7568 | ······<ocil:questionnaires> |
| 7569 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_ | 7569 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_client_cert_rotation_master_ocil:questionnaire:1"> |
| 7570 | ··········<ocil:title>kubelet·-· | 7570 | ··········<ocil:title>kubelet·-·Enable·Client·Certificate·Rotation</ocil:title> |
| 7571 | ··········<ocil:actions> | 7571 | ··········<ocil:actions> |
| 7572 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_ | 7572 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_client_cert_rotation_master_action:testaction:1</ocil:test_action_ref> |
| 7573 | ··········</ocil:actions> | 7573 | ··········</ocil:actions> |
| 7574 | ········</ocil:questionnaire> | 7574 | ········</ocil:questionnaire> |
| 7575 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_ | 7575 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_anonymous_auth_worker_ocil:questionnaire:1"> |
| 7576 | ··········<ocil:title> | 7576 | ··········<ocil:title>Disable·Anonymous·Authentication·to·the·Kubelet</ocil:title> |
| 7577 | ··········<ocil:actions> | 7577 | ··········<ocil:actions> |
| 7578 | ············<ocil:test_action_ref>ocil:ssg-kubelet_ | 7578 | ············<ocil:test_action_ref>ocil:ssg-kubelet_anonymous_auth_worker_action:testaction:1</ocil:test_action_ref> |
| 7579 | ··········</ocil:actions> | 7579 | ··········</ocil:actions> |
| 7580 | ········</ocil:questionnaire> | 7580 | ········</ocil:questionnaire> |
| 7581 | ········<ocil:questionnaire·id="ocil:ssg-file_permissions_kubelet_conf_ocil:questionnaire:1"> | ||
| 7582 | ········ | 7581 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_ocil:questionnaire:1"> |
| 7582 | ··········<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> | ||
| 7583 | ··········<ocil:actions> | 7583 | ··········<ocil:actions> |
| 7584 | ············<ocil:test_action_ref>ocil:ssg- | 7584 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_action:testaction:1</ocil:test_action_ref> |
| 7585 | ··········</ocil:actions> | 7585 | ··········</ocil:actions> |
| 7586 | ········</ocil:questionnaire> | 7586 | ········</ocil:questionnaire> |
| 7587 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_s | 7587 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_ocil:questionnaire:1"> |
| 7588 | ··········<ocil:title>kubelet·-· | 7588 | ··········<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> |
| 7589 | ··········<ocil:actions> | 7589 | ··········<ocil:actions> |
| 7590 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_s | 7590 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_action:testaction:1</ocil:test_action_ref> |
| 7591 | ··········</ocil:actions> | 7591 | ··········</ocil:actions> |
| 7592 | ········</ocil:questionnaire> | 7592 | ········</ocil:questionnaire> |
| 7593 | ········<ocil:questionnaire·id="ocil:ssg- | 7593 | ········<ocil:questionnaire·id="ocil:ssg-configure_tls_ocil:questionnaire:1"> |
| 7594 | ··········<ocil:title> | 7594 | ··········<ocil:title>Encrypt·Traffic·to·Load·Balancers·and·Workloads</ocil:title> |
| 7595 | ··········<ocil:actions> | 7595 | ··········<ocil:actions> |
| 7596 | ············<ocil:test_action_ref>ocil:ssg- | 7596 | ············<ocil:test_action_ref>ocil:ssg-configure_tls_action:testaction:1</ocil:test_action_ref> |
| 7597 | ··········</ocil:actions> | 7597 | ··········</ocil:actions> |
| 7598 | ········</ocil:questionnaire> | 7598 | ········</ocil:questionnaire> |
| 7599 | ········<ocil:questionnaire·id="ocil:ssg- | 7599 | ········<ocil:questionnaire·id="ocil:ssg-file_owner_worker_kubeconfig_ocil:questionnaire:1"> |
| 7600 | ··········<ocil:title> | 7600 | ··········<ocil:title>Verify·User·Who·Owns·The·Worker·Kubeconfig·File</ocil:title> |
| 7601 | ··········<ocil:actions> | 7601 | ··········<ocil:actions> |
| 7602 | ············<ocil:test_action_ref>ocil:ssg- | 7602 | ············<ocil:test_action_ref>ocil:ssg-file_owner_worker_kubeconfig_action:testaction:1</ocil:test_action_ref> |
| 7603 | ··········</ocil:actions> | 7603 | ··········</ocil:actions> |
| 7604 | ········</ocil:questionnaire> | 7604 | ········</ocil:questionnaire> |
| 7605 | ········<ocil:questionnaire·id="ocil:ssg- | 7605 | ········<ocil:questionnaire·id="ocil:ssg-audit_logging_ocil:questionnaire:1"> |
| 7606 | ··········<ocil:title>Ensure· | 7606 | ··········<ocil:title>Ensure·Audit·Logging·is·Enabled</ocil:title> |
| 7607 | ··········<ocil:actions> | 7607 | ··········<ocil:actions> |
| 7608 | ············<ocil:test_action_ref>ocil:ssg- | 7608 | ············<ocil:test_action_ref>ocil:ssg-audit_logging_action:testaction:1</ocil:test_action_ref> |
| 7609 | ··········</ocil:actions> | 7609 | ··········</ocil:actions> |
| 7610 | ········</ocil:questionnaire> | 7610 | ········</ocil:questionnaire> |
| 7611 | ········<ocil:questionnaire·id="ocil:ssg- | 7611 | ········<ocil:questionnaire·id="ocil:ssg-secret_encryption_ocil:questionnaire:1"> |
| 7612 | ··········<ocil:title> | 7612 | ··········<ocil:title>Ensure·Kubernetes·Secrets·are·Encrypted</ocil:title> |
| 7613 | ··········<ocil:actions> | 7613 | ··········<ocil:actions> |
| 7614 | ············<ocil:test_action_ref>ocil:ssg- | 7614 | ············<ocil:test_action_ref>ocil:ssg-secret_encryption_action:testaction:1</ocil:test_action_ref> |
| 7615 | ··········</ocil:actions> | 7615 | ··········</ocil:actions> |
| 7616 | ········</ocil:questionnaire> | 7616 | ········</ocil:questionnaire> |
| 7617 | ········<ocil:questionnaire·id="ocil:ssg- | 7617 | ········<ocil:questionnaire·id="ocil:ssg-file_owner_kubelet_conf_ocil:questionnaire:1"> |
| 7618 | ··········<ocil:title> | 7618 | ··········<ocil:title>Verify·User·Who·Owns·The·Kubelet·Configuration·File</ocil:title> |
| 7619 | ··········<ocil:actions> | 7619 | ··········<ocil:actions> |
| 7620 | ············<ocil:test_action_ref>ocil:ssg- | 7620 | ············<ocil:test_action_ref>ocil:ssg-file_owner_kubelet_conf_action:testaction:1</ocil:test_action_ref> |
| 7621 | ··········</ocil:actions> | 7621 | ··········</ocil:actions> |
| 7622 | ········</ocil:questionnaire> | 7622 | ········</ocil:questionnaire> |
| 7623 | ········<ocil:questionnaire·id="ocil:ssg- | 7623 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_read_only_port_secured_ocil:questionnaire:1"> |
| 7624 | ··········<ocil:title> | 7624 | ··········<ocil:title>kubelet·-·Ensure·that·the·--read-only-port·is·secured</ocil:title> |
| 7625 | ··········<ocil:actions> | 7625 | ··········<ocil:actions> |
| 7626 | ············<ocil:test_action_ref>ocil:ssg- | 7626 | ············<ocil:test_action_ref>ocil:ssg-kubelet_read_only_port_secured_action:testaction:1</ocil:test_action_ref> |
| 7627 | ··········</ocil:actions> | 7627 | ··········</ocil:actions> |
| 7628 | ········</ocil:questionnaire> | 7628 | ········</ocil:questionnaire> |
| 7629 | ········<ocil:questionnaire·id="ocil:ssg-dedicated_service_accounts_ocil:questionnaire:1"> | ||
| 7630 | ········ | 7629 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_ocil:questionnaire:1"> |
| 7630 | ··········<ocil:title>kubelet·-·Allow·Automatic·Firewall·Configuration</ocil:title> | ||
| 7631 | ··········<ocil:actions> | 7631 | ··········<ocil:actions> |
| 7632 | ············<ocil:test_action_ref>ocil:ssg- | 7632 | ············<ocil:test_action_ref>ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_action:testaction:1</ocil:test_action_ref> |
| 7633 | ··········</ocil:actions> | 7633 | ··········</ocil:actions> |
| 7634 | ········</ocil:questionnaire> | 7634 | ········</ocil:questionnaire> |
| 7635 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_ | 7635 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_authorization_mode_ocil:questionnaire:1"> |
| 7636 | ··········<ocil:title> | 7636 | ··········<ocil:title>Ensure·authorization·is·set·to·Webhook</ocil:title> |
| 7637 | ··········<ocil:actions> | 7637 | ··········<ocil:actions> |
| 7638 | ············<ocil:test_action_ref>ocil:ssg-kubelet_ | 7638 | ············<ocil:test_action_ref>ocil:ssg-kubelet_authorization_mode_action:testaction:1</ocil:test_action_ref> |
| 7639 | ··········</ocil:actions> | 7639 | ··········</ocil:actions> |
| 7640 | ········</ocil:questionnaire> | 7640 | ········</ocil:questionnaire> |
| 7641 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_ | 7641 | ········<ocil:questionnaire·id="ocil:ssg-kubelet_configure_client_ca_worker_ocil:questionnaire:1"> |
| 7642 | ··········<ocil:title> | 7642 | ··········<ocil:title>kubelet·-·Configure·the·Client·CA·Certificate</ocil:title> |
| 7643 | ··········<ocil:actions> | 7643 | ··········<ocil:actions> |
| 7644 | ············<ocil:test_action_ref>ocil:ssg-kubelet_ | 7644 | ············<ocil:test_action_ref>ocil:ssg-kubelet_configure_client_ca_worker_action:testaction:1</ocil:test_action_ref> |
| 7645 | ··········</ocil:actions> | 7645 | ··········</ocil:actions> |
| 7646 | ········</ocil:questionnaire> | 7646 | ········</ocil:questionnaire> |
| 7647 | ········<ocil:questionnaire·id="ocil:ssg- | 7647 | ········<ocil:questionnaire·id="ocil:ssg-file_permissions_kubelet_conf_ocil:questionnaire:1"> |
| Max diff block lines reached; 132371/144895 bytes (91.36%) of diff not shown. | |||
| Offset 3, 479 lines modified | Offset 3, 479 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_client_cert_rotation_master_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>kubelet·-· | 11 | ······<ocil:title>kubelet·-·Enable·Client·Certificate·Rotation</ocil:title> |
| 12 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 13 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_ | 13 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_client_cert_rotation_master_action:testaction:1</ocil:test_action_ref> |
| 14 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 15 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 16 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_ | 16 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_anonymous_auth_worker_ocil:questionnaire:1"> |
| 17 | ······<ocil:title> | 17 | ······<ocil:title>Disable·Anonymous·Authentication·to·the·Kubelet</ocil:title> |
| 18 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg-kubelet_ | 19 | ········<ocil:test_action_ref>ocil:ssg-kubelet_anonymous_auth_worker_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_kubelet_conf_ocil:questionnaire:1"> | ||
| 23 | ···· | 22 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> | ||
| 24 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_s | 28 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_ocil:questionnaire:1"> |
| 29 | ······<ocil:title>kubelet·-· | 29 | ······<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> |
| 30 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_s | 31 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg- | 34 | ····<ocil:questionnaire·id="ocil:ssg-configure_tls_ocil:questionnaire:1"> |
| 35 | ······<ocil:title> | 35 | ······<ocil:title>Encrypt·Traffic·to·Load·Balancers·and·Workloads</ocil:title> |
| 36 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-configure_tls_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg- | 40 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_worker_kubeconfig_ocil:questionnaire:1"> |
| 41 | ······<ocil:title> | 41 | ······<ocil:title>Verify·User·Who·Owns·The·Worker·Kubeconfig·File</ocil:title> |
| 42 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-file_owner_worker_kubeconfig_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-audit_logging_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Ensure· | 47 | ······<ocil:title>Ensure·Audit·Logging·is·Enabled</ocil:title> |
| 48 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-audit_logging_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 52 | ····<ocil:questionnaire·id="ocil:ssg-secret_encryption_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 53 | ······<ocil:title>Ensure·Kubernetes·Secrets·are·Encrypted</ocil:title> |
| 54 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-secret_encryption_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_kubelet_conf_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 59 | ······<ocil:title>Verify·User·Who·Owns·The·Kubelet·Configuration·File</ocil:title> |
| 60 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-file_owner_kubelet_conf_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_read_only_port_secured_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 65 | ······<ocil:title>kubelet·-·Ensure·that·the·--read-only-port·is·secured</ocil:title> |
| 66 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-kubelet_read_only_port_secured_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-dedicated_service_accounts_ocil:questionnaire:1"> | ||
| 71 | ···· | 70 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_ocil:questionnaire:1"> |
| 71 | ······<ocil:title>kubelet·-·Allow·Automatic·Firewall·Configuration</ocil:title> | ||
| 72 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_iptables_util_chains_deprecated_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_ | 76 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_authorization_mode_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 77 | ······<ocil:title>Ensure·authorization·is·set·to·Webhook</ocil:title> |
| 78 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg-kubelet_ | 79 | ········<ocil:test_action_ref>ocil:ssg-kubelet_authorization_mode_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_ | 82 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_configure_client_ca_worker_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 83 | ······<ocil:title>kubelet·-·Configure·the·Client·CA·Certificate</ocil:title> |
| 84 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg-kubelet_ | 85 | ········<ocil:test_action_ref>ocil:ssg-kubelet_configure_client_ca_worker_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg- | 88 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_kubelet_conf_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 89 | ······<ocil:title>Verify·Permissions·on·The·Kubelet·Configuration·File</ocil:title> |
| 90 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_kubelet_conf_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_read_only_port_secured_deprecated_ocil:questionnaire:1"> | ||
| 95 | ···· | 94 | ····<ocil:questionnaire·id="ocil:ssg-iam_integration_ocil:questionnaire:1"> |
| 95 | ······<ocil:title>Manage·Users·with·AWS·IAM</ocil:title> | ||
| 96 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-iam_integration_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-a | 100 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_authorization_mode_master_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 101 | ······<ocil:title>Ensure·authorization·is·set·to·Webhook</ocil:title> |
| 102 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg-a | 103 | ········<ocil:test_action_ref>ocil:ssg-kubelet_authorization_mode_master_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_cert_rotation_ocil:questionnaire:1"> | 106 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_cert_rotation_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>kubelet·-·Enable·Certificate·Rotation</ocil:title> | 107 | ······<ocil:title>kubelet·-·Enable·Certificate·Rotation</ocil:title> |
| 108 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_cert_rotation_action:testaction:1</ocil:test_action_ref> | 109 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_cert_rotation_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 112 | ····<ocil:questionnaire·id="ocil:ssg-configure_network_policies_namespaces_ocil:questionnaire:1"> |
| 113 | ······<ocil:title>Ensure·that·application·Namespaces·have·Network·Policies·defined.</ocil:title> | ||
| 113 | ······<ocil:title>kubelet·-·Configure·the·Client·CA·Certificate</ocil:title> | ||
| 114 | ······<ocil:actions> | ||
| 115 | ········<ocil:test_action_ref>ocil:ssg-kubelet_configure_client_ca_action:testaction:1</ocil:test_action_ref> | ||
| 116 | ······</ocil:actions> | ||
| 117 | ····</ocil:questionnaire> | ||
| 118 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_cert_rotation_master_ocil:questionnaire:1"> | ||
| 119 | ······<ocil:title>kubelet·-·Enable·Certificate·Rotation</ocil:title> | ||
| 120 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 115 | ········<ocil:test_action_ref>ocil:ssg-configure_network_policies_namespaces_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_read_only_port_secured_ocil:questionnaire:1"> | ||
| 125 | ···· | 118 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_worker_kubeconfig_ocil:questionnaire:1"> |
| Max diff block lines reached; 123706/135980 bytes (90.97%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_EKS"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_EKS"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Amazon·Elastic·Kubernetes·Service</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Amazon·Elastic·Kubernetes·Service.·It·is·a·rendering·of | 7 | configuration·settings·for·Amazon·Elastic·Kubernetes·Service.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 22 lines modified | Offset 47, 22 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id="eks | 54 | ····<cpe-lang:platform·id="eks"> |
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/ | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:amazon:elastic_kubernetes_service:1"/> |
| 57 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 58 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 59 | ····<cpe-lang:platform·id="eks"> | 59 | ····<cpe-lang:platform·id="eks-node"> |
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 61 | ········<cpe-lang:fact-ref·name="cpe:/ | 61 | ········<cpe-lang:fact-ref·name="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> |
| 62 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 63 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 64 | ··</cpe-lang:platform-specification> | 64 | ··</cpe-lang:platform-specification> |
| 65 | ··<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service_node:1.21"/> | 65 | ··<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service_node:1.21"/> |
| 66 | ··<xccdf-1.2:platform·idref="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> | 66 | ··<xccdf-1.2:platform·idref="cpe:/o:amazon:elastic_kubernetes_service_node:1"/> |
| 67 | ··<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service:1"/> | 67 | ··<xccdf-1.2:platform·idref="cpe:/a:amazon:elastic_kubernetes_service:1"/> |
| 68 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 68 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| Offset 28, 15 lines modified | Offset 28, 15 lines modified | ||
| 28 | ········<cpe-dict:title·xml:lang="en-us">Mozilla·Firefox</cpe-dict:title> | 28 | ········<cpe-dict:title·xml:lang="en-us">Mozilla·Firefox</cpe-dict:title> |
| 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-firefox-cpe-oval.xml">oval:ssg-installed_app_is_firefox:def:1</cpe-dict:check> | 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-firefox-cpe-oval.xml">oval:ssg-installed_app_is_firefox:def:1</cpe-dict:check> |
| 30 | ······</cpe-dict:cpe-item> | 30 | ······</cpe-dict:cpe-item> |
| 31 | ····</cpe-dict:cpe-list> | 31 | ····</cpe-dict:cpe-list> |
| 32 | ··</ds:component> | 32 | ··</ds:component> |
| 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-firefox-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-firefox-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_FIREFOX"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_FIREFOX"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 35 | ······<xccdf-1.2:status·date="202 | 35 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Firefox</xccdf-1.2:title> | 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Firefox</xccdf-1.2:title> |
| 37 | ······<xccdf-1.2:description> | 37 | ······<xccdf-1.2:description> |
| 38 | ········This·guide·presents·a·catalog·of·security-relevant | 38 | ········This·guide·presents·a·catalog·of·security-relevant |
| 39 | configuration·settings·for·Firefox.·It·is·a·rendering·of | 39 | configuration·settings·for·Firefox.·It·is·a·rendering·of |
| 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 41 | in·order·to·support·security·automation.··The·SCAP·content·is | 41 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 42 | is·available·in·the | 42 | is·available·in·the |
| Offset 4950, 436 lines modified | Offset 4950, 482 lines modified | ||
| 4950 | ······<ocil:generator> | 4950 | ······<ocil:generator> |
| 4951 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4951 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 4952 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 4952 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 4953 | ········<ocil:schema_version>2.0</ocil:schema_version> | 4953 | ········<ocil:schema_version>2.0</ocil:schema_version> |
| 4954 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 4954 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 4955 | ······</ocil:generator> | 4955 | ······</ocil:generator> |
| 4956 | ······<ocil:questionnaires> | 4956 | ······<ocil:questionnaires> |
| 4957 | ········<ocil:questionnaire·id="ocil:ssg-firefox_p | 4957 | ········<ocil:questionnaire·id="ocil:ssg-firefox_preferences-enable_ca_trust_ocil:questionnaire:1"> |
| 4958 | ··········<ocil:title> | 4958 | ··········<ocil:title>Enable·Shared·System·Certificates</ocil:title> |
| 4959 | ··········<ocil:actions> | 4959 | ··········<ocil:actions> |
| 4960 | ············<ocil:test_action_ref>ocil:ssg-firefox_p | 4960 | ············<ocil:test_action_ref>ocil:ssg-firefox_preferences-enable_ca_trust_action:testaction:1</ocil:test_action_ref> |
| 4961 | ··········</ocil:actions> | 4961 | ··········</ocil:actions> |
| 4962 | ········</ocil:questionnaire> | 4962 | ········</ocil:questionnaire> |
| 4963 | ········<ocil:questionnaire·id="ocil:ssg-firefox_p | 4963 | ········<ocil:questionnaire·id="ocil:ssg-firefox_preferences-auto-download_actions_ocil:questionnaire:1"> |
| 4964 | ··········<ocil:title>Disable· | 4964 | ··········<ocil:title>Disable·auto-download·for·proscribed·MIME·types.</ocil:title> |
| 4965 | ··········<ocil:actions> | 4965 | ··········<ocil:actions> |
| 4966 | ············<ocil:test_action_ref>ocil:ssg-firefox_p | 4966 | ············<ocil:test_action_ref>ocil:ssg-firefox_preferences-auto-download_actions_action:testaction:1</ocil:test_action_ref> |
| 4967 | ··········</ocil:actions> | 4967 | ··········</ocil:actions> |
| 4968 | ········</ocil:questionnaire> | 4968 | ········</ocil:questionnaire> |
| 4969 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-te | 4969 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-extension_update_ocil:questionnaire:1"> |
| 4970 | ··········<ocil:title> | 4970 | ··········<ocil:title>Firefox·must·be·configured·to·not·automatically·update·installed·add-ons·and·plugins.</ocil:title> |
| 4971 | ··········<ocil:actions> | 4971 | ··········<ocil:actions> |
| 4972 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-extension_update_action:testaction:1</ocil:test_action_ref> | ||
| 4973 | ··········</ocil:actions> | ||
| 4974 | ········</ocil:questionnaire> | ||
| 4975 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-pop-up_windows_ocil:questionnaire:1"> | ||
| 4976 | ··········<ocil:title>Enable·Firefox·Pop-up·Blocker</ocil:title> | ||
| 4977 | ··········<ocil:actions> | ||
| 4978 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-pop-up_windows_action:testaction:1</ocil:test_action_ref> | ||
| 4979 | ··········</ocil:actions> | ||
| 4980 | ········</ocil:questionnaire> | ||
| 4981 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-enhanced_tracking_ocil:questionnaire:1"> | ||
| 4982 | ··········<ocil:title>Enabled·Firefox·Enhanced·Tracking·Protection</ocil:title> | ||
| 4983 | ··········<ocil:actions> | ||
| 4972 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 4984 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-enhanced_tracking_action:testaction:1</ocil:test_action_ref> |
| 4985 | ··········</ocil:actions> | ||
| 4986 | ········</ocil:questionnaire> | ||
| 4987 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_deprecated_ciphers_ocil:questionnaire:1"> | ||
| 4988 | ··········<ocil:title>Disable·Firefox·deprecated·ciphers</ocil:title> | ||
| 4989 | ··········<ocil:actions> | ||
| 4990 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_deprecated_ciphers_action:testaction:1</ocil:test_action_ref> | ||
| 4973 | ··········</ocil:actions> | 4991 | ··········</ocil:actions> |
| 4974 | ········</ocil:questionnaire> | 4992 | ········</ocil:questionnaire> |
| 4975 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-network_prediction_ocil:questionnaire:1"> | 4993 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-network_prediction_ocil:questionnaire:1"> |
| 4976 | ··········<ocil:title>Disable·Firefox·network·prediction</ocil:title> | 4994 | ··········<ocil:title>Disable·Firefox·network·prediction</ocil:title> |
| 4977 | ··········<ocil:actions> | 4995 | ··········<ocil:actions> |
| 4978 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-network_prediction_action:testaction:1</ocil:test_action_ref> | 4996 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-network_prediction_action:testaction:1</ocil:test_action_ref> |
| 4979 | ··········</ocil:actions> | 4997 | ··········</ocil:actions> |
| 4980 | ········</ocil:questionnaire> | 4998 | ········</ocil:questionnaire> |
| 4981 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 4999 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-autoplay_video_ocil:questionnaire:1"> |
| 4982 | ··········<ocil:title> | 5000 | ··········<ocil:title>Firefox·autoplay·must·be·disabled.</ocil:title> |
| 4983 | ··········<ocil:actions> | 5001 | ··········<ocil:actions> |
| 4984 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5002 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-autoplay_video_action:testaction:1</ocil:test_action_ref> |
| 4985 | ··········</ocil:actions> | 5003 | ··········</ocil:actions> |
| 4986 | ········</ocil:questionnaire> | 5004 | ········</ocil:questionnaire> |
| 4987 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_pocket_ocil:questionnaire:1"> | 5005 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_pocket_ocil:questionnaire:1"> |
| 4988 | ··········<ocil:title>Disable·Firefox·Pocket</ocil:title> | 5006 | ··········<ocil:title>Disable·Firefox·Pocket</ocil:title> |
| 4989 | ··········<ocil:actions> | 5007 | ··········<ocil:actions> |
| 4990 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_pocket_action:testaction:1</ocil:test_action_ref> | 5008 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_pocket_action:testaction:1</ocil:test_action_ref> |
| 4991 | ··········</ocil:actions> | 5009 | ··········</ocil:actions> |
| 4992 | ········</ocil:questionnaire> | 5010 | ········</ocil:questionnaire> |
| 4993 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_studies_ocil:questionnaire:1"> | ||
| 4994 | ··········<ocil:title>Disable·Firefox·Studies</ocil:title> | ||
| 4995 | ··········<ocil:actions> | ||
| 4996 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_studies_action:testaction:1</ocil:test_action_ref> | ||
| 4997 | ··········</ocil:actions> | ||
| 4998 | ········</ocil:questionnaire> | ||
| 4999 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5011 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-forget_button_ocil:questionnaire:1"> |
| 5000 | ··········<ocil:title>Firefox·se | 5012 | ··········<ocil:title>Firefox·must·prevent·the·user·from·quickly·deleting·data.</ocil:title> |
| 5001 | ··········<ocil:actions> | 5013 | ··········<ocil:actions> |
| 5002 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5014 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-forget_button_action:testaction:1</ocil:test_action_ref> |
| 5003 | ··········</ocil:actions> | 5015 | ··········</ocil:actions> |
| 5004 | ········</ocil:questionnaire> | 5016 | ········</ocil:questionnaire> |
| 5005 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5017 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-verification_ocil:questionnaire:1"> |
| 5006 | ··········<ocil:title> | 5018 | ··········<ocil:title>Enable·Certificate·Verification</ocil:title> |
| 5007 | ··········<ocil:actions> | 5019 | ··········<ocil:actions> |
| 5008 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5020 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-verification_action:testaction:1</ocil:test_action_ref> |
| 5009 | ··········</ocil:actions> | 5021 | ··········</ocil:actions> |
| 5010 | ········</ocil:questionnaire> | 5022 | ········</ocil:questionnaire> |
| 5011 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_deprecated_ciphers_ocil:questionnaire:1"> | ||
| 5012 | ········ | 5023 | ········<ocil:questionnaire·id="ocil:ssg-firefox_preferences-dod_root_certificate_installed_ocil:questionnaire:1"> |
| 5024 | ··········<ocil:title>The·DoD·Root·Certificate·Exists</ocil:title> | ||
| 5013 | ··········<ocil:actions> | 5025 | ··········<ocil:actions> |
| 5014 | ············<ocil:test_action_ref>ocil:ssg-firefox_p | 5026 | ············<ocil:test_action_ref>ocil:ssg-firefox_preferences-dod_root_certificate_installed_action:testaction:1</ocil:test_action_ref> |
| 5015 | ··········</ocil:actions> | 5027 | ··········</ocil:actions> |
| 5016 | ········</ocil:questionnaire> | 5028 | ········</ocil:questionnaire> |
| 5017 | ········<ocil:questionnaire·id="ocil:ssg-installed_firefox_version_supported_ocil:questionnaire:1"> | 5029 | ········<ocil:questionnaire·id="ocil:ssg-installed_firefox_version_supported_ocil:questionnaire:1"> |
| 5018 | ··········<ocil:title>Supported·Version·of·Firefox·Installed</ocil:title> | 5030 | ··········<ocil:title>Supported·Version·of·Firefox·Installed</ocil:title> |
| 5019 | ··········<ocil:actions> | 5031 | ··········<ocil:actions> |
| 5020 | ············<ocil:test_action_ref>ocil:ssg-installed_firefox_version_supported_action:testaction:1</ocil:test_action_ref> | 5032 | ············<ocil:test_action_ref>ocil:ssg-installed_firefox_version_supported_action:testaction:1</ocil:test_action_ref> |
| 5021 | ··········</ocil:actions> | 5033 | ··········</ocil:actions> |
| 5022 | ········</ocil:questionnaire> | 5034 | ········</ocil:questionnaire> |
| 5023 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-development_tools_ocil:questionnaire:1"> | 5035 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-development_tools_ocil:questionnaire:1"> |
| 5024 | ··········<ocil:title>Disable·Firefox·Development·Tools</ocil:title> | 5036 | ··········<ocil:title>Disable·Firefox·Development·Tools</ocil:title> |
| 5025 | ··········<ocil:actions> | 5037 | ··········<ocil:actions> |
| 5026 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-development_tools_action:testaction:1</ocil:test_action_ref> | 5038 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-development_tools_action:testaction:1</ocil:test_action_ref> |
| 5027 | ··········</ocil:actions> | 5039 | ··········</ocil:actions> |
| 5028 | ········</ocil:questionnaire> | 5040 | ········</ocil:questionnaire> |
| 5029 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5041 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-telemetry_ocil:questionnaire:1"> |
| 5030 | ··········<ocil:title> | 5042 | ··········<ocil:title>Disable·Firefox·Telemetry</ocil:title> |
| 5031 | ··········<ocil:actions> | 5043 | ··········<ocil:actions> |
| 5032 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5044 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-telemetry_action:testaction:1</ocil:test_action_ref> |
| 5033 | ··········</ocil:actions> | 5045 | ··········</ocil:actions> |
| 5034 | ········</ocil:questionnaire> | 5046 | ········</ocil:questionnaire> |
| 5035 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5047 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_studies_ocil:questionnaire:1"> |
| 5036 | ··········<ocil:title> | 5048 | ··········<ocil:title>Disable·Firefox·Studies</ocil:title> |
| 5037 | ··········<ocil:actions> | 5049 | ··········<ocil:actions> |
| 5038 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5050 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_studies_action:testaction:1</ocil:test_action_ref> |
| 5039 | ··········</ocil:actions> | 5051 | ··········</ocil:actions> |
| 5040 | ········</ocil:questionnaire> | 5052 | ········</ocil:questionnaire> |
| 5041 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5053 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-extension_recommendation_ocil:questionnaire:1"> |
| Max diff block lines reached; 40059/51163 bytes (78.30%) of diff not shown. | |||
| Offset 28, 15 lines modified | Offset 28, 15 lines modified | ||
| 28 | ········<cpe-dict:title·xml:lang="en-us">Mozilla·Firefox</cpe-dict:title> | 28 | ········<cpe-dict:title·xml:lang="en-us">Mozilla·Firefox</cpe-dict:title> |
| 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-firefox-cpe-oval.xml">oval:ssg-installed_app_is_firefox:def:1</cpe-dict:check> | 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-firefox-cpe-oval.xml">oval:ssg-installed_app_is_firefox:def:1</cpe-dict:check> |
| 30 | ······</cpe-dict:cpe-item> | 30 | ······</cpe-dict:cpe-item> |
| 31 | ····</cpe-dict:cpe-list> | 31 | ····</cpe-dict:cpe-list> |
| 32 | ··</ds:component> | 32 | ··</ds:component> |
| 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-firefox-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-firefox-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_FIREFOX"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_FIREFOX"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 35 | ······<xccdf-1.2:status·date="202 | 35 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Firefox</xccdf-1.2:title> | 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Firefox</xccdf-1.2:title> |
| 37 | ······<xccdf-1.2:description> | 37 | ······<xccdf-1.2:description> |
| 38 | ········This·guide·presents·a·catalog·of·security-relevant | 38 | ········This·guide·presents·a·catalog·of·security-relevant |
| 39 | configuration·settings·for·Firefox.·It·is·a·rendering·of | 39 | configuration·settings·for·Firefox.·It·is·a·rendering·of |
| 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 41 | in·order·to·support·security·automation.··The·SCAP·content·is | 41 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 42 | is·available·in·the | 42 | is·available·in·the |
| Offset 4950, 436 lines modified | Offset 4950, 482 lines modified | ||
| 4950 | ······<ocil:generator> | 4950 | ······<ocil:generator> |
| 4951 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4951 | ········<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 4952 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 4952 | ········<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 4953 | ········<ocil:schema_version>2.0</ocil:schema_version> | 4953 | ········<ocil:schema_version>2.0</ocil:schema_version> |
| 4954 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 4954 | ········<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 4955 | ······</ocil:generator> | 4955 | ······</ocil:generator> |
| 4956 | ······<ocil:questionnaires> | 4956 | ······<ocil:questionnaires> |
| 4957 | ········<ocil:questionnaire·id="ocil:ssg-firefox_p | 4957 | ········<ocil:questionnaire·id="ocil:ssg-firefox_preferences-enable_ca_trust_ocil:questionnaire:1"> |
| 4958 | ··········<ocil:title> | 4958 | ··········<ocil:title>Enable·Shared·System·Certificates</ocil:title> |
| 4959 | ··········<ocil:actions> | 4959 | ··········<ocil:actions> |
| 4960 | ············<ocil:test_action_ref>ocil:ssg-firefox_p | 4960 | ············<ocil:test_action_ref>ocil:ssg-firefox_preferences-enable_ca_trust_action:testaction:1</ocil:test_action_ref> |
| 4961 | ··········</ocil:actions> | 4961 | ··········</ocil:actions> |
| 4962 | ········</ocil:questionnaire> | 4962 | ········</ocil:questionnaire> |
| 4963 | ········<ocil:questionnaire·id="ocil:ssg-firefox_p | 4963 | ········<ocil:questionnaire·id="ocil:ssg-firefox_preferences-auto-download_actions_ocil:questionnaire:1"> |
| 4964 | ··········<ocil:title>Disable· | 4964 | ··········<ocil:title>Disable·auto-download·for·proscribed·MIME·types.</ocil:title> |
| 4965 | ··········<ocil:actions> | 4965 | ··········<ocil:actions> |
| 4966 | ············<ocil:test_action_ref>ocil:ssg-firefox_p | 4966 | ············<ocil:test_action_ref>ocil:ssg-firefox_preferences-auto-download_actions_action:testaction:1</ocil:test_action_ref> |
| 4967 | ··········</ocil:actions> | 4967 | ··········</ocil:actions> |
| 4968 | ········</ocil:questionnaire> | 4968 | ········</ocil:questionnaire> |
| 4969 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-te | 4969 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-extension_update_ocil:questionnaire:1"> |
| 4970 | ··········<ocil:title> | 4970 | ··········<ocil:title>Firefox·must·be·configured·to·not·automatically·update·installed·add-ons·and·plugins.</ocil:title> |
| 4971 | ··········<ocil:actions> | 4971 | ··········<ocil:actions> |
| 4972 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-extension_update_action:testaction:1</ocil:test_action_ref> | ||
| 4973 | ··········</ocil:actions> | ||
| 4974 | ········</ocil:questionnaire> | ||
| 4975 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-pop-up_windows_ocil:questionnaire:1"> | ||
| 4976 | ··········<ocil:title>Enable·Firefox·Pop-up·Blocker</ocil:title> | ||
| 4977 | ··········<ocil:actions> | ||
| 4978 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-pop-up_windows_action:testaction:1</ocil:test_action_ref> | ||
| 4979 | ··········</ocil:actions> | ||
| 4980 | ········</ocil:questionnaire> | ||
| 4981 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-enhanced_tracking_ocil:questionnaire:1"> | ||
| 4982 | ··········<ocil:title>Enabled·Firefox·Enhanced·Tracking·Protection</ocil:title> | ||
| 4983 | ··········<ocil:actions> | ||
| 4972 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 4984 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-enhanced_tracking_action:testaction:1</ocil:test_action_ref> |
| 4985 | ··········</ocil:actions> | ||
| 4986 | ········</ocil:questionnaire> | ||
| 4987 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_deprecated_ciphers_ocil:questionnaire:1"> | ||
| 4988 | ··········<ocil:title>Disable·Firefox·deprecated·ciphers</ocil:title> | ||
| 4989 | ··········<ocil:actions> | ||
| 4990 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_deprecated_ciphers_action:testaction:1</ocil:test_action_ref> | ||
| 4973 | ··········</ocil:actions> | 4991 | ··········</ocil:actions> |
| 4974 | ········</ocil:questionnaire> | 4992 | ········</ocil:questionnaire> |
| 4975 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-network_prediction_ocil:questionnaire:1"> | 4993 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-network_prediction_ocil:questionnaire:1"> |
| 4976 | ··········<ocil:title>Disable·Firefox·network·prediction</ocil:title> | 4994 | ··········<ocil:title>Disable·Firefox·network·prediction</ocil:title> |
| 4977 | ··········<ocil:actions> | 4995 | ··········<ocil:actions> |
| 4978 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-network_prediction_action:testaction:1</ocil:test_action_ref> | 4996 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-network_prediction_action:testaction:1</ocil:test_action_ref> |
| 4979 | ··········</ocil:actions> | 4997 | ··········</ocil:actions> |
| 4980 | ········</ocil:questionnaire> | 4998 | ········</ocil:questionnaire> |
| 4981 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 4999 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-autoplay_video_ocil:questionnaire:1"> |
| 4982 | ··········<ocil:title> | 5000 | ··········<ocil:title>Firefox·autoplay·must·be·disabled.</ocil:title> |
| 4983 | ··········<ocil:actions> | 5001 | ··········<ocil:actions> |
| 4984 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5002 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-autoplay_video_action:testaction:1</ocil:test_action_ref> |
| 4985 | ··········</ocil:actions> | 5003 | ··········</ocil:actions> |
| 4986 | ········</ocil:questionnaire> | 5004 | ········</ocil:questionnaire> |
| 4987 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_pocket_ocil:questionnaire:1"> | 5005 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_pocket_ocil:questionnaire:1"> |
| 4988 | ··········<ocil:title>Disable·Firefox·Pocket</ocil:title> | 5006 | ··········<ocil:title>Disable·Firefox·Pocket</ocil:title> |
| 4989 | ··········<ocil:actions> | 5007 | ··········<ocil:actions> |
| 4990 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_pocket_action:testaction:1</ocil:test_action_ref> | 5008 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_pocket_action:testaction:1</ocil:test_action_ref> |
| 4991 | ··········</ocil:actions> | 5009 | ··········</ocil:actions> |
| 4992 | ········</ocil:questionnaire> | 5010 | ········</ocil:questionnaire> |
| 4993 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_studies_ocil:questionnaire:1"> | ||
| 4994 | ··········<ocil:title>Disable·Firefox·Studies</ocil:title> | ||
| 4995 | ··········<ocil:actions> | ||
| 4996 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_studies_action:testaction:1</ocil:test_action_ref> | ||
| 4997 | ··········</ocil:actions> | ||
| 4998 | ········</ocil:questionnaire> | ||
| 4999 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5011 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-forget_button_ocil:questionnaire:1"> |
| 5000 | ··········<ocil:title>Firefox·se | 5012 | ··········<ocil:title>Firefox·must·prevent·the·user·from·quickly·deleting·data.</ocil:title> |
| 5001 | ··········<ocil:actions> | 5013 | ··········<ocil:actions> |
| 5002 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5014 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-forget_button_action:testaction:1</ocil:test_action_ref> |
| 5003 | ··········</ocil:actions> | 5015 | ··········</ocil:actions> |
| 5004 | ········</ocil:questionnaire> | 5016 | ········</ocil:questionnaire> |
| 5005 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5017 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-verification_ocil:questionnaire:1"> |
| 5006 | ··········<ocil:title> | 5018 | ··········<ocil:title>Enable·Certificate·Verification</ocil:title> |
| 5007 | ··········<ocil:actions> | 5019 | ··········<ocil:actions> |
| 5008 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5020 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-verification_action:testaction:1</ocil:test_action_ref> |
| 5009 | ··········</ocil:actions> | 5021 | ··········</ocil:actions> |
| 5010 | ········</ocil:questionnaire> | 5022 | ········</ocil:questionnaire> |
| 5011 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_deprecated_ciphers_ocil:questionnaire:1"> | ||
| 5012 | ········ | 5023 | ········<ocil:questionnaire·id="ocil:ssg-firefox_preferences-dod_root_certificate_installed_ocil:questionnaire:1"> |
| 5024 | ··········<ocil:title>The·DoD·Root·Certificate·Exists</ocil:title> | ||
| 5013 | ··········<ocil:actions> | 5025 | ··········<ocil:actions> |
| 5014 | ············<ocil:test_action_ref>ocil:ssg-firefox_p | 5026 | ············<ocil:test_action_ref>ocil:ssg-firefox_preferences-dod_root_certificate_installed_action:testaction:1</ocil:test_action_ref> |
| 5015 | ··········</ocil:actions> | 5027 | ··········</ocil:actions> |
| 5016 | ········</ocil:questionnaire> | 5028 | ········</ocil:questionnaire> |
| 5017 | ········<ocil:questionnaire·id="ocil:ssg-installed_firefox_version_supported_ocil:questionnaire:1"> | 5029 | ········<ocil:questionnaire·id="ocil:ssg-installed_firefox_version_supported_ocil:questionnaire:1"> |
| 5018 | ··········<ocil:title>Supported·Version·of·Firefox·Installed</ocil:title> | 5030 | ··········<ocil:title>Supported·Version·of·Firefox·Installed</ocil:title> |
| 5019 | ··········<ocil:actions> | 5031 | ··········<ocil:actions> |
| 5020 | ············<ocil:test_action_ref>ocil:ssg-installed_firefox_version_supported_action:testaction:1</ocil:test_action_ref> | 5032 | ············<ocil:test_action_ref>ocil:ssg-installed_firefox_version_supported_action:testaction:1</ocil:test_action_ref> |
| 5021 | ··········</ocil:actions> | 5033 | ··········</ocil:actions> |
| 5022 | ········</ocil:questionnaire> | 5034 | ········</ocil:questionnaire> |
| 5023 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-development_tools_ocil:questionnaire:1"> | 5035 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-development_tools_ocil:questionnaire:1"> |
| 5024 | ··········<ocil:title>Disable·Firefox·Development·Tools</ocil:title> | 5036 | ··········<ocil:title>Disable·Firefox·Development·Tools</ocil:title> |
| 5025 | ··········<ocil:actions> | 5037 | ··········<ocil:actions> |
| 5026 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-development_tools_action:testaction:1</ocil:test_action_ref> | 5038 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-development_tools_action:testaction:1</ocil:test_action_ref> |
| 5027 | ··········</ocil:actions> | 5039 | ··········</ocil:actions> |
| 5028 | ········</ocil:questionnaire> | 5040 | ········</ocil:questionnaire> |
| 5029 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5041 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-telemetry_ocil:questionnaire:1"> |
| 5030 | ··········<ocil:title> | 5042 | ··········<ocil:title>Disable·Firefox·Telemetry</ocil:title> |
| 5031 | ··········<ocil:actions> | 5043 | ··········<ocil:actions> |
| 5032 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5044 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-telemetry_action:testaction:1</ocil:test_action_ref> |
| 5033 | ··········</ocil:actions> | 5045 | ··········</ocil:actions> |
| 5034 | ········</ocil:questionnaire> | 5046 | ········</ocil:questionnaire> |
| 5035 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5047 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_studies_ocil:questionnaire:1"> |
| 5036 | ··········<ocil:title> | 5048 | ··········<ocil:title>Disable·Firefox·Studies</ocil:title> |
| 5037 | ··········<ocil:actions> | 5049 | ··········<ocil:actions> |
| 5038 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy- | 5050 | ············<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_studies_action:testaction:1</ocil:test_action_ref> |
| 5039 | ··········</ocil:actions> | 5051 | ··········</ocil:actions> |
| 5040 | ········</ocil:questionnaire> | 5052 | ········</ocil:questionnaire> |
| 5041 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 5053 | ········<ocil:questionnaire·id="ocil:ssg-firefox_policy-extension_recommendation_ocil:questionnaire:1"> |
| Max diff block lines reached; 40059/51163 bytes (78.30%) of diff not shown. | |||
| Offset 3, 436 lines modified | Offset 3, 482 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-firefox_p | 10 | ····<ocil:questionnaire·id="ocil:ssg-firefox_preferences-enable_ca_trust_ocil:questionnaire:1"> |
| 11 | ······<ocil:title> | 11 | ······<ocil:title>Enable·Shared·System·Certificates</ocil:title> |
| 12 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 13 | ········<ocil:test_action_ref>ocil:ssg-firefox_p | 13 | ········<ocil:test_action_ref>ocil:ssg-firefox_preferences-enable_ca_trust_action:testaction:1</ocil:test_action_ref> |
| 14 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 15 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 16 | ····<ocil:questionnaire·id="ocil:ssg-firefox_p | 16 | ····<ocil:questionnaire·id="ocil:ssg-firefox_preferences-auto-download_actions_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Disable· | 17 | ······<ocil:title>Disable·auto-download·for·proscribed·MIME·types.</ocil:title> |
| 18 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg-firefox_p | 19 | ········<ocil:test_action_ref>ocil:ssg-firefox_preferences-auto-download_actions_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-te | 22 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-extension_update_ocil:questionnaire:1"> |
| 23 | ······<ocil:title> | 23 | ······<ocil:title>Firefox·must·be·configured·to·not·automatically·update·installed·add-ons·and·plugins.</ocil:title> |
| 24 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-extension_update_action:testaction:1</ocil:test_action_ref> | ||
| 26 | ······</ocil:actions> | ||
| 27 | ····</ocil:questionnaire> | ||
| 28 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-pop-up_windows_ocil:questionnaire:1"> | ||
| 29 | ······<ocil:title>Enable·Firefox·Pop-up·Blocker</ocil:title> | ||
| 30 | ······<ocil:actions> | ||
| 31 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-pop-up_windows_action:testaction:1</ocil:test_action_ref> | ||
| 32 | ······</ocil:actions> | ||
| 33 | ····</ocil:questionnaire> | ||
| 34 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-enhanced_tracking_ocil:questionnaire:1"> | ||
| 35 | ······<ocil:title>Enabled·Firefox·Enhanced·Tracking·Protection</ocil:title> | ||
| 36 | ······<ocil:actions> | ||
| 25 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 37 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-enhanced_tracking_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | ||
| 39 | ····</ocil:questionnaire> | ||
| 40 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_deprecated_ciphers_ocil:questionnaire:1"> | ||
| 41 | ······<ocil:title>Disable·Firefox·deprecated·ciphers</ocil:title> | ||
| 42 | ······<ocil:actions> | ||
| 43 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_deprecated_ciphers_action:testaction:1</ocil:test_action_ref> | ||
| 26 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-network_prediction_ocil:questionnaire:1"> | 46 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-network_prediction_ocil:questionnaire:1"> |
| 29 | ······<ocil:title>Disable·Firefox·network·prediction</ocil:title> | 47 | ······<ocil:title>Disable·Firefox·network·prediction</ocil:title> |
| 30 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-network_prediction_action:testaction:1</ocil:test_action_ref> | 49 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-network_prediction_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 52 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-autoplay_video_ocil:questionnaire:1"> |
| 35 | ······<ocil:title> | 53 | ······<ocil:title>Firefox·autoplay·must·be·disabled.</ocil:title> |
| 36 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 55 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-autoplay_video_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_pocket_ocil:questionnaire:1"> | 58 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_pocket_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Disable·Firefox·Pocket</ocil:title> | 59 | ······<ocil:title>Disable·Firefox·Pocket</ocil:title> |
| 42 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_pocket_action:testaction:1</ocil:test_action_ref> | 61 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_pocket_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_studies_ocil:questionnaire:1"> | ||
| 47 | ······<ocil:title>Disable·Firefox·Studies</ocil:title> | ||
| 48 | ······<ocil:actions> | ||
| 49 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_studies_action:testaction:1</ocil:test_action_ref> | ||
| 50 | ······</ocil:actions> | ||
| 51 | ····</ocil:questionnaire> | ||
| 52 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 64 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-forget_button_ocil:questionnaire:1"> |
| 53 | ······<ocil:title>Firefox·se | 65 | ······<ocil:title>Firefox·must·prevent·the·user·from·quickly·deleting·data.</ocil:title> |
| 54 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 67 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-forget_button_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 70 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-verification_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 71 | ······<ocil:title>Enable·Certificate·Verification</ocil:title> |
| 60 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 73 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-verification_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_deprecated_ciphers_ocil:questionnaire:1"> | ||
| 65 | ···· | 76 | ····<ocil:questionnaire·id="ocil:ssg-firefox_preferences-dod_root_certificate_installed_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>The·DoD·Root·Certificate·Exists</ocil:title> | ||
| 66 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg-firefox_p | 79 | ········<ocil:test_action_ref>ocil:ssg-firefox_preferences-dod_root_certificate_installed_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-installed_firefox_version_supported_ocil:questionnaire:1"> | 82 | ····<ocil:questionnaire·id="ocil:ssg-installed_firefox_version_supported_ocil:questionnaire:1"> |
| 71 | ······<ocil:title>Supported·Version·of·Firefox·Installed</ocil:title> | 83 | ······<ocil:title>Supported·Version·of·Firefox·Installed</ocil:title> |
| 72 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg-installed_firefox_version_supported_action:testaction:1</ocil:test_action_ref> | 85 | ········<ocil:test_action_ref>ocil:ssg-installed_firefox_version_supported_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-development_tools_ocil:questionnaire:1"> | 88 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-development_tools_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>Disable·Firefox·Development·Tools</ocil:title> | 89 | ······<ocil:title>Disable·Firefox·Development·Tools</ocil:title> |
| 78 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-development_tools_action:testaction:1</ocil:test_action_ref> | 91 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-development_tools_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 94 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-telemetry_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 95 | ······<ocil:title>Disable·Firefox·Telemetry</ocil:title> |
| 84 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 97 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-telemetry_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 100 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-disable_studies_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 101 | ······<ocil:title>Disable·Firefox·Studies</ocil:title> |
| 90 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 103 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-disable_studies_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy- | 106 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-extension_recommendation_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 107 | ······<ocil:title>Disabled·Firefox·Extension·Recommendations</ocil:title> |
| 96 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy- | 109 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-extension_recommendation_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-javascript_window_changes_ocil:questionnaire:1"> | 112 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-javascript_window_changes_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Disable·JavaScript's·Raise·Or·Lower·Windows·Capability</ocil:title> | 113 | ······<ocil:title>Disable·JavaScript's·Raise·Or·Lower·Windows·Capability</ocil:title> |
| 102 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-javascript_window_changes_action:testaction:1</ocil:test_action_ref> | 115 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-javascript_window_changes_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-firefox_policy-fingerprinting_protection_ocil:questionnaire:1"> | ||
| 107 | ······<ocil:title>Enabled·Firefox·Fingerprinting·Protection</ocil:title> | ||
| 108 | ······<ocil:actions> | ||
| 109 | ········<ocil:test_action_ref>ocil:ssg-firefox_policy-fingerprinting_protection_action:testaction:1</ocil:test_action_ref> | ||
| 110 | ······</ocil:actions> | ||
| Max diff block lines reached; 36026/47139 bytes (76.43%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_FIREFOX"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_FIREFOX"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Firefox</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Firefox</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Firefox.·It·is·a·rendering·of | 7 | configuration·settings·for·Firefox.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 1, 3 lines modified | Offset 1, 3 lines modified | ||
| 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary | 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary |
| 2 | -rw-r--r--···0········0········0·····27 | 2 | -rw-r--r--···0········0········0·····2780·2022-12-20·09:54:05.000000·control.tar.xz |
| 3 | -rw-r--r--···0········0········0··339 | 3 | -rw-r--r--···0········0········0··3391180·2022-12-20·09:54:05.000000·data.tar.xz |
| Offset 14286, 16 lines modified | Offset 14286, 16 lines modified | ||
| 00037cd0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037cd0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037ce0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037ce0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037cf0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037cf0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037d00:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037d00:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037d10:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037d10:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037d20:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037d20:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037d30:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d30:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d40:·2861·7320·6f66·2032·3032·3 | 00037d40:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037d50:·3 | 00037d50:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037d60:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037d60:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037d70:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037d70:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037d80:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037d80:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037d90:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037d90:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037da0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037da0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037db0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037db0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037dc0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037dc0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 16728, 139 lines modified | Offset 16728, 139 lines modified | ||
| 00041570:·7267·6574·3d22·2369·646d·3235·3637·2220··rget="#idm2567"· | 00041570:·7267·6574·3d22·2369·646d·3235·3637·2220··rget="#idm2567"· | ||
| 00041580:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 00041580:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 00041590:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 00041590:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 000415a0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 000415a0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 000415b0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 000415b0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 000415c0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 000415c0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 000415d0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 000415d0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 000415e0:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 000415f0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 00041600:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 00041610:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 00041620:·643d·2269·646d·3235·3637·223e·3c74·6162··d="idm2567"><tab | |||
| 00041630:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 00041640:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 00041650:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 00041660:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 00041670:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 000415e0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 000415f0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 00041600:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 00041610:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 00041620:·2220·6964·3d22·6964·6d32·3536·3722·3e3c··"·id="idm2567">< | |||
| 00041630:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 00041640:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 00041650:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 00041660:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 00041670:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 00041680:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 00041690:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 000416a0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 000416 | 00041680:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | ||
| 000416 | 00041690:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | ||
| 000416a0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 000416b0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 000416c0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 000416d0:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 000416e0:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 000416f0:·626c·653e·3c70·7265·3e3c·636f·6465·3e0a··ble><pre><code>. | |||
| 00041700:·666f·7220·6620·696e·202f·6574·632f·7375··for·f·in·/etc/su | |||
| 00041710:·646f·6572·7320·2f65·7463·2f73·7564·6f65··doers·/etc/sudoe | |||
| 00041720:·7273·2e64·2f2a·203b·2064·6f0a·2020·6966··rs.d/*·;·do.··if | |||
| 00041730:·205b·2021·202d·6520·2224·6622·205d·203b···[·!·-e·"$f"·]·; | |||
| 00041740:·2074·6865·6e0a·2020·2020·636f·6e74·696e···then.····contin | |||
| 00041750:·7565·0a20·2066·690a·2020·6d61·7463·6869··ue.··fi.··matchi | |||
| 00041760:·6e67·5f6c·6973·743d·2428·6772·6570·202d··ng_list=$(grep·- | |||
| 00041770:·5020·275e·283f·2123·292e·2a5b·5c73·5d2b··P·'^(?!#).*[\s]+ | |||
| 000416d0:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 000416e0:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 000416f0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 00041700:·653e·2d20·6e61·6d65·3a20·4669·6e64·202f··e>-·name:·Find·/ | |||
| 00041710:·6574·632f·7375·646f·6572·732e·642f·2066··etc/sudoers.d/·f | |||
| 00041720:·696c·6573·0a20·2066·696e·643a·0a20·2020··iles.··find:.··· | |||
| 00041730:·2070·6174·6873·3a0a·2020·2020·2d20·2f65···paths:.····-·/e | |||
| 00041740:·7463·2f73·7564·6f65·7273·2e64·2f0a·2020··tc/sudoers.d/.·· | |||
| 00041750:·7265·6769·7374·6572·3a20·7375·646f·6572··register:·sudoer | |||
| 00041760:·730a·2020·7461·6773·3a0a·2020·2d20·4e49··s.··tags:.··-·NI | |||
| 00041770:·5354·2d38·3030·2d35·332d·434d·2d36·2861··ST-800-53-CM-6(a | |||
| 00041780:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 00041790:·332d·4941·2d31·310a·2020·2d20·6c6f·775f··3-IA-11.··-·low_ | |||
| 000417a0:·636f·6d70·6c65·7869·7479·0a20·202d·206c··complexity.··-·l | |||
| 000417b0:·6f77·5f64·6973·7275·7074·696f·6e0a·2020··ow_disruption.·· | |||
| 000417c0:·2d20·6d65·6469·756d·5f73·6576·6572·6974··-·medium_severit | |||
| 000417d0:·790a·2020·2d20·6e6f·5f72·6562·6f6f·745f··y.··-·no_reboot_ | |||
| 000417e0:·6e65·6564·6564·0a20·202d·2072·6573·7472··needed.··-·restr | |||
| 000417f0:·6963·745f·7374·7261·7465·6779·0a20·202d··ict_strategy.··- | |||
| 00041800:·2073·7564·6f5f·7265·6d6f·7665·5f6e·6f5f···sudo_remove_no_ | |||
| 00041 | 00041780:·5c21·6175·7468·656e·7469·6361·7465·2e2a··\!authenticate.* | ||
| 00041790:·2427·2024·6620·7c20·756e·6971·2029·0a20··$'·$f·|·uniq·).· | |||
| 000417a0:·2069·6620·2120·7465·7374·202d·7a20·2224···if·!·test·-z·"$ | |||
| 000417b0:·6d61·7463·6869·6e67·5f6c·6973·7422·3b20··matching_list";· | |||
| 000417c0:·7468·656e·0a20·2020·2077·6869·6c65·2049··then.····while·I | |||
| 000417d0:·4653·3d20·7265·6164·202d·7220·656e·7472··FS=·read·-r·entr | |||
| 000417e0:·793b·2064·6f0a·2020·2020·2020·2320·636f··y;·do.······#·co | |||
| 000417f0:·6d6d·656e·7420·6f75·7420·2221·6175·7468··mment·out·"!auth | |||
| 00041800:·656e·7469·6361·7465·2220·6d61·7463·6865··enticate"·matche | |||
| 00041810:·7320·746f·2070·7265·7365·7276·6520·7573··s·to·preserve·us | |||
| 00041820:·6572·2064·6174·610a·2020·2020·2020·7365··er·data.······se | |||
| 00041830:·6420·2d69·2022·732f·5e24·7b65·6e74·7279··d·-i·"s/^${entry | |||
| 00041840:·7d24·2f23·2026·616d·703b·2f67·2220·2466··}$/#·&/g"·$f | |||
| 00041850:·0a20·2020·2064·6f6e·6520·266c·743b·266c··.····done·<&l | |||
| 00041860:·743b·266c·743b·2022·246d·6174·6368·696e··t;<·"$matchin | |||
| 00041870:·675f·6c69·7374·220a·0a20·2020·202f·7573··g_list"..····/us | |||
| 00041880:·722f·7362·696e·2f76·6973·7564·6f20·2d63··r/sbin/visudo·-c | |||
| 00041890:·6620·2466·2026·616d·703b·2667·743b·202f··f·$f·&>·/ | |||
| 000418a0:·6465·762f·6e75·6c6c·207c·7c20·6563·686f··dev/null·||·echo | |||
| 000418b0:·2022·4661·696c·2074·6f20·7661·6c69·6461···"Fail·to·valida | |||
| 000418c0:·7465·2024·6620·7769·7468·2076·6973·7564··te·$f·with·visud | |||
| 000418d0:·6f22·0a20·2066·690a·646f·6e65·0a3c·2f63··o".··fi.done.</c | |||
| 000418e0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 000418f0:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 00041900:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 00041910:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 00041920:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 00041930:·6964·6d32·3536·3822·2074·6162·696e·6465··idm2568"·tabinde | |||
| 00041940:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 00041950:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 00041960:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 00041970:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 00041980:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 00041990:·656d·6564·6961·7469·6f6e·2041·6e73·6962··emediation·Ansib | |||
| 000419a0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 00041820:·6e61·6d65·3a20·5265·6d6f·7665·206c·696e··name:·Remove·lin | |||
| 00041830:·6573·2063·6f6e·7461·696e·696e·6720·2161··es·containing·!a | |||
| 00041840:·7574·6865·6e74·6963·6174·6520·6672·6f6d··uthenticate·from | |||
| 00041850:·2073·7564·6f65·7273·2066·696c·6573·0a20···sudoers·files.· | |||
| 00041860:·2072·6570·6c61·6365·3a0a·2020·2020·7265···replace:.····re | |||
| 00041870:·6765·7870·3a20·285e·283f·2123·292e·2a5b··gexp:·(^(?!#).*[ | |||
| 00041880:·5c73·5d2b·5c21·6175·7468·656e·7469·6361··\s]+\!authentica | |||
| 00041890:·7465·2e2a·2429·0a20·2020·2072·6570·6c61··te.*$).····repla | |||
| 000418a0:·6365·3a20·2723·205c·6726·6c74·3b31·2667··ce:·'#·\g<1&g | |||
| Max diff block lines reached; 538810/557908 bytes (96.58%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Configure_Syslog | 48 | ·········2.·Configure_Syslog |
| 49 | ·········3.·File_Permissions_and_Masks | 49 | ·········3.·File_Permissions_and_Masks |
| 50 | ···2.·Services | 50 | ···2.·Services |
| 51 | ·········1.·APT_service_configuration | 51 | ·········1.·APT_service_configuration |
| Offset 167, 14 lines modified | Offset 167, 33 lines modified | ||
| 167 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 167 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 168 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 168 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 169 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 169 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 170 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 170 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 171 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 171 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 172 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 172 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 173 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 173 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 174 | Remediation_Shell_script_⇲ | ||
| 175 | Complexity:·low | ||
| 176 | Disruption:·low | ||
| 177 | Strategy:···restrict | ||
| 178 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 179 | ··if·[·!·-e·"$f"·]·;·then | ||
| 180 | ····continue | ||
| 181 | ··fi | ||
| 182 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 183 | ··if·!·test·-z·"$matching_list";·then | ||
| 184 | ····while·IFS=·read·-r·entry;·do | ||
| 185 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 186 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 187 | ····done·<<<·"$matching_list" | ||
| 188 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 189 | ··fi | ||
| 190 | done | ||
| 174 | Remediation_Ansible_snippet_⇲ | 191 | Remediation_Ansible_snippet_⇲ |
| 175 | Complexity:·low | 192 | Complexity:·low |
| 176 | Disruption:·low | 193 | Disruption:·low |
| 177 | Strategy:···restrict | 194 | Strategy:···restrict |
| 178 | -·name:·Find·/etc/sudoers.d/·files | 195 | -·name:·Find·/etc/sudoers.d/·files |
| 179 | ··find: | 196 | ··find: |
| 180 | ····paths: | 197 | ····paths: |
| Offset 204, 33 lines modified | Offset 223, 14 lines modified | ||
| 204 | ··-·NIST-800-53-IA-11 | 223 | ··-·NIST-800-53-IA-11 |
| 205 | ··-·low_complexity | 224 | ··-·low_complexity |
| 206 | ··-·low_disruption | 225 | ··-·low_disruption |
| 207 | ··-·medium_severity | 226 | ··-·medium_severity |
| 208 | ··-·no_reboot_needed | 227 | ··-·no_reboot_needed |
| 209 | ··-·restrict_strategy | 228 | ··-·restrict_strategy |
| 210 | ··-·sudo_remove_no_authenticate | 229 | ··-·sudo_remove_no_authenticate |
| 211 | Remediation_Shell_script_⇲ | ||
| 212 | Complexity:·low | ||
| 213 | Disruption:·low | ||
| 214 | Strategy:···restrict | ||
| 215 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 216 | ··if·[·!·-e·"$f"·]·;·then | ||
| 217 | ····continue | ||
| 218 | ··fi | ||
| 219 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 220 | ··if·!·test·-z·"$matching_list";·then | ||
| 221 | ····while·IFS=·read·-r·entry;·do | ||
| 222 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 223 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 224 | ····done·<<<·"$matching_list" | ||
| 225 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 226 | ··fi | ||
| 227 | done | ||
| 228 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 230 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 229 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 231 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 230 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 232 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 231 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 233 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 232 | sudoers.d/. | 234 | sudoers.d/. |
| 233 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 235 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 234 | ············they·do·not·have·authorization. | 236 | ············they·do·not·have·authorization. |
| Offset 242, 14 lines modified | Offset 242, 33 lines modified | ||
| 242 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 242 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 243 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 243 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 244 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 244 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 245 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 245 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 246 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 246 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 247 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 247 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 248 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 248 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 249 | Remediation_Shell_script_⇲ | ||
| 250 | Complexity:·low | ||
| 251 | Disruption:·low | ||
| 252 | Strategy:···restrict | ||
| 253 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 254 | ··if·[·!·-e·"$f"·]·;·then | ||
| 255 | ····continue | ||
| 256 | ··fi | ||
| 257 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 258 | ··if·!·test·-z·"$matching_list";·then | ||
| 259 | ····while·IFS=·read·-r·entry;·do | ||
| 260 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 261 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 262 | ····done·<<<·"$matching_list" | ||
| 263 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 264 | ··fi | ||
| 265 | done | ||
| 249 | Remediation_Ansible_snippet_⇲ | 266 | Remediation_Ansible_snippet_⇲ |
| 250 | Complexity:·low | 267 | Complexity:·low |
| 251 | Disruption:·low | 268 | Disruption:·low |
| 252 | Strategy:···restrict | 269 | Strategy:···restrict |
| 253 | -·name:·Find·/etc/sudoers.d/·files | 270 | -·name:·Find·/etc/sudoers.d/·files |
| 254 | ··find: | 271 | ··find: |
| 255 | ····paths: | 272 | ····paths: |
| Offset 279, 33 lines modified | Offset 298, 14 lines modified | ||
| 279 | ··-·NIST-800-53-IA-11 | 298 | ··-·NIST-800-53-IA-11 |
| 280 | ··-·low_complexity | 299 | ··-·low_complexity |
| 281 | ··-·low_disruption | 300 | ··-·low_disruption |
| 282 | ··-·medium_severity | 301 | ··-·medium_severity |
| 283 | ··-·no_reboot_needed | 302 | ··-·no_reboot_needed |
| 284 | ··-·restrict_strategy | 303 | ··-·restrict_strategy |
| 285 | ··-·sudo_remove_nopasswd | 304 | ··-·sudo_remove_nopasswd |
| 286 | Remediation_Shell_script_⇲ | ||
| 287 | Complexity:·low | ||
| Max diff block lines reached; 75022/80440 bytes (93.26%) of diff not shown. | |||
| Offset 14288, 15 lines modified | Offset 14288, 15 lines modified | ||
| 00037cf0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037cf0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037d00:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037d00:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037d10:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037d10:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037d20:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037d20:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037d30:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037d30:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037d40:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037d40:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037d50:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037d50:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037d60:·3 | 00037d60:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037d70:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037d70:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037d80:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037d80:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037d90:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037d90:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037da0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037da0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037db0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037db0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037dc0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037dc0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037dd0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037dd0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 16747, 140 lines modified | Offset 16747, 140 lines modified | ||
| 000416a0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 000416a0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 000416b0:·2223·6964·6d32·3536·3722·2074·6162·696e··"#idm2567"·tabin | 000416b0:·2223·6964·6d32·3536·3722·2074·6162·696e··"#idm2567"·tabin | ||
| 000416c0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 000416c0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 000416d0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 000416d0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 000416e0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 000416e0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 000416f0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 000416f0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 00041700:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 00041700:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 00041710:·3e52·656d·6564·6961·7469·6f6e·20 | 00041710:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 00041720:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 00041730:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 000417 | 00041720:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | ||
| 00041730:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 00041740:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 00041750:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 00041760:·6d32·3536·3722·3e3c·7461·626c·6520·636c··m2567"><table·cl | |||
| 00041770:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 00041780:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 00041790:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 000417a0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 000417b0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 000417c0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 000417d0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 000417e0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 000417f0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 00041800:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 00041810:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 00041820:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 00041830:·7072·653e·3c63·6f64·653e·0a66·6f72·2066··pre><code>.for·f | |||
| 00041840:·2069·6e20·2f65·7463·2f73·7564·6f65·7273···in·/etc/sudoers | |||
| 00041850:·202f·6574·632f·7375·646f·6572·732e·642f···/etc/sudoers.d/ | |||
| 00041860:·2a20·3b20·646f·0a20·2069·6620·5b20·2120··*·;·do.··if·[·!· | |||
| 00041870:·2d65·2022·2466·2220·5d20·3b20·7468·656e··-e·"$f"·]·;·then | |||
| 00041880:·0a20·2020·2063·6f6e·7469·6e75·650a·2020··.····continue.·· | |||
| 00041890:·6669·0a20·206d·6174·6368·696e·675f·6c69··fi.··matching_li | |||
| 000418a0:·7374·3d24·2867·7265·7020·2d50·2027·5e28··st=$(grep·-P·'^( | |||
| 000418b0:·3f21·2329·2e2a·5b5c·735d·2b5c·2161·7574··?!#).*[\s]+\!aut | |||
| 000418c0:·6865·6e74·6963·6174·652e·2a24·2720·2466··henticate.*$'·$f | |||
| 000418d0:·207c·2075·6e69·7120·290a·2020·6966·2021···|·uniq·).··if·! | |||
| 000418e0:·2074·6573·7420·2d7a·2022·246d·6174·6368···test·-z·"$match | |||
| 000418f0:·696e·675f·6c69·7374·223b·2074·6865·6e0a··ing_list";·then. | |||
| 00041900:·2020·2020·7768·696c·6520·4946·533d·2072······while·IFS=·r | |||
| 00041910:·6561·6420·2d72·2065·6e74·7279·3b20·646f··ead·-r·entry;·do | |||
| 00041920:·0a20·2020·2020·2023·2063·6f6d·6d65·6e74··.······#·comment | |||
| 00041930:·206f·7574·2022·2161·7574·6865·6e74·6963···out·"!authentic | |||
| 00041940:·6174·6522·206d·6174·6368·6573·2074·6f20··ate"·matches·to· | |||
| 00041950:·7072·6573·6572·7665·2075·7365·7220·6461··preserve·user·da | |||
| 00041960:·7461·0a20·2020·2020·2073·6564·202d·6920··ta.······sed·-i· | |||
| 00041970:·2273·2f5e·247b·656e·7472·797d·242f·2320··"s/^${entry}$/#· | |||
| 00041980:·2661·6d70·3b2f·6722·2024·660a·2020·2020··&/g"·$f.···· | |||
| 00041990:·646f·6e65·2026·6c74·3b26·6c74·3b26·6c74··done·<<< | |||
| 000419a0:·3b20·2224·6d61·7463·6869·6e67·5f6c·6973··;·"$matching_lis | |||
| 000419b0:·7422·0a0a·2020·2020·2f75·7372·2f73·6269··t"..····/usr/sbi | |||
| 000419c0:·6e2f·7669·7375·646f·202d·6366·2024·6620··n/visudo·-cf·$f· | |||
| 000419d0:·2661·6d70·3b26·6774·3b20·2f64·6576·2f6e··&>·/dev/n | |||
| 000419e0:·756c·6c20·7c7c·2065·6368·6f20·2246·6169··ull·||·echo·"Fai | |||
| 000419f0:·6c20·746f·2076·616c·6964·6174·6520·2466··l·to·validate·$f | |||
| 00041a00:·2077·6974·6820·7669·7375·646f·220a·2020···with·visudo".·· | |||
| 00041a10:·6669·0a64·6f6e·650a·3c2f·636f·6465·3e3c··fi.done.</code>< | |||
| 00041a20:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 00041a30:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 00041a40:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 00041 | 00041a50:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | ||
| 00041a60:·612d·7461·7267·6574·3d22·2369·646d·3235··a-target="#idm25 | |||
| 00041a70:·3638·2220·7461·6269·6e64·6578·3d22·3022··68"·tabindex="0" | |||
| 00041a80:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 00041a90:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 00041aa0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 00041ab0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 00041ac0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 00041ad0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 00041760:·2269·646d·3235·3637·223e·3c74·6162·6c65··"idm2567"><table | |||
| 00041770:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 00041780:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 00041790:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 000417a0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 000417b0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 000417c0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 000417d0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 000417e0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 000417f0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 00041800:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 00041810:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 00041820:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 00041830:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 00041840:·616d·653a·2046·696e·6420·2f65·7463·2f73··ame:·Find·/etc/s | |||
| 00041850:·7564·6f65·7273·2e64·2f20·6669·6c65·730a··udoers.d/·files. | |||
| 00041860:·2020·6669·6e64·3a0a·2020·2020·7061·7468····find:.····path | |||
| 00041870:·733a·0a20·2020·202d·202f·6574·632f·7375··s:.····-·/etc/su | |||
| 00041880:·646f·6572·732e·642f·0a20·2072·6567·6973··doers.d/.··regis | |||
| 00041890:·7465·723a·2073·7564·6f65·7273·0a20·2074··ter:·sudoers.··t | |||
| 000418a0:·6167·733a·0a20·202d·204e·4953·542d·3830··ags:.··-·NIST-80 | |||
| 000418b0:·302d·3533·2d43·4d2d·3628·6129·0a20·202d··0-53-CM-6(a).··- | |||
| 000418c0:·204e·4953·542d·3830·302d·3533·2d49·412d···NIST-800-53-IA- | |||
| 000418d0:·3131·0a20·202d·206c·6f77·5f63·6f6d·706c··11.··-·low_compl | |||
| 000418e0:·6578·6974·790a·2020·2d20·6c6f·775f·6469··exity.··-·low_di | |||
| 000418f0:·7372·7570·7469·6f6e·0a20·202d·206d·6564··sruption.··-·med | |||
| 00041900:·6975·6d5f·7365·7665·7269·7479·0a20·202d··ium_severity.··- | |||
| 00041910:·206e·6f5f·7265·626f·6f74·5f6e·6565·6465···no_reboot_neede | |||
| 00041920:·640a·2020·2d20·7265·7374·7269·6374·5f73··d.··-·restrict_s | |||
| 00041930:·7472·6174·6567·790a·2020·2d20·7375·646f··trategy.··-·sudo | |||
| 00041940:·5f72·656d·6f76·655f·6e6f·5f61·7574·6865··_remove_no_authe | |||
| 00041950:·6e74·6963·6174·650a·0a2d·206e·616d·653a··nticate..-·name: | |||
| 00041960:·2052·656d·6f76·6520·6c69·6e65·7320·636f···Remove·lines·co | |||
| 00041970:·6e74·6169·6e69·6e67·2021·6175·7468·656e··ntaining·!authen | |||
| 00041980:·7469·6361·7465·2066·726f·6d20·7375·646f··ticate·from·sudo | |||
| 00041990:·6572·7320·6669·6c65·730a·2020·7265·706c··ers·files.··repl | |||
| 000419a0:·6163·653a·0a20·2020·2072·6567·6578·703a··ace:.····regexp: | |||
| 000419b0:·2028·5e28·3f21·2329·2e2a·5b5c·735d·2b5c···(^(?!#).*[\s]+\ | |||
| 000419c0:·2161·7574·6865·6e74·6963·6174·652e·2a24··!authenticate.*$ | |||
| 000419d0:·290a·2020·2020·7265·706c·6163·653a·2027··).····replace:·' | |||
| 000419e0:·2320·5c67·266c·743b·3126·6774·3b27·0a20··#·\g<1>'.· | |||
| Max diff block lines reached; 648410/667508 bytes (97.14%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level | 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ | 42 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·GRUB2_bootloader_configuration | 50 | ·········3.·GRUB2_bootloader_configuration |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 171, 14 lines modified | Offset 171, 33 lines modified | ||
| 171 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 171 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 172 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 172 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 173 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 173 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 174 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 174 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 175 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 175 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 176 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 176 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 177 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 177 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 178 | Remediation_Shell_script_⇲ | ||
| 179 | Complexity:·low | ||
| 180 | Disruption:·low | ||
| 181 | Strategy:···restrict | ||
| 182 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 183 | ··if·[·!·-e·"$f"·]·;·then | ||
| 184 | ····continue | ||
| 185 | ··fi | ||
| 186 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 187 | ··if·!·test·-z·"$matching_list";·then | ||
| 188 | ····while·IFS=·read·-r·entry;·do | ||
| 189 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 190 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 191 | ····done·<<<·"$matching_list" | ||
| 192 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 193 | ··fi | ||
| 194 | done | ||
| 178 | Remediation_Ansible_snippet_⇲ | 195 | Remediation_Ansible_snippet_⇲ |
| 179 | Complexity:·low | 196 | Complexity:·low |
| 180 | Disruption:·low | 197 | Disruption:·low |
| 181 | Strategy:···restrict | 198 | Strategy:···restrict |
| 182 | -·name:·Find·/etc/sudoers.d/·files | 199 | -·name:·Find·/etc/sudoers.d/·files |
| 183 | ··find: | 200 | ··find: |
| 184 | ····paths: | 201 | ····paths: |
| Offset 208, 33 lines modified | Offset 227, 14 lines modified | ||
| 208 | ··-·NIST-800-53-IA-11 | 227 | ··-·NIST-800-53-IA-11 |
| 209 | ··-·low_complexity | 228 | ··-·low_complexity |
| 210 | ··-·low_disruption | 229 | ··-·low_disruption |
| 211 | ··-·medium_severity | 230 | ··-·medium_severity |
| 212 | ··-·no_reboot_needed | 231 | ··-·no_reboot_needed |
| 213 | ··-·restrict_strategy | 232 | ··-·restrict_strategy |
| 214 | ··-·sudo_remove_no_authenticate | 233 | ··-·sudo_remove_no_authenticate |
| 215 | Remediation_Shell_script_⇲ | ||
| 216 | Complexity:·low | ||
| 217 | Disruption:·low | ||
| 218 | Strategy:···restrict | ||
| 219 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 220 | ··if·[·!·-e·"$f"·]·;·then | ||
| 221 | ····continue | ||
| 222 | ··fi | ||
| 223 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 224 | ··if·!·test·-z·"$matching_list";·then | ||
| 225 | ····while·IFS=·read·-r·entry;·do | ||
| 226 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 227 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 228 | ····done·<<<·"$matching_list" | ||
| 229 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 230 | ··fi | ||
| 231 | done | ||
| 232 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 234 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 233 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 235 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 234 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 236 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 235 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 237 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 236 | sudoers.d/. | 238 | sudoers.d/. |
| 237 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 239 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 238 | ············they·do·not·have·authorization. | 240 | ············they·do·not·have·authorization. |
| Offset 246, 14 lines modified | Offset 246, 33 lines modified | ||
| 246 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 246 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 247 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 247 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 248 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 248 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 249 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 249 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 250 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 250 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 251 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 251 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 252 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 252 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 253 | Remediation_Shell_script_⇲ | ||
| 254 | Complexity:·low | ||
| 255 | Disruption:·low | ||
| 256 | Strategy:···restrict | ||
| 257 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 258 | ··if·[·!·-e·"$f"·]·;·then | ||
| 259 | ····continue | ||
| 260 | ··fi | ||
| 261 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 262 | ··if·!·test·-z·"$matching_list";·then | ||
| 263 | ····while·IFS=·read·-r·entry;·do | ||
| 264 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 265 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 266 | ····done·<<<·"$matching_list" | ||
| 267 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 268 | ··fi | ||
| 269 | done | ||
| 253 | Remediation_Ansible_snippet_⇲ | 270 | Remediation_Ansible_snippet_⇲ |
| 254 | Complexity:·low | 271 | Complexity:·low |
| 255 | Disruption:·low | 272 | Disruption:·low |
| 256 | Strategy:···restrict | 273 | Strategy:···restrict |
| 257 | -·name:·Find·/etc/sudoers.d/·files | 274 | -·name:·Find·/etc/sudoers.d/·files |
| 258 | ··find: | 275 | ··find: |
| 259 | ····paths: | 276 | ····paths: |
| Offset 283, 33 lines modified | Offset 302, 14 lines modified | ||
| 283 | ··-·NIST-800-53-IA-11 | 302 | ··-·NIST-800-53-IA-11 |
| 284 | ··-·low_complexity | 303 | ··-·low_complexity |
| 285 | ··-·low_disruption | 304 | ··-·low_disruption |
| 286 | ··-·medium_severity | 305 | ··-·medium_severity |
| 287 | ··-·no_reboot_needed | 306 | ··-·no_reboot_needed |
| 288 | ··-·restrict_strategy | 307 | ··-·restrict_strategy |
| 289 | ··-·sudo_remove_nopasswd | 308 | ··-·sudo_remove_nopasswd |
| 290 | Remediation_Shell_script_⇲ | ||
| 291 | Complexity:·low | ||
| Max diff block lines reached; 86029/91469 bytes (94.05%) of diff not shown. | |||
| Offset 14281, 15 lines modified | Offset 14281, 15 lines modified | ||
| 00037c80:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037c80:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037c90:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037c90:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037ca0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037ca0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037cb0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037cb0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037cc0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037cc0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037cd0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037cd0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037ce0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037ce0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037cf0:·3032·3 | 00037cf0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037d00:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037d00:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037d10:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037d10:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037d20:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037d20:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037d30:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037d30:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037d40:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037d40:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037d50:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037d50:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037d60:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037d60:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 14943, 140 lines modified | Offset 14943, 140 lines modified | ||
| 0003a5e0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003a5e0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003a5f0:·3d22·2369·646d·3235·3637·2220·7461·6269··="#idm2567"·tabi | 0003a5f0:·3d22·2369·646d·3235·3637·2220·7461·6269··="#idm2567"·tabi | ||
| 0003a600:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003a600:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003a610:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003a610:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003a620:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003a620:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003a630:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003a630:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003a640:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003a640:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003a650:·223e·5265·6d65·6469·6174·696f·6e20· | 0003a650:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003a660:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003a670:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003a6 | 0003a660:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003a670:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003a680:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003a690:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003a6a0:·646d·3235·3637·223e·3c74·6162·6c65·2063··dm2567"><table·c | |||
| 0003a6b0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003a6c0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003a6d0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003a6e0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003a6f0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003a700:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003a710:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003a720:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003a730:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003a740:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003a750:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003a760:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003a770:·3c70·7265·3e3c·636f·6465·3e0a·666f·7220··<pre><code>.for· | |||
| 0003a780:·6620·696e·202f·6574·632f·7375·646f·6572··f·in·/etc/sudoer | |||
| 0003a790:·7320·2f65·7463·2f73·7564·6f65·7273·2e64··s·/etc/sudoers.d | |||
| 0003a7a0:·2f2a·203b·2064·6f0a·2020·6966·205b·2021··/*·;·do.··if·[·! | |||
| 0003a7b0:·202d·6520·2224·6622·205d·203b·2074·6865···-e·"$f"·]·;·the | |||
| 0003a7c0:·6e0a·2020·2020·636f·6e74·696e·7565·0a20··n.····continue.· | |||
| 0003a7d0:·2066·690a·2020·6d61·7463·6869·6e67·5f6c···fi.··matching_l | |||
| 0003a7e0:·6973·743d·2428·6772·6570·202d·5020·275e··ist=$(grep·-P·'^ | |||
| 0003a7f0:·283f·2123·292e·2a5b·5c73·5d2b·5c21·6175··(?!#).*[\s]+\!au | |||
| 0003a800:·7468·656e·7469·6361·7465·2e2a·2427·2024··thenticate.*$'·$ | |||
| 0003a810:·6620·7c20·756e·6971·2029·0a20·2069·6620··f·|·uniq·).··if· | |||
| 0003a820:·2120·7465·7374·202d·7a20·2224·6d61·7463··!·test·-z·"$matc | |||
| 0003a830:·6869·6e67·5f6c·6973·7422·3b20·7468·656e··hing_list";·then | |||
| 0003a840:·0a20·2020·2077·6869·6c65·2049·4653·3d20··.····while·IFS=· | |||
| 0003a850:·7265·6164·202d·7220·656e·7472·793b·2064··read·-r·entry;·d | |||
| 0003a860:·6f0a·2020·2020·2020·2320·636f·6d6d·656e··o.······#·commen | |||
| 0003a870:·7420·6f75·7420·2221·6175·7468·656e·7469··t·out·"!authenti | |||
| 0003a880:·6361·7465·2220·6d61·7463·6865·7320·746f··cate"·matches·to | |||
| 0003a890:·2070·7265·7365·7276·6520·7573·6572·2064···preserve·user·d | |||
| 0003a8a0:·6174·610a·2020·2020·2020·7365·6420·2d69··ata.······sed·-i | |||
| 0003a8b0:·2022·732f·5e24·7b65·6e74·7279·7d24·2f23···"s/^${entry}$/# | |||
| 0003a8c0:·2026·616d·703b·2f67·2220·2466·0a20·2020···&/g"·$f.··· | |||
| 0003a8d0:·2064·6f6e·6520·266c·743b·266c·743b·266c···done·<<&l | |||
| 0003a8e0:·743b·2022·246d·6174·6368·696e·675f·6c69··t;·"$matching_li | |||
| 0003a8f0:·7374·220a·0a20·2020·202f·7573·722f·7362··st"..····/usr/sb | |||
| 0003a900:·696e·2f76·6973·7564·6f20·2d63·6620·2466··in/visudo·-cf·$f | |||
| 0003a910:·2026·616d·703b·2667·743b·202f·6465·762f···&>·/dev/ | |||
| 0003a920:·6e75·6c6c·207c·7c20·6563·686f·2022·4661··null·||·echo·"Fa | |||
| 0003a930:·696c·2074·6f20·7661·6c69·6461·7465·2024··il·to·validate·$ | |||
| 0003a940:·6620·7769·7468·2076·6973·7564·6f22·0a20··f·with·visudo".· | |||
| 0003a950:·2066·690a·646f·6e65·0a3c·2f63·6f64·653e···fi.done.</code> | |||
| 0003a960:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003a970:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003a980:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003a | 0003a990:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003a9a0:·7461·2d74·6172·6765·743d·2223·6964·6d32··ta-target="#idm2 | |||
| 0003a9b0:·3536·3822·2074·6162·696e·6465·783d·2230··568"·tabindex="0 | |||
| 0003a9c0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003a9d0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003a9e0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003a9f0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003aa00:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003aa10:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003a6a0:·3d22·6964·6d32·3536·3722·3e3c·7461·626c··="idm2567"><tabl | |||
| 0003a6b0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003a6c0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003a6d0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003a6e0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003a6f0:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003a700:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003a710:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003a720:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003a730:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003a740:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003a750:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003a760:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003a770:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003a780:·6e61·6d65·3a20·4669·6e64·202f·6574·632f··name:·Find·/etc/ | |||
| 0003a790:·7375·646f·6572·732e·642f·2066·696c·6573··sudoers.d/·files | |||
| 0003a7a0:·0a20·2066·696e·643a·0a20·2020·2070·6174··.··find:.····pat | |||
| 0003a7b0:·6873·3a0a·2020·2020·2d20·2f65·7463·2f73··hs:.····-·/etc/s | |||
| 0003a7c0:·7564·6f65·7273·2e64·2f0a·2020·7265·6769··udoers.d/.··regi | |||
| 0003a7d0:·7374·6572·3a20·7375·646f·6572·730a·2020··ster:·sudoers.·· | |||
| 0003a7e0:·7461·6773·3a0a·2020·2d20·4e49·5354·2d38··tags:.··-·NIST-8 | |||
| 0003a7f0:·3030·2d35·332d·434d·2d36·2861·290a·2020··00-53-CM-6(a).·· | |||
| 0003a800:·2d20·4e49·5354·2d38·3030·2d35·332d·4941··-·NIST-800-53-IA | |||
| 0003a810:·2d31·310a·2020·2d20·6c6f·775f·636f·6d70··-11.··-·low_comp | |||
| 0003a820:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003a830:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003a840:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003a850:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003a860:·6564·0a20·202d·2072·6573·7472·6963·745f··ed.··-·restrict_ | |||
| 0003a870:·7374·7261·7465·6779·0a20·202d·2073·7564··strategy.··-·sud | |||
| 0003a880:·6f5f·7265·6d6f·7665·5f6e·6f5f·6175·7468··o_remove_no_auth | |||
| 0003a890:·656e·7469·6361·7465·0a0a·2d20·6e61·6d65··enticate..-·name | |||
| 0003a8a0:·3a20·5265·6d6f·7665·206c·696e·6573·2063··:·Remove·lines·c | |||
| 0003a8b0:·6f6e·7461·696e·696e·6720·2161·7574·6865··ontaining·!authe | |||
| 0003a8c0:·6e74·6963·6174·6520·6672·6f6d·2073·7564··nticate·from·sud | |||
| 0003a8d0:·6f65·7273·2066·696c·6573·0a20·2072·6570··oers·files.··rep | |||
| 0003a8e0:·6c61·6365·3a0a·2020·2020·7265·6765·7870··lace:.····regexp | |||
| 0003a8f0:·3a20·285e·283f·2123·292e·2a5b·5c73·5d2b··:·(^(?!#).*[\s]+ | |||
| 0003a900:·5c21·6175·7468·656e·7469·6361·7465·2e2a··\!authenticate.* | |||
| 0003a910:·2429·0a20·2020·2072·6570·6c61·6365·3a20··$).····replace:· | |||
| 0003a920:·2723·205c·6726·6c74·3b31·2667·743b·270a··'#·\g<1>'. | |||
| Max diff block lines reached; 235484/254582 bytes (92.50%) of diff not shown. | |||
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | *****·Profile·Information·***** | 36 | *****·Profile·Information·***** |
| 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level | 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level |
| 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal | 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal |
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ | 40 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ |
| 41 | *****·Revision·History·***** | 41 | *****·Revision·History·***** |
| 42 | Current·version:·0.1.65 | 42 | Current·version:·0.1.65 |
| 43 | ····*·draft·(as·of·202 | 43 | ····*·draft·(as·of·2025-02-23) |
| 44 | *****·Table·of·Contents·***** | 44 | *****·Table·of·Contents·***** |
| 45 | ···1.·System_Settings | 45 | ···1.·System_Settings |
| 46 | ·········1.·Installing_and_Maintaining_Software | 46 | ·········1.·Installing_and_Maintaining_Software |
| 47 | ·········2.·File_Permissions_and_Masks | 47 | ·········2.·File_Permissions_and_Masks |
| 48 | ···2.·Services | 48 | ···2.·Services |
| 49 | ·········1.·APT_service_configuration | 49 | ·········1.·APT_service_configuration |
| 50 | ·········2.·Deprecated_services | 50 | ·········2.·Deprecated_services |
| Offset 80, 14 lines modified | Offset 80, 33 lines modified | ||
| 80 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 80 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 81 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 81 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 82 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 82 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 83 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 83 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 84 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 84 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 85 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 85 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 86 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 86 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 87 | Remediation_Shell_script_⇲ | ||
| 88 | Complexity:·low | ||
| 89 | Disruption:·low | ||
| 90 | Strategy:···restrict | ||
| 91 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 92 | ··if·[·!·-e·"$f"·]·;·then | ||
| 93 | ····continue | ||
| 94 | ··fi | ||
| 95 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 96 | ··if·!·test·-z·"$matching_list";·then | ||
| 97 | ····while·IFS=·read·-r·entry;·do | ||
| 98 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 99 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 100 | ····done·<<<·"$matching_list" | ||
| 101 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 102 | ··fi | ||
| 103 | done | ||
| 87 | Remediation_Ansible_snippet_⇲ | 104 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·low | 105 | Complexity:·low |
| 89 | Disruption:·low | 106 | Disruption:·low |
| 90 | Strategy:···restrict | 107 | Strategy:···restrict |
| 91 | -·name:·Find·/etc/sudoers.d/·files | 108 | -·name:·Find·/etc/sudoers.d/·files |
| 92 | ··find: | 109 | ··find: |
| 93 | ····paths: | 110 | ····paths: |
| Offset 117, 33 lines modified | Offset 136, 14 lines modified | ||
| 117 | ··-·NIST-800-53-IA-11 | 136 | ··-·NIST-800-53-IA-11 |
| 118 | ··-·low_complexity | 137 | ··-·low_complexity |
| 119 | ··-·low_disruption | 138 | ··-·low_disruption |
| 120 | ··-·medium_severity | 139 | ··-·medium_severity |
| 121 | ··-·no_reboot_needed | 140 | ··-·no_reboot_needed |
| 122 | ··-·restrict_strategy | 141 | ··-·restrict_strategy |
| 123 | ··-·sudo_remove_no_authenticate | 142 | ··-·sudo_remove_no_authenticate |
| 124 | Remediation_Shell_script_⇲ | ||
| 125 | Complexity:·low | ||
| 126 | Disruption:·low | ||
| 127 | Strategy:···restrict | ||
| 128 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 129 | ··if·[·!·-e·"$f"·]·;·then | ||
| 130 | ····continue | ||
| 131 | ··fi | ||
| 132 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 133 | ··if·!·test·-z·"$matching_list";·then | ||
| 134 | ····while·IFS=·read·-r·entry;·do | ||
| 135 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 136 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 137 | ····done·<<<·"$matching_list" | ||
| 138 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 139 | ··fi | ||
| 140 | done | ||
| 141 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 143 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 142 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 144 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 143 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 145 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 144 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 146 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 145 | sudoers.d/. | 147 | sudoers.d/. |
| 146 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 148 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 147 | ············they·do·not·have·authorization. | 149 | ············they·do·not·have·authorization. |
| Offset 155, 14 lines modified | Offset 155, 33 lines modified | ||
| 155 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 155 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 156 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 156 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 157 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 157 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 158 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 158 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 159 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 159 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 160 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 160 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 161 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 161 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 162 | Remediation_Shell_script_⇲ | ||
| 163 | Complexity:·low | ||
| 164 | Disruption:·low | ||
| 165 | Strategy:···restrict | ||
| 166 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 167 | ··if·[·!·-e·"$f"·]·;·then | ||
| 168 | ····continue | ||
| 169 | ··fi | ||
| 170 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 171 | ··if·!·test·-z·"$matching_list";·then | ||
| 172 | ····while·IFS=·read·-r·entry;·do | ||
| 173 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 174 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 175 | ····done·<<<·"$matching_list" | ||
| 176 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 177 | ··fi | ||
| 178 | done | ||
| 162 | Remediation_Ansible_snippet_⇲ | 179 | Remediation_Ansible_snippet_⇲ |
| 163 | Complexity:·low | 180 | Complexity:·low |
| 164 | Disruption:·low | 181 | Disruption:·low |
| 165 | Strategy:···restrict | 182 | Strategy:···restrict |
| 166 | -·name:·Find·/etc/sudoers.d/·files | 183 | -·name:·Find·/etc/sudoers.d/·files |
| 167 | ··find: | 184 | ··find: |
| 168 | ····paths: | 185 | ····paths: |
| Offset 192, 33 lines modified | Offset 211, 14 lines modified | ||
| 192 | ··-·NIST-800-53-IA-11 | 211 | ··-·NIST-800-53-IA-11 |
| 193 | ··-·low_complexity | 212 | ··-·low_complexity |
| 194 | ··-·low_disruption | 213 | ··-·low_disruption |
| 195 | ··-·medium_severity | 214 | ··-·medium_severity |
| 196 | ··-·no_reboot_needed | 215 | ··-·no_reboot_needed |
| 197 | ··-·restrict_strategy | 216 | ··-·restrict_strategy |
| 198 | ··-·sudo_remove_nopasswd | 217 | ··-·sudo_remove_nopasswd |
| 199 | Remediation_Shell_script_⇲ | ||
| 200 | Complexity:·low | ||
| Max diff block lines reached; 26468/31883 bytes (83.02%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037cc0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037cd0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037cd0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037ce0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037ce0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037cf0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037cf0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037d00:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037d00:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037d10:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037d10:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037d20:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037d20:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037d30:·3032·3 | 00037d30:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037d40:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037d40:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037d50:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037d50:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037d60:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037d60:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037d70:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037d70:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037d80:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037d80:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037d90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037d90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037da0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037da0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 16738, 139 lines modified | Offset 16738, 139 lines modified | ||
| 00041610:·2d74·6172·6765·743d·2223·6964·6d32·3536··-target="#idm256 | 00041610:·2d74·6172·6765·743d·2223·6964·6d32·3536··-target="#idm256 | ||
| 00041620:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | 00041620:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | ||
| 00041630:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 00041630:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 00041640:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 00041640:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 00041650:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 00041650:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 00041660:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 00041660:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 00041670:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 00041670:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 00041680:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 00041690:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 000416a0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 000416b0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 000416c0:·7073·6522·2069·643d·2269·646d·3235·3637··pse"·id="idm2567 | |||
| 000416d0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 000416e0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 000416f0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 00041700:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 00041710:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 00041 | 00041680:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 00041690:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 000416a0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 000416b0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 000416c0:·2220·6964·3d22·6964·6d32·3536·3722·3e3c··"·id="idm2567">< | |||
| 000416d0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 000416e0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 000416f0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 00041700:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 00041710:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 00041720:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 00041730:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 00041740:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 00041750:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 00041760:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 00041770:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 000417 | 00041780:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | ||
| 00041790:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 000417a0:·653e·0a66·6f72·2066·2069·6e20·2f65·7463··e>.for·f·in·/etc | |||
| 000417b0:·2f73·7564·6f65·7273·202f·6574·632f·7375··/sudoers·/etc/su | |||
| 000417c0:·646f·6572·732e·642f·2a20·3b20·646f·0a20··doers.d/*·;·do.· | |||
| 000417d0:·2069·6620·5b20·2120·2d65·2022·2466·2220···if·[·!·-e·"$f"· | |||
| 000417e0:·5d20·3b20·7468·656e·0a20·2020·2063·6f6e··]·;·then.····con | |||
| 000417f0:·7469·6e75·650a·2020·6669·0a20·206d·6174··tinue.··fi.··mat | |||
| 00041800:·6368·696e·675f·6c69·7374·3d24·2867·7265··ching_list=$(gre | |||
| 00041810:·7020·2d50·2027·5e28·3f21·2329·2e2a·5b5c··p·-P·'^(?!#).*[\ | |||
| 00041740:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 00041750:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 00041760:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 00041770:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 00041780:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 00041790:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 000417a0:·636f·6465·3e2d·206e·616d·653a·2046·696e··code>-·name:·Fin | |||
| 000417b0:·6420·2f65·7463·2f73·7564·6f65·7273·2e64··d·/etc/sudoers.d | |||
| 000417c0:·2f20·6669·6c65·730a·2020·6669·6e64·3a0a··/·files.··find:. | |||
| 000417d0:·2020·2020·7061·7468·733a·0a20·2020·202d······paths:.····- | |||
| 000417e0:·202f·6574·632f·7375·646f·6572·732e·642f···/etc/sudoers.d/ | |||
| 000417f0:·0a20·2072·6567·6973·7465·723a·2073·7564··.··register:·sud | |||
| 00041800:·6f65·7273·0a20·2074·6167·733a·0a20·202d··oers.··tags:.··- | |||
| 00041810:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 00041820:·3628·6129·0a20·202d·204e·4953·542d·3830··6(a).··-·NIST-80 | |||
| 00041830:·302d·3533·2d49·412d·3131·0a20·202d·206c··0-53-IA-11.··-·l | |||
| 00041840:·6f77·5f63·6f6d·706c·6578·6974·790a·2020··ow_complexity.·· | |||
| 00041850:·2d20·6c6f·775f·6469·7372·7570·7469·6f6e··-·low_disruption | |||
| 00041860:·0a20·202d·206d·6564·6975·6d5f·7365·7665··.··-·medium_seve | |||
| 00041870:·7269·7479·0a20·202d·206e·6f5f·7265·626f··rity.··-·no_rebo | |||
| 00041880:·6f74·5f6e·6565·6465·640a·2020·2d20·7265··ot_needed.··-·re | |||
| 00041890:·7374·7269·6374·5f73·7472·6174·6567·790a··strict_strategy. | |||
| 000418a0:·2020·2d20·7375·646f·5f72·656d·6f76·655f····-·sudo_remove_ | |||
| 000418b0:·6e6f·5f61·7574·6865·6e74·6963·6174·650a··no_authenticate. | |||
| 000418c0:·0a2d·206e·616d·653a·2052·656d·6f76·6520··.-·name:·Remove· | |||
| 000418d0:·6c69·6e65·7320·636f·6e74·6169·6e69·6e67··lines·containing | |||
| 000418e0:·2021·6175·7468·656e·7469·6361·7465·2066···!authenticate·f | |||
| 000418f0:·726f·6d20·7375·646f·6572·7320·6669·6c65··rom·sudoers·file | |||
| 00041900:·730a·2020·7265·706c·6163·653a·0a20·2020··s.··replace:.··· | |||
| 00041910:·2072·6567·6578·703a·2028·5e28·3f21·2329···regexp:·(^(?!#) | |||
| 00041 | 00041820:·735d·2b5c·2161·7574·6865·6e74·6963·6174··s]+\!authenticat | ||
| 00041830:·652e·2a24·2720·2466·207c·2075·6e69·7120··e.*$'·$f·|·uniq· | |||
| 00041840:·290a·2020·6966·2021·2074·6573·7420·2d7a··).··if·!·test·-z | |||
| 00041850:·2022·246d·6174·6368·696e·675f·6c69·7374···"$matching_list | |||
| 00041860:·223b·2074·6865·6e0a·2020·2020·7768·696c··";·then.····whil | |||
| 00041870:·6520·4946·533d·2072·6561·6420·2d72·2065··e·IFS=·read·-r·e | |||
| 00041880:·6e74·7279·3b20·646f·0a20·2020·2020·2023··ntry;·do.······# | |||
| 00041890:·2063·6f6d·6d65·6e74·206f·7574·2022·2161···comment·out·"!a | |||
| 000418a0:·7574·6865·6e74·6963·6174·6522·206d·6174··uthenticate"·mat | |||
| 000418b0:·6368·6573·2074·6f20·7072·6573·6572·7665··ches·to·preserve | |||
| 000418c0:·2075·7365·7220·6461·7461·0a20·2020·2020···user·data.····· | |||
| 000418d0:·2073·6564·202d·6920·2273·2f5e·247b·656e···sed·-i·"s/^${en | |||
| 000418e0:·7472·797d·242f·2320·2661·6d70·3b2f·6722··try}$/#·&/g" | |||
| 000418f0:·2024·660a·2020·2020·646f·6e65·2026·6c74···$f.····done·< | |||
| 00041900:·3b26·6c74·3b26·6c74·3b20·2224·6d61·7463··;<<·"$matc | |||
| 00041910:·6869·6e67·5f6c·6973·7422·0a0a·2020·2020··hing_list"..···· | |||
| 00041920:·2f75·7372·2f73·6269·6e2f·7669·7375·646f··/usr/sbin/visudo | |||
| 00041930:·202d·6366·2024·6620·2661·6d70·3b26·6774···-cf·$f·&> | |||
| 00041940:·3b20·2f64·6576·2f6e·756c·6c20·7c7c·2065··;·/dev/null·||·e | |||
| 00041950:·6368·6f20·2246·6169·6c20·746f·2076·616c··cho·"Fail·to·val | |||
| 00041960:·6964·6174·6520·2466·2077·6974·6820·7669··idate·$f·with·vi | |||
| 00041970:·7375·646f·220a·2020·6669·0a64·6f6e·650a··sudo".··fi.done. | |||
| 00041980:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 00041990:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 000419a0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 000419b0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 000419c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 000419d0:·3d22·2369·646d·3235·3638·2220·7461·6269··="#idm2568"·tabi | |||
| 000419e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 000419f0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 00041a00:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 00041a10:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 00041a20:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 00041a30:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 00041a40:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 00041930:·6963·6174·652e·2a24·290a·2020·2020·7265··icate.*$).····re | |||
| 00041940:·706c·6163·653a·2027·2320·5c67·266c·743b··place:·'#·\g< | |||
| 00041950:·3126·6774·3b27·0a20·2020·2070·6174·683a··1>'.····path: | |||
| Max diff block lines reached; 636792/655752 bytes (97.11%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·System_Accounting_with_auditd | 48 | ·········2.·System_Accounting_with_auditd |
| 49 | ·········3.·Configure_Syslog | 49 | ·········3.·Configure_Syslog |
| 50 | ·········4.·File_Permissions_and_Masks | 50 | ·········4.·File_Permissions_and_Masks |
| 51 | ···2.·Services | 51 | ···2.·Services |
| Offset 169, 14 lines modified | Offset 169, 33 lines modified | ||
| 169 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 169 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 170 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 170 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 171 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 171 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 172 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 172 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 173 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 173 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 174 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 174 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 175 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 175 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 176 | Remediation_Shell_script_⇲ | ||
| 177 | Complexity:·low | ||
| 178 | Disruption:·low | ||
| 179 | Strategy:···restrict | ||
| 180 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 181 | ··if·[·!·-e·"$f"·]·;·then | ||
| 182 | ····continue | ||
| 183 | ··fi | ||
| 184 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 185 | ··if·!·test·-z·"$matching_list";·then | ||
| 186 | ····while·IFS=·read·-r·entry;·do | ||
| 187 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 188 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 189 | ····done·<<<·"$matching_list" | ||
| 190 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 191 | ··fi | ||
| 192 | done | ||
| 176 | Remediation_Ansible_snippet_⇲ | 193 | Remediation_Ansible_snippet_⇲ |
| 177 | Complexity:·low | 194 | Complexity:·low |
| 178 | Disruption:·low | 195 | Disruption:·low |
| 179 | Strategy:···restrict | 196 | Strategy:···restrict |
| 180 | -·name:·Find·/etc/sudoers.d/·files | 197 | -·name:·Find·/etc/sudoers.d/·files |
| 181 | ··find: | 198 | ··find: |
| 182 | ····paths: | 199 | ····paths: |
| Offset 206, 33 lines modified | Offset 225, 14 lines modified | ||
| 206 | ··-·NIST-800-53-IA-11 | 225 | ··-·NIST-800-53-IA-11 |
| 207 | ··-·low_complexity | 226 | ··-·low_complexity |
| 208 | ··-·low_disruption | 227 | ··-·low_disruption |
| 209 | ··-·medium_severity | 228 | ··-·medium_severity |
| 210 | ··-·no_reboot_needed | 229 | ··-·no_reboot_needed |
| 211 | ··-·restrict_strategy | 230 | ··-·restrict_strategy |
| 212 | ··-·sudo_remove_no_authenticate | 231 | ··-·sudo_remove_no_authenticate |
| 213 | Remediation_Shell_script_⇲ | ||
| 214 | Complexity:·low | ||
| 215 | Disruption:·low | ||
| 216 | Strategy:···restrict | ||
| 217 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 218 | ··if·[·!·-e·"$f"·]·;·then | ||
| 219 | ····continue | ||
| 220 | ··fi | ||
| 221 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 222 | ··if·!·test·-z·"$matching_list";·then | ||
| 223 | ····while·IFS=·read·-r·entry;·do | ||
| 224 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 225 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 226 | ····done·<<<·"$matching_list" | ||
| 227 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 228 | ··fi | ||
| 229 | done | ||
| 230 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 232 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 231 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 233 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 232 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 234 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 233 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 235 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 234 | sudoers.d/. | 236 | sudoers.d/. |
| 235 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 237 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 236 | ············they·do·not·have·authorization. | 238 | ············they·do·not·have·authorization. |
| Offset 244, 14 lines modified | Offset 244, 33 lines modified | ||
| 244 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 244 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 245 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 245 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 246 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 246 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 247 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 247 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 248 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 248 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 249 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 249 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 250 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 250 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | Complexity:·low | ||
| 253 | Disruption:·low | ||
| 254 | Strategy:···restrict | ||
| 255 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 256 | ··if·[·!·-e·"$f"·]·;·then | ||
| 257 | ····continue | ||
| 258 | ··fi | ||
| 259 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 260 | ··if·!·test·-z·"$matching_list";·then | ||
| 261 | ····while·IFS=·read·-r·entry;·do | ||
| 262 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 263 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 264 | ····done·<<<·"$matching_list" | ||
| 265 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 266 | ··fi | ||
| 267 | done | ||
| 251 | Remediation_Ansible_snippet_⇲ | 268 | Remediation_Ansible_snippet_⇲ |
| 252 | Complexity:·low | 269 | Complexity:·low |
| 253 | Disruption:·low | 270 | Disruption:·low |
| 254 | Strategy:···restrict | 271 | Strategy:···restrict |
| 255 | -·name:·Find·/etc/sudoers.d/·files | 272 | -·name:·Find·/etc/sudoers.d/·files |
| 256 | ··find: | 273 | ··find: |
| 257 | ····paths: | 274 | ····paths: |
| Offset 281, 33 lines modified | Offset 300, 14 lines modified | ||
| 281 | ··-·NIST-800-53-IA-11 | 300 | ··-·NIST-800-53-IA-11 |
| 282 | ··-·low_complexity | 301 | ··-·low_complexity |
| 283 | ··-·low_disruption | 302 | ··-·low_disruption |
| 284 | ··-·medium_severity | 303 | ··-·medium_severity |
| 285 | ··-·no_reboot_needed | 304 | ··-·no_reboot_needed |
| 286 | ··-·restrict_strategy | 305 | ··-·restrict_strategy |
| 287 | ··-·sudo_remove_nopasswd | 306 | ··-·sudo_remove_nopasswd |
| 288 | Remediation_Shell_script_⇲ | ||
| 289 | Complexity:·low | ||
| Max diff block lines reached; 84139/89554 bytes (93.95%) of diff not shown. | |||
| Offset 14287, 16 lines modified | Offset 14287, 16 lines modified | ||
| 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·2020·2020·2028·6173·206f·6620·3230·323 | 00037d50:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00037d60:·2d30·3 | 00037d60:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 17203, 131 lines modified | Offset 17203, 131 lines modified | ||
| 00043320:·2d74·6172·6765·743d·2223·6964·6d35·3134··-target="#idm514 | 00043320:·2d74·6172·6765·743d·2223·6964·6d35·3134··-target="#idm514 | ||
| 00043330:·3422·2074·6162·696e·6465·783d·2230·2220··4"·tabindex="0"· | 00043330:·3422·2074·6162·696e·6465·783d·2230·2220··4"·tabindex="0"· | ||
| 00043340:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 00043340:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 00043350:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 00043350:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 00043360:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 00043360:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 00043370:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 00043370:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 00043380:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 00043380:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 00043390:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 000433a0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 000433b0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 000433c0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 000433d0:·7073·6522·2069·643d·2269·646d·3531·3434··pse"·id="idm5144 | |||
| 000433e0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 000433f0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 00043400:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 00043410:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 00043420:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 00043 | 00043390:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 000433a0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 000433b0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 000433c0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 000433d0:·2220·6964·3d22·6964·6d35·3134·3422·3e3c··"·id="idm5144">< | |||
| 000433e0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 000433f0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 00043400:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 00043410:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 00043420:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 00043430:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 00043440:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 00043450:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 00043460:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 00043470:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 00043480:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 000434 | 00043490:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | ||
| 00043450:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 00043460:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 00043470:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 00043480:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 00043490:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 000434a0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 000434b0:·6465·3e2d·206e·616d·653a·2045·6e73·7572··de>-·name:·Ensur | |||
| 000434c0:·6520·6175·6469·7464·2069·7320·696e·7374··e·auditd·is·inst | |||
| 000434d0:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 000434e0:·0a20·2020·206e·616d·653a·2061·7564·6974··.····name:·audit | |||
| 000434f0:·640a·2020·2020·7374·6174·653a·2070·7265··d.····state:·pre | |||
| 00043500:·7365·6e74·0a20·2077·6865·6e3a·2061·6e73··sent.··when:·ans | |||
| 00043510:·6962·6c65·5f76·6972·7475·616c·697a·6174··ible_virtualizat | |||
| 00043520:·696f·6e5f·7479·7065·206e·6f74·2069·6e20··ion_type·not·in· | |||
| 00043530:·5b22·646f·636b·6572·222c·2022·6c78·6322··["docker",·"lxc" | |||
| 00043540:·2c20·226f·7065·6e76·7a22·2c20·2270·6f64··,·"openvz",·"pod | |||
| 00043550:·6d61·6e22·2c20·2263·6f6e·7461·696e·6572··man",·"container | |||
| 00043560:·225d·0a20·2074·6167·733a·0a20·202d·204e··"].··tags:.··-·N | |||
| 00043570:·4953·542d·3830·302d·3533·2d41·432d·3728··IST-800-53-AC-7( | |||
| 00043580:·6129·0a20·202d·204e·4953·542d·3830·302d··a).··-·NIST-800- | |||
| 00043590:·3533·2d41·552d·3132·2832·290a·2020·2d20··53-AU-12(2).··-· | |||
| 000435a0:·4e49·5354·2d38·3030·2d35·332d·4155·2d31··NIST-800-53-AU-1 | |||
| 000435b0:·340a·2020·2d20·4e49·5354·2d38·3030·2d35··4.··-·NIST-800-5 | |||
| 00043 | 000434a0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | ||
| 000434b0:·2320·5265·6d65·6469·6174·696f·6e20·6973··#·Remediation·is | |||
| 000434c0:·2061·7070·6c69·6361·626c·6520·6f6e·6c79···applicable·only | |||
| 000434d0:·2069·6e20·6365·7274·6169·6e20·706c·6174···in·certain·plat | |||
| 000434e0:·666f·726d·730a·6966·205b·2021·202d·6620··forms.if·[·!·-f· | |||
| 000434f0:·2f2e·646f·636b·6572·656e·7620·5d20·2661··/.dockerenv·]·&a | |||
| 00043500:·6d70·3b26·616d·703b·205b·2021·202d·6620··mp;&·[·!·-f· | |||
| 00043510:·2f72·756e·2f2e·636f·6e74·6169·6e65·7265··/run/.containere | |||
| 00043520:·6e76·205d·3b20·7468·656e·0a0a·4445·4249··nv·];·then..DEBI | |||
| 00043530:·414e·5f46·524f·4e54·454e·443d·6e6f·6e69··AN_FRONTEND=noni | |||
| 00043540:·6e74·6572·6163·7469·7665·2061·7074·2d67··nteractive·apt-g | |||
| 00043550:·6574·2069·6e73·7461·6c6c·202d·7920·2261··et·install·-y·"a | |||
| 00043560:·7564·6974·6422·0a0a·656c·7365·0a20·2020··uditd"..else.··· | |||
| 00043570:·2026·6774·3b26·616d·703b·3220·6563·686f···>&2·echo | |||
| 00043580:·2027·5265·6d65·6469·6174·696f·6e20·6973···'Remediation·is | |||
| 00043590:·206e·6f74·2061·7070·6c69·6361·626c·652c···not·applicable, | |||
| 000435a0:·206e·6f74·6869·6e67·2077·6173·2064·6f6e···nothing·was·don | |||
| 000435b0:·6527·0a66·690a·3c2f·636f·6465·3e3c·2f70··e'.fi.</code></p | |||
| 000435c0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 000435d0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 000435e0:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 000435f0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 00043600:·7461·7267·6574·3d22·2369·646d·3531·3435··target="#idm5145 | |||
| 00043610:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 00043620:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 00043630:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 00043640:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 00043650:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 00043660:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 00043670:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 00043680:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 00043690:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 000436a0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 000436b0:·7365·2220·6964·3d22·6964·6d35·3134·3522··se"·id="idm5145" | |||
| 000436c0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 000436d0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 000436e0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 000436f0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 00043700:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 00043710:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 00043720:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 00043730:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 00043740:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 00043750:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 00043760:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 00043770:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 00043780:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 00043790:·653e·2d20·6e61·6d65·3a20·456e·7375·7265··e>-·name:·Ensure | |||
| 000437a0:·2061·7564·6974·6420·6973·2069·6e73·7461···auditd·is·insta | |||
| 000437b0:·6c6c·6564·0a20·2070·6163·6b61·6765·3a0a··lled.··package:. | |||
| 000437c0:·2020·2020·6e61·6d65·3a20·6175·6469·7464······name:·auditd | |||
| 000437d0:·0a20·2020·2073·7461·7465·3a20·7072·6573··.····state:·pres | |||
| 000437e0:·656e·740a·2020·7768·656e·3a20·616e·7369··ent.··when:·ansi | |||
| Max diff block lines reached; 654622/672616 bytes (97.32%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·16.04 | 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·16.04 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ | 42 | ····*·cpe:/o:canonical:ubuntu_linux:16.04::~~lts~~~ |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·Configure_Syslog | 50 | ·········3.·Configure_Syslog |
| 51 | ·········4.·File_Permissions_and_Masks | 51 | ·········4.·File_Permissions_and_Masks |
| 52 | ···2.·Services | 52 | ···2.·Services |
| Offset 245, 14 lines modified | Offset 245, 26 lines modified | ||
| 245 | include·install_auditd | 245 | include·install_auditd |
| 246 | class·install_auditd·{ | 246 | class·install_auditd·{ |
| 247 | ··package·{·'auditd': | 247 | ··package·{·'auditd': |
| 248 | ····ensure·=>·'installed', | 248 | ····ensure·=>·'installed', |
| 249 | ··} | 249 | ··} |
| 250 | } | 250 | } |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | Complexity:·low | ||
| 253 | Disruption:·low | ||
| 254 | Strategy:···enable | ||
| 255 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 256 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 257 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"auditd" | ||
| 258 | else | ||
| 259 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 260 | fi | ||
| 251 | Remediation_Ansible_snippet_⇲ | 261 | Remediation_Ansible_snippet_⇲ |
| 252 | Complexity:·low | 262 | Complexity:·low |
| 253 | Disruption:·low | 263 | Disruption:·low |
| 254 | Strategy:···enable | 264 | Strategy:···enable |
| 255 | -·name:·Ensure·auditd·is·installed | 265 | -·name:·Ensure·auditd·is·installed |
| 256 | ··package: | 266 | ··package: |
| 257 | ····name:·auditd | 267 | ····name:·auditd |
| Offset 274, 26 lines modified | Offset 286, 14 lines modified | ||
| 274 | ··-·no_reboot_needed | 286 | ··-·no_reboot_needed |
| 275 | ··-·package_audit_installed | 287 | ··-·package_audit_installed |
| 276 | Remediation_OSBuild_Blueprint_snippet_⇲ | 288 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 277 | [[packages]] | 289 | [[packages]] |
| 278 | name·=·"auditd" | 290 | name·=·"auditd" |
| 279 | version·=·"*" | 291 | version·=·"*" |
| 280 | Remediation_Shell_script_⇲ | ||
| 281 | Complexity:·low | ||
| 282 | Disruption:·low | ||
| 283 | Strategy:···enable | ||
| 284 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 285 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 286 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"auditd" | ||
| 287 | else | ||
| 288 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 289 | fi | ||
| 290 | ***·Rule ·Enable·auditd·Service· [ref]·*** | 292 | ***·Rule ·Enable·auditd·Service· [ref]·*** |
| 291 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is | 293 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is |
| 292 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following | 294 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following |
| 293 | command: | 295 | command: |
| 294 | $·sudo·systemctl·enable·auditd.service | 296 | $·sudo·systemctl·enable·auditd.service |
| 295 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, | 297 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, |
| 296 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the | 298 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the |
| Offset 340, 14 lines modified | Offset 340, 30 lines modified | ||
| 340 | class·enable_auditd·{ | 340 | class·enable_auditd·{ |
| 341 | ··service·{'auditd': | 341 | ··service·{'auditd': |
| 342 | ····enable·=>·true, | 342 | ····enable·=>·true, |
| 343 | ····ensure·=>·'running', | 343 | ····ensure·=>·'running', |
| 344 | ··} | 344 | ··} |
| 345 | } | 345 | } |
| 346 | Remediation_Shell_script_⇲ | ||
| 347 | Complexity:·low | ||
| 348 | Disruption:·low | ||
| 349 | Strategy:···enable | ||
| 350 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 351 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 352 | Status-Status}\n'·'audit'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 353 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 354 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 355 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 356 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 357 | else | ||
| 358 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 359 | fi | ||
| 346 | Remediation_Ansible_snippet_⇲ | 360 | Remediation_Ansible_snippet_⇲ |
| 347 | Complexity:·low | 361 | Complexity:·low |
| 348 | Disruption:·low | 362 | Disruption:·low |
| 349 | Strategy:···enable | 363 | Strategy:···enable |
| 350 | -·name:·Gather·the·package·facts | 364 | -·name:·Gather·the·package·facts |
| 351 | ··package_facts: | 365 | ··package_facts: |
| 352 | ····manager:·auto | 366 | ····manager:·auto |
| Offset 412, 30 lines modified | Offset 428, 14 lines modified | ||
| 412 | ··-·medium_severity | 428 | ··-·medium_severity |
| 413 | ··-·no_reboot_needed | 429 | ··-·no_reboot_needed |
| 414 | ··-·service_auditd_enabled | 430 | ··-·service_auditd_enabled |
| 415 | Remediation_OSBuild_Blueprint_snippet_⇲ | 431 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 416 | [customizations.services] | 432 | [customizations.services] |
| 417 | enabled·=·["auditd"] | 433 | enabled·=·["auditd"] |
| 418 | Remediation_Shell_script_⇲ | ||
| 419 | Complexity:·low | ||
| 420 | Disruption:·low | ||
| 421 | Strategy:···enable | ||
| 422 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 423 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 424 | Status-Status}\n'·'audit'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 425 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 426 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 427 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 428 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 429 | else | ||
| 430 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 431 | fi | ||
| 432 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules | 434 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules |
| 433 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It | 435 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It |
| 434 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for | 436 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for |
| Max diff block lines reached; 85297/89402 bytes (95.41%) of diff not shown. | |||
| Offset 14286, 16 lines modified | Offset 14286, 16 lines modified | ||
| 00037cd0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037cd0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037ce0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037ce0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037cf0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037cf0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037d00:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037d00:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037d10:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037d10:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037d20:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037d20:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037d30:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d30:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d40:·2861·7320·6f66·2032·3032·3 | 00037d40:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037d50:·3 | 00037d50:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037d60:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037d60:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037d70:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037d70:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037d80:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037d80:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037d90:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037d90:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037da0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037da0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037db0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037db0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037dc0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037dc0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 16750, 140 lines modified | Offset 16750, 140 lines modified | ||
| 000416d0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 000416d0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 000416e0:·2223·6964·6d32·3930·3422·2074·6162·696e··"#idm2904"·tabin | 000416e0:·2223·6964·6d32·3930·3422·2074·6162·696e··"#idm2904"·tabin | ||
| 000416f0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 000416f0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 00041700:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 00041700:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 00041710:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 00041710:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 00041720:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 00041720:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 00041730:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 00041730:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 00041740:·3e52·656d·6564·6961·7469·6f6e·20 | 00041740:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 00041750:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 00041760:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 000417 | 00041750:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | ||
| 00041760:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 00041770:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 00041780:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 00041790:·6d32·3930·3422·3e3c·7461·626c·6520·636c··m2904"><table·cl | |||
| 000417a0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 000417b0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 000417c0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 000417d0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 000417e0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 000417f0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 00041800:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 00041810:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 00041820:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 00041830:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 00041840:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 00041850:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 00041860:·7072·653e·3c63·6f64·653e·0a66·6f72·2066··pre><code>.for·f | |||
| 00041870:·2069·6e20·2f65·7463·2f73·7564·6f65·7273···in·/etc/sudoers | |||
| 00041880:·202f·6574·632f·7375·646f·6572·732e·642f···/etc/sudoers.d/ | |||
| 00041890:·2a20·3b20·646f·0a20·2069·6620·5b20·2120··*·;·do.··if·[·!· | |||
| 000418a0:·2d65·2022·2466·2220·5d20·3b20·7468·656e··-e·"$f"·]·;·then | |||
| 000418b0:·0a20·2020·2063·6f6e·7469·6e75·650a·2020··.····continue.·· | |||
| 000418c0:·6669·0a20·206d·6174·6368·696e·675f·6c69··fi.··matching_li | |||
| 000418d0:·7374·3d24·2867·7265·7020·2d50·2027·5e28··st=$(grep·-P·'^( | |||
| 000418e0:·3f21·2329·2e2a·5b5c·735d·2b5c·2161·7574··?!#).*[\s]+\!aut | |||
| 000418f0:·6865·6e74·6963·6174·652e·2a24·2720·2466··henticate.*$'·$f | |||
| 00041900:·207c·2075·6e69·7120·290a·2020·6966·2021···|·uniq·).··if·! | |||
| 00041910:·2074·6573·7420·2d7a·2022·246d·6174·6368···test·-z·"$match | |||
| 00041920:·696e·675f·6c69·7374·223b·2074·6865·6e0a··ing_list";·then. | |||
| 00041930:·2020·2020·7768·696c·6520·4946·533d·2072······while·IFS=·r | |||
| 00041940:·6561·6420·2d72·2065·6e74·7279·3b20·646f··ead·-r·entry;·do | |||
| 00041950:·0a20·2020·2020·2023·2063·6f6d·6d65·6e74··.······#·comment | |||
| 00041960:·206f·7574·2022·2161·7574·6865·6e74·6963···out·"!authentic | |||
| 00041970:·6174·6522·206d·6174·6368·6573·2074·6f20··ate"·matches·to· | |||
| 00041980:·7072·6573·6572·7665·2075·7365·7220·6461··preserve·user·da | |||
| 00041990:·7461·0a20·2020·2020·2073·6564·202d·6920··ta.······sed·-i· | |||
| 000419a0:·2273·2f5e·247b·656e·7472·797d·242f·2320··"s/^${entry}$/#· | |||
| 000419b0:·2661·6d70·3b2f·6722·2024·660a·2020·2020··&/g"·$f.···· | |||
| 000419c0:·646f·6e65·2026·6c74·3b26·6c74·3b26·6c74··done·<<< | |||
| 000419d0:·3b20·2224·6d61·7463·6869·6e67·5f6c·6973··;·"$matching_lis | |||
| 000419e0:·7422·0a0a·2020·2020·2f75·7372·2f73·6269··t"..····/usr/sbi | |||
| 000419f0:·6e2f·7669·7375·646f·202d·6366·2024·6620··n/visudo·-cf·$f· | |||
| 00041a00:·2661·6d70·3b26·6774·3b20·2f64·6576·2f6e··&>·/dev/n | |||
| 00041a10:·756c·6c20·7c7c·2065·6368·6f20·2246·6169··ull·||·echo·"Fai | |||
| 00041a20:·6c20·746f·2076·616c·6964·6174·6520·2466··l·to·validate·$f | |||
| 00041a30:·2077·6974·6820·7669·7375·646f·220a·2020···with·visudo".·· | |||
| 00041a40:·6669·0a64·6f6e·650a·3c2f·636f·6465·3e3c··fi.done.</code>< | |||
| 00041a50:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 00041a60:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 00041a70:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 00041 | 00041a80:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | ||
| 00041a90:·612d·7461·7267·6574·3d22·2369·646d·3239··a-target="#idm29 | |||
| 00041aa0:·3035·2220·7461·6269·6e64·6578·3d22·3022··05"·tabindex="0" | |||
| 00041ab0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 00041ac0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 00041ad0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 00041ae0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 00041af0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 00041b00:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 00041790:·2269·646d·3239·3034·223e·3c74·6162·6c65··"idm2904"><table | |||
| 000417a0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 000417b0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 000417c0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 000417d0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 000417e0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 000417f0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 00041800:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 00041810:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 00041820:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 00041830:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 00041840:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 00041850:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 00041860:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 00041870:·616d·653a·2046·696e·6420·2f65·7463·2f73··ame:·Find·/etc/s | |||
| 00041880:·7564·6f65·7273·2e64·2f20·6669·6c65·730a··udoers.d/·files. | |||
| 00041890:·2020·6669·6e64·3a0a·2020·2020·7061·7468····find:.····path | |||
| 000418a0:·733a·0a20·2020·202d·202f·6574·632f·7375··s:.····-·/etc/su | |||
| 000418b0:·646f·6572·732e·642f·0a20·2072·6567·6973··doers.d/.··regis | |||
| 000418c0:·7465·723a·2073·7564·6f65·7273·0a20·2074··ter:·sudoers.··t | |||
| 000418d0:·6167·733a·0a20·202d·204e·4953·542d·3830··ags:.··-·NIST-80 | |||
| 000418e0:·302d·3533·2d43·4d2d·3628·6129·0a20·202d··0-53-CM-6(a).··- | |||
| 000418f0:·204e·4953·542d·3830·302d·3533·2d49·412d···NIST-800-53-IA- | |||
| 00041900:·3131·0a20·202d·206c·6f77·5f63·6f6d·706c··11.··-·low_compl | |||
| 00041910:·6578·6974·790a·2020·2d20·6c6f·775f·6469··exity.··-·low_di | |||
| 00041920:·7372·7570·7469·6f6e·0a20·202d·206d·6564··sruption.··-·med | |||
| 00041930:·6975·6d5f·7365·7665·7269·7479·0a20·202d··ium_severity.··- | |||
| 00041940:·206e·6f5f·7265·626f·6f74·5f6e·6565·6465···no_reboot_neede | |||
| 00041950:·640a·2020·2d20·7265·7374·7269·6374·5f73··d.··-·restrict_s | |||
| 00041960:·7472·6174·6567·790a·2020·2d20·7375·646f··trategy.··-·sudo | |||
| 00041970:·5f72·656d·6f76·655f·6e6f·5f61·7574·6865··_remove_no_authe | |||
| 00041980:·6e74·6963·6174·650a·0a2d·206e·616d·653a··nticate..-·name: | |||
| 00041990:·2052·656d·6f76·6520·6c69·6e65·7320·636f···Remove·lines·co | |||
| 000419a0:·6e74·6169·6e69·6e67·2021·6175·7468·656e··ntaining·!authen | |||
| 000419b0:·7469·6361·7465·2066·726f·6d20·7375·646f··ticate·from·sudo | |||
| 000419c0:·6572·7320·6669·6c65·730a·2020·7265·706c··ers·files.··repl | |||
| 000419d0:·6163·653a·0a20·2020·2072·6567·6578·703a··ace:.····regexp: | |||
| 000419e0:·2028·5e28·3f21·2329·2e2a·5b5c·735d·2b5c···(^(?!#).*[\s]+\ | |||
| 000419f0:·2161·7574·6865·6e74·6963·6174·652e·2a24··!authenticate.*$ | |||
| 00041a00:·290a·2020·2020·7265·706c·6163·653a·2027··).····replace:·' | |||
| Max diff block lines reached; 538810/558046 bytes (96.55%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Configure_Syslog | 48 | ·········2.·Configure_Syslog |
| 49 | ·········3.·File_Permissions_and_Masks | 49 | ·········3.·File_Permissions_and_Masks |
| 50 | ···2.·Services | 50 | ···2.·Services |
| 51 | ·········1.·APT_service_configuration | 51 | ·········1.·APT_service_configuration |
| Offset 168, 14 lines modified | Offset 168, 33 lines modified | ||
| 168 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 168 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 169 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 169 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 170 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 170 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 171 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 171 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 172 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 172 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 173 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 173 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 174 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 174 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 175 | Remediation_Shell_script_⇲ | ||
| 176 | Complexity:·low | ||
| 177 | Disruption:·low | ||
| 178 | Strategy:···restrict | ||
| 179 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 180 | ··if·[·!·-e·"$f"·]·;·then | ||
| 181 | ····continue | ||
| 182 | ··fi | ||
| 183 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 184 | ··if·!·test·-z·"$matching_list";·then | ||
| 185 | ····while·IFS=·read·-r·entry;·do | ||
| 186 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 187 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 188 | ····done·<<<·"$matching_list" | ||
| 189 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 190 | ··fi | ||
| 191 | done | ||
| 175 | Remediation_Ansible_snippet_⇲ | 192 | Remediation_Ansible_snippet_⇲ |
| 176 | Complexity:·low | 193 | Complexity:·low |
| 177 | Disruption:·low | 194 | Disruption:·low |
| 178 | Strategy:···restrict | 195 | Strategy:···restrict |
| 179 | -·name:·Find·/etc/sudoers.d/·files | 196 | -·name:·Find·/etc/sudoers.d/·files |
| 180 | ··find: | 197 | ··find: |
| 181 | ····paths: | 198 | ····paths: |
| Offset 205, 33 lines modified | Offset 224, 14 lines modified | ||
| 205 | ··-·NIST-800-53-IA-11 | 224 | ··-·NIST-800-53-IA-11 |
| 206 | ··-·low_complexity | 225 | ··-·low_complexity |
| 207 | ··-·low_disruption | 226 | ··-·low_disruption |
| 208 | ··-·medium_severity | 227 | ··-·medium_severity |
| 209 | ··-·no_reboot_needed | 228 | ··-·no_reboot_needed |
| 210 | ··-·restrict_strategy | 229 | ··-·restrict_strategy |
| 211 | ··-·sudo_remove_no_authenticate | 230 | ··-·sudo_remove_no_authenticate |
| 212 | Remediation_Shell_script_⇲ | ||
| 213 | Complexity:·low | ||
| 214 | Disruption:·low | ||
| 215 | Strategy:···restrict | ||
| 216 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 217 | ··if·[·!·-e·"$f"·]·;·then | ||
| 218 | ····continue | ||
| 219 | ··fi | ||
| 220 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 221 | ··if·!·test·-z·"$matching_list";·then | ||
| 222 | ····while·IFS=·read·-r·entry;·do | ||
| 223 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 224 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 225 | ····done·<<<·"$matching_list" | ||
| 226 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 227 | ··fi | ||
| 228 | done | ||
| 229 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 231 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 230 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 232 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 231 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 233 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 232 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 234 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 233 | sudoers.d/. | 235 | sudoers.d/. |
| 234 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 236 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 235 | ············they·do·not·have·authorization. | 237 | ············they·do·not·have·authorization. |
| Offset 243, 14 lines modified | Offset 243, 33 lines modified | ||
| 243 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 243 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 244 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 244 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 245 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 245 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 246 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 246 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 247 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 247 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 248 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 248 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 249 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 249 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 250 | Remediation_Shell_script_⇲ | ||
| 251 | Complexity:·low | ||
| 252 | Disruption:·low | ||
| 253 | Strategy:···restrict | ||
| 254 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 255 | ··if·[·!·-e·"$f"·]·;·then | ||
| 256 | ····continue | ||
| 257 | ··fi | ||
| 258 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 259 | ··if·!·test·-z·"$matching_list";·then | ||
| 260 | ····while·IFS=·read·-r·entry;·do | ||
| 261 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 262 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 263 | ····done·<<<·"$matching_list" | ||
| 264 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 265 | ··fi | ||
| 266 | done | ||
| 250 | Remediation_Ansible_snippet_⇲ | 267 | Remediation_Ansible_snippet_⇲ |
| 251 | Complexity:·low | 268 | Complexity:·low |
| 252 | Disruption:·low | 269 | Disruption:·low |
| 253 | Strategy:···restrict | 270 | Strategy:···restrict |
| 254 | -·name:·Find·/etc/sudoers.d/·files | 271 | -·name:·Find·/etc/sudoers.d/·files |
| 255 | ··find: | 272 | ··find: |
| 256 | ····paths: | 273 | ····paths: |
| Offset 280, 33 lines modified | Offset 299, 14 lines modified | ||
| 280 | ··-·NIST-800-53-IA-11 | 299 | ··-·NIST-800-53-IA-11 |
| 281 | ··-·low_complexity | 300 | ··-·low_complexity |
| 282 | ··-·low_disruption | 301 | ··-·low_disruption |
| 283 | ··-·medium_severity | 302 | ··-·medium_severity |
| 284 | ··-·no_reboot_needed | 303 | ··-·no_reboot_needed |
| 285 | ··-·restrict_strategy | 304 | ··-·restrict_strategy |
| 286 | ··-·sudo_remove_nopasswd | 305 | ··-·sudo_remove_nopasswd |
| 287 | Remediation_Shell_script_⇲ | ||
| 288 | Complexity:·low | ||
| Max diff block lines reached; 75022/80440 bytes (93.26%) of diff not shown. | |||
| Offset 14288, 15 lines modified | Offset 14288, 15 lines modified | ||
| 00037cf0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037cf0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037d00:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037d00:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037d10:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037d10:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037d20:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037d20:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037d30:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037d30:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037d40:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037d40:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037d50:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037d50:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037d60:·3 | 00037d60:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037d70:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037d70:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037d80:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037d80:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037d90:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037d90:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037da0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037da0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037db0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037db0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037dc0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037dc0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037dd0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037dd0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 16770, 139 lines modified | Offset 16770, 139 lines modified | ||
| 00041810:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 00041810:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 00041820:·3239·3034·2220·7461·6269·6e64·6578·3d22··2904"·tabindex=" | 00041820:·3239·3034·2220·7461·6269·6e64·6578·3d22··2904"·tabindex=" | ||
| 00041830:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 00041830:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 00041840:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 00041840:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 00041850:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 00041850:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 00041860:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 00041860:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 00041870:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 00041870:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 00041880:·6469·6174·696f·6e20·5368·656c·6c20·7363··diation·Shell·sc | |||
| 00041890:·7269·7074·20e2·87b2·3c2f·613e·3c62·723e··ript·...</a><br> | |||
| 000418a0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 000418b0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 000418c0:·7073·6522·2069·643d·2269·646d·3239·3034··pse"·id="idm2904 | |||
| 000418d0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 000418e0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 00041880:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 00041890:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 000418a0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 000418b0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 000418c0:·6c6c·6170·7365·2220·6964·3d22·6964·6d32··llapse"·id="idm2 | |||
| 000418d0:·3930·3422·3e3c·7461·626c·6520·636c·6173··904"><table·clas | |||
| 000418e0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 000418f0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 00041 | 000418f0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | ||
| 00041900:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 00041910:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 00041920:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 00041910:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 00041920:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 00041930:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 00041940:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 00041950:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 000419 | 00041930:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 00041940:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 00041950:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 00041960:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 00041970:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 00041980:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 00041990:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 000419a0:·636f·6465·3e0a·666f·7220·6620·696e·202f··code>.for·f·in·/ | |||
| 000419b0:·6574·632f·7375·646f·6572·7320·2f65·7463··etc/sudoers·/etc | |||
| 000419c0:·2f73·7564·6f65·7273·2e64·2f2a·203b·2064··/sudoers.d/*·;·d | |||
| 000419d0:·6f0a·2020·6966·205b·2021·202d·6520·2224··o.··if·[·!·-e·"$ | |||
| 000419e0:·6622·205d·203b·2074·6865·6e0a·2020·2020··f"·]·;·then.···· | |||
| 000419f0:·636f·6e74·696e·7565·0a20·2066·690a·2020··continue.··fi.·· | |||
| 00041a00:·6d61·7463·6869·6e67·5f6c·6973·743d·2428··matching_list=$( | |||
| 00041a10:·6772·6570·202d·5020·275e·283f·2123·292e··grep·-P·'^(?!#). | |||
| 00041970:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 00041980:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 00041990:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 000419a0:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 000419b0:·4669·6e64·202f·6574·632f·7375·646f·6572··Find·/etc/sudoer | |||
| 000419c0:·732e·642f·2066·696c·6573·0a20·2066·696e··s.d/·files.··fin | |||
| 000419d0:·643a·0a20·2020·2070·6174·6873·3a0a·2020··d:.····paths:.·· | |||
| 000419e0:·2020·2d20·2f65·7463·2f73·7564·6f65·7273····-·/etc/sudoers | |||
| 000419f0:·2e64·2f0a·2020·7265·6769·7374·6572·3a20··.d/.··register:· | |||
| 00041a00:·7375·646f·6572·730a·2020·7461·6773·3a0a··sudoers.··tags:. | |||
| 00041a10:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 00041a20:·434d·2d36·2861·290a·2020·2d20·4e49·5354··CM-6(a).··-·NIST | |||
| 00041a30:·2d38·3030·2d35·332d·4941·2d31·310a·2020··-800-53-IA-11.·· | |||
| 00041a40:·2d20·6c6f·775f·636f·6d70·6c65·7869·7479··-·low_complexity | |||
| 00041a50:·0a20·202d·206c·6f77·5f64·6973·7275·7074··.··-·low_disrupt | |||
| 00041a60:·696f·6e0a·2020·2d20·6d65·6469·756d·5f73··ion.··-·medium_s | |||
| 00041a70:·6576·6572·6974·790a·2020·2d20·6e6f·5f72··everity.··-·no_r | |||
| 00041a80:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 00041a90:·2072·6573·7472·6963·745f·7374·7261·7465···restrict_strate | |||
| 00041aa0:·6779·0a20·202d·2073·7564·6f5f·7265·6d6f··gy.··-·sudo_remo | |||
| 00041ab0:·7665·5f6e·6f5f·6175·7468·656e·7469·6361··ve_no_authentica | |||
| 00041ac0:·7465·0a0a·2d20·6e61·6d65·3a20·5265·6d6f··te..-·name:·Remo | |||
| 00041ad0:·7665·206c·696e·6573·2063·6f6e·7461·696e··ve·lines·contain | |||
| 00041ae0:·696e·6720·2161·7574·6865·6e74·6963·6174··ing·!authenticat | |||
| 00041af0:·6520·6672·6f6d·2073·7564·6f65·7273·2066··e·from·sudoers·f | |||
| 00041b00:·696c·6573·0a20·2072·6570·6c61·6365·3a0a··iles.··replace:. | |||
| 00041b10:·2020·2020·7265·6765·7870·3a20·285e·283f······regexp:·(^(? | |||
| 00041 | 00041a20:·2a5b·5c73·5d2b·5c21·6175·7468·656e·7469··*[\s]+\!authenti | ||
| 00041a30:·6361·7465·2e2a·2427·2024·6620·7c20·756e··cate.*$'·$f·|·un | |||
| 00041a40:·6971·2029·0a20·2069·6620·2120·7465·7374··iq·).··if·!·test | |||
| 00041a50:·202d·7a20·2224·6d61·7463·6869·6e67·5f6c···-z·"$matching_l | |||
| 00041a60:·6973·7422·3b20·7468·656e·0a20·2020·2077··ist";·then.····w | |||
| 00041a70:·6869·6c65·2049·4653·3d20·7265·6164·202d··hile·IFS=·read·- | |||
| 00041a80:·7220·656e·7472·793b·2064·6f0a·2020·2020··r·entry;·do.···· | |||
| 00041a90:·2020·2320·636f·6d6d·656e·7420·6f75·7420····#·comment·out· | |||
| 00041aa0:·2221·6175·7468·656e·7469·6361·7465·2220··"!authenticate"· | |||
| 00041ab0:·6d61·7463·6865·7320·746f·2070·7265·7365··matches·to·prese | |||
| 00041ac0:·7276·6520·7573·6572·2064·6174·610a·2020··rve·user·data.·· | |||
| 00041ad0:·2020·2020·7365·6420·2d69·2022·732f·5e24······sed·-i·"s/^$ | |||
| 00041ae0:·7b65·6e74·7279·7d24·2f23·2026·616d·703b··{entry}$/#·& | |||
| 00041af0:·2f67·2220·2466·0a20·2020·2064·6f6e·6520··/g"·$f.····done· | |||
| 00041b00:·266c·743b·266c·743b·266c·743b·2022·246d··<<<·"$m | |||
| 00041b10:·6174·6368·696e·675f·6c69·7374·220a·0a20··atching_list"..· | |||
| 00041b20:·2020·202f·7573·722f·7362·696e·2f76·6973·····/usr/sbin/vis | |||
| 00041b30:·7564·6f20·2d63·6620·2466·2026·616d·703b··udo·-cf·$f·& | |||
| 00041b40:·2667·743b·202f·6465·762f·6e75·6c6c·207c··>·/dev/null·| | |||
| 00041b50:·7c20·6563·686f·2022·4661·696c·2074·6f20··|·echo·"Fail·to· | |||
| 00041b60:·7661·6c69·6461·7465·2024·6620·7769·7468··validate·$f·with | |||
| 00041b70:·2076·6973·7564·6f22·0a20·2066·690a·646f···visudo".··fi.do | |||
| 00041b80:·6e65·0a3c·2f63·6f64·653e·3c2f·7072·653e··ne.</code></pre> | |||
| 00041b90:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 00041ba0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 00041bb0:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 00041bc0:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 00041bd0:·6765·743d·2223·6964·6d32·3930·3522·2074··get="#idm2905"·t | |||
| 00041be0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 00041bf0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 00041c00:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 00041c10:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 00041c20:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 00041c30:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 00041c40:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 00041b30:·656e·7469·6361·7465·2e2a·2429·0a20·2020··enticate.*$).··· | |||
| 00041b40:·2072·6570·6c61·6365·3a20·2723·205c·6726···replace:·'#·\g& | |||
| 00041b50:·6c74·3b31·2667·743b·270a·2020·2020·7061··lt;1>'.····pa | |||
| Max diff block lines reached; 648410/667370 bytes (97.16%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level | 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ | 42 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·GRUB2_bootloader_configuration | 50 | ·········3.·GRUB2_bootloader_configuration |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 172, 14 lines modified | Offset 172, 33 lines modified | ||
| 172 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 172 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 173 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 173 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 174 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 174 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 175 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 175 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 176 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 176 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 177 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 177 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 178 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 178 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 179 | Remediation_Shell_script_⇲ | ||
| 180 | Complexity:·low | ||
| 181 | Disruption:·low | ||
| 182 | Strategy:···restrict | ||
| 183 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 184 | ··if·[·!·-e·"$f"·]·;·then | ||
| 185 | ····continue | ||
| 186 | ··fi | ||
| 187 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 188 | ··if·!·test·-z·"$matching_list";·then | ||
| 189 | ····while·IFS=·read·-r·entry;·do | ||
| 190 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 191 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 192 | ····done·<<<·"$matching_list" | ||
| 193 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 194 | ··fi | ||
| 195 | done | ||
| 179 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 180 | Complexity:·low | 197 | Complexity:·low |
| 181 | Disruption:·low | 198 | Disruption:·low |
| 182 | Strategy:···restrict | 199 | Strategy:···restrict |
| 183 | -·name:·Find·/etc/sudoers.d/·files | 200 | -·name:·Find·/etc/sudoers.d/·files |
| 184 | ··find: | 201 | ··find: |
| 185 | ····paths: | 202 | ····paths: |
| Offset 209, 33 lines modified | Offset 228, 14 lines modified | ||
| 209 | ··-·NIST-800-53-IA-11 | 228 | ··-·NIST-800-53-IA-11 |
| 210 | ··-·low_complexity | 229 | ··-·low_complexity |
| 211 | ··-·low_disruption | 230 | ··-·low_disruption |
| 212 | ··-·medium_severity | 231 | ··-·medium_severity |
| 213 | ··-·no_reboot_needed | 232 | ··-·no_reboot_needed |
| 214 | ··-·restrict_strategy | 233 | ··-·restrict_strategy |
| 215 | ··-·sudo_remove_no_authenticate | 234 | ··-·sudo_remove_no_authenticate |
| 216 | Remediation_Shell_script_⇲ | ||
| 217 | Complexity:·low | ||
| 218 | Disruption:·low | ||
| 219 | Strategy:···restrict | ||
| 220 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 221 | ··if·[·!·-e·"$f"·]·;·then | ||
| 222 | ····continue | ||
| 223 | ··fi | ||
| 224 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 225 | ··if·!·test·-z·"$matching_list";·then | ||
| 226 | ····while·IFS=·read·-r·entry;·do | ||
| 227 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 228 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 229 | ····done·<<<·"$matching_list" | ||
| 230 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 231 | ··fi | ||
| 232 | done | ||
| 233 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 235 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 234 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 236 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 235 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 237 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 236 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 238 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 237 | sudoers.d/. | 239 | sudoers.d/. |
| 238 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 240 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 239 | ············they·do·not·have·authorization. | 241 | ············they·do·not·have·authorization. |
| Offset 247, 14 lines modified | Offset 247, 33 lines modified | ||
| 247 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 247 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 248 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 248 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 249 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 249 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 250 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 250 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 251 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 251 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 252 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 252 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 253 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 253 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 254 | Remediation_Shell_script_⇲ | ||
| 255 | Complexity:·low | ||
| 256 | Disruption:·low | ||
| 257 | Strategy:···restrict | ||
| 258 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 259 | ··if·[·!·-e·"$f"·]·;·then | ||
| 260 | ····continue | ||
| 261 | ··fi | ||
| 262 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 263 | ··if·!·test·-z·"$matching_list";·then | ||
| 264 | ····while·IFS=·read·-r·entry;·do | ||
| 265 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 266 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 267 | ····done·<<<·"$matching_list" | ||
| 268 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 269 | ··fi | ||
| 270 | done | ||
| 254 | Remediation_Ansible_snippet_⇲ | 271 | Remediation_Ansible_snippet_⇲ |
| 255 | Complexity:·low | 272 | Complexity:·low |
| 256 | Disruption:·low | 273 | Disruption:·low |
| 257 | Strategy:···restrict | 274 | Strategy:···restrict |
| 258 | -·name:·Find·/etc/sudoers.d/·files | 275 | -·name:·Find·/etc/sudoers.d/·files |
| 259 | ··find: | 276 | ··find: |
| 260 | ····paths: | 277 | ····paths: |
| Offset 284, 33 lines modified | Offset 303, 14 lines modified | ||
| 284 | ··-·NIST-800-53-IA-11 | 303 | ··-·NIST-800-53-IA-11 |
| 285 | ··-·low_complexity | 304 | ··-·low_complexity |
| 286 | ··-·low_disruption | 305 | ··-·low_disruption |
| 287 | ··-·medium_severity | 306 | ··-·medium_severity |
| 288 | ··-·no_reboot_needed | 307 | ··-·no_reboot_needed |
| 289 | ··-·restrict_strategy | 308 | ··-·restrict_strategy |
| 290 | ··-·sudo_remove_nopasswd | 309 | ··-·sudo_remove_nopasswd |
| 291 | Remediation_Shell_script_⇲ | ||
| 292 | Complexity:·low | ||
| Max diff block lines reached; 86029/91469 bytes (94.05%) of diff not shown. | |||
| Offset 14281, 15 lines modified | Offset 14281, 15 lines modified | ||
| 00037c80:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037c80:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037c90:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037c90:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037ca0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037ca0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037cb0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037cb0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037cc0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037cc0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037cd0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037cd0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037ce0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037ce0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037cf0:·3032·3 | 00037cf0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037d00:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037d00:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037d10:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037d10:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037d20:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037d20:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037d30:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037d30:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037d40:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037d40:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037d50:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037d50:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037d60:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037d60:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 14943, 140 lines modified | Offset 14943, 140 lines modified | ||
| 0003a5e0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003a5e0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003a5f0:·3d22·2369·646d·3239·3034·2220·7461·6269··="#idm2904"·tabi | 0003a5f0:·3d22·2369·646d·3239·3034·2220·7461·6269··="#idm2904"·tabi | ||
| 0003a600:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003a600:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003a610:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003a610:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003a620:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003a620:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003a630:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003a630:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003a640:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003a640:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003a650:·223e·5265·6d65·6469·6174·696f·6e20· | 0003a650:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003a660:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003a670:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003a6 | 0003a660:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003a670:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003a680:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003a690:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003a6a0:·646d·3239·3034·223e·3c74·6162·6c65·2063··dm2904"><table·c | |||
| 0003a6b0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003a6c0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003a6d0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003a6e0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003a6f0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003a700:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003a710:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003a720:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003a730:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003a740:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003a750:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003a760:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003a770:·3c70·7265·3e3c·636f·6465·3e0a·666f·7220··<pre><code>.for· | |||
| 0003a780:·6620·696e·202f·6574·632f·7375·646f·6572··f·in·/etc/sudoer | |||
| 0003a790:·7320·2f65·7463·2f73·7564·6f65·7273·2e64··s·/etc/sudoers.d | |||
| 0003a7a0:·2f2a·203b·2064·6f0a·2020·6966·205b·2021··/*·;·do.··if·[·! | |||
| 0003a7b0:·202d·6520·2224·6622·205d·203b·2074·6865···-e·"$f"·]·;·the | |||
| 0003a7c0:·6e0a·2020·2020·636f·6e74·696e·7565·0a20··n.····continue.· | |||
| 0003a7d0:·2066·690a·2020·6d61·7463·6869·6e67·5f6c···fi.··matching_l | |||
| 0003a7e0:·6973·743d·2428·6772·6570·202d·5020·275e··ist=$(grep·-P·'^ | |||
| 0003a7f0:·283f·2123·292e·2a5b·5c73·5d2b·5c21·6175··(?!#).*[\s]+\!au | |||
| 0003a800:·7468·656e·7469·6361·7465·2e2a·2427·2024··thenticate.*$'·$ | |||
| 0003a810:·6620·7c20·756e·6971·2029·0a20·2069·6620··f·|·uniq·).··if· | |||
| 0003a820:·2120·7465·7374·202d·7a20·2224·6d61·7463··!·test·-z·"$matc | |||
| 0003a830:·6869·6e67·5f6c·6973·7422·3b20·7468·656e··hing_list";·then | |||
| 0003a840:·0a20·2020·2077·6869·6c65·2049·4653·3d20··.····while·IFS=· | |||
| 0003a850:·7265·6164·202d·7220·656e·7472·793b·2064··read·-r·entry;·d | |||
| 0003a860:·6f0a·2020·2020·2020·2320·636f·6d6d·656e··o.······#·commen | |||
| 0003a870:·7420·6f75·7420·2221·6175·7468·656e·7469··t·out·"!authenti | |||
| 0003a880:·6361·7465·2220·6d61·7463·6865·7320·746f··cate"·matches·to | |||
| 0003a890:·2070·7265·7365·7276·6520·7573·6572·2064···preserve·user·d | |||
| 0003a8a0:·6174·610a·2020·2020·2020·7365·6420·2d69··ata.······sed·-i | |||
| 0003a8b0:·2022·732f·5e24·7b65·6e74·7279·7d24·2f23···"s/^${entry}$/# | |||
| 0003a8c0:·2026·616d·703b·2f67·2220·2466·0a20·2020···&/g"·$f.··· | |||
| 0003a8d0:·2064·6f6e·6520·266c·743b·266c·743b·266c···done·<<&l | |||
| 0003a8e0:·743b·2022·246d·6174·6368·696e·675f·6c69··t;·"$matching_li | |||
| 0003a8f0:·7374·220a·0a20·2020·202f·7573·722f·7362··st"..····/usr/sb | |||
| 0003a900:·696e·2f76·6973·7564·6f20·2d63·6620·2466··in/visudo·-cf·$f | |||
| 0003a910:·2026·616d·703b·2667·743b·202f·6465·762f···&>·/dev/ | |||
| 0003a920:·6e75·6c6c·207c·7c20·6563·686f·2022·4661··null·||·echo·"Fa | |||
| 0003a930:·696c·2074·6f20·7661·6c69·6461·7465·2024··il·to·validate·$ | |||
| 0003a940:·6620·7769·7468·2076·6973·7564·6f22·0a20··f·with·visudo".· | |||
| 0003a950:·2066·690a·646f·6e65·0a3c·2f63·6f64·653e···fi.done.</code> | |||
| 0003a960:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003a970:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003a980:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003a | 0003a990:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003a9a0:·7461·2d74·6172·6765·743d·2223·6964·6d32··ta-target="#idm2 | |||
| 0003a9b0:·3930·3522·2074·6162·696e·6465·783d·2230··905"·tabindex="0 | |||
| 0003a9c0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003a9d0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003a9e0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003a9f0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003aa00:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003aa10:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003a6a0:·3d22·6964·6d32·3930·3422·3e3c·7461·626c··="idm2904"><tabl | |||
| 0003a6b0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003a6c0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003a6d0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003a6e0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003a6f0:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003a700:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003a710:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003a720:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003a730:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003a740:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003a750:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003a760:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003a770:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003a780:·6e61·6d65·3a20·4669·6e64·202f·6574·632f··name:·Find·/etc/ | |||
| 0003a790:·7375·646f·6572·732e·642f·2066·696c·6573··sudoers.d/·files | |||
| 0003a7a0:·0a20·2066·696e·643a·0a20·2020·2070·6174··.··find:.····pat | |||
| 0003a7b0:·6873·3a0a·2020·2020·2d20·2f65·7463·2f73··hs:.····-·/etc/s | |||
| 0003a7c0:·7564·6f65·7273·2e64·2f0a·2020·7265·6769··udoers.d/.··regi | |||
| 0003a7d0:·7374·6572·3a20·7375·646f·6572·730a·2020··ster:·sudoers.·· | |||
| 0003a7e0:·7461·6773·3a0a·2020·2d20·4e49·5354·2d38··tags:.··-·NIST-8 | |||
| 0003a7f0:·3030·2d35·332d·434d·2d36·2861·290a·2020··00-53-CM-6(a).·· | |||
| 0003a800:·2d20·4e49·5354·2d38·3030·2d35·332d·4941··-·NIST-800-53-IA | |||
| 0003a810:·2d31·310a·2020·2d20·6c6f·775f·636f·6d70··-11.··-·low_comp | |||
| 0003a820:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003a830:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003a840:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003a850:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003a860:·6564·0a20·202d·2072·6573·7472·6963·745f··ed.··-·restrict_ | |||
| 0003a870:·7374·7261·7465·6779·0a20·202d·2073·7564··strategy.··-·sud | |||
| 0003a880:·6f5f·7265·6d6f·7665·5f6e·6f5f·6175·7468··o_remove_no_auth | |||
| 0003a890:·656e·7469·6361·7465·0a0a·2d20·6e61·6d65··enticate..-·name | |||
| 0003a8a0:·3a20·5265·6d6f·7665·206c·696e·6573·2063··:·Remove·lines·c | |||
| 0003a8b0:·6f6e·7461·696e·696e·6720·2161·7574·6865··ontaining·!authe | |||
| 0003a8c0:·6e74·6963·6174·6520·6672·6f6d·2073·7564··nticate·from·sud | |||
| 0003a8d0:·6f65·7273·2066·696c·6573·0a20·2072·6570··oers·files.··rep | |||
| 0003a8e0:·6c61·6365·3a0a·2020·2020·7265·6765·7870··lace:.····regexp | |||
| 0003a8f0:·3a20·285e·283f·2123·292e·2a5b·5c73·5d2b··:·(^(?!#).*[\s]+ | |||
| 0003a900:·5c21·6175·7468·656e·7469·6361·7465·2e2a··\!authenticate.* | |||
| 0003a910:·2429·0a20·2020·2072·6570·6c61·6365·3a20··$).····replace:· | |||
| 0003a920:·2723·205c·6726·6c74·3b31·2667·743b·270a··'#·\g<1>'. | |||
| Max diff block lines reached; 235484/254582 bytes (92.50%) of diff not shown. | |||
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | *****·Profile·Information·***** | 36 | *****·Profile·Information·***** |
| 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level | 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level |
| 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal | 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal |
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ | 40 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ |
| 41 | *****·Revision·History·***** | 41 | *****·Revision·History·***** |
| 42 | Current·version:·0.1.65 | 42 | Current·version:·0.1.65 |
| 43 | ····*·draft·(as·of·202 | 43 | ····*·draft·(as·of·2025-02-23) |
| 44 | *****·Table·of·Contents·***** | 44 | *****·Table·of·Contents·***** |
| 45 | ···1.·System_Settings | 45 | ···1.·System_Settings |
| 46 | ·········1.·Installing_and_Maintaining_Software | 46 | ·········1.·Installing_and_Maintaining_Software |
| 47 | ·········2.·File_Permissions_and_Masks | 47 | ·········2.·File_Permissions_and_Masks |
| 48 | ···2.·Services | 48 | ···2.·Services |
| 49 | ·········1.·APT_service_configuration | 49 | ·········1.·APT_service_configuration |
| 50 | ·········2.·Deprecated_services | 50 | ·········2.·Deprecated_services |
| Offset 80, 14 lines modified | Offset 80, 33 lines modified | ||
| 80 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 80 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 81 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 81 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 82 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 82 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 83 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 83 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 84 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 84 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 85 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 85 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 86 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 86 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 87 | Remediation_Shell_script_⇲ | ||
| 88 | Complexity:·low | ||
| 89 | Disruption:·low | ||
| 90 | Strategy:···restrict | ||
| 91 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 92 | ··if·[·!·-e·"$f"·]·;·then | ||
| 93 | ····continue | ||
| 94 | ··fi | ||
| 95 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 96 | ··if·!·test·-z·"$matching_list";·then | ||
| 97 | ····while·IFS=·read·-r·entry;·do | ||
| 98 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 99 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 100 | ····done·<<<·"$matching_list" | ||
| 101 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 102 | ··fi | ||
| 103 | done | ||
| 87 | Remediation_Ansible_snippet_⇲ | 104 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·low | 105 | Complexity:·low |
| 89 | Disruption:·low | 106 | Disruption:·low |
| 90 | Strategy:···restrict | 107 | Strategy:···restrict |
| 91 | -·name:·Find·/etc/sudoers.d/·files | 108 | -·name:·Find·/etc/sudoers.d/·files |
| 92 | ··find: | 109 | ··find: |
| 93 | ····paths: | 110 | ····paths: |
| Offset 117, 33 lines modified | Offset 136, 14 lines modified | ||
| 117 | ··-·NIST-800-53-IA-11 | 136 | ··-·NIST-800-53-IA-11 |
| 118 | ··-·low_complexity | 137 | ··-·low_complexity |
| 119 | ··-·low_disruption | 138 | ··-·low_disruption |
| 120 | ··-·medium_severity | 139 | ··-·medium_severity |
| 121 | ··-·no_reboot_needed | 140 | ··-·no_reboot_needed |
| 122 | ··-·restrict_strategy | 141 | ··-·restrict_strategy |
| 123 | ··-·sudo_remove_no_authenticate | 142 | ··-·sudo_remove_no_authenticate |
| 124 | Remediation_Shell_script_⇲ | ||
| 125 | Complexity:·low | ||
| 126 | Disruption:·low | ||
| 127 | Strategy:···restrict | ||
| 128 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 129 | ··if·[·!·-e·"$f"·]·;·then | ||
| 130 | ····continue | ||
| 131 | ··fi | ||
| 132 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 133 | ··if·!·test·-z·"$matching_list";·then | ||
| 134 | ····while·IFS=·read·-r·entry;·do | ||
| 135 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 136 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 137 | ····done·<<<·"$matching_list" | ||
| 138 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 139 | ··fi | ||
| 140 | done | ||
| 141 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 143 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 142 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 144 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 143 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 145 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 144 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 146 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 145 | sudoers.d/. | 147 | sudoers.d/. |
| 146 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 148 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 147 | ············they·do·not·have·authorization. | 149 | ············they·do·not·have·authorization. |
| Offset 155, 14 lines modified | Offset 155, 33 lines modified | ||
| 155 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 155 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 156 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 156 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 157 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 157 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 158 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 158 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 159 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 159 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 160 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 160 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 161 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 161 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 162 | Remediation_Shell_script_⇲ | ||
| 163 | Complexity:·low | ||
| 164 | Disruption:·low | ||
| 165 | Strategy:···restrict | ||
| 166 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 167 | ··if·[·!·-e·"$f"·]·;·then | ||
| 168 | ····continue | ||
| 169 | ··fi | ||
| 170 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 171 | ··if·!·test·-z·"$matching_list";·then | ||
| 172 | ····while·IFS=·read·-r·entry;·do | ||
| 173 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 174 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 175 | ····done·<<<·"$matching_list" | ||
| 176 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 177 | ··fi | ||
| 178 | done | ||
| 162 | Remediation_Ansible_snippet_⇲ | 179 | Remediation_Ansible_snippet_⇲ |
| 163 | Complexity:·low | 180 | Complexity:·low |
| 164 | Disruption:·low | 181 | Disruption:·low |
| 165 | Strategy:···restrict | 182 | Strategy:···restrict |
| 166 | -·name:·Find·/etc/sudoers.d/·files | 183 | -·name:·Find·/etc/sudoers.d/·files |
| 167 | ··find: | 184 | ··find: |
| 168 | ····paths: | 185 | ····paths: |
| Offset 192, 33 lines modified | Offset 211, 14 lines modified | ||
| 192 | ··-·NIST-800-53-IA-11 | 211 | ··-·NIST-800-53-IA-11 |
| 193 | ··-·low_complexity | 212 | ··-·low_complexity |
| 194 | ··-·low_disruption | 213 | ··-·low_disruption |
| 195 | ··-·medium_severity | 214 | ··-·medium_severity |
| 196 | ··-·no_reboot_needed | 215 | ··-·no_reboot_needed |
| 197 | ··-·restrict_strategy | 216 | ··-·restrict_strategy |
| 198 | ··-·sudo_remove_nopasswd | 217 | ··-·sudo_remove_nopasswd |
| 199 | Remediation_Shell_script_⇲ | ||
| 200 | Complexity:·low | ||
| Max diff block lines reached; 26468/31883 bytes (83.02%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037cc0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037cd0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037cd0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037ce0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037ce0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037cf0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037cf0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037d00:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037d00:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037d10:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037d10:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037d20:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037d20:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037d30:·3032·3 | 00037d30:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037d40:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037d40:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037d50:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037d50:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037d60:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037d60:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037d70:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037d70:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037d80:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037d80:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037d90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037d90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037da0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037da0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 16761, 139 lines modified | Offset 16761, 139 lines modified | ||
| 00041780:·6574·3d22·2369·646d·3239·3034·2220·7461··et="#idm2904"·ta | 00041780:·6574·3d22·2369·646d·3239·3034·2220·7461··et="#idm2904"·ta | ||
| 00041790:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 00041790:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 000417a0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 000417a0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 000417b0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 000417b0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 000417c0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 000417c0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 000417d0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 000417d0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 000417e0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 000417e0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 000417f0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 00041800:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 00041 | 000417f0:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | ||
| 00041800:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 00041810:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 00041820:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 00041830:·2269·646d·3239·3034·223e·3c74·6162·6c65··"idm2904"><table | |||
| 00041840:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 00041850:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 00041860:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 00041870:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 00041880:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 00041890:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 000418a0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 000418b0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 000418c0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 000418d0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 000418e0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 000418f0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 00041900:·653e·3c70·7265·3e3c·636f·6465·3e0a·666f··e><pre><code>.fo | |||
| 00041910:·7220·6620·696e·202f·6574·632f·7375·646f··r·f·in·/etc/sudo | |||
| 00041920:·6572·7320·2f65·7463·2f73·7564·6f65·7273··ers·/etc/sudoers | |||
| 00041930:·2e64·2f2a·203b·2064·6f0a·2020·6966·205b··.d/*·;·do.··if·[ | |||
| 00041940:·2021·202d·6520·2224·6622·205d·203b·2074···!·-e·"$f"·]·;·t | |||
| 00041950:·6865·6e0a·2020·2020·636f·6e74·696e·7565··hen.····continue | |||
| 00041960:·0a20·2066·690a·2020·6d61·7463·6869·6e67··.··fi.··matching | |||
| 00041970:·5f6c·6973·743d·2428·6772·6570·202d·5020··_list=$(grep·-P· | |||
| 00041980:·275e·283f·2123·292e·2a5b·5c73·5d2b·5c21··'^(?!#).*[\s]+\! | |||
| 00041990:·6175·7468·656e·7469·6361·7465·2e2a·2427··authenticate.*$' | |||
| 000419a0:·2024·6620·7c20·756e·6971·2029·0a20·2069···$f·|·uniq·).··i | |||
| 000419b0:·6620·2120·7465·7374·202d·7a20·2224·6d61··f·!·test·-z·"$ma | |||
| 000419c0:·7463·6869·6e67·5f6c·6973·7422·3b20·7468··tching_list";·th | |||
| 000419d0:·656e·0a20·2020·2077·6869·6c65·2049·4653··en.····while·IFS | |||
| 000419e0:·3d20·7265·6164·202d·7220·656e·7472·793b··=·read·-r·entry; | |||
| 000419f0:·2064·6f0a·2020·2020·2020·2320·636f·6d6d···do.······#·comm | |||
| 00041a00:·656e·7420·6f75·7420·2221·6175·7468·656e··ent·out·"!authen | |||
| 00041a10:·7469·6361·7465·2220·6d61·7463·6865·7320··ticate"·matches· | |||
| 00041a20:·746f·2070·7265·7365·7276·6520·7573·6572··to·preserve·user | |||
| 00041a30:·2064·6174·610a·2020·2020·2020·7365·6420···data.······sed· | |||
| 00041a40:·2d69·2022·732f·5e24·7b65·6e74·7279·7d24··-i·"s/^${entry}$ | |||
| 00041a50:·2f23·2026·616d·703b·2f67·2220·2466·0a20··/#·&/g"·$f.· | |||
| 00041a60:·2020·2064·6f6e·6520·266c·743b·266c·743b·····done·<< | |||
| 00041a70:·266c·743b·2022·246d·6174·6368·696e·675f··<·"$matching_ | |||
| 00041a80:·6c69·7374·220a·0a20·2020·202f·7573·722f··list"..····/usr/ | |||
| 00041a90:·7362·696e·2f76·6973·7564·6f20·2d63·6620··sbin/visudo·-cf· | |||
| 00041aa0:·2466·2026·616d·703b·2667·743b·202f·6465··$f·&>·/de | |||
| 00041ab0:·762f·6e75·6c6c·207c·7c20·6563·686f·2022··v/null·||·echo·" | |||
| 00041ac0:·4661·696c·2074·6f20·7661·6c69·6461·7465··Fail·to·validate | |||
| 00041ad0:·2024·6620·7769·7468·2076·6973·7564·6f22···$f·with·visudo" | |||
| 00041ae0:·0a20·2066·690a·646f·6e65·0a3c·2f63·6f64··.··fi.done.</cod | |||
| 00041af0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 00041b00:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 00041b10:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 00041 | 00041b20:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 00041b30:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 00041b40:·6d32·3930·3522·2074·6162·696e·6465·783d··m2905"·tabindex= | |||
| 00041b50:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 00041b60:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 00041b70:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 00041b80:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 00041b90:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 00041ba0:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 00041830:·6964·3d22·6964·6d32·3930·3422·3e3c·7461··id="idm2904"><ta | |||
| 00041840:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 00041850:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 00041860:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 00041870:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 00041880:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 00041890:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 000418a0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 000418b0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 000418c0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 000418d0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 000418e0:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 000418f0:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 00041900:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 00041910:·2d20·6e61·6d65·3a20·4669·6e64·202f·6574··-·name:·Find·/et | |||
| 00041920:·632f·7375·646f·6572·732e·642f·2066·696c··c/sudoers.d/·fil | |||
| 00041930:·6573·0a20·2066·696e·643a·0a20·2020·2070··es.··find:.····p | |||
| 00041940:·6174·6873·3a0a·2020·2020·2d20·2f65·7463··aths:.····-·/etc | |||
| 00041950:·2f73·7564·6f65·7273·2e64·2f0a·2020·7265··/sudoers.d/.··re | |||
| 00041960:·6769·7374·6572·3a20·7375·646f·6572·730a··gister:·sudoers. | |||
| 00041970:·2020·7461·6773·3a0a·2020·2d20·4e49·5354····tags:.··-·NIST | |||
| 00041980:·2d38·3030·2d35·332d·434d·2d36·2861·290a··-800-53-CM-6(a). | |||
| 00041990:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 000419a0:·4941·2d31·310a·2020·2d20·6c6f·775f·636f··IA-11.··-·low_co | |||
| 000419b0:·6d70·6c65·7869·7479·0a20·202d·206c·6f77··mplexity.··-·low | |||
| 000419c0:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | |||
| 000419d0:·6d65·6469·756d·5f73·6576·6572·6974·790a··medium_severity. | |||
| 000419e0:·2020·2d20·6e6f·5f72·6562·6f6f·745f·6e65····-·no_reboot_ne | |||
| 000419f0:·6564·6564·0a20·202d·2072·6573·7472·6963··eded.··-·restric | |||
| 00041a00:·745f·7374·7261·7465·6779·0a20·202d·2073··t_strategy.··-·s | |||
| 00041a10:·7564·6f5f·7265·6d6f·7665·5f6e·6f5f·6175··udo_remove_no_au | |||
| 00041a20:·7468·656e·7469·6361·7465·0a0a·2d20·6e61··thenticate..-·na | |||
| 00041a30:·6d65·3a20·5265·6d6f·7665·206c·696e·6573··me:·Remove·lines | |||
| 00041a40:·2063·6f6e·7461·696e·696e·6720·2161·7574···containing·!aut | |||
| 00041a50:·6865·6e74·6963·6174·6520·6672·6f6d·2073··henticate·from·s | |||
| 00041a60:·7564·6f65·7273·2066·696c·6573·0a20·2072··udoers·files.··r | |||
| 00041a70:·6570·6c61·6365·3a0a·2020·2020·7265·6765··eplace:.····rege | |||
| 00041a80:·7870·3a20·285e·283f·2123·292e·2a5b·5c73··xp:·(^(?!#).*[\s | |||
| 00041a90:·5d2b·5c21·6175·7468·656e·7469·6361·7465··]+\!authenticate | |||
| 00041aa0:·2e2a·2429·0a20·2020·2072·6570·6c61·6365··.*$).····replace | |||
| 00041ab0:·3a20·2723·205c·6726·6c74·3b31·2667·743b··:·'#·\g<1> | |||
| 00041ac0:·270a·2020·2020·7061·7468·3a20·277b·7b20··'.····path:·'{{· | |||
| Max diff block lines reached; 636654/655614 bytes (97.11%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·System_Accounting_with_auditd | 48 | ·········2.·System_Accounting_with_auditd |
| 49 | ·········3.·Configure_Syslog | 49 | ·········3.·Configure_Syslog |
| 50 | ·········4.·File_Permissions_and_Masks | 50 | ·········4.·File_Permissions_and_Masks |
| 51 | ···2.·Services | 51 | ···2.·Services |
| Offset 170, 14 lines modified | Offset 170, 33 lines modified | ||
| 170 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 170 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 171 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 171 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 172 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 172 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 173 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 173 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 174 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 174 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 175 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 175 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 176 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 176 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 177 | Remediation_Shell_script_⇲ | ||
| 178 | Complexity:·low | ||
| 179 | Disruption:·low | ||
| 180 | Strategy:···restrict | ||
| 181 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 182 | ··if·[·!·-e·"$f"·]·;·then | ||
| 183 | ····continue | ||
| 184 | ··fi | ||
| 185 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 186 | ··if·!·test·-z·"$matching_list";·then | ||
| 187 | ····while·IFS=·read·-r·entry;·do | ||
| 188 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 189 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 190 | ····done·<<<·"$matching_list" | ||
| 191 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 192 | ··fi | ||
| 193 | done | ||
| 177 | Remediation_Ansible_snippet_⇲ | 194 | Remediation_Ansible_snippet_⇲ |
| 178 | Complexity:·low | 195 | Complexity:·low |
| 179 | Disruption:·low | 196 | Disruption:·low |
| 180 | Strategy:···restrict | 197 | Strategy:···restrict |
| 181 | -·name:·Find·/etc/sudoers.d/·files | 198 | -·name:·Find·/etc/sudoers.d/·files |
| 182 | ··find: | 199 | ··find: |
| 183 | ····paths: | 200 | ····paths: |
| Offset 207, 33 lines modified | Offset 226, 14 lines modified | ||
| 207 | ··-·NIST-800-53-IA-11 | 226 | ··-·NIST-800-53-IA-11 |
| 208 | ··-·low_complexity | 227 | ··-·low_complexity |
| 209 | ··-·low_disruption | 228 | ··-·low_disruption |
| 210 | ··-·medium_severity | 229 | ··-·medium_severity |
| 211 | ··-·no_reboot_needed | 230 | ··-·no_reboot_needed |
| 212 | ··-·restrict_strategy | 231 | ··-·restrict_strategy |
| 213 | ··-·sudo_remove_no_authenticate | 232 | ··-·sudo_remove_no_authenticate |
| 214 | Remediation_Shell_script_⇲ | ||
| 215 | Complexity:·low | ||
| 216 | Disruption:·low | ||
| 217 | Strategy:···restrict | ||
| 218 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 219 | ··if·[·!·-e·"$f"·]·;·then | ||
| 220 | ····continue | ||
| 221 | ··fi | ||
| 222 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 223 | ··if·!·test·-z·"$matching_list";·then | ||
| 224 | ····while·IFS=·read·-r·entry;·do | ||
| 225 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 226 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 227 | ····done·<<<·"$matching_list" | ||
| 228 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 229 | ··fi | ||
| 230 | done | ||
| 231 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 233 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 232 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 234 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 233 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 235 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 234 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 236 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 235 | sudoers.d/. | 237 | sudoers.d/. |
| 236 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 238 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 237 | ············they·do·not·have·authorization. | 239 | ············they·do·not·have·authorization. |
| Offset 245, 14 lines modified | Offset 245, 33 lines modified | ||
| 245 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 245 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 246 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 246 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 247 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 247 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 248 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 248 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 249 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 249 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 250 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 250 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 251 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 251 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 252 | Remediation_Shell_script_⇲ | ||
| 253 | Complexity:·low | ||
| 254 | Disruption:·low | ||
| 255 | Strategy:···restrict | ||
| 256 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 257 | ··if·[·!·-e·"$f"·]·;·then | ||
| 258 | ····continue | ||
| 259 | ··fi | ||
| 260 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 261 | ··if·!·test·-z·"$matching_list";·then | ||
| 262 | ····while·IFS=·read·-r·entry;·do | ||
| 263 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 264 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 265 | ····done·<<<·"$matching_list" | ||
| 266 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 267 | ··fi | ||
| 268 | done | ||
| 252 | Remediation_Ansible_snippet_⇲ | 269 | Remediation_Ansible_snippet_⇲ |
| 253 | Complexity:·low | 270 | Complexity:·low |
| 254 | Disruption:·low | 271 | Disruption:·low |
| 255 | Strategy:···restrict | 272 | Strategy:···restrict |
| 256 | -·name:·Find·/etc/sudoers.d/·files | 273 | -·name:·Find·/etc/sudoers.d/·files |
| 257 | ··find: | 274 | ··find: |
| 258 | ····paths: | 275 | ····paths: |
| Offset 282, 33 lines modified | Offset 301, 14 lines modified | ||
| 282 | ··-·NIST-800-53-IA-11 | 301 | ··-·NIST-800-53-IA-11 |
| 283 | ··-·low_complexity | 302 | ··-·low_complexity |
| 284 | ··-·low_disruption | 303 | ··-·low_disruption |
| 285 | ··-·medium_severity | 304 | ··-·medium_severity |
| 286 | ··-·no_reboot_needed | 305 | ··-·no_reboot_needed |
| 287 | ··-·restrict_strategy | 306 | ··-·restrict_strategy |
| 288 | ··-·sudo_remove_nopasswd | 307 | ··-·sudo_remove_nopasswd |
| 289 | Remediation_Shell_script_⇲ | ||
| 290 | Complexity:·low | ||
| Max diff block lines reached; 84139/89554 bytes (93.95%) of diff not shown. | |||
| Offset 14282, 15 lines modified | Offset 14282, 15 lines modified | ||
| 00037c90:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00037c90:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00037ca0:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00037ca0:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00037cb0:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00037cb0:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00037cc0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00037cc0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00037cd0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00037cd0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00037ce0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00037ce0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 00037cf0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 00037cf0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00037d00:·2032·3032·3 | 00037d00:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 00037d10:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 00037d20:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 00037d20:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 00037d30:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 00037d30:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 00037d40:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 00037d40:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00037d50:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00037d50:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00037d60:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00037d60:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00037d70:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00037d70:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 18332, 22 lines modified | Offset 18332, 22 lines modified | ||
| 000479b0:·6e65·6564·6564·0a20·202d·2072·6573·7472··needed.··-·restr | 000479b0:·6e65·6564·6564·0a20·202d·2072·6573·7472··needed.··-·restr | ||
| 000479c0:·6963·745f·7374·7261·7465·6779·0a0a·2d20··ict_strategy..-· | 000479c0:·6963·745f·7374·7261·7465·6779·0a0a·2d20··ict_strategy..-· | ||
| 000479d0:·6e61·6d65·3a20·5365·7420·6172·6368·6974··name:·Set·archit | 000479d0:·6e61·6d65·3a20·5365·7420·6172·6368·6974··name:·Set·archit | ||
| 000479e0:·6563·7475·7265·2066·6f72·2061·7564·6974··ecture·for·audit | 000479e0:·6563·7475·7265·2066·6f72·2061·7564·6974··ecture·for·audit | ||
| 000479f0:·2074·6173·6b73·0a20·2073·6574·5f66·6163···tasks.··set_fac | 000479f0:·2074·6173·6b73·0a20·2073·6574·5f66·6163···tasks.··set_fac | ||
| 00047a00:·743a·0a20·2020·2061·7564·6974·5f61·7263··t:.····audit_arc | 00047a00:·743a·0a20·2020·2061·7564·6974·5f61·7263··t:.····audit_arc | ||
| 00047a10:·683a·2062·3634·0a20·2077·6865·6e3a·0a20··h:·b64.··when:.· | 00047a10:·683a·2062·3634·0a20·2077·6865·6e3a·0a20··h:·b64.··when:.· | ||
| 00047a20:·202d·2061·6e73·6962·6c65·5f76·6972·7475···-·ansible_virtu | |||
| 00047a30:·616c·697a·6174·696f·6e5f·7479·7065·206e··alization_type·n | |||
| 00047a40:·6f74·2069·6e20·5b22·646f·636b·6572·222c··ot·in·["docker", | |||
| 00047a50:·2022·6c78·6322·2c20·226f·7065·6e76·7a22···"lxc",·"openvz" | |||
| 00047a60:·2c20·2270·6f64·6d61·6e22·2c20·2263·6f6e··,·"podman",·"con | |||
| 00047a70:·7461·696e·6572·225d·0a20·202d·2027·2261··tainer"].··-·'"a | |||
| 00047a80:·7564·6974·2220·696e·2061·6e73·6962·6c65··udit"·in·ansible | |||
| 00047a | 00047a20:·202d·2027·2261·7564·6974·2220·696e·2061···-·'"audit"·in·a | ||
| 00047a30:·6e73·6962·6c65·5f66·6163·7473·2e70·6163··nsible_facts.pac | |||
| 00047a40:·6b61·6765·7327·0a20·202d·2061·6e73·6962··kages'.··-·ansib | |||
| 00047a50:·6c65·5f76·6972·7475·616c·697a·6174·696f··le_virtualizatio | |||
| 00047a60:·6e5f·7479·7065·206e·6f74·2069·6e20·5b22··n_type·not·in·[" | |||
| 00047a70:·646f·636b·6572·222c·2022·6c78·6322·2c20··docker",·"lxc",· | |||
| 00047a80:·226f·7065·6e76·7a22·2c20·2270·6f64·6d61··"openvz",·"podma | |||
| 00047a90:·6e22·2c20·2263·6f6e·7461·696e·6572·225d··n",·"container"] | |||
| 00047aa0:·0a20·202d·2061·6e73·6962·6c65·5f61·7263··.··-·ansible_arc | 00047aa0:·0a20·202d·2061·6e73·6962·6c65·5f61·7263··.··-·ansible_arc | ||
| 00047ab0:·6869·7465·6374·7572·6520·3d3d·2022·6161··hitecture·==·"aa | 00047ab0:·6869·7465·6374·7572·6520·3d3d·2022·6161··hitecture·==·"aa | ||
| 00047ac0:·7263·6836·3422·206f·7220·616e·7369·626c··rch64"·or·ansibl | 00047ac0:·7263·6836·3422·206f·7220·616e·7369·626c··rch64"·or·ansibl | ||
| 00047ad0:·655f·6172·6368·6974·6563·7475·7265·203d··e_architecture·= | 00047ad0:·655f·6172·6368·6974·6563·7475·7265·203d··e_architecture·= | ||
| 00047ae0:·3d20·2270·7063·3634·2220·6f72·2061·6e73··=·"ppc64"·or·ans | 00047ae0:·3d20·2270·7063·3634·2220·6f72·2061·6e73··=·"ppc64"·or·ans | ||
| 00047af0:·6962·6c65·5f61·7263·6869·7465·6374·7572··ible_architectur | 00047af0:·6962·6c65·5f61·7263·6869·7465·6374·7572··ible_architectur | ||
| 00047b00:·650a·2020·2020·3d3d·2022·7070·6336·346c··e.····==·"ppc64l | 00047b00:·650a·2020·2020·3d3d·2022·7070·6336·346c··e.····==·"ppc64l | ||
| Offset 18644, 23 lines modified | Offset 18644, 23 lines modified | ||
| 00048d30:·6d65·5f72·756c·6573·0a20·2020·2020·2063··me_rules.······c | 00048d30:·6d65·5f72·756c·6573·0a20·2020·2020·2063··me_rules.······c | ||
| 00048d40:·7265·6174·653a·2074·7275·650a·2020·2020··reate:·true.···· | 00048d40:·7265·6174·653a·2074·7275·650a·2020·2020··reate:·true.···· | ||
| 00048d50:·2020·6d6f·6465·3a20·6f2d·7277·780a·2020····mode:·o-rwx.·· | 00048d50:·2020·6d6f·6465·3a20·6f2d·7277·780a·2020····mode:·o-rwx.·· | ||
| 00048d60:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | 00048d60:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | ||
| 00048d70:·6e74·0a20·2020·2077·6865·6e3a·2073·7973··nt.····when:·sys | 00048d70:·6e74·0a20·2020·2077·6865·6e3a·2073·7973··nt.····when:·sys | ||
| 00048d80:·6361·6c6c·735f·666f·756e·6420·7c20·6c65··calls_found·|·le | 00048d80:·6361·6c6c·735f·666f·756e·6420·7c20·6c65··calls_found·|·le | ||
| 00048d90:·6e67·7468·203d·3d20·300a·2020·7768·656e··ngth·==·0.··when | 00048d90:·6e67·7468·203d·3d20·300a·2020·7768·656e··ngth·==·0.··when | ||
| 00048da0:·3a0a·2020·2d20·616e·7369·626c·655f·7669··:.··-·ansible_vi | |||
| 00048db0:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 00048dc0:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 00048dd0:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 00048de0:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 00048df0:·636f·6e74·6169·6e65·7222·5d0a·2020·2d20··container"].··-· | |||
| 00048e00:·2722·6175·6469·7422·2069·6e20·616e·7369··'"audit"·in·ansi | |||
| 00048 | 00048da0:·3a0a·2020·2d20·2722·6175·6469·7422·2069··:.··-·'"audit"·i | ||
| 00048db0:·6e20·616e·7369·626c·655f·6661·6374·732e··n·ansible_facts. | |||
| 00048dc0:·7061·636b·6167·6573·270a·2020·2d20·616e··packages'.··-·an | |||
| 00048dd0:·7369·626c·655f·7669·7274·7561·6c69·7a61··sible_virtualiza | |||
| 00048de0:·7469·6f6e·5f74·7970·6520·6e6f·7420·696e··tion_type·not·in | |||
| 00048df0:·205b·2264·6f63·6b65·7222·2c20·226c·7863···["docker",·"lxc | |||
| 00048e00:·222c·2022·6f70·656e·767a·222c·2022·706f··",·"openvz",·"po | |||
| 00048e10:·646d·616e·222c·2022·636f·6e74·6169·6e65··dman",·"containe | |||
| 00048e20:· | 00048e20:·7222·5d0a·2020·7461·6773·3a0a·2020·2d20··r"].··tags:.··-· | ||
| 00048e30:·434a·4953·2d35·2e34·2e31·2e31·0a20·202d··CJIS-5.4.1.1.··- | 00048e30:·434a·4953·2d35·2e34·2e31·2e31·0a20·202d··CJIS-5.4.1.1.··- | ||
| 00048e40:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | 00048e40:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | ||
| 00048e50:·312e·370a·2020·2d20·4e49·5354·2d38·3030··1.7.··-·NIST-800 | 00048e50:·312e·370a·2020·2d20·4e49·5354·2d38·3030··1.7.··-·NIST-800 | ||
| 00048e60:·2d35·332d·4143·2d36·2839·290a·2020·2d20··-53-AC-6(9).··-· | 00048e60:·2d35·332d·4143·2d36·2839·290a·2020·2d20··-53-AC-6(9).··-· | ||
| 00048e70:·4e49·5354·2d38·3030·2d35·332d·4155·2d31··NIST-800-53-AU-1 | 00048e70:·4e49·5354·2d38·3030·2d35·332d·4155·2d31··NIST-800-53-AU-1 | ||
| 00048e80:·3228·6329·0a20·202d·204e·4953·542d·3830··2(c).··-·NIST-80 | 00048e80:·3228·6329·0a20·202d·204e·4953·542d·3830··2(c).··-·NIST-80 | ||
| 00048e90:·302d·3533·2d41·552d·3228·6429·0a20·202d··0-53-AU-2(d).··- | 00048e90:·302d·3533·2d41·552d·3228·6429·0a20·202d··0-53-AU-2(d).··- | ||
| Offset 18944, 22 lines modified | Offset 18944, 22 lines modified | ||
| 00049ff0:·756c·6573·0a20·2020·2020·2063·7265·6174··ules.······creat | 00049ff0:·756c·6573·0a20·2020·2020·2063·7265·6174··ules.······creat | ||
| 0004a000:·653a·2074·7275·650a·2020·2020·2020·6d6f··e:·true.······mo | 0004a000:·653a·2074·7275·650a·2020·2020·2020·6d6f··e:·true.······mo | ||
| 0004a010:·6465·3a20·6f2d·7277·780a·2020·2020·2020··de:·o-rwx.······ | 0004a010:·6465·3a20·6f2d·7277·780a·2020·2020·2020··de:·o-rwx.······ | ||
| 0004a020:·7374·6174·653a·2070·7265·7365·6e74·0a20··state:·present.· | 0004a020:·7374·6174·653a·2070·7265·7365·6e74·0a20··state:·present.· | ||
| 0004a030:·2020·2077·6865·6e3a·2073·7973·6361·6c6c·····when:·syscall | 0004a030:·2020·2077·6865·6e3a·2073·7973·6361·6c6c·····when:·syscall | ||
| 0004a040:·735f·666f·756e·6420·7c20·6c65·6e67·7468··s_found·|·length | 0004a040:·735f·666f·756e·6420·7c20·6c65·6e67·7468··s_found·|·length | ||
| 0004a050:·203d·3d20·300a·2020·7768·656e·3a0a·2020···==·0.··when:.·· | 0004a050:·203d·3d20·300a·2020·7768·656e·3a0a·2020···==·0.··when:.·· | ||
| 0004a060:·2d20·616e·7369·626c·655f·7669·7274·7561··-·ansible_virtua | |||
| 0004a070:·6c69·7a61·7469·6f6e·5f74·7970·6520·6e6f··lization_type·no | |||
| 0004a080:·7420·696e·205b·2264·6f63·6b65·7222·2c20··t·in·["docker",· | |||
| 0004a090:·226c·7863·222c·2022·6f70·656e·767a·222c··"lxc",·"openvz", | |||
| 0004a0a0:·2022·706f·646d·616e·222c·2022·636f·6e74···"podman",·"cont | |||
| 0004a0b0:·6169·6e65·7222·5d0a·2020·2d20·2722·6175··ainer"].··-·'"au | |||
| 0004a0c0:·6469·7422·2069·6e20·616e·7369·626c·655f··dit"·in·ansible_ | |||
| 0004a0 | 0004a060:·2d20·2722·6175·6469·7422·2069·6e20·616e··-·'"audit"·in·an | ||
| 0004a070:·7369·626c·655f·6661·6374·732e·7061·636b··sible_facts.pack | |||
| 0004a080:·6167·6573·270a·2020·2d20·616e·7369·626c··ages'.··-·ansibl | |||
| 0004a090:·655f·7669·7274·7561·6c69·7a61·7469·6f6e··e_virtualization | |||
| 0004a0a0:·5f74·7970·6520·6e6f·7420·696e·205b·2264··_type·not·in·["d | |||
| 0004a0b0:·6f63·6b65·7222·2c20·226c·7863·222c·2022··ocker",·"lxc",·" | |||
| 0004a0c0:·6f70·656e·767a·222c·2022·706f·646d·616e··openvz",·"podman | |||
| 0004a0d0:·222c·2022·636f·6e74·6169·6e65·7222·5d0a··",·"container"]. | |||
| 0004a0e0:·2020·2d20·6175·6469·745f·6172·6368·203d····-·audit_arch·= | 0004a0e0:·2020·2d20·6175·6469·745f·6172·6368·203d····-·audit_arch·= | ||
| 0004a0f0:·3d20·2262·3634·220a·2020·7461·6773·3a0a··=·"b64".··tags:. | 0004a0f0:·3d20·2262·3634·220a·2020·7461·6773·3a0a··=·"b64".··tags:. | ||
| 0004a100:·2020·2d20·434a·4953·2d35·2e34·2e31·2e31····-·CJIS-5.4.1.1 | 0004a100:·2020·2d20·434a·4953·2d35·2e34·2e31·2e31····-·CJIS-5.4.1.1 | ||
| 0004a110:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | 0004a110:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | ||
| 0004a120:·312d·332e·312e·370a·2020·2d20·4e49·5354··1-3.1.7.··-·NIST | 0004a120:·312d·332e·312e·370a·2020·2d20·4e49·5354··1-3.1.7.··-·NIST | ||
| 0004a130:·2d38·3030·2d35·332d·4143·2d36·2839·290a··-800-53-AC-6(9). | 0004a130:·2d38·3030·2d35·332d·4143·2d36·2839·290a··-800-53-AC-6(9). | ||
| 0004a140:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | 0004a140:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | ||
| Offset 22393, 23 lines modified | Offset 22393, 23 lines modified | ||
| 00057780:·2063·6f6e·7461·696e·733a·205e·5c73·2a2d···contains:·^\s*- | 00057780:·2063·6f6e·7461·696e·733a·205e·5c73·2a2d···contains:·^\s*- | ||
| 00057790:·775c·732b·2f65·7463·2f73·7564·6f65·7273··w\s+/etc/sudoers | 00057790:·775c·732b·2f65·7463·2f73·7564·6f65·7273··w\s+/etc/sudoers | ||
| 000577a0:·5c73·2b2d·705c·732b·7761·285c·737c·2429··\s+-p\s+wa(\s|$) | 000577a0:·5c73·2b2d·705c·732b·7761·285c·737c·2429··\s+-p\s+wa(\s|$) | ||
| 000577b0:·2b0a·2020·2020·7061·7474·6572·6e73·3a20··+.····patterns:· | 000577b0:·2b0a·2020·2020·7061·7474·6572·6e73·3a20··+.····patterns:· | ||
| 000577c0:·272a·2e72·756c·6573·270a·2020·7265·6769··'*.rules'.··regi | 000577c0:·272a·2e72·756c·6573·270a·2020·7265·6769··'*.rules'.··regi | ||
| 000577d0:·7374·6572·3a20·6669·6e64·5f65·7869·7374··ster:·find_exist | 000577d0:·7374·6572·3a20·6669·6e64·5f65·7869·7374··ster:·find_exist | ||
| 000577e0:·696e·675f·7761·7463·685f·7275·6c65·735f··ing_watch_rules_ | 000577e0:·696e·675f·7761·7463·685f·7275·6c65·735f··ing_watch_rules_ | ||
| 000577f0:·640a·2020·7768·656e·3a0a·2020·2d20· | 000577f0:·640a·2020·7768·656e·3a0a·2020·2d20·2722··d.··when:.··-·'" | ||
| 00057800:·7369·626c·655f·7669·7274·7561·6c69·7a61··sible_virtualiza | |||
| 00057810:·7469·6f6e·5f74·7970·6520·6e6f·7420·696e··tion_type·not·in | |||
| 00057820:·205b·2264·6f63·6b65·7222·2c20·226c·7863···["docker",·"lxc | |||
| 00057830:·222c·2022·6f70·656e·767a·222c·2022·706f··",·"openvz",·"po | |||
| 00057840:·646d·616e·222c·2022·636f·6e74·6169·6e65··dman",·"containe | |||
| 00057850:·7222·5d0a·2020·2d20·2722·6175·6469·7422··r"].··-·'"audit" | |||
| 00057860:·2069·6e20·616e·7369·626c·655f·6661·6374···in·ansible_fact | |||
| 000578 | 00057800:·6175·6469·7422·2069·6e20·616e·7369·626c··audit"·in·ansibl | ||
| 00057810:·655f·6661·6374·732e·7061·636b·6167·6573··e_facts.packages | |||
| 00057820:·270a·2020·2d20·616e·7369·626c·655f·7669··'.··-·ansible_vi | |||
| 00057830:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 00057840:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| Max diff block lines reached; 1133707/1143083 bytes (99.18%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·18.04·LTS·Benchmark | 38 | Profile·Title·CIS·Ubuntu·18.04·LTS·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·System_Accounting_with_auditd | 48 | ·········2.·System_Accounting_with_auditd |
| 49 | ·········3.·Network_Configuration_and_Firewalls | 49 | ·········3.·Network_Configuration_and_Firewalls |
| 50 | ·········4.·File_Permissions_and_Masks | 50 | ·········4.·File_Permissions_and_Masks |
| 51 | ···2.·Services | 51 | ···2.·Services |
| Offset 369, 16 lines modified | Offset 369, 16 lines modified | ||
| 369 | ··-·no_reboot_needed | 369 | ··-·no_reboot_needed |
| 370 | ··-·restrict_strategy | 370 | ··-·restrict_strategy |
| 371 | -·name:·Set·architecture·for·audit·tasks | 371 | -·name:·Set·architecture·for·audit·tasks |
| 372 | ··set_fact: | 372 | ··set_fact: |
| 373 | ····audit_arch:·b64 | 373 | ····audit_arch:·b64 |
| 374 | ··when: | 374 | ··when: |
| 375 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 376 | ··-·'"audit"·in·ansible_facts.packages' | 375 | ··-·'"audit"·in·ansible_facts.packages' |
| 376 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 377 | ··-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 377 | ··-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 378 | ····==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 378 | ····==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 379 | ··tags: | 379 | ··tags: |
| 380 | ··-·CJIS-5.4.1.1 | 380 | ··-·CJIS-5.4.1.1 |
| 381 | ··-·NIST-800-171-3.1.7 | 381 | ··-·NIST-800-171-3.1.7 |
| 382 | ··-·NIST-800-53-AC-6(9) | 382 | ··-·NIST-800-53-AC-6(9) |
| 383 | ··-·NIST-800-53-AU-12(c) | 383 | ··-·NIST-800-53-AU-12(c) |
| Offset 513, 16 lines modified | Offset 513, 16 lines modified | ||
| 513 | ······path:·'{{·audit_file·}}' | 513 | ······path:·'{{·audit_file·}}' |
| 514 | ······line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_time_rules | 514 | ······line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_time_rules |
| 515 | ······create:·true | 515 | ······create:·true |
| 516 | ······mode:·o-rwx | 516 | ······mode:·o-rwx |
| 517 | ······state:·present | 517 | ······state:·present |
| 518 | ····when:·syscalls_found·|·length·==·0 | 518 | ····when:·syscalls_found·|·length·==·0 |
| 519 | ··when: | 519 | ··when: |
| 520 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 521 | ··-·'"audit"·in·ansible_facts.packages' | 520 | ··-·'"audit"·in·ansible_facts.packages' |
| 521 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 522 | ··tags: | 522 | ··tags: |
| 523 | ··-·CJIS-5.4.1.1 | 523 | ··-·CJIS-5.4.1.1 |
| 524 | ··-·NIST-800-171-3.1.7 | 524 | ··-·NIST-800-171-3.1.7 |
| 525 | ··-·NIST-800-53-AC-6(9) | 525 | ··-·NIST-800-53-AC-6(9) |
| 526 | ··-·NIST-800-53-AU-12(c) | 526 | ··-·NIST-800-53-AU-12(c) |
| 527 | ··-·NIST-800-53-AU-2(d) | 527 | ··-·NIST-800-53-AU-2(d) |
| 528 | ··-·NIST-800-53-CM-6(a) | 528 | ··-·NIST-800-53-CM-6(a) |
| Offset 654, 16 lines modified | Offset 654, 16 lines modified | ||
| 654 | ······path:·'{{·audit_file·}}' | 654 | ······path:·'{{·audit_file·}}' |
| 655 | ······line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_time_rules | 655 | ······line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_time_rules |
| 656 | ······create:·true | 656 | ······create:·true |
| 657 | ······mode:·o-rwx | 657 | ······mode:·o-rwx |
| 658 | ······state:·present | 658 | ······state:·present |
| 659 | ····when:·syscalls_found·|·length·==·0 | 659 | ····when:·syscalls_found·|·length·==·0 |
| 660 | ··when: | 660 | ··when: |
| 661 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 662 | ··-·'"audit"·in·ansible_facts.packages' | 661 | ··-·'"audit"·in·ansible_facts.packages' |
| 662 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 663 | ··-·audit_arch·==·"b64" | 663 | ··-·audit_arch·==·"b64" |
| 664 | ··tags: | 664 | ··tags: |
| 665 | ··-·CJIS-5.4.1.1 | 665 | ··-·CJIS-5.4.1.1 |
| 666 | ··-·NIST-800-171-3.1.7 | 666 | ··-·NIST-800-171-3.1.7 |
| 667 | ··-·NIST-800-53-AC-6(9) | 667 | ··-·NIST-800-53-AC-6(9) |
| 668 | ··-·NIST-800-53-AU-12(c) | 668 | ··-·NIST-800-53-AU-12(c) |
| 669 | ··-·NIST-800-53-AU-2(d) | 669 | ··-·NIST-800-53-AU-2(d) |
| Offset 831, 16 lines modified | Offset 831, 16 lines modified | ||
| 831 | -·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 831 | -·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 832 | ··find: | 832 | ··find: |
| 833 | ····paths:·/etc/audit/rules.d | 833 | ····paths:·/etc/audit/rules.d |
| 834 | ····contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 834 | ····contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 835 | ····patterns:·'*.rules' | 835 | ····patterns:·'*.rules' |
| 836 | ··register:·find_existing_watch_rules_d | 836 | ··register:·find_existing_watch_rules_d |
| 837 | ··when: | 837 | ··when: |
| 838 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 839 | ··-·'"audit"·in·ansible_facts.packages' | 838 | ··-·'"audit"·in·ansible_facts.packages' |
| 839 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 840 | ··tags: | 840 | ··tags: |
| 841 | ··-·CJIS-5.4.1.1 | 841 | ··-·CJIS-5.4.1.1 |
| 842 | ··-·NIST-800-171-3.1.7 | 842 | ··-·NIST-800-171-3.1.7 |
| 843 | ··-·NIST-800-53-AC-2(7)(b) | 843 | ··-·NIST-800-53-AC-2(7)(b) |
| 844 | ··-·NIST-800-53-AC-6(9) | 844 | ··-·NIST-800-53-AC-6(9) |
| 845 | ··-·NIST-800-53-AU-12(c) | 845 | ··-·NIST-800-53-AU-12(c) |
| 846 | ··-·NIST-800-53-AU-2(d) | 846 | ··-·NIST-800-53-AU-2(d) |
| Offset 857, 16 lines modified | Offset 857, 16 lines modified | ||
| 857 | -·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 857 | -·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| 858 | ··find: | 858 | ··find: |
| 859 | ····paths:·/etc/audit/rules.d | 859 | ····paths:·/etc/audit/rules.d |
| 860 | ····contains:·^.*(?:-F·key=|-k\s+)actions$ | 860 | ····contains:·^.*(?:-F·key=|-k\s+)actions$ |
| 861 | ····patterns:·'*.rules' | 861 | ····patterns:·'*.rules' |
| 862 | ··register:·find_watch_key | 862 | ··register:·find_watch_key |
| 863 | ··when: | 863 | ··when: |
| 864 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 865 | ··-·'"audit"·in·ansible_facts.packages' | 864 | ··-·'"audit"·in·ansible_facts.packages' |
| 865 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 866 | ··-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 866 | ··-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 867 | ····==·0 | 867 | ····==·0 |
| 868 | ··tags: | 868 | ··tags: |
| 869 | ··-·CJIS-5.4.1.1 | 869 | ··-·CJIS-5.4.1.1 |
| 870 | ··-·NIST-800-171-3.1.7 | 870 | ··-·NIST-800-171-3.1.7 |
| 871 | ··-·NIST-800-53-AC-2(7)(b) | 871 | ··-·NIST-800-53-AC-2(7)(b) |
| 872 | ··-·NIST-800-53-AC-6(9) | 872 | ··-·NIST-800-53-AC-6(9) |
| Offset 883, 16 lines modified | Offset 883, 16 lines modified | ||
| 883 | ··-·restrict_strategy | 883 | ··-·restrict_strategy |
| 884 | -·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule | 884 | -·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule |
| 885 | ··set_fact: | 885 | ··set_fact: |
| 886 | ····all_files: | 886 | ····all_files: |
| 887 | ····-·/etc/audit/rules.d/actions.rules | 887 | ····-·/etc/audit/rules.d/actions.rules |
| 888 | ··when: | 888 | ··when: |
| 889 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 890 | ··-·'"audit"·in·ansible_facts.packages' | 889 | ··-·'"audit"·in·ansible_facts.packages' |
| 890 | ··-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 891 | ··-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and | 891 | ··-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and |
| 892 | find_existing_watch_rules_d.matched | 892 | find_existing_watch_rules_d.matched |
| 893 | ····is·defined·and·find_existing_watch_rules_d.matched·==·0 | 893 | ····is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 894 | ··tags: | 894 | ··tags: |
| 895 | ··-·CJIS-5.4.1.1 | 895 | ··-·CJIS-5.4.1.1 |
| 896 | ··-·NIST-800-171-3.1.7 | 896 | ··-·NIST-800-171-3.1.7 |
| 897 | ··-·NIST-800-53-AC-2(7)(b) | 897 | ··-·NIST-800-53-AC-2(7)(b) |
| Offset 910, 16 lines modified | Offset 910, 16 lines modified | ||
| 910 | ··-·restrict_strategy | 910 | ··-·restrict_strategy |
| 911 | -·name:·Use·matched·file·as·the·recipient·for·the·rule | 911 | -·name:·Use·matched·file·as·the·recipient·for·the·rule |
| Max diff block lines reached; 149055/153708 bytes (96.97%) of diff not shown. | |||
| Offset 14287, 16 lines modified | Offset 14287, 16 lines modified | ||
| 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·2020·2020·2028·6173·206f·6620·3230·323 | 00037d50:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00037d60:·2d30·3 | 00037d60:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 17226, 130 lines modified | Offset 17226, 130 lines modified | ||
| 00043490:·6574·3d22·2369·646d·3534·3830·2220·7461··et="#idm5480"·ta | 00043490:·6574·3d22·2369·646d·3534·3830·2220·7461··et="#idm5480"·ta | ||
| 000434a0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 000434a0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 000434b0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 000434b0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 000434c0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 000434c0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 000434d0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 000434d0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 000434e0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 000434e0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 000434f0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 000434f0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 00043500:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | |||
| 00043510:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 00043520:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 00043530:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 00043540:·2269·646d·3534·3830·223e·3c74·6162·6c65··"idm5480"><table | |||
| 00043550:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 00043560:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 00043570:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 00043580:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 00043590:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 00043500:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 00043510:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 00043520:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 00043530:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 00043540:·6964·3d22·6964·6d35·3438·3022·3e3c·7461··id="idm5480"><ta | |||
| 00043550:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 00043560:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 00043570:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 00043580:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 00043590:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 000435a0:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 000435b0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 000435c0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 000435 | 000435a0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 000435e0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 000435f0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 00043600:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 00043610:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 00043620:·6e61·6d65·3a20·456e·7375·7265·2061·7564··name:·Ensure·aud | |||
| 00043630:·6974·6420·6973·2069·6e73·7461·6c6c·6564··itd·is·installed | |||
| 00043640:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 00043650:·6e61·6d65·3a20·6175·6469·7464·0a20·2020··name:·auditd.··· | |||
| 00043660:·2073·7461·7465·3a20·7072·6573·656e·740a···state:·present. | |||
| 00043670:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 00043680:·7669·7274·7561·6c69·7a61·7469·6f6e·5f74··virtualization_t | |||
| 00043690:·7970·6520·6e6f·7420·696e·205b·2264·6f63··ype·not·in·["doc | |||
| 000436a0:·6b65·7222·2c20·226c·7863·222c·2022·6f70··ker",·"lxc",·"op | |||
| 000436b0:·656e·767a·222c·2022·706f·646d·616e·222c··envz",·"podman", | |||
| 000436c0:·2022·636f·6e74·6169·6e65·7222·5d0a·2020···"container"].·· | |||
| 000436d0:·7461·6773·3a0a·2020·2d20·4e49·5354·2d38··tags:.··-·NIST-8 | |||
| 000436e0:·3030·2d35·332d·4143·2d37·2861·290a·2020··00-53-AC-7(a).·· | |||
| 000436f0:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 00043 | 000435b0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 000435c0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 000435d0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 000435e0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 000435f0:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 00043600:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 00043610:·3c70·7265·3e3c·636f·6465·3e23·2052·656d··<pre><code>#·Rem | |||
| 00043620:·6564·6961·7469·6f6e·2069·7320·6170·706c··ediation·is·appl | |||
| 00043630:·6963·6162·6c65·206f·6e6c·7920·696e·2063··icable·only·in·c | |||
| 00043640:·6572·7461·696e·2070·6c61·7466·6f72·6d73··ertain·platforms | |||
| 00043650:·0a69·6620·5b20·2120·2d66·202f·2e64·6f63··.if·[·!·-f·/.doc | |||
| 00043660:·6b65·7265·6e76·205d·2026·616d·703b·2661··kerenv·]·&&a | |||
| 00043670:·6d70·3b20·5b20·2120·2d66·202f·7275·6e2f··mp;·[·!·-f·/run/ | |||
| 00043680:·2e63·6f6e·7461·696e·6572·656e·7620·5d3b··.containerenv·]; | |||
| 00043690:·2074·6865·6e0a·0a44·4542·4941·4e5f·4652···then..DEBIAN_FR | |||
| 000436a0:·4f4e·5445·4e44·3d6e·6f6e·696e·7465·7261··ONTEND=nonintera | |||
| 000436b0:·6374·6976·6520·6170·742d·6765·7420·696e··ctive·apt-get·in | |||
| 000436c0:·7374·616c·6c20·2d79·2022·6175·6469·7464··stall·-y·"auditd | |||
| 000436d0:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 000436e0:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 000436f0:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 00043700:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 00043710:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 00043720:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 00043730:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 00043740:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 00043750:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 00043760:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 00043770:·743d·2223·6964·6d35·3438·3122·2074·6162··t="#idm5481"·tab | |||
| 00043780:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 00043790:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 000437a0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 000437b0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 000437c0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 000437d0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 000437e0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 000437f0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 00043800:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 00043810:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 00043820:·643d·2269·646d·3534·3831·223e·3c74·6162··d="idm5481"><tab | |||
| 00043830:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 00043840:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 00043850:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 00043860:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 00043870:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 00043880:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 00043890:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 000438a0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 000438b0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 000438c0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 000438d0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 000438e0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 000438f0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 00043900:·616d·653a·2045·6e73·7572·6520·6175·6469··ame:·Ensure·audi | |||
| 00043910:·7464·2069·7320·696e·7374·616c·6c65·640a··td·is·installed. | |||
| 00043920:·2020·7061·636b·6167·653a·0a20·2020·206e····package:.····n | |||
| 00043930:·616d·653a·2061·7564·6974·640a·2020·2020··ame:·auditd.···· | |||
| 00043940:·7374·6174·653a·2070·7265·7365·6e74·0a20··state:·present.· | |||
| 00043950:·2077·6865·6e3a·2061·6e73·6962·6c65·5f76···when:·ansible_v | |||
| 00043960:·6972·7475·616c·697a·6174·696f·6e5f·7479··irtualization_ty | |||
| 00043970:·7065·206e·6f74·2069·6e20·5b22·646f·636b··pe·not·in·["dock | |||
| Max diff block lines reached; 654346/672202 bytes (97.34%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·18.04 | 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·18.04 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ | 42 | ····*·cpe:/o:canonical:ubuntu_linux:18.04::~~lts~~~ |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·Configure_Syslog | 50 | ·········3.·Configure_Syslog |
| 51 | ·········4.·File_Permissions_and_Masks | 51 | ·········4.·File_Permissions_and_Masks |
| 52 | ···2.·Services | 52 | ···2.·Services |
| Offset 246, 14 lines modified | Offset 246, 26 lines modified | ||
| 246 | include·install_auditd | 246 | include·install_auditd |
| 247 | class·install_auditd·{ | 247 | class·install_auditd·{ |
| 248 | ··package·{·'auditd': | 248 | ··package·{·'auditd': |
| 249 | ····ensure·=>·'installed', | 249 | ····ensure·=>·'installed', |
| 250 | ··} | 250 | ··} |
| 251 | } | 251 | } |
| 252 | Remediation_Shell_script_⇲ | ||
| 253 | Complexity:·low | ||
| 254 | Disruption:·low | ||
| 255 | Strategy:···enable | ||
| 256 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 257 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 258 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"auditd" | ||
| 259 | else | ||
| 260 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 261 | fi | ||
| 252 | Remediation_Ansible_snippet_⇲ | 262 | Remediation_Ansible_snippet_⇲ |
| 253 | Complexity:·low | 263 | Complexity:·low |
| 254 | Disruption:·low | 264 | Disruption:·low |
| 255 | Strategy:···enable | 265 | Strategy:···enable |
| 256 | -·name:·Ensure·auditd·is·installed | 266 | -·name:·Ensure·auditd·is·installed |
| 257 | ··package: | 267 | ··package: |
| 258 | ····name:·auditd | 268 | ····name:·auditd |
| Offset 275, 26 lines modified | Offset 287, 14 lines modified | ||
| 275 | ··-·no_reboot_needed | 287 | ··-·no_reboot_needed |
| 276 | ··-·package_audit_installed | 288 | ··-·package_audit_installed |
| 277 | Remediation_OSBuild_Blueprint_snippet_⇲ | 289 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 278 | [[packages]] | 290 | [[packages]] |
| 279 | name·=·"auditd" | 291 | name·=·"auditd" |
| 280 | version·=·"*" | 292 | version·=·"*" |
| 281 | Remediation_Shell_script_⇲ | ||
| 282 | Complexity:·low | ||
| 283 | Disruption:·low | ||
| 284 | Strategy:···enable | ||
| 285 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 286 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 287 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"auditd" | ||
| 288 | else | ||
| 289 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 290 | fi | ||
| 291 | ***·Rule ·Enable·auditd·Service· [ref]·*** | 293 | ***·Rule ·Enable·auditd·Service· [ref]·*** |
| 292 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is | 294 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is |
| 293 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following | 295 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following |
| 294 | command: | 296 | command: |
| 295 | $·sudo·systemctl·enable·auditd.service | 297 | $·sudo·systemctl·enable·auditd.service |
| 296 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, | 298 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, |
| 297 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the | 299 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the |
| Offset 341, 14 lines modified | Offset 341, 30 lines modified | ||
| 341 | class·enable_auditd·{ | 341 | class·enable_auditd·{ |
| 342 | ··service·{'auditd': | 342 | ··service·{'auditd': |
| 343 | ····enable·=>·true, | 343 | ····enable·=>·true, |
| 344 | ····ensure·=>·'running', | 344 | ····ensure·=>·'running', |
| 345 | ··} | 345 | ··} |
| 346 | } | 346 | } |
| 347 | Remediation_Shell_script_⇲ | ||
| 348 | Complexity:·low | ||
| 349 | Disruption:·low | ||
| 350 | Strategy:···enable | ||
| 351 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 352 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 353 | Status-Status}\n'·'audit'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 354 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 355 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 356 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 357 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 358 | else | ||
| 359 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 360 | fi | ||
| 347 | Remediation_Ansible_snippet_⇲ | 361 | Remediation_Ansible_snippet_⇲ |
| 348 | Complexity:·low | 362 | Complexity:·low |
| 349 | Disruption:·low | 363 | Disruption:·low |
| 350 | Strategy:···enable | 364 | Strategy:···enable |
| 351 | -·name:·Gather·the·package·facts | 365 | -·name:·Gather·the·package·facts |
| 352 | ··package_facts: | 366 | ··package_facts: |
| 353 | ····manager:·auto | 367 | ····manager:·auto |
| Offset 413, 30 lines modified | Offset 429, 14 lines modified | ||
| 413 | ··-·medium_severity | 429 | ··-·medium_severity |
| 414 | ··-·no_reboot_needed | 430 | ··-·no_reboot_needed |
| 415 | ··-·service_auditd_enabled | 431 | ··-·service_auditd_enabled |
| 416 | Remediation_OSBuild_Blueprint_snippet_⇲ | 432 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 417 | [customizations.services] | 433 | [customizations.services] |
| 418 | enabled·=·["auditd"] | 434 | enabled·=·["auditd"] |
| 419 | Remediation_Shell_script_⇲ | ||
| 420 | Complexity:·low | ||
| 421 | Disruption:·low | ||
| 422 | Strategy:···enable | ||
| 423 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 424 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 425 | Status-Status}\n'·'audit'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 426 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 427 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 428 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 429 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 430 | else | ||
| 431 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 432 | fi | ||
| 433 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules | 435 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules |
| 434 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It | 436 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It |
| 435 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for | 437 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for |
| Max diff block lines reached; 85297/89402 bytes (95.41%) of diff not shown. | |||
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d20:·7320·6f66·2032·3032·3 | 00037d20:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15292, 124 lines modified | Offset 15292, 124 lines modified | ||
| 0003bbb0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003bbb0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003bbc0:·2223·6964·6d32·3835·3022·2074·6162·696e··"#idm2850"·tabin | 0003bbc0:·2223·6964·6d32·3835·3022·2074·6162·696e··"#idm2850"·tabin | ||
| 0003bbd0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003bbd0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003bbe0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003bbe0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003bbf0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003bbf0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003bc00:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003bc00:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003bc10:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003bc10:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003bc20:·3e52·656d·6564·6961·7469·6f6e·20 | 0003bc20:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 0003bc30:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | |||
| 0003bc40:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003bc50:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003bc60:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003bc70:·6d32·3835·3022·3e3c·7461·626c·6520·636c··m2850"><table·cl | |||
| 0003bc80:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003bc90:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003bca0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003bcb0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003bcc0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003bc30:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003bc40:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bc50:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003bc60:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003bc70:·2269·646d·3238·3530·223e·3c74·6162·6c65··"idm2850"><table | |||
| 0003bc80:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003bc90:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003bca0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003bcb0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003bcc0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003bcd0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bce0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003bcf0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003bd0 | 0003bcd0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003bce0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bcf0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003bd00:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003bd10:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bd20:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003bd30:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003bd40:·653e·3c63·6f64·653e·2320·5265·6d65·6469··e><code>#·Remedi | |||
| 0003bd50:·6174·696f·6e20·6973·2061·7070·6c69·6361··ation·is·applica | |||
| 0003bd60:·626c·6520·6f6e·6c79·2069·6e20·6365·7274··ble·only·in·cert | |||
| 0003bd70:·6169·6e20·706c·6174·666f·726d·730a·6966··ain·platforms.if | |||
| 0003bd80:·205b·2021·202d·6620·2f2e·646f·636b·6572···[·!·-f·/.docker | |||
| 0003bd90:·656e·7620·5d20·2661·6d70·3b26·616d·703b··env·]·&& | |||
| 0003bda0:·205b·2021·202d·6620·2f72·756e·2f2e·636f···[·!·-f·/run/.co | |||
| 0003bdb0:·6e74·6169·6e65·7265·6e76·205d·3b20·7468··ntainerenv·];·th | |||
| 0003bdc0:·656e·0a0a·4445·4249·414e·5f46·524f·4e54··en..DEBIAN_FRONT | |||
| 0003bdd0:·454e·443d·6e6f·6e69·6e74·6572·6163·7469··END=noninteracti | |||
| 0003bde0:·7665·2061·7074·2d67·6574·2069·6e73·7461··ve·apt-get·insta | |||
| 0003bdf0:·6c6c·202d·7920·2261·6964·6522·0a0a·656c··ll·-y·"aide"..el | |||
| 0003be00:·7365·0a20·2020·2026·6774·3b26·616d·703b··se.····>& | |||
| 0003be10:·3220·6563·686f·2027·5265·6d65·6469·6174··2·echo·'Remediat | |||
| 0003be20:·696f·6e20·6973·206e·6f74·2061·7070·6c69··ion·is·not·appli | |||
| 0003be30:·6361·626c·652c·206e·6f74·6869·6e67·2077··cable,·nothing·w | |||
| 0003be40:·6173·2064·6f6e·6527·0a66·690a·3c2f·636f··as·done'.fi.</co | |||
| 0003be50:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003be60:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003be70:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bd10:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bd20:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003bd30:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003bd40:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003bd50:·653a·2045·6e73·7572·6520·6169·6465·2069··e:·Ensure·aide·i | |||
| 0003bd60:·7320·696e·7374·616c·6c65·640a·2020·7061··s·installed.··pa | |||
| 0003bd70:·636b·6167·653a·0a20·2020·206e·616d·653a··ckage:.····name: | |||
| 0003bd80:·2061·6964·650a·2020·2020·7374·6174·653a···aide.····state: | |||
| 0003bd90:·2070·7265·7365·6e74·0a20·2077·6865·6e3a···present.··when: | |||
| 0003bda0:·2061·6e73·6962·6c65·5f76·6972·7475·616c···ansible_virtual | |||
| 0003bdb0:·697a·6174·696f·6e5f·7479·7065·206e·6f74··ization_type·not | |||
| 0003bdc0:·2069·6e20·5b22·646f·636b·6572·222c·2022···in·["docker",·" | |||
| 0003bdd0:·6c78·6322·2c20·226f·7065·6e76·7a22·2c20··lxc",·"openvz",· | |||
| 0003bde0:·2270·6f64·6d61·6e22·2c20·2263·6f6e·7461··"podman",·"conta | |||
| 0003bdf0:·696e·6572·225d·0a20·2074·6167·733a·0a20··iner"].··tags:.· | |||
| 0003be00:·202d·2043·4a49·532d·352e·3130·2e31·2e33···-·CJIS-5.10.1.3 | |||
| 0003be10:·0a20·202d·2044·4953·412d·5354·4947·2d55··.··-·DISA-STIG-U | |||
| 0003be20:·4254·552d·3230·2d30·3130·3435·300a·2020··BTU-20-010450.·· | |||
| 0003be30:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003be40:·2d36·2861·290a·2020·2d20·5043·492d·4453··-6(a).··-·PCI-DS | |||
| 0003be50:·532d·5265·712d·3131·2e35·0a20·202d·2065··S-Req-11.5.··-·e | |||
| 0003be60:·6e61·626c·655f·7374·7261·7465·6779·0a20··nable_strategy.· | |||
| 0003be70:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 0003be80:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 0003be90:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 0003bea0:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 0003beb0:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 0003bec0:·2d20·7061·636b·6167·655f·6169·6465·5f69··-·package_aide_i | |||
| 0003bed0:·6e73·7461·6c6c·6564·0a3c·2f63·6f64·653e··nstalled.</code> | |||
| 0003bee0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003bef0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003bf00:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003bf10:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003bf20:·7461·2d74·6172·6765·743d·2223·6964·6d32··ta-target="#idm2 | |||
| 0003bf30:·3835·3122·2074·6162·696e·6465·783d·2230··851"·tabindex="0 | |||
| 0003bf40:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003bf50:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003bf60:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003bf70:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003bf80:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003bf90:·6961·7469·6f6e·204f·5342·7569·6c64·2042··iation·OSBuild·B | |||
| 0003bfa0:·6c75·6570·7269·6e74·2073·6e69·7070·6574··lueprint·snippet | |||
| 0003bfb0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bfc0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003b | 0003be80:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | ||
| 0003bfe0:·2069·643d·2269·646d·3238·3531·223e·3c70···id="idm2851"><p | |||
| 0003bff0:·7265·3e3c·636f·6465·3e0a·5b5b·7061·636b··re><code>.[[pack | |||
| 0003c000:·6167·6573·5d5d·0a6e·616d·6520·3d20·2261··ages]].name·=·"a | |||
| 0003c010:·6964·6522·0a76·6572·7369·6f6e·203d·2022··ide".version·=·" | |||
| 0003c020:·2a22·0a3c·2f63·6f64·653e·3c2f·7072·653e··*".</code></pre> | |||
| 0003c030:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c040:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003 | 0003be90:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| Max diff block lines reached; 3579015/3595905 bytes (99.53%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·20.04·Level·1·Server·Benchmark | 38 | Profile·Title·CIS·Ubuntu·20.04·Level·1·Server·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_server | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_server |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·GRUB2_bootloader_configuration | 49 | ·········3.·GRUB2_bootloader_configuration |
| 50 | ·········4.·Configure_Syslog | 50 | ·········4.·Configure_Syslog |
| 51 | ·········5.·Network_Configuration_and_Firewalls | 51 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 117, 14 lines modified | Offset 117, 26 lines modified | ||
| 117 | include·install_aide | 117 | include·install_aide |
| 118 | class·install_aide·{ | 118 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 119 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 120 | ····ensure·=>·'installed', |
| 121 | ··} | 121 | ··} |
| 122 | } | 122 | } |
| 123 | Remediation_Shell_script_⇲ | ||
| 124 | Complexity:·low | ||
| 125 | Disruption:·low | ||
| 126 | Strategy:···enable | ||
| 127 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 128 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 129 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 130 | else | ||
| 131 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 132 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 133 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 134 | Complexity:·low |
| 125 | Disruption:·low | 135 | Disruption:·low |
| 126 | Strategy:···enable | 136 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 137 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 138 | ··package: |
| 129 | ····name:·aide | 139 | ····name:·aide |
| Offset 142, 26 lines modified | Offset 154, 14 lines modified | ||
| 142 | ··-·no_reboot_needed | 154 | ··-·no_reboot_needed |
| 143 | ··-·package_aide_installed | 155 | ··-·package_aide_installed |
| 144 | Remediation_OSBuild_Blueprint_snippet_⇲ | 156 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 145 | [[packages]] | 157 | [[packages]] |
| 146 | name·=·"aide" | 158 | name·=·"aide" |
| 147 | version·=·"*" | 159 | version·=·"*" |
| 148 | Remediation_Shell_script_⇲ | ||
| 149 | Complexity:·low | ||
| 150 | Disruption:·low | ||
| 151 | Strategy:···enable | ||
| 152 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 153 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 154 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 155 | else | ||
| 156 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 157 | fi | ||
| 158 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 159 | Run·the·following·command·to·generate·a·new·database: | 161 | Run·the·following·command·to·generate·a·new·database: |
| 160 | $·sudo·aideinit | 162 | $·sudo·aideinit |
| 161 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 162 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure | 164 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure |
| 163 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 165 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 164 | database·can·be·installed·as·follows: | 166 | database·can·be·installed·as·follows: |
| Offset 175, 14 lines modified | Offset 175, 26 lines modified | ||
| 175 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 175 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 176 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 176 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 177 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 177 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 178 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 178 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 179 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 179 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 180 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 180 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 181 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 181 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 182 | Remediation_Shell_script_⇲ | ||
| 183 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 184 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 185 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 186 | /usr/sbin/aideinit | ||
| 187 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 188 | else | ||
| 189 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 190 | fi | ||
| 182 | Remediation_Ansible_snippet_⇲ | 191 | Remediation_Ansible_snippet_⇲ |
| 183 | Complexity:·low | 192 | Complexity:·low |
| 184 | Disruption:·low | 193 | Disruption:·low |
| 185 | Strategy:···restrict | 194 | Strategy:···restrict |
| 186 | -·name:·Ensure·AIDE·is·installed | 195 | -·name:·Ensure·AIDE·is·installed |
| 187 | ··package: | 196 | ··package: |
| 188 | ····name:·'{{·item·}}' | 197 | ····name:·'{{·item·}}' |
| Offset 247, 26 lines modified | Offset 259, 14 lines modified | ||
| 247 | ··-·PCI-DSS-Req-11.5 | 259 | ··-·PCI-DSS-Req-11.5 |
| 248 | ··-·aide_build_database | 260 | ··-·aide_build_database |
| 249 | ··-·low_complexity | 261 | ··-·low_complexity |
| 250 | ··-·low_disruption | 262 | ··-·low_disruption |
| 251 | ··-·medium_severity | 263 | ··-·medium_severity |
| 252 | ··-·no_reboot_needed | 264 | ··-·no_reboot_needed |
| 253 | ··-·restrict_strategy | 265 | ··-·restrict_strategy |
| 254 | Remediation_Shell_script_⇲ | ||
| 255 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 256 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 257 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 258 | /usr/sbin/aideinit | ||
| 259 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 260 | else | ||
| 261 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 262 | fi | ||
| 263 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 266 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 264 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 267 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 265 | using·cron,·add·the·following·line·to·/etc/crontab: | 268 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 266 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 269 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 267 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 270 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 268 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 271 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 269 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 272 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 289, 14 lines modified | Offset 289, 29 lines modified | ||
| 289 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 289 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 290 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 290 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 291 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 291 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 506707/511801 bytes (99.00%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d30:·206f·6620·3230·323 | 00037d30:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15283, 124 lines modified | Offset 15283, 124 lines modified | ||
| 0003bb20:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003bb20:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003bb30:·6d32·3835·3022·2074·6162·696e·6465·783d··m2850"·tabindex= | 0003bb30:·6d32·3835·3022·2074·6162·696e·6465·783d··m2850"·tabindex= | ||
| 0003bb40:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003bb40:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003bb50:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003bb50:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003bb60:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003bb60:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003bb70:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003bb70:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003bb80:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003bb80:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003bb90:·6564·6961·7469·6f6e·20 | 0003bb90:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0003bba0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | |||
| 0003bbb0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bbc0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bbd0:·6170·7365·2220·6964·3d22·6964·6d32·3835··apse"·id="idm285 | |||
| 0003bbe0:·3022·3e3c·7461·626c·6520·636c·6173·733d··0"><table·class= | |||
| 0003bbf0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003bc00:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003bc10:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003bc20:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003bc30:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003bba0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bbb0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bbc0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bbd0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bbe0:·3238·3530·223e·3c74·6162·6c65·2063·6c61··2850"><table·cla | |||
| 0003bbf0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bc00:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bc10:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bc20:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bc30:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bc40:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003bc50:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003bc60:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003bc | 0003bc40:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003bc50:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003bc60:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bc70:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003bc80:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003bc90:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003bca0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bcb0:·6f64·653e·2320·5265·6d65·6469·6174·696f··ode>#·Remediatio | |||
| 0003bcc0:·6e20·6973·2061·7070·6c69·6361·626c·6520··n·is·applicable· | |||
| 0003bcd0:·6f6e·6c79·2069·6e20·6365·7274·6169·6e20··only·in·certain· | |||
| 0003bce0:·706c·6174·666f·726d·730a·6966·205b·2021··platforms.if·[·! | |||
| 0003bcf0:·202d·6620·2f2e·646f·636b·6572·656e·7620···-f·/.dockerenv· | |||
| 0003bd00:·5d20·2661·6d70·3b26·616d·703b·205b·2021··]·&&·[·! | |||
| 0003bd10:·202d·6620·2f72·756e·2f2e·636f·6e74·6169···-f·/run/.contai | |||
| 0003bd20:·6e65·7265·6e76·205d·3b20·7468·656e·0a0a··nerenv·];·then.. | |||
| 0003bd30:·4445·4249·414e·5f46·524f·4e54·454e·443d··DEBIAN_FRONTEND= | |||
| 0003bd40:·6e6f·6e69·6e74·6572·6163·7469·7665·2061··noninteractive·a | |||
| 0003bd50:·7074·2d67·6574·2069·6e73·7461·6c6c·202d··pt-get·install·- | |||
| 0003bd60:·7920·2261·6964·6522·0a0a·656c·7365·0a20··y·"aide"..else.· | |||
| 0003bd70:·2020·2026·6774·3b26·616d·703b·3220·6563·····>&2·ec | |||
| 0003bd80:·686f·2027·5265·6d65·6469·6174·696f·6e20··ho·'Remediation· | |||
| 0003bd90:·6973·206e·6f74·2061·7070·6c69·6361·626c··is·not·applicabl | |||
| 0003bda0:·652c·206e·6f74·6869·6e67·2077·6173·2064··e,·nothing·was·d | |||
| 0003bdb0:·6f6e·6527·0a66·690a·3c2f·636f·6465·3e3c··one'.fi.</code>< | |||
| 0003bdc0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bdd0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bde0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bc80:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bc90:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003bca0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003bcb0:·3e3c·636f·6465·3e2d·206e·616d·653a·2045··><code>-·name:·E | |||
| 0003bcc0:·6e73·7572·6520·6169·6465·2069·7320·696e··nsure·aide·is·in | |||
| 0003bcd0:·7374·616c·6c65·640a·2020·7061·636b·6167··stalled.··packag | |||
| 0003bce0:·653a·0a20·2020·206e·616d·653a·2061·6964··e:.····name:·aid | |||
| 0003bcf0:·650a·2020·2020·7374·6174·653a·2070·7265··e.····state:·pre | |||
| 0003bd00:·7365·6e74·0a20·2077·6865·6e3a·2061·6e73··sent.··when:·ans | |||
| 0003bd10:·6962·6c65·5f76·6972·7475·616c·697a·6174··ible_virtualizat | |||
| 0003bd20:·696f·6e5f·7479·7065·206e·6f74·2069·6e20··ion_type·not·in· | |||
| 0003bd30:·5b22·646f·636b·6572·222c·2022·6c78·6322··["docker",·"lxc" | |||
| 0003bd40:·2c20·226f·7065·6e76·7a22·2c20·2270·6f64··,·"openvz",·"pod | |||
| 0003bd50:·6d61·6e22·2c20·2263·6f6e·7461·696e·6572··man",·"container | |||
| 0003bd60:·225d·0a20·2074·6167·733a·0a20·202d·2043··"].··tags:.··-·C | |||
| 0003bd70:·4a49·532d·352e·3130·2e31·2e33·0a20·202d··JIS-5.10.1.3.··- | |||
| 0003bd80:·2044·4953·412d·5354·4947·2d55·4254·552d···DISA-STIG-UBTU- | |||
| 0003bd90:·3230·2d30·3130·3435·300a·2020·2d20·4e49··20-010450.··-·NI | |||
| 0003bda0:·5354·2d38·3030·2d35·332d·434d·2d36·2861··ST-800-53-CM-6(a | |||
| 0003bdb0:·290a·2020·2d20·5043·492d·4453·532d·5265··).··-·PCI-DSS-Re | |||
| 0003bdc0:·712d·3131·2e35·0a20·202d·2065·6e61·626c··q-11.5.··-·enabl | |||
| 0003bdd0:·655f·7374·7261·7465·6779·0a20·202d·206c··e_strategy.··-·l | |||
| 0003bde0:·6f77·5f63·6f6d·706c·6578·6974·790a·2020··ow_complexity.·· | |||
| 0003bdf0:·2d20·6c6f·775f·6469·7372·7570·7469·6f6e··-·low_disruption | |||
| 0003be00:·0a20·202d·206d·6564·6975·6d5f·7365·7665··.··-·medium_seve | |||
| 0003be10:·7269·7479·0a20·202d·206e·6f5f·7265·626f··rity.··-·no_rebo | |||
| 0003be20:·6f74·5f6e·6565·6465·640a·2020·2d20·7061··ot_needed.··-·pa | |||
| 0003be30:·636b·6167·655f·6169·6465·5f69·6e73·7461··ckage_aide_insta | |||
| 0003be40:·6c6c·6564·0a3c·2f63·6f64·653e·3c2f·7072··lled.</code></pr | |||
| 0003be50:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003be60:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003be70:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003be80:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003be90:·6172·6765·743d·2223·6964·6d32·3835·3122··arget="#idm2851" | |||
| 0003bea0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003beb0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003bec0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003bed0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003bee0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003bef0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003bf00:·6f6e·204f·5342·7569·6c64·2042·6c75·6570··on·OSBuild·Bluep | |||
| 0003bf10:·7269·6e74·2073·6e69·7070·6574·20e2·87b2··rint·snippet·... | |||
| 0003bf20:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bf30:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003b | 0003bdf0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | ||
| 0003bf50:·2269·646d·3238·3531·223e·3c70·7265·3e3c··"idm2851"><pre>< | |||
| 0003bf60:·636f·6465·3e0a·5b5b·7061·636b·6167·6573··code>.[[packages | |||
| 0003bf70:·5d5d·0a6e·616d·6520·3d20·2261·6964·6522··]].name·=·"aide" | |||
| 0003bf80:·0a76·6572·7369·6f6e·203d·2022·2a22·0a3c··.version·=·"*".< | |||
| 0003bf90:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003bfa0:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003bfb0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bfc0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| Max diff block lines reached; 3459909/3476799 bytes (99.51%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·20.04·Level·1·Workstation·Benchmark | 38 | Profile·Title·CIS·Ubuntu·20.04·Level·1·Workstation·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_workstation | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_workstation |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·GRUB2_bootloader_configuration | 49 | ·········3.·GRUB2_bootloader_configuration |
| 50 | ·········4.·Configure_Syslog | 50 | ·········4.·Configure_Syslog |
| 51 | ·········5.·Network_Configuration_and_Firewalls | 51 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 115, 14 lines modified | Offset 115, 26 lines modified | ||
| 115 | include·install_aide | 115 | include·install_aide |
| 116 | class·install_aide·{ | 116 | class·install_aide·{ |
| 117 | ··package·{·'aide': | 117 | ··package·{·'aide': |
| 118 | ····ensure·=>·'installed', | 118 | ····ensure·=>·'installed', |
| 119 | ··} | 119 | ··} |
| 120 | } | 120 | } |
| 121 | Remediation_Shell_script_⇲ | ||
| 122 | Complexity:·low | ||
| 123 | Disruption:·low | ||
| 124 | Strategy:···enable | ||
| 125 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 126 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 127 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 121 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 122 | Complexity:·low | 132 | Complexity:·low |
| 123 | Disruption:·low | 133 | Disruption:·low |
| 124 | Strategy:···enable | 134 | Strategy:···enable |
| 125 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 126 | ··package: | 136 | ··package: |
| 127 | ····name:·aide | 137 | ····name:·aide |
| Offset 140, 26 lines modified | Offset 152, 14 lines modified | ||
| 140 | ··-·no_reboot_needed | 152 | ··-·no_reboot_needed |
| 141 | ··-·package_aide_installed | 153 | ··-·package_aide_installed |
| 142 | Remediation_OSBuild_Blueprint_snippet_⇲ | 154 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 143 | [[packages]] | 155 | [[packages]] |
| 144 | name·=·"aide" | 156 | name·=·"aide" |
| 145 | version·=·"*" | 157 | version·=·"*" |
| 146 | Remediation_Shell_script_⇲ | ||
| 147 | Complexity:·low | ||
| 148 | Disruption:·low | ||
| 149 | Strategy:···enable | ||
| 150 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 151 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 152 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 153 | else | ||
| 154 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 155 | fi | ||
| 156 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 158 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 157 | Run·the·following·command·to·generate·a·new·database: | 159 | Run·the·following·command·to·generate·a·new·database: |
| 158 | $·sudo·aideinit | 160 | $·sudo·aideinit |
| 159 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 161 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 160 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure | 162 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure |
| 161 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 163 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 162 | database·can·be·installed·as·follows: | 164 | database·can·be·installed·as·follows: |
| Offset 173, 14 lines modified | Offset 173, 26 lines modified | ||
| 173 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 173 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 174 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 174 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 175 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 175 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 176 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 176 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 177 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 177 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 178 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 178 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 179 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 179 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 180 | Remediation_Shell_script_⇲ | ||
| 181 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 182 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 183 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 184 | /usr/sbin/aideinit | ||
| 185 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 186 | else | ||
| 187 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 188 | fi | ||
| 180 | Remediation_Ansible_snippet_⇲ | 189 | Remediation_Ansible_snippet_⇲ |
| 181 | Complexity:·low | 190 | Complexity:·low |
| 182 | Disruption:·low | 191 | Disruption:·low |
| 183 | Strategy:···restrict | 192 | Strategy:···restrict |
| 184 | -·name:·Ensure·AIDE·is·installed | 193 | -·name:·Ensure·AIDE·is·installed |
| 185 | ··package: | 194 | ··package: |
| 186 | ····name:·'{{·item·}}' | 195 | ····name:·'{{·item·}}' |
| Offset 245, 26 lines modified | Offset 257, 14 lines modified | ||
| 245 | ··-·PCI-DSS-Req-11.5 | 257 | ··-·PCI-DSS-Req-11.5 |
| 246 | ··-·aide_build_database | 258 | ··-·aide_build_database |
| 247 | ··-·low_complexity | 259 | ··-·low_complexity |
| 248 | ··-·low_disruption | 260 | ··-·low_disruption |
| 249 | ··-·medium_severity | 261 | ··-·medium_severity |
| 250 | ··-·no_reboot_needed | 262 | ··-·no_reboot_needed |
| 251 | ··-·restrict_strategy | 263 | ··-·restrict_strategy |
| 252 | Remediation_Shell_script_⇲ | ||
| 253 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 254 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 255 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 256 | /usr/sbin/aideinit | ||
| 257 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 258 | else | ||
| 259 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 260 | fi | ||
| 261 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 264 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 262 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 265 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 263 | using·cron,·add·the·following·line·to·/etc/crontab: | 266 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 264 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 267 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 265 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 268 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 266 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 269 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 267 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 270 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 287, 14 lines modified | Offset 287, 29 lines modified | ||
| 287 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 287 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 288 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 288 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 289 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 289 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 494934/500038 bytes (98.98%) of diff not shown. | |||
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d20:·7320·6f66·2032·3032·3 | 00037d20:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15298, 125 lines modified | Offset 15298, 125 lines modified | ||
| 0003bc10:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003bc10:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003bc20:·743d·2223·6964·6d32·3835·3022·2074·6162··t="#idm2850"·tab | 0003bc20:·743d·2223·6964·6d32·3835·3022·2074·6162··t="#idm2850"·tab | ||
| 0003bc30:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003bc30:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003bc40:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003bc40:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003bc50:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003bc50:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003bc60:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003bc60:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003bc70:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003bc70:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003bc80:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003bc80:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 0003bc90:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | |||
| 0003bca0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bcb0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bcc0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bcd0:·6964·6d32·3835·3022·3e3c·7461·626c·6520··idm2850"><table· | |||
| 0003bce0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bcf0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bd00:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bd10:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bd20:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bc90:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003bca0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bcb0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bcc0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bcd0:·643d·2269·646d·3238·3530·223e·3c74·6162··d="idm2850"><tab | |||
| 0003bce0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bcf0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bd00:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bd10:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bd20:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bd30:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bd40:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bd50:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bd | 0003bd30:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003bd40:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bd50:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bd60:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003bd70:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003bd80:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003bd90:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003bda0:·7072·653e·3c63·6f64·653e·2320·5265·6d65··pre><code>#·Reme | |||
| 0003bdb0:·6469·6174·696f·6e20·6973·2061·7070·6c69··diation·is·appli | |||
| 0003bdc0:·6361·626c·6520·6f6e·6c79·2069·6e20·6365··cable·only·in·ce | |||
| 0003bdd0:·7274·6169·6e20·706c·6174·666f·726d·730a··rtain·platforms. | |||
| 0003bde0:·6966·205b·2021·202d·6620·2f2e·646f·636b··if·[·!·-f·/.dock | |||
| 0003bdf0:·6572·656e·7620·5d20·2661·6d70·3b26·616d··erenv·]·&&am | |||
| 0003be00:·703b·205b·2021·202d·6620·2f72·756e·2f2e··p;·[·!·-f·/run/. | |||
| 0003be10:·636f·6e74·6169·6e65·7265·6e76·205d·3b20··containerenv·];· | |||
| 0003be20:·7468·656e·0a0a·4445·4249·414e·5f46·524f··then..DEBIAN_FRO | |||
| 0003be30:·4e54·454e·443d·6e6f·6e69·6e74·6572·6163··NTEND=noninterac | |||
| 0003be40:·7469·7665·2061·7074·2d67·6574·2069·6e73··tive·apt-get·ins | |||
| 0003be50:·7461·6c6c·202d·7920·2261·6964·6522·0a0a··tall·-y·"aide".. | |||
| 0003be60:·656c·7365·0a20·2020·2026·6774·3b26·616d··else.····>&am | |||
| 0003be70:·703b·3220·6563·686f·2027·5265·6d65·6469··p;2·echo·'Remedi | |||
| 0003be80:·6174·696f·6e20·6973·206e·6f74·2061·7070··ation·is·not·app | |||
| 0003be90:·6c69·6361·626c·652c·206e·6f74·6869·6e67··licable,·nothing | |||
| 0003bea0:·2077·6173·2064·6f6e·6527·0a66·690a·3c2f···was·done'.fi.</ | |||
| 0003beb0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bec0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003bed0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003bee0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003bd70:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bd80:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003bd90:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bda0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003bdb0:·616d·653a·2045·6e73·7572·6520·6169·6465··ame:·Ensure·aide | |||
| 0003bdc0:·2069·7320·696e·7374·616c·6c65·640a·2020···is·installed.·· | |||
| 0003bdd0:·7061·636b·6167·653a·0a20·2020·206e·616d··package:.····nam | |||
| 0003bde0:·653a·2061·6964·650a·2020·2020·7374·6174··e:·aide.····stat | |||
| 0003bdf0:·653a·2070·7265·7365·6e74·0a20·2077·6865··e:·present.··whe | |||
| 0003be00:·6e3a·2061·6e73·6962·6c65·5f76·6972·7475··n:·ansible_virtu | |||
| 0003be10:·616c·697a·6174·696f·6e5f·7479·7065·206e··alization_type·n | |||
| 0003be20:·6f74·2069·6e20·5b22·646f·636b·6572·222c··ot·in·["docker", | |||
| 0003be30:·2022·6c78·6322·2c20·226f·7065·6e76·7a22···"lxc",·"openvz" | |||
| 0003be40:·2c20·2270·6f64·6d61·6e22·2c20·2263·6f6e··,·"podman",·"con | |||
| 0003be50:·7461·696e·6572·225d·0a20·2074·6167·733a··tainer"].··tags: | |||
| 0003be60:·0a20·202d·2043·4a49·532d·352e·3130·2e31··.··-·CJIS-5.10.1 | |||
| 0003be70:·2e33·0a20·202d·2044·4953·412d·5354·4947··.3.··-·DISA-STIG | |||
| 0003be80:·2d55·4254·552d·3230·2d30·3130·3435·300a··-UBTU-20-010450. | |||
| 0003be90:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bea0:·434d·2d36·2861·290a·2020·2d20·5043·492d··CM-6(a).··-·PCI- | |||
| 0003beb0:·4453·532d·5265·712d·3131·2e35·0a20·202d··DSS-Req-11.5.··- | |||
| 0003bec0:·2065·6e61·626c·655f·7374·7261·7465·6779···enable_strategy | |||
| 0003bed0:·0a20·202d·206c·6f77·5f63·6f6d·706c·6578··.··-·low_complex | |||
| 0003bee0:·6974·790a·2020·2d20·6c6f·775f·6469·7372··ity.··-·low_disr | |||
| 0003bef0:·7570·7469·6f6e·0a20·202d·206d·6564·6975··uption.··-·mediu | |||
| 0003bf00:·6d5f·7365·7665·7269·7479·0a20·202d·206e··m_severity.··-·n | |||
| 0003bf10:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 0003bf20:·2020·2d20·7061·636b·6167·655f·6169·6465····-·package_aide | |||
| 0003bf30:·5f69·6e73·7461·6c6c·6564·0a3c·2f63·6f64··_installed.</cod | |||
| 0003bf40:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bf50:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bf60:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bf70:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bf80:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bf90:·6d32·3835·3122·2074·6162·696e·6465·783d··m2851"·tabindex= | |||
| 0003bfa0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bfb0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bfc0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bfd0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bfe0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bff0:·6564·6961·7469·6f6e·204f·5342·7569·6c64··ediation·OSBuild | |||
| 0003c000:·2042·6c75·6570·7269·6e74·2073·6e69·7070···Blueprint·snipp | |||
| 0003c010:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c020:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c030:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c040:·6522·2069·643d·2269·646d·3238·3531·223e··e"·id="idm2851"> | |||
| 0003c050:·3c70·7265·3e3c·636f·6465·3e0a·5b5b·7061··<pre><code>.[[pa | |||
| 0003c060:·636b·6167·6573·5d5d·0a6e·616d·6520·3d20··ckages]].name·=· | |||
| 0003c070:·2261·6964·6522·0a76·6572·7369·6f6e·203d··"aide".version·= | |||
| 0003c080:·2022·2a22·0a3c·2f63·6f64·653e·3c2f·7072···"*".</code></pr | |||
| 0003c090:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c0a0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| Max diff block lines reached; 14944518/14961546 bytes (99.89%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d30:·206f·6620·3230·323 | 00037d30:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15294, 124 lines modified | Offset 15294, 124 lines modified | ||
| 0003bbd0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003bbd0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003bbe0:·6964·6d32·3835·3022·2074·6162·696e·6465··idm2850"·tabinde | 0003bbe0:·6964·6d32·3835·3022·2074·6162·696e·6465··idm2850"·tabinde | ||
| 0003bbf0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003bbf0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003bc00:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003bc00:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003bc10:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003bc10:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003bc20:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003bc20:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003bc30:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003bc30:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003bc40:·656d·6564·6961·7469·6f6e·20 | 0003bc40:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003bc50:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003bc60:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bc70:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bc80:·6c6c·6170·7365·2220·6964·3d22·6964·6d32··llapse"·id="idm2 | |||
| 0003bc90:·3835·3022·3e3c·7461·626c·6520·636c·6173··850"><table·clas | |||
| 0003bca0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bcb0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bcc0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bcd0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bce0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bc50:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bc60:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bc70:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bc80:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bc90:·646d·3238·3530·223e·3c74·6162·6c65·2063··dm2850"><table·c | |||
| 0003bca0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bcb0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bcc0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bcd0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bce0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bcf0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bd00:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bd10:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003b | 0003bcf0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003bd00:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bd10:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bd20:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bd30:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bd40:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003bd50:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bd60:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003bd70:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003bd80:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003bd90:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003bda0:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003bdb0:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003bdc0:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003bdd0:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003bde0:·0a0a·4445·4249·414e·5f46·524f·4e54·454e··..DEBIAN_FRONTEN | |||
| 0003bdf0:·443d·6e6f·6e69·6e74·6572·6163·7469·7665··D=noninteractive | |||
| 0003be00:·2061·7074·2d67·6574·2069·6e73·7461·6c6c···apt-get·install | |||
| 0003be10:·202d·7920·2261·6964·6522·0a0a·656c·7365···-y·"aide"..else | |||
| 0003be20:·0a20·2020·2026·6774·3b26·616d·703b·3220··.····>&2· | |||
| 0003be30:·6563·686f·2027·5265·6d65·6469·6174·696f··echo·'Remediatio | |||
| 0003be40:·6e20·6973·206e·6f74·2061·7070·6c69·6361··n·is·not·applica | |||
| 0003be50:·626c·652c·206e·6f74·6869·6e67·2077·6173··ble,·nothing·was | |||
| 0003be60:·2064·6f6e·6527·0a66·690a·3c2f·636f·6465···done'.fi.</code | |||
| 0003be70:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003be80:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003be90:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003bd30:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003bd40:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003bd50:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bd60:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003bd70:·2045·6e73·7572·6520·6169·6465·2069·7320···Ensure·aide·is· | |||
| 0003bd80:·696e·7374·616c·6c65·640a·2020·7061·636b··installed.··pack | |||
| 0003bd90:·6167·653a·0a20·2020·206e·616d·653a·2061··age:.····name:·a | |||
| 0003bda0:·6964·650a·2020·2020·7374·6174·653a·2070··ide.····state:·p | |||
| 0003bdb0:·7265·7365·6e74·0a20·2077·6865·6e3a·2061··resent.··when:·a | |||
| 0003bdc0:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| 0003bdd0:·6174·696f·6e5f·7479·7065·206e·6f74·2069··ation_type·not·i | |||
| 0003bde0:·6e20·5b22·646f·636b·6572·222c·2022·6c78··n·["docker",·"lx | |||
| 0003bdf0:·6322·2c20·226f·7065·6e76·7a22·2c20·2270··c",·"openvz",·"p | |||
| 0003be00:·6f64·6d61·6e22·2c20·2263·6f6e·7461·696e··odman",·"contain | |||
| 0003be10:·6572·225d·0a20·2074·6167·733a·0a20·202d··er"].··tags:.··- | |||
| 0003be20:·2043·4a49·532d·352e·3130·2e31·2e33·0a20···CJIS-5.10.1.3.· | |||
| 0003be30:·202d·2044·4953·412d·5354·4947·2d55·4254···-·DISA-STIG-UBT | |||
| 0003be40:·552d·3230·2d30·3130·3435·300a·2020·2d20··U-20-010450.··-· | |||
| 0003be50:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003be60:·2861·290a·2020·2d20·5043·492d·4453·532d··(a).··-·PCI-DSS- | |||
| 0003be70:·5265·712d·3131·2e35·0a20·202d·2065·6e61··Req-11.5.··-·ena | |||
| 0003be80:·626c·655f·7374·7261·7465·6779·0a20·202d··ble_strategy.··- | |||
| 0003be90:·206c·6f77·5f63·6f6d·706c·6578·6974·790a···low_complexity. | |||
| 0003bea0:·2020·2d20·6c6f·775f·6469·7372·7570·7469····-·low_disrupti | |||
| 0003beb0:·6f6e·0a20·202d·206d·6564·6975·6d5f·7365··on.··-·medium_se | |||
| 0003bec0:·7665·7269·7479·0a20·202d·206e·6f5f·7265··verity.··-·no_re | |||
| 0003bed0:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003bee0:·7061·636b·6167·655f·6169·6465·5f69·6e73··package_aide_ins | |||
| 0003bef0:·7461·6c6c·6564·0a3c·2f63·6f64·653e·3c2f··talled.</code></ | |||
| 0003bf00:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003bf10:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003bf20:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003bf30:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003bf40:·2d74·6172·6765·743d·2223·6964·6d32·3835··-target="#idm285 | |||
| 0003bf50:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | |||
| 0003bf60:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003bf70:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003bf80:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003bf90:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003bfa0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003bfb0:·7469·6f6e·204f·5342·7569·6c64·2042·6c75··tion·OSBuild·Blu | |||
| 0003bfc0:·6570·7269·6e74·2073·6e69·7070·6574·20e2··eprint·snippet·. | |||
| 0003bfd0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bfe0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b | 0003bea0:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | ||
| 0003c000:·643d·2269·646d·3238·3531·223e·3c70·7265··d="idm2851"><pre | |||
| 0003c010:·3e3c·636f·6465·3e0a·5b5b·7061·636b·6167··><code>.[[packag | |||
| 0003c020:·6573·5d5d·0a6e·616d·6520·3d20·2261·6964··es]].name·=·"aid | |||
| 0003c030:·6522·0a76·6572·7369·6f6e·203d·2022·2a22··e".version·=·"*" | |||
| 0003c040:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c050:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c060:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c070:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| Max diff block lines reached; 14914307/14931197 bytes (99.89%) of diff not shown. | |||
| Offset 14287, 16 lines modified | Offset 14287, 16 lines modified | ||
| 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·2020·2020·2028·6173·206f·6620·3230·323 | 00037d50:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00037d60:·2d30·3 | 00037d60:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 17540, 133 lines modified | Offset 17540, 133 lines modified | ||
| 00044830:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 00044830:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 00044840:·6d39·3130·3922·2074·6162·696e·6465·783d··m9109"·tabindex= | 00044840:·6d39·3130·3922·2074·6162·696e·6465·783d··m9109"·tabindex= | ||
| 00044850:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 00044850:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 00044860:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 00044860:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 00044870:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 00044870:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 00044880:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 00044880:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 00044890:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 00044890:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 000448a0:·6564·6961·7469·6f6e·20 | 000448a0:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 000448b0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 000448c0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 000448d0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 000448e0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 000448f0:·3931·3039·223e·3c74·6162·6c65·2063·6c61··9109"><table·cla | |||
| 00044900:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 00044 | 000448b0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | ||
| 000448c0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 000448d0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 000448e0:·6170·7365·2220·6964·3d22·6964·6d39·3130··apse"·id="idm910 | |||
| 000448f0:·3922·3e3c·7461·626c·6520·636c·6173·733d··9"><table·class= | |||
| 00044900:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 00044910:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 00044920:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 00044930:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 00044940:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 00044950:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 00044960:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 00044970:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 00044980:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 00044990:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 000449a0:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 000449b0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 000449c0:·6f64·653e·2320·5265·6d65·6469·6174·696f··ode>#·Remediatio | |||
| 000449d0:·6e20·6973·2061·7070·6c69·6361·626c·6520··n·is·applicable· | |||
| 000449e0:·6f6e·6c79·2069·6e20·6365·7274·6169·6e20··only·in·certain· | |||
| 000449f0:·706c·6174·666f·726d·730a·6966·205b·2021··platforms.if·[·! | |||
| 00044a00:·202d·6620·2f2e·646f·636b·6572·656e·7620···-f·/.dockerenv· | |||
| 00044a10:·5d20·2661·6d70·3b26·616d·703b·205b·2021··]·&&·[·! | |||
| 00044a20:·202d·6620·2f72·756e·2f2e·636f·6e74·6169···-f·/run/.contai | |||
| 00044a30:·6e65·7265·6e76·205d·3b20·7468·656e·0a0a··nerenv·];·then.. | |||
| 00044a40:·4445·4249·414e·5f46·524f·4e54·454e·443d··DEBIAN_FRONTEND= | |||
| 00044a50:·6e6f·6e69·6e74·6572·6163·7469·7665·2061··noninteractive·a | |||
| 00044a60:·7074·2d67·6574·2069·6e73·7461·6c6c·202d··pt-get·install·- | |||
| 00044a70:·7920·2261·7564·6974·6422·0a0a·656c·7365··y·"auditd"..else | |||
| 00044a80:·0a20·2020·2026·6774·3b26·616d·703b·3220··.····>&2· | |||
| 00044a90:·6563·686f·2027·5265·6d65·6469·6174·696f··echo·'Remediatio | |||
| 00044aa0:·6e20·6973·206e·6f74·2061·7070·6c69·6361··n·is·not·applica | |||
| 00044ab0:·626c·652c·206e·6f74·6869·6e67·2077·6173··ble,·nothing·was | |||
| 00044ac0:·2064·6f6e·6527·0a66·690a·3c2f·636f·6465···done'.fi.</code | |||
| 00044ad0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 00044ae0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 00044af0:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 00044b00:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 00044b10:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 00044b20:·3931·3130·2220·7461·6269·6e64·6578·3d22··9110"·tabindex=" | |||
| 00044b30:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 00044b40:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 00044b50:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 00044b60:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 00044b70:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 00044b80:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 00044b90:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 00044ba0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 00044bb0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 00044bc0:·6c6c·6170·7365·2220·6964·3d22·6964·6d39··llapse"·id="idm9 | |||
| 00044bd0:·3131·3022·3e3c·7461·626c·6520·636c·6173··110"><table·clas | |||
| 00044be0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 00044 | 00044bf0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | ||
| 00044c00:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 00044c10:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 00044c20:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 00044c30:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 00044c40:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 00044c50:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 00044c60:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 00044c70:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 00044c80:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 00044c90:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 00044ca0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·456e··<code>-·name:·En | |||
| 00044cb0:·7375·7265·2061·7564·6974·6420·6973·2069··sure·auditd·is·i | |||
| 00044cc0:·6e73·7461·6c6c·6564·0a20·2070·6163·6b61··nstalled.··packa | |||
| 00044cd0:·6765·3a0a·2020·2020·6e61·6d65·3a20·6175··ge:.····name:·au | |||
| 00044ce0:·6469·7464·0a20·2020·2073·7461·7465·3a20··ditd.····state:· | |||
| 00044cf0:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 00044d00:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 00044d10:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 00044d20:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 00044d30:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 00044d40:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 00044d50:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 00044d60:·2d20·4449·5341·2d53·5449·472d·5542·5455··-·DISA-STIG-UBTU | |||
| 00044d70:·2d32·302d·3031·3031·3832·0a20·202d·204e··-20-010182.··-·N | |||
| 00044930:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 00044940:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 00044950:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 00044960:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 00044970:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 00044980:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 00044990:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 000449a0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 000449b0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 000449c0:·3e3c·636f·6465·3e2d·206e·616d·653a·2045··><code>-·name:·E | |||
| 000449d0:·6e73·7572·6520·6175·6469·7464·2069·7320··nsure·auditd·is· | |||
| 000449e0:·696e·7374·616c·6c65·640a·2020·7061·636b··installed.··pack | |||
| 000449f0:·6167·653a·0a20·2020·206e·616d·653a·2061··age:.····name:·a | |||
| 00044a00:·7564·6974·640a·2020·2020·7374·6174·653a··uditd.····state: | |||
| 00044a10:·2070·7265·7365·6e74·0a20·2077·6865·6e3a···present.··when: | |||
| 00044a20:·2061·6e73·6962·6c65·5f76·6972·7475·616c···ansible_virtual | |||
| 00044a30:·697a·6174·696f·6e5f·7479·7065·206e·6f74··ization_type·not | |||
| 00044a40:·2069·6e20·5b22·646f·636b·6572·222c·2022···in·["docker",·" | |||
| 00044a50:·6c78·6322·2c20·226f·7065·6e76·7a22·2c20··lxc",·"openvz",· | |||
| Max diff block lines reached; 676221/694491 bytes (97.37%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·20.04 | 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·20.04 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ | 42 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 272, 14 lines modified | Offset 272, 26 lines modified | ||
| 272 | include·install_auditd | 272 | include·install_auditd |
| 273 | class·install_auditd·{ | 273 | class·install_auditd·{ |
| 274 | ··package·{·'auditd': | 274 | ··package·{·'auditd': |
| 275 | ····ensure·=>·'installed', | 275 | ····ensure·=>·'installed', |
| 276 | ··} | 276 | ··} |
| 277 | } | 277 | } |
| 278 | Remediation_Shell_script_⇲ | ||
| 279 | Complexity:·low | ||
| 280 | Disruption:·low | ||
| 281 | Strategy:···enable | ||
| 282 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 283 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 284 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"auditd" | ||
| 285 | else | ||
| 286 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 287 | fi | ||
| 278 | Remediation_Ansible_snippet_⇲ | 288 | Remediation_Ansible_snippet_⇲ |
| 279 | Complexity:·low | 289 | Complexity:·low |
| 280 | Disruption:·low | 290 | Disruption:·low |
| 281 | Strategy:···enable | 291 | Strategy:···enable |
| 282 | -·name:·Ensure·auditd·is·installed | 292 | -·name:·Ensure·auditd·is·installed |
| 283 | ··package: | 293 | ··package: |
| 284 | ····name:·auditd | 294 | ····name:·auditd |
| Offset 302, 26 lines modified | Offset 314, 14 lines modified | ||
| 302 | ··-·no_reboot_needed | 314 | ··-·no_reboot_needed |
| 303 | ··-·package_audit_installed | 315 | ··-·package_audit_installed |
| 304 | Remediation_OSBuild_Blueprint_snippet_⇲ | 316 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 305 | [[packages]] | 317 | [[packages]] |
| 306 | name·=·"auditd" | 318 | name·=·"auditd" |
| 307 | version·=·"*" | 319 | version·=·"*" |
| 308 | Remediation_Shell_script_⇲ | ||
| 309 | Complexity:·low | ||
| 310 | Disruption:·low | ||
| 311 | Strategy:···enable | ||
| 312 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 313 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 314 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"auditd" | ||
| 315 | else | ||
| 316 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 317 | fi | ||
| 318 | ***·Rule ·Enable·auditd·Service· [ref]·*** | 320 | ***·Rule ·Enable·auditd·Service· [ref]·*** |
| 319 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is | 321 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is |
| 320 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following | 322 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following |
| 321 | command: | 323 | command: |
| 322 | $·sudo·systemctl·enable·auditd.service | 324 | $·sudo·systemctl·enable·auditd.service |
| 323 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, | 325 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, |
| 324 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the | 326 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the |
| Offset 368, 14 lines modified | Offset 368, 30 lines modified | ||
| 368 | class·enable_auditd·{ | 368 | class·enable_auditd·{ |
| 369 | ··service·{'auditd': | 369 | ··service·{'auditd': |
| 370 | ····enable·=>·true, | 370 | ····enable·=>·true, |
| 371 | ····ensure·=>·'running', | 371 | ····ensure·=>·'running', |
| 372 | ··} | 372 | ··} |
| 373 | } | 373 | } |
| 374 | Remediation_Shell_script_⇲ | ||
| 375 | Complexity:·low | ||
| 376 | Disruption:·low | ||
| 377 | Strategy:···enable | ||
| 378 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 379 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 380 | Status-Status}\n'·'auditd'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 381 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 382 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 383 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 384 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 385 | else | ||
| 386 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 387 | fi | ||
| 374 | Remediation_Ansible_snippet_⇲ | 388 | Remediation_Ansible_snippet_⇲ |
| 375 | Complexity:·low | 389 | Complexity:·low |
| 376 | Disruption:·low | 390 | Disruption:·low |
| 377 | Strategy:···enable | 391 | Strategy:···enable |
| 378 | -·name:·Gather·the·package·facts | 392 | -·name:·Gather·the·package·facts |
| 379 | ··package_facts: | 393 | ··package_facts: |
| 380 | ····manager:·auto | 394 | ····manager:·auto |
| Offset 440, 30 lines modified | Offset 456, 14 lines modified | ||
| 440 | ··-·medium_severity | 456 | ··-·medium_severity |
| 441 | ··-·no_reboot_needed | 457 | ··-·no_reboot_needed |
| 442 | ··-·service_auditd_enabled | 458 | ··-·service_auditd_enabled |
| 443 | Remediation_OSBuild_Blueprint_snippet_⇲ | 459 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 444 | [customizations.services] | 460 | [customizations.services] |
| 445 | enabled·=·["auditd"] | 461 | enabled·=·["auditd"] |
| 446 | Remediation_Shell_script_⇲ | ||
| 447 | Complexity:·low | ||
| 448 | Disruption:·low | ||
| 449 | Strategy:···enable | ||
| 450 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 451 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 452 | Status-Status}\n'·'auditd'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 453 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 454 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 455 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 456 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 457 | else | ||
| 458 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 459 | fi | ||
| 460 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules | 462 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules |
| 461 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It | 463 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It |
| 462 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for | 464 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for |
| Max diff block lines reached; 87441/91572 bytes (95.49%) of diff not shown. | |||
| Offset 14297, 16 lines modified | Offset 14297, 16 lines modified | ||
| 00037d80:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00037d80:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00037d90:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00037d90:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00037da0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00037da0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00037db0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00037db0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00037dc0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00037dc0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00037dd0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00037dd0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00037de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037df0:·2020·2028·6173·206f·6620·3230·323 | 00037df0:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00037e00:·3 | 00037e00:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00037e10:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00037e10:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00037e20:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00037e20:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00037e30:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00037e30:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00037e40:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00037e40:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00037e50:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00037e50:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00037e60:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00037e60:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00037e70:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00037e70:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15268, 124 lines modified | Offset 15268, 124 lines modified | ||
| 0003ba30:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003ba30:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003ba40:·6964·6d32·3835·3022·2074·6162·696e·6465··idm2850"·tabinde | 0003ba40:·6964·6d32·3835·3022·2074·6162·696e·6465··idm2850"·tabinde | ||
| 0003ba50:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003ba50:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003ba60:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003ba60:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003ba70:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003ba70:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003ba80:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003ba80:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003ba90:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003ba90:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003baa0:·656d·6564·6961·7469·6f6e·20 | 0003baa0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003bab0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003bac0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bad0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bae0:·6c6c·6170·7365·2220·6964·3d22·6964·6d32··llapse"·id="idm2 | |||
| 0003baf0:·3835·3022·3e3c·7461·626c·6520·636c·6173··850"><table·clas | |||
| 0003bb00:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bb10:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bb20:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bb30:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bb40:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bab0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bac0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bad0:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bae0:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003baf0:·646d·3238·3530·223e·3c74·6162·6c65·2063··dm2850"><table·c | |||
| 0003bb00:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bb10:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bb20:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bb30:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bb40:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bb50:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bb60:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bb70:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003bb | 0003bb50:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003bb60:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bb70:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bb80:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bb90:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bba0:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003bbb0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bbc0:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003bbd0:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003bbe0:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003bbf0:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003bc00:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003bc10:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003bc20:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003bc30:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003bc40:·0a0a·4445·4249·414e·5f46·524f·4e54·454e··..DEBIAN_FRONTEN | |||
| 0003bc50:·443d·6e6f·6e69·6e74·6572·6163·7469·7665··D=noninteractive | |||
| 0003bc60:·2061·7074·2d67·6574·2069·6e73·7461·6c6c···apt-get·install | |||
| 0003bc70:·202d·7920·2261·6964·6522·0a0a·656c·7365···-y·"aide"..else | |||
| 0003bc80:·0a20·2020·2026·6774·3b26·616d·703b·3220··.····>&2· | |||
| 0003bc90:·6563·686f·2027·5265·6d65·6469·6174·696f··echo·'Remediatio | |||
| 0003bca0:·6e20·6973·206e·6f74·2061·7070·6c69·6361··n·is·not·applica | |||
| 0003bcb0:·626c·652c·206e·6f74·6869·6e67·2077·6173··ble,·nothing·was | |||
| 0003bcc0:·2064·6f6e·6527·0a66·690a·3c2f·636f·6465···done'.fi.</code | |||
| 0003bcd0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003bce0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003bcf0:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003bb90:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003bba0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003bbb0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bbc0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003bbd0:·2045·6e73·7572·6520·6169·6465·2069·7320···Ensure·aide·is· | |||
| 0003bbe0:·696e·7374·616c·6c65·640a·2020·7061·636b··installed.··pack | |||
| 0003bbf0:·6167·653a·0a20·2020·206e·616d·653a·2061··age:.····name:·a | |||
| 0003bc00:·6964·650a·2020·2020·7374·6174·653a·2070··ide.····state:·p | |||
| 0003bc10:·7265·7365·6e74·0a20·2077·6865·6e3a·2061··resent.··when:·a | |||
| 0003bc20:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| 0003bc30:·6174·696f·6e5f·7479·7065·206e·6f74·2069··ation_type·not·i | |||
| 0003bc40:·6e20·5b22·646f·636b·6572·222c·2022·6c78··n·["docker",·"lx | |||
| 0003bc50:·6322·2c20·226f·7065·6e76·7a22·2c20·2270··c",·"openvz",·"p | |||
| 0003bc60:·6f64·6d61·6e22·2c20·2263·6f6e·7461·696e··odman",·"contain | |||
| 0003bc70:·6572·225d·0a20·2074·6167·733a·0a20·202d··er"].··tags:.··- | |||
| 0003bc80:·2043·4a49·532d·352e·3130·2e31·2e33·0a20···CJIS-5.10.1.3.· | |||
| 0003bc90:·202d·2044·4953·412d·5354·4947·2d55·4254···-·DISA-STIG-UBT | |||
| 0003bca0:·552d·3230·2d30·3130·3435·300a·2020·2d20··U-20-010450.··-· | |||
| 0003bcb0:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003bcc0:·2861·290a·2020·2d20·5043·492d·4453·532d··(a).··-·PCI-DSS- | |||
| 0003bcd0:·5265·712d·3131·2e35·0a20·202d·2065·6e61··Req-11.5.··-·ena | |||
| 0003bce0:·626c·655f·7374·7261·7465·6779·0a20·202d··ble_strategy.··- | |||
| 0003bcf0:·206c·6f77·5f63·6f6d·706c·6578·6974·790a···low_complexity. | |||
| 0003bd00:·2020·2d20·6c6f·775f·6469·7372·7570·7469····-·low_disrupti | |||
| 0003bd10:·6f6e·0a20·202d·206d·6564·6975·6d5f·7365··on.··-·medium_se | |||
| 0003bd20:·7665·7269·7479·0a20·202d·206e·6f5f·7265··verity.··-·no_re | |||
| 0003bd30:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003bd40:·7061·636b·6167·655f·6169·6465·5f69·6e73··package_aide_ins | |||
| 0003bd50:·7461·6c6c·6564·0a3c·2f63·6f64·653e·3c2f··talled.</code></ | |||
| 0003bd60:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003bd70:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003bd80:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003bd90:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003bda0:·2d74·6172·6765·743d·2223·6964·6d32·3835··-target="#idm285 | |||
| 0003bdb0:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | |||
| 0003bdc0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003bdd0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003bde0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003bdf0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003be00:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003be10:·7469·6f6e·204f·5342·7569·6c64·2042·6c75··tion·OSBuild·Blu | |||
| 0003be20:·6570·7269·6e74·2073·6e69·7070·6574·20e2··eprint·snippet·. | |||
| 0003be30:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003be40:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b | 0003bd00:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | ||
| 0003be60:·643d·2269·646d·3238·3531·223e·3c70·7265··d="idm2851"><pre | |||
| 0003be70:·3e3c·636f·6465·3e0a·5b5b·7061·636b·6167··><code>.[[packag | |||
| 0003be80:·6573·5d5d·0a6e·616d·6520·3d20·2261·6964··es]].name·=·"aid | |||
| 0003be90:·6522·0a76·6572·7369·6f6e·203d·2022·2a22··e".version·=·"*" | |||
| 0003bea0:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003beb0:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bec0:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| Max diff block lines reached; 13866803/13883831 bytes (99.88%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | Profile·Title·Canonical·Ubuntu·20.04·LTS·Security·Technical·Implementation | 41 | Profile·Title·Canonical·Ubuntu·20.04·LTS·Security·Technical·Implementation |
| 42 | ··············Guide·(STIG)·V1R1 | 42 | ··············Guide·(STIG)·V1R1 |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_stig | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_stig |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ | 45 | ····*·cpe:/o:canonical:ubuntu_linux:20.04::~~lts~~~ |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·AppArmor | 54 | ·········4.·AppArmor |
| 55 | ·········5.·GRUB2_bootloader_configuration | 55 | ·········5.·GRUB2_bootloader_configuration |
| Offset 111, 14 lines modified | Offset 111, 26 lines modified | ||
| 111 | include·install_aide | 111 | include·install_aide |
| 112 | class·install_aide·{ | 112 | class·install_aide·{ |
| 113 | ··package·{·'aide': | 113 | ··package·{·'aide': |
| 114 | ····ensure·=>·'installed', | 114 | ····ensure·=>·'installed', |
| 115 | ··} | 115 | ··} |
| 116 | } | 116 | } |
| 117 | Remediation_Shell_script_⇲ | ||
| 118 | Complexity:·low | ||
| 119 | Disruption:·low | ||
| 120 | Strategy:···enable | ||
| 121 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 122 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 123 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 124 | else | ||
| 125 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 126 | fi | ||
| 117 | Remediation_Ansible_snippet_⇲ | 127 | Remediation_Ansible_snippet_⇲ |
| 118 | Complexity:·low | 128 | Complexity:·low |
| 119 | Disruption:·low | 129 | Disruption:·low |
| 120 | Strategy:···enable | 130 | Strategy:···enable |
| 121 | -·name:·Ensure·aide·is·installed | 131 | -·name:·Ensure·aide·is·installed |
| 122 | ··package: | 132 | ··package: |
| 123 | ····name:·aide | 133 | ····name:·aide |
| Offset 136, 26 lines modified | Offset 148, 14 lines modified | ||
| 136 | ··-·no_reboot_needed | 148 | ··-·no_reboot_needed |
| 137 | ··-·package_aide_installed | 149 | ··-·package_aide_installed |
| 138 | Remediation_OSBuild_Blueprint_snippet_⇲ | 150 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 139 | [[packages]] | 151 | [[packages]] |
| 140 | name·=·"aide" | 152 | name·=·"aide" |
| 141 | version·=·"*" | 153 | version·=·"*" |
| 142 | Remediation_Shell_script_⇲ | ||
| 143 | Complexity:·low | ||
| 144 | Disruption:·low | ||
| 145 | Strategy:···enable | ||
| 146 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 147 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 148 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 149 | else | ||
| 150 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 151 | fi | ||
| 152 | ***·Rule ·Configure·AIDE·to·Verify·the·Audit·Tools· [ref]·*** | 154 | ***·Rule ·Configure·AIDE·to·Verify·the·Audit·Tools· [ref]·*** |
| 153 | The·operating·system·file·integrity·tool·must·be·configured·to·protect·the·integrity·of·the | 155 | The·operating·system·file·integrity·tool·must·be·configured·to·protect·the·integrity·of·the |
| 154 | audit·tools. | 156 | audit·tools. |
| 155 | ················Protecting·the·integrity·of·the·tools·used·for·auditing·purposes·is·a·critical | 157 | ················Protecting·the·integrity·of·the·tools·used·for·auditing·purposes·is·a·critical |
| 156 | ················step·toward·ensuring·the·integrity·of·audit·information.·Audit·information | 158 | ················step·toward·ensuring·the·integrity·of·audit·information.·Audit·information |
| 157 | ················includes·all·information·(e.g.,·audit·records,·audit·settings,·and·audit | 159 | ················includes·all·information·(e.g.,·audit·records,·audit·settings,·and·audit |
| 158 | ················reports)·needed·to·successfully·audit·information·system·activity.·Audit·tools | 160 | ················reports)·needed·to·successfully·audit·information·system·activity.·Audit·tools |
| Offset 275, 14 lines modified | Offset 275, 29 lines modified | ||
| 275 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 275 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 276 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 276 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 277 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 277 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| 278 | References··A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4, | 278 | References··A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4, |
| 279 | ············A.14.2.7,·A.15.2.1,·A.8.2.3,·SI-7,·SI-7(1),·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8, | 279 | ············A.14.2.7,·A.15.2.1,·A.8.2.3,·SI-7,·SI-7(1),·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8, |
| 280 | ············PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000446-GPOS-00200,·SRG-OS-000447-GPOS- | 280 | ············PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000446-GPOS-00200,·SRG-OS-000447-GPOS- |
| 281 | ············00201,·UBTU-20-010074,·1.4.2 | 281 | ············00201,·UBTU-20-010074,·1.4.2 |
| 282 | Remediation_Shell_script_⇲ | ||
| 283 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 284 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 285 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 286 | #·AiDE·usually·adds·its·own·cron·jobs·to·/etc/cron.daily.·If·script·is·there,·this·rule·is | ||
| 287 | #·compliant.·Otherwise,·we·copy·the·script·to·the·/etc/cron.weekly | ||
| 288 | if·!·egrep·-q·'^(/usr/bin/)?aide\.wrapper\s+'·/etc/cron.*/*;·then | ||
| 289 | ····cp·-f·/usr/share/aide/config/cron.daily/aide·/etc/cron.weekly/ | ||
| 290 | fi | ||
| 291 | else | ||
| 292 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 293 | fi | ||
| 282 | Remediation_Ansible_snippet_⇲ | 294 | Remediation_Ansible_snippet_⇲ |
| 283 | Complexity:·low | 295 | Complexity:·low |
| 284 | Disruption:·low | 296 | Disruption:·low |
| 285 | Strategy:···restrict | 297 | Strategy:···restrict |
| 286 | -·name:·Ensure·AIDE·is·installed | 298 | -·name:·Ensure·AIDE·is·installed |
| 287 | ··package: | 299 | ··package: |
| 288 | ····name:·'{{·item·}}' | 300 | ····name:·'{{·item·}}' |
| Offset 381, 29 lines modified | Offset 396, 14 lines modified | ||
| 381 | ··-·PCI-DSS-Req-11.5 | 396 | ··-·PCI-DSS-Req-11.5 |
| 382 | ··-·aide_periodic_cron_checking | 397 | ··-·aide_periodic_cron_checking |
| 383 | ··-·low_complexity | 398 | ··-·low_complexity |
| 384 | ··-·low_disruption | 399 | ··-·low_disruption |
| 385 | ··-·medium_severity | 400 | ··-·medium_severity |
| 386 | ··-·no_reboot_needed | 401 | ··-·no_reboot_needed |
| 387 | ··-·restrict_strategy | 402 | ··-·restrict_strategy |
| 388 | Remediation_Shell_script_⇲ | ||
| 389 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 390 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 391 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 392 | #·AiDE·usually·adds·its·own·cron·jobs·to·/etc/cron.daily.·If·script·is·there,·this·rule·is | ||
| 393 | #·compliant.·Otherwise,·we·copy·the·script·to·the·/etc/cron.weekly | ||
| 394 | if·!·egrep·-q·'^(/usr/bin/)?aide\.wrapper\s+'·/etc/cron.*/*;·then | ||
| 395 | ····cp·-f·/usr/share/aide/config/cron.daily/aide·/etc/cron.weekly/ | ||
| 396 | fi | ||
| 397 | else | ||
| 398 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 399 | fi | ||
| 400 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·1·rule | 403 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·1·rule |
| 401 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is | 404 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is |
| 402 | developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic | 405 | developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic |
| 403 | modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different | 406 | modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different |
| 404 | industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 407 | industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| Max diff block lines reached; 980297/985298 bytes (99.49%) of diff not shown. | |||
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d20:·7320·6f66·2032·3032·3 | 00037d20:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15285, 122 lines modified | Offset 15285, 122 lines modified | ||
| 0003bb40:·612d·7461·7267·6574·3d22·2369·646d·3234··a-target="#idm24 | 0003bb40:·612d·7461·7267·6574·3d22·2369·646d·3234··a-target="#idm24 | ||
| 0003bb50:·3533·2220·7461·6269·6e64·6578·3d22·3022··53"·tabindex="0" | 0003bb50:·3533·2220·7461·6269·6e64·6578·3d22·3022··53"·tabindex="0" | ||
| 0003bb60:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003bb60:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003bb70:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003bb70:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003bb80:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003bb80:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003bb90:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003bb90:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003bba0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003bba0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003bbb0:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | |||
| 0003bbc0:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003bbd0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003bbe0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003bbf0:·6522·2069·643d·2269·646d·3234·3533·223e··e"·id="idm2453"> | |||
| 0003bc00:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003bc10:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003bbb0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003bbc0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003bbd0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bbe0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bbf0:·6170·7365·2220·6964·3d22·6964·6d32·3435··apse"·id="idm245 | |||
| 0003bc00:·3322·3e3c·7461·626c·6520·636c·6173·733d··3"><table·class= | |||
| 0003bc10:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003bc20:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003bc | 0003bc20:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003bc40:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003bc | 0003bc30:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003bc40:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003bc50:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003bc60:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003bc70:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003bc80:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bc90:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003bca0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003bc | 0003bcb0:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | ||
| 0003bcc0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003bcd0:·3e23·2052·656d·6564·6961·7469·6f6e·2069··>#·Remediation·i | |||
| 0003bce0:·7320·6170·706c·6963·6162·6c65·206f·6e6c··s·applicable·onl | |||
| 0003bcf0:·7920·696e·2063·6572·7461·696e·2070·6c61··y·in·certain·pla | |||
| 0003bd00:·7466·6f72·6d73·0a69·6620·5b20·2120·2d66··tforms.if·[·!·-f | |||
| 0003bd10:·202f·2e64·6f63·6b65·7265·6e76·205d·2026···/.dockerenv·]·& | |||
| 0003bd20:·616d·703b·2661·6d70·3b20·5b20·2120·2d66··amp;&·[·!·-f | |||
| 0003bd30:·202f·7275·6e2f·2e63·6f6e·7461·696e·6572···/run/.container | |||
| 0003bd40:·656e·7620·5d3b·2074·6865·6e0a·0a44·4542··env·];·then..DEB | |||
| 0003bd50:·4941·4e5f·4652·4f4e·5445·4e44·3d6e·6f6e··IAN_FRONTEND=non | |||
| 0003bd60:·696e·7465·7261·6374·6976·6520·6170·742d··interactive·apt- | |||
| 0003bd70:·6765·7420·696e·7374·616c·6c20·2d79·2022··get·install·-y·" | |||
| 0003bd80:·6169·6465·220a·0a65·6c73·650a·2020·2020··aide"..else.···· | |||
| 0003bd90:·2667·743b·2661·6d70·3b32·2065·6368·6f20··>&2·echo· | |||
| 0003bda0:·2752·656d·6564·6961·7469·6f6e·2069·7320··'Remediation·is· | |||
| 0003bdb0:·6e6f·7420·6170·706c·6963·6162·6c65·2c20··not·applicable,· | |||
| 0003bdc0:·6e6f·7468·696e·6720·7761·7320·646f·6e65··nothing·was·done | |||
| 0003bc70:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003bc80:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bc90:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003bca0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003bcb0:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003bcc0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bcd0:·6f64·653e·2d20·6e61·6d65·3a20·456e·7375··ode>-·name:·Ensu | |||
| 0003bce0:·7265·2061·6964·6520·6973·2069·6e73·7461··re·aide·is·insta | |||
| 0003bcf0:·6c6c·6564·0a20·2070·6163·6b61·6765·3a0a··lled.··package:. | |||
| 0003bd00:·2020·2020·6e61·6d65·3a20·6169·6465·0a20······name:·aide.· | |||
| 0003bd10:·2020·2073·7461·7465·3a20·7072·6573·656e·····state:·presen | |||
| 0003bd20:·740a·2020·7768·656e·3a20·616e·7369·626c··t.··when:·ansibl | |||
| 0003bd30:·655f·7669·7274·7561·6c69·7a61·7469·6f6e··e_virtualization | |||
| 0003bd40:·5f74·7970·6520·6e6f·7420·696e·205b·2264··_type·not·in·["d | |||
| 0003bd50:·6f63·6b65·7222·2c20·226c·7863·222c·2022··ocker",·"lxc",·" | |||
| 0003bd60:·6f70·656e·767a·222c·2022·706f·646d·616e··openvz",·"podman | |||
| 0003bd70:·222c·2022·636f·6e74·6169·6e65·7222·5d0a··",·"container"]. | |||
| 0003bd80:·2020·7461·6773·3a0a·2020·2d20·434a·4953····tags:.··-·CJIS | |||
| 0003bd90:·2d35·2e31·302e·312e·330a·2020·2d20·4e49··-5.10.1.3.··-·NI | |||
| 0003bda0:·5354·2d38·3030·2d35·332d·434d·2d36·2861··ST-800-53-CM-6(a | |||
| 0003bdb0:·290a·2020·2d20·5043·492d·4453·532d·5265··).··-·PCI-DSS-Re | |||
| 0003bdc0:·712d·3131·2e35·0a20·202d·2065·6e61·626c··q-11.5.··-·enabl | |||
| 0003bdd0:·655f·7374·7261·7465·6779·0a20·202d·206c··e_strategy.··-·l | |||
| 0003bde0:·6f77·5f63·6f6d·706c·6578·6974·790a·2020··ow_complexity.·· | |||
| 0003bdf0:·2d20·6c6f·775f·6469·7372·7570·7469·6f6e··-·low_disruption | |||
| 0003be00:·0a20·202d·206d·6564·6975·6d5f·7365·7665··.··-·medium_seve | |||
| 0003be10:·7269·7479·0a20·202d·206e·6f5f·7265·626f··rity.··-·no_rebo | |||
| 0003be20:·6f74·5f6e·6565·6465·640a·2020·2d20·7061··ot_needed.··-·pa | |||
| 0003be30:·636b·6167·655f·6169·6465·5f69·6e73·7461··ckage_aide_insta | |||
| 0003b | 0003bdd0:·270a·6669·0a3c·2f63·6f64·653e·3c2f·7072··'.fi.</code></pr | ||
| 0003b | 0003bde0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | ||
| 0003b | 0003bdf0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | ||
| 0003be | 0003be00:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | ||
| 0003be | 0003be10:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | ||
| 0003be | 0003be20:·6172·6765·743d·2223·6964·6d32·3435·3422··arget="#idm2454" | ||
| 0003be | 0003be30:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003be | 0003be40:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003be | 0003be50:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003be | 0003be60:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003be | 0003be70:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003be | 0003be80:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003bf00:·6f6e·204f·5342·7569·6c64·2042·6c75·6570··on·OSBuild·Bluep | |||
| 0003bf10:·7269·6e74·2073·6e69·7070·6574·20e2·87b2··rint·snippet·... | |||
| 0003bf20:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bf30:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003bf40:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003bf50:·2269·646d·3234·3534·223e·3c70·7265·3e3c··"idm2454"><pre>< | |||
| 0003bf60:·636f·6465·3e0a·5b5b·7061·636b·6167·6573··code>.[[packages | |||
| 0003bf70:·5d5d·0a6e·616d·6520·3d20·2261·6964·6522··]].name·=·"aide" | |||
| 0003bf80:·0a76·6572·7369·6f6e·203d·2022·2a22·0a3c··.version·=·"*".< | |||
| 0003bf90:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003bfa0:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003bfb0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bfc0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bfd0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003bfe0:·2223·6964·6d32·3435·3522·2074·6162·696e··"#idm2455"·tabin | |||
| 0003bff0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003c000:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003c010:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003c020:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003c030:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| Max diff block lines reached; 3557796/3574410 bytes (99.54%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·22.04·Level·1·Server·Benchmark | 38 | Profile·Title·CIS·Ubuntu·22.04·Level·1·Server·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_server | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_server |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·GRUB2_bootloader_configuration | 49 | ·········3.·GRUB2_bootloader_configuration |
| 50 | ·········4.·Configure_Syslog | 50 | ·········4.·Configure_Syslog |
| 51 | ·········5.·Network_Configuration_and_Firewalls | 51 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 117, 14 lines modified | Offset 117, 26 lines modified | ||
| 117 | include·install_aide | 117 | include·install_aide |
| 118 | class·install_aide·{ | 118 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 119 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 120 | ····ensure·=>·'installed', |
| 121 | ··} | 121 | ··} |
| 122 | } | 122 | } |
| 123 | Remediation_Shell_script_⇲ | ||
| 124 | Complexity:·low | ||
| 125 | Disruption:·low | ||
| 126 | Strategy:···enable | ||
| 127 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 128 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 129 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 130 | else | ||
| 131 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 132 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 133 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 134 | Complexity:·low |
| 125 | Disruption:·low | 135 | Disruption:·low |
| 126 | Strategy:···enable | 136 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 137 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 138 | ··package: |
| 129 | ····name:·aide | 139 | ····name:·aide |
| Offset 141, 26 lines modified | Offset 153, 14 lines modified | ||
| 141 | ··-·no_reboot_needed | 153 | ··-·no_reboot_needed |
| 142 | ··-·package_aide_installed | 154 | ··-·package_aide_installed |
| 143 | Remediation_OSBuild_Blueprint_snippet_⇲ | 155 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 144 | [[packages]] | 156 | [[packages]] |
| 145 | name·=·"aide" | 157 | name·=·"aide" |
| 146 | version·=·"*" | 158 | version·=·"*" |
| 147 | Remediation_Shell_script_⇲ | ||
| 148 | Complexity:·low | ||
| 149 | Disruption:·low | ||
| 150 | Strategy:···enable | ||
| 151 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 152 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 153 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 154 | else | ||
| 155 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 156 | fi | ||
| 157 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 159 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 158 | Run·the·following·command·to·generate·a·new·database: | 160 | Run·the·following·command·to·generate·a·new·database: |
| 159 | $·sudo·aideinit | 161 | $·sudo·aideinit |
| 160 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 162 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 161 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure | 163 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure |
| 162 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 164 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 163 | database·can·be·installed·as·follows: | 165 | database·can·be·installed·as·follows: |
| Offset 174, 14 lines modified | Offset 174, 26 lines modified | ||
| 174 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 174 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 175 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 175 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 176 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 176 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 177 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 177 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 178 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 178 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 179 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 179 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 180 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 180 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 181 | Remediation_Shell_script_⇲ | ||
| 182 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 183 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 184 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 185 | /usr/sbin/aideinit | ||
| 186 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 187 | else | ||
| 188 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 189 | fi | ||
| 181 | Remediation_Ansible_snippet_⇲ | 190 | Remediation_Ansible_snippet_⇲ |
| 182 | Complexity:·low | 191 | Complexity:·low |
| 183 | Disruption:·low | 192 | Disruption:·low |
| 184 | Strategy:···restrict | 193 | Strategy:···restrict |
| 185 | -·name:·Ensure·AIDE·is·installed | 194 | -·name:·Ensure·AIDE·is·installed |
| 186 | ··package: | 195 | ··package: |
| 187 | ····name:·'{{·item·}}' | 196 | ····name:·'{{·item·}}' |
| Offset 246, 26 lines modified | Offset 258, 14 lines modified | ||
| 246 | ··-·PCI-DSS-Req-11.5 | 258 | ··-·PCI-DSS-Req-11.5 |
| 247 | ··-·aide_build_database | 259 | ··-·aide_build_database |
| 248 | ··-·low_complexity | 260 | ··-·low_complexity |
| 249 | ··-·low_disruption | 261 | ··-·low_disruption |
| 250 | ··-·medium_severity | 262 | ··-·medium_severity |
| 251 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 252 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 253 | Remediation_Shell_script_⇲ | ||
| 254 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 255 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 256 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 257 | /usr/sbin/aideinit | ||
| 258 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 259 | else | ||
| 260 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 261 | fi | ||
| 262 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 265 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 263 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 266 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 264 | using·cron,·add·the·following·line·to·/etc/crontab: | 267 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 265 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 268 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 266 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 269 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 267 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 270 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 268 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 271 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 288, 14 lines modified | Offset 288, 29 lines modified | ||
| 288 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 288 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 289 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 289 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 290 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 290 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 502975/508069 bytes (99.00%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d30:·206f·6620·3230·323 | 00037d30:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15276, 122 lines modified | Offset 15276, 122 lines modified | ||
| 0003bab0:·7267·6574·3d22·2369·646d·3234·3533·2220··rget="#idm2453"· | 0003bab0:·7267·6574·3d22·2369·646d·3234·3533·2220··rget="#idm2453"· | ||
| 0003bac0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003bac0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003bad0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003bad0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003bae0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003bae0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003baf0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003baf0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003bb00:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003bb00:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003bb10:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003bb10:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003bb20:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bb30:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bb40:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bb50:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bb60:·2220·6964·3d22·6964·6d32·3435·3322·3e3c··"·id="idm2453">< | |||
| 0003bb70:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bb80:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bb90:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bba0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bbb0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bb | 0003bb20:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | ||
| 0003bb30:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bb40:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bb50:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bb60:·643d·2269·646d·3234·3533·223e·3c74·6162··d="idm2453"><tab | |||
| 0003bb70:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bb80:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bb90:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bba0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bbb0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bbc0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bbd0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bbe0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bbf0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bc00:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bc10:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003b | 0003bc20:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003bc30:·653e·3c70·7265·3e3c·636f·6465·3e23·2052··e><pre><code>#·R | |||
| 0003bc40:·656d·6564·6961·7469·6f6e·2069·7320·6170··emediation·is·ap | |||
| 0003bc50:·706c·6963·6162·6c65·206f·6e6c·7920·696e··plicable·only·in | |||
| 0003bc60:·2063·6572·7461·696e·2070·6c61·7466·6f72···certain·platfor | |||
| 0003bc70:·6d73·0a69·6620·5b20·2120·2d66·202f·2e64··ms.if·[·!·-f·/.d | |||
| 0003bc80:·6f63·6b65·7265·6e76·205d·2026·616d·703b··ockerenv·]·& | |||
| 0003bc90:·2661·6d70·3b20·5b20·2120·2d66·202f·7275··&·[·!·-f·/ru | |||
| 0003bca0:·6e2f·2e63·6f6e·7461·696e·6572·656e·7620··n/.containerenv· | |||
| 0003bcb0:·5d3b·2074·6865·6e0a·0a44·4542·4941·4e5f··];·then..DEBIAN_ | |||
| 0003bcc0:·4652·4f4e·5445·4e44·3d6e·6f6e·696e·7465··FRONTEND=noninte | |||
| 0003bcd0:·7261·6374·6976·6520·6170·742d·6765·7420··ractive·apt-get· | |||
| 0003bce0:·696e·7374·616c·6c20·2d79·2022·6169·6465··install·-y·"aide | |||
| 0003bcf0:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 0003bd00:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 0003bd10:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 0003bd20:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 0003bd30:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 0003bbe0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bbf0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bc00:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003bc10:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003bc20:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003bc30:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003bc40:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003bc50:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003bc60:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003bc70:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003bc80:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003bc90:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003bca0:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003bcb0:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003bcc0:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003bcd0:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003bce0:·636f·6e74·6169·6e65·7222·5d0a·2020·7461··container"].··ta | |||
| 0003bcf0:·6773·3a0a·2020·2d20·434a·4953·2d35·2e31··gs:.··-·CJIS-5.1 | |||
| 0003bd00:·302e·312e·330a·2020·2d20·4e49·5354·2d38··0.1.3.··-·NIST-8 | |||
| 0003bd10:·3030·2d35·332d·434d·2d36·2861·290a·2020··00-53-CM-6(a).·· | |||
| 0003bd20:·2d20·5043·492d·4453·532d·5265·712d·3131··-·PCI-DSS-Req-11 | |||
| 0003bd30:·2e35·0a20·202d·2065·6e61·626c·655f·7374··.5.··-·enable_st | |||
| 0003bd40:·7261·7465·6779·0a20·202d·206c·6f77·5f63··rategy.··-·low_c | |||
| 0003bd50:·6f6d·706c·6578·6974·790a·2020·2d20·6c6f··omplexity.··-·lo | |||
| 0003bd60:·775f·6469·7372·7570·7469·6f6e·0a20·202d··w_disruption.··- | |||
| 0003bd70:·206d·6564·6975·6d5f·7365·7665·7269·7479···medium_severity | |||
| 0003bd80:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 0003bd90:·6565·6465·640a·2020·2d20·7061·636b·6167··eeded.··-·packag | |||
| 0003bda0:·655f·6169·6465·5f69·6e73·7461·6c6c·6564··e_aide_installed | |||
| 0003bd | 0003bd40:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | ||
| 0003bd | 0003bd50:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | ||
| 0003bd | 0003bd60:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | ||
| 0003bd | 0003bd70:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | ||
| 0003bd | 0003bd80:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003b | 0003bd90:·743d·2223·6964·6d32·3435·3422·2074·6162··t="#idm2454"·tab | ||
| 0003b | 0003bda0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003b | 0003bdb0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003b | 0003bdc0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003b | 0003bdd0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003b | 0003bde0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003b | 0003bdf0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | ||
| 0003be00:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003be10:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003be20:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003be30:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003be40:·643d·2269·646d·3234·3534·223e·3c74·6162··d="idm2454"><tab | |||
| 0003be50:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003be60:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003be70:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003be80:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003be90:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003be70:·5342·7569·6c64·2042·6c75·6570·7269·6e74··SBuild·Blueprint | |||
| 0003be80:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003be90:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bea0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003beb0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bec0:·3234·3534·223e·3c70·7265·3e3c·636f·6465··2454"><pre><code | |||
| 0003bed0:·3e0a·5b5b·7061·636b·6167·6573·5d5d·0a6e··>.[[packages]].n | |||
| 0003bee0:·616d·6520·3d20·2261·6964·6522·0a76·6572··ame·=·"aide".ver | |||
| 0003bef0:·7369·6f6e·203d·2022·2a22·0a3c·2f63·6f64··sion·=·"*".</cod | |||
| Max diff block lines reached; 3439936/3456550 bytes (99.52%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·22.04·Level·1·Workstation·Benchmark | 38 | Profile·Title·CIS·Ubuntu·22.04·Level·1·Workstation·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_workstation | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level1_workstation |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·GRUB2_bootloader_configuration | 49 | ·········3.·GRUB2_bootloader_configuration |
| 50 | ·········4.·Configure_Syslog | 50 | ·········4.·Configure_Syslog |
| 51 | ·········5.·Network_Configuration_and_Firewalls | 51 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 115, 14 lines modified | Offset 115, 26 lines modified | ||
| 115 | include·install_aide | 115 | include·install_aide |
| 116 | class·install_aide·{ | 116 | class·install_aide·{ |
| 117 | ··package·{·'aide': | 117 | ··package·{·'aide': |
| 118 | ····ensure·=>·'installed', | 118 | ····ensure·=>·'installed', |
| 119 | ··} | 119 | ··} |
| 120 | } | 120 | } |
| 121 | Remediation_Shell_script_⇲ | ||
| 122 | Complexity:·low | ||
| 123 | Disruption:·low | ||
| 124 | Strategy:···enable | ||
| 125 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 126 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 127 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 121 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 122 | Complexity:·low | 132 | Complexity:·low |
| 123 | Disruption:·low | 133 | Disruption:·low |
| 124 | Strategy:···enable | 134 | Strategy:···enable |
| 125 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 126 | ··package: | 136 | ··package: |
| 127 | ····name:·aide | 137 | ····name:·aide |
| Offset 139, 26 lines modified | Offset 151, 14 lines modified | ||
| 139 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 140 | ··-·package_aide_installed | 152 | ··-·package_aide_installed |
| 141 | Remediation_OSBuild_Blueprint_snippet_⇲ | 153 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 142 | [[packages]] | 154 | [[packages]] |
| 143 | name·=·"aide" | 155 | name·=·"aide" |
| 144 | version·=·"*" | 156 | version·=·"*" |
| 145 | Remediation_Shell_script_⇲ | ||
| 146 | Complexity:·low | ||
| 147 | Disruption:·low | ||
| 148 | Strategy:···enable | ||
| 149 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 150 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 151 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 152 | else | ||
| 153 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 154 | fi | ||
| 155 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 157 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 156 | Run·the·following·command·to·generate·a·new·database: | 158 | Run·the·following·command·to·generate·a·new·database: |
| 157 | $·sudo·aideinit | 159 | $·sudo·aideinit |
| 158 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 160 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 159 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure | 161 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure |
| 160 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 162 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 161 | database·can·be·installed·as·follows: | 163 | database·can·be·installed·as·follows: |
| Offset 172, 14 lines modified | Offset 172, 26 lines modified | ||
| 172 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 172 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 173 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 173 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 174 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 174 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 175 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 175 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 176 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 176 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 177 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 177 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 178 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 178 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 179 | Remediation_Shell_script_⇲ | ||
| 180 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 181 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 182 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 183 | /usr/sbin/aideinit | ||
| 184 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 185 | else | ||
| 186 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 187 | fi | ||
| 179 | Remediation_Ansible_snippet_⇲ | 188 | Remediation_Ansible_snippet_⇲ |
| 180 | Complexity:·low | 189 | Complexity:·low |
| 181 | Disruption:·low | 190 | Disruption:·low |
| 182 | Strategy:···restrict | 191 | Strategy:···restrict |
| 183 | -·name:·Ensure·AIDE·is·installed | 192 | -·name:·Ensure·AIDE·is·installed |
| 184 | ··package: | 193 | ··package: |
| 185 | ····name:·'{{·item·}}' | 194 | ····name:·'{{·item·}}' |
| Offset 244, 26 lines modified | Offset 256, 14 lines modified | ||
| 244 | ··-·PCI-DSS-Req-11.5 | 256 | ··-·PCI-DSS-Req-11.5 |
| 245 | ··-·aide_build_database | 257 | ··-·aide_build_database |
| 246 | ··-·low_complexity | 258 | ··-·low_complexity |
| 247 | ··-·low_disruption | 259 | ··-·low_disruption |
| 248 | ··-·medium_severity | 260 | ··-·medium_severity |
| 249 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 250 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 253 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 254 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 255 | /usr/sbin/aideinit | ||
| 256 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 257 | else | ||
| 258 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 259 | fi | ||
| 260 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 263 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 261 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 264 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 262 | using·cron,·add·the·following·line·to·/etc/crontab: | 265 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 263 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 266 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 264 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 267 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 265 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 268 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 266 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 269 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 286, 14 lines modified | Offset 286, 29 lines modified | ||
| 286 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 286 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 287 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 287 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 288 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 288 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 490932/496036 bytes (98.97%) of diff not shown. | |||
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037cd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037ce0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037cf0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d20:·7320·6f66·2032·3032·3 | 00037d20:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037d90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15291, 122 lines modified | Offset 15291, 122 lines modified | ||
| 0003bba0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003bba0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003bbb0:·3234·3533·2220·7461·6269·6e64·6578·3d22··2453"·tabindex=" | 0003bbb0:·3234·3533·2220·7461·6269·6e64·6578·3d22··2453"·tabindex=" | ||
| 0003bbc0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003bbc0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003bbd0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003bbd0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003bbe0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003bbe0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003bbf0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003bbf0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003bc00:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003bc00:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003bc10:·6469·6174·696f·6e20·5368·656c·6c20·7363··diation·Shell·sc | |||
| 0003bc20:·7269·7074·20e2·87b2·3c2f·613e·3c62·723e··ript·...</a><br> | |||
| 0003bc30:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bc40:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bc50:·7073·6522·2069·643d·2269·646d·3234·3533··pse"·id="idm2453 | |||
| 0003bc60:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bc70:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003bc10:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003bc20:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bc30:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bc40:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bc50:·6c6c·6170·7365·2220·6964·3d22·6964·6d32··llapse"·id="idm2 | |||
| 0003bc60:·3435·3322·3e3c·7461·626c·6520·636c·6173··453"><table·clas | |||
| 0003bc70:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bc80:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bc | 0003bc80:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | ||
| 0003bc90:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003bca0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003bcb0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003bca0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bcb0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bcc0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bcd0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bce0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bc | 0003bcc0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003bcd0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003bce0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003bcf0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003bd00:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003bd10:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003bd20:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003bd30:·6465·3e23·2052·656d·6564·6961·7469·6f6e··de>#·Remediation | |||
| 0003bd40:·2069·7320·6170·706c·6963·6162·6c65·206f···is·applicable·o | |||
| 0003bd50:·6e6c·7920·696e·2063·6572·7461·696e·2070··nly·in·certain·p | |||
| 0003bd60:·6c61·7466·6f72·6d73·0a69·6620·5b20·2120··latforms.if·[·!· | |||
| 0003bd70:·2d66·202f·2e64·6f63·6b65·7265·6e76·205d··-f·/.dockerenv·] | |||
| 0003bd80:·2026·616d·703b·2661·6d70·3b20·5b20·2120···&&·[·!· | |||
| 0003bd90:·2d66·202f·7275·6e2f·2e63·6f6e·7461·696e··-f·/run/.contain | |||
| 0003bda0:·6572·656e·7620·5d3b·2074·6865·6e0a·0a44··erenv·];·then..D | |||
| 0003bdb0:·4542·4941·4e5f·4652·4f4e·5445·4e44·3d6e··EBIAN_FRONTEND=n | |||
| 0003bdc0:·6f6e·696e·7465·7261·6374·6976·6520·6170··oninteractive·ap | |||
| 0003bdd0:·742d·6765·7420·696e·7374·616c·6c20·2d79··t-get·install·-y | |||
| 0003bde0:·2022·6169·6465·220a·0a65·6c73·650a·2020···"aide"..else.·· | |||
| 0003bdf0:·2020·2667·743b·2661·6d70·3b32·2065·6368····>&2·ech | |||
| 0003be00:·6f20·2752·656d·6564·6961·7469·6f6e·2069··o·'Remediation·i | |||
| 0003be10:·7320·6e6f·7420·6170·706c·6963·6162·6c65··s·not·applicable | |||
| 0003be20:·2c20·6e6f·7468·696e·6720·7761·7320·646f··,·nothing·was·do | |||
| 0003bd00:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bd10:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003bd20:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bd30:·3c63·6f64·653e·2d20·6e61·6d65·3a20·456e··<code>-·name:·En | |||
| 0003bd40:·7375·7265·2061·6964·6520·6973·2069·6e73··sure·aide·is·ins | |||
| 0003bd50:·7461·6c6c·6564·0a20·2070·6163·6b61·6765··talled.··package | |||
| 0003bd60:·3a0a·2020·2020·6e61·6d65·3a20·6169·6465··:.····name:·aide | |||
| 0003bd70:·0a20·2020·2073·7461·7465·3a20·7072·6573··.····state:·pres | |||
| 0003bd80:·656e·740a·2020·7768·656e·3a20·616e·7369··ent.··when:·ansi | |||
| 0003bd90:·626c·655f·7669·7274·7561·6c69·7a61·7469··ble_virtualizati | |||
| 0003bda0:·6f6e·5f74·7970·6520·6e6f·7420·696e·205b··on_type·not·in·[ | |||
| 0003bdb0:·2264·6f63·6b65·7222·2c20·226c·7863·222c··"docker",·"lxc", | |||
| 0003bdc0:·2022·6f70·656e·767a·222c·2022·706f·646d···"openvz",·"podm | |||
| 0003bdd0:·616e·222c·2022·636f·6e74·6169·6e65·7222··an",·"container" | |||
| 0003bde0:·5d0a·2020·7461·6773·3a0a·2020·2d20·434a··].··tags:.··-·CJ | |||
| 0003bdf0:·4953·2d35·2e31·302e·312e·330a·2020·2d20··IS-5.10.1.3.··-· | |||
| 0003be00:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003be10:·2861·290a·2020·2d20·5043·492d·4453·532d··(a).··-·PCI-DSS- | |||
| 0003be20:·5265·712d·3131·2e35·0a20·202d·2065·6e61··Req-11.5.··-·ena | |||
| 0003be30:·626c·655f·7374·7261·7465·6779·0a20·202d··ble_strategy.··- | |||
| 0003be40:·206c·6f77·5f63·6f6d·706c·6578·6974·790a···low_complexity. | |||
| 0003be50:·2020·2d20·6c6f·775f·6469·7372·7570·7469····-·low_disrupti | |||
| 0003be60:·6f6e·0a20·202d·206d·6564·6975·6d5f·7365··on.··-·medium_se | |||
| 0003be70:·7665·7269·7479·0a20·202d·206e·6f5f·7265··verity.··-·no_re | |||
| 0003be80:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003be90:·7061·636b·6167·655f·6169·6465·5f69·6e73··package_aide_ins | |||
| 0003be | 0003be30:·6e65·270a·6669·0a3c·2f63·6f64·653e·3c2f··ne'.fi.</code></ | ||
| 0003be | 0003be40:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | ||
| 0003be | 0003be50:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | ||
| 0003be | 0003be60:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | ||
| 0003be | 0003be70:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | ||
| 0003be | 0003be80:·2d74·6172·6765·743d·2223·6964·6d32·3435··-target="#idm245 | ||
| 0003b | 0003be90:·3422·2074·6162·696e·6465·783d·2230·2220··4"·tabindex="0"· | ||
| 0003b | 0003bea0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003b | 0003beb0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003b | 0003bec0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003b | 0003bed0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003b | 0003bee0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bf60:·7469·6f6e·204f·5342·7569·6c64·2042·6c75··tion·OSBuild·Blu | |||
| 0003bf70:·6570·7269·6e74·2073·6e69·7070·6574·20e2··eprint·snippet·. | |||
| 0003bf80:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bf90:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bfa0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bfb0:·643d·2269·646d·3234·3534·223e·3c70·7265··d="idm2454"><pre | |||
| 0003bfc0:·3e3c·636f·6465·3e0a·5b5b·7061·636b·6167··><code>.[[packag | |||
| 0003bfd0:·6573·5d5d·0a6e·616d·6520·3d20·2261·6964··es]].name·=·"aid | |||
| 0003bfe0:·6522·0a76·6572·7369·6f6e·203d·2022·2a22··e".version·=·"*" | |||
| 0003bff0:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c000:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c010:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c020:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c030:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003c040:·743d·2223·6964·6d32·3435·3522·2074·6162··t="#idm2455"·tab | |||
| 0003c050:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003c060:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003c070:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003c080:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| Max diff block lines reached; 13654543/13671157 bytes (99.88%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·22.04·Level·2·Server·Benchmark | 38 | Profile·Title·CIS·Ubuntu·22.04·Level·2·Server·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level2_server | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level2_server |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 118, 14 lines modified | Offset 118, 26 lines modified | ||
| 118 | include·install_aide | 118 | include·install_aide |
| 119 | class·install_aide·{ | 119 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 120 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 121 | ····ensure·=>·'installed', |
| 122 | ··} | 122 | ··} |
| 123 | } | 123 | } |
| 124 | Remediation_Shell_script_⇲ | ||
| 125 | Complexity:·low | ||
| 126 | Disruption:·low | ||
| 127 | Strategy:···enable | ||
| 128 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 129 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 130 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 131 | else | ||
| 132 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 133 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 134 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 135 | Complexity:·low |
| 126 | Disruption:·low | 136 | Disruption:·low |
| 127 | Strategy:···enable | 137 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 138 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 139 | ··package: |
| 130 | ····name:·aide | 140 | ····name:·aide |
| Offset 142, 26 lines modified | Offset 154, 14 lines modified | ||
| 142 | ··-·no_reboot_needed | 154 | ··-·no_reboot_needed |
| 143 | ··-·package_aide_installed | 155 | ··-·package_aide_installed |
| 144 | Remediation_OSBuild_Blueprint_snippet_⇲ | 156 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 145 | [[packages]] | 157 | [[packages]] |
| 146 | name·=·"aide" | 158 | name·=·"aide" |
| 147 | version·=·"*" | 159 | version·=·"*" |
| 148 | Remediation_Shell_script_⇲ | ||
| 149 | Complexity:·low | ||
| 150 | Disruption:·low | ||
| 151 | Strategy:···enable | ||
| 152 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 153 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 154 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 155 | else | ||
| 156 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 157 | fi | ||
| 158 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 159 | Run·the·following·command·to·generate·a·new·database: | 161 | Run·the·following·command·to·generate·a·new·database: |
| 160 | $·sudo·aideinit | 162 | $·sudo·aideinit |
| 161 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 162 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure | 164 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure |
| 163 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 165 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 164 | database·can·be·installed·as·follows: | 166 | database·can·be·installed·as·follows: |
| Offset 175, 14 lines modified | Offset 175, 26 lines modified | ||
| 175 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 175 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 176 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 176 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 177 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 177 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 178 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 178 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 179 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 179 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 180 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 180 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 181 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 181 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 182 | Remediation_Shell_script_⇲ | ||
| 183 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 184 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 185 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 186 | /usr/sbin/aideinit | ||
| 187 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 188 | else | ||
| 189 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 190 | fi | ||
| 182 | Remediation_Ansible_snippet_⇲ | 191 | Remediation_Ansible_snippet_⇲ |
| 183 | Complexity:·low | 192 | Complexity:·low |
| 184 | Disruption:·low | 193 | Disruption:·low |
| 185 | Strategy:···restrict | 194 | Strategy:···restrict |
| 186 | -·name:·Ensure·AIDE·is·installed | 195 | -·name:·Ensure·AIDE·is·installed |
| 187 | ··package: | 196 | ··package: |
| 188 | ····name:·'{{·item·}}' | 197 | ····name:·'{{·item·}}' |
| Offset 247, 26 lines modified | Offset 259, 14 lines modified | ||
| 247 | ··-·PCI-DSS-Req-11.5 | 259 | ··-·PCI-DSS-Req-11.5 |
| 248 | ··-·aide_build_database | 260 | ··-·aide_build_database |
| 249 | ··-·low_complexity | 261 | ··-·low_complexity |
| 250 | ··-·low_disruption | 262 | ··-·low_disruption |
| 251 | ··-·medium_severity | 263 | ··-·medium_severity |
| 252 | ··-·no_reboot_needed | 264 | ··-·no_reboot_needed |
| 253 | ··-·restrict_strategy | 265 | ··-·restrict_strategy |
| 254 | Remediation_Shell_script_⇲ | ||
| 255 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 256 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 257 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 258 | /usr/sbin/aideinit | ||
| 259 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 260 | else | ||
| 261 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 262 | fi | ||
| 263 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 266 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 264 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 267 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 265 | using·cron,·add·the·following·line·to·/etc/crontab: | 268 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 266 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 269 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 267 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 270 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 268 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 271 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 269 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 272 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 289, 14 lines modified | Offset 289, 29 lines modified | ||
| 289 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 289 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 290 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 290 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 291 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 291 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 1084335/1089423 bytes (99.53%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d30:·206f·6620·3230·323 | 00037d30:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15287, 122 lines modified | Offset 15287, 122 lines modified | ||
| 0003bb60:·7461·7267·6574·3d22·2369·646d·3234·3533··target="#idm2453 | 0003bb60:·7461·7267·6574·3d22·2369·646d·3234·3533··target="#idm2453 | ||
| 0003bb70:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003bb70:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003bb80:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003bb80:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003bb90:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003bb90:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003bba0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003bba0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003bbb0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003bbb0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003bbc0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003bbc0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003bbd0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003bbe0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003bbf0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003bc00:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003bc10:·7365·2220·6964·3d22·6964·6d32·3435·3322··se"·id="idm2453" | |||
| 0003bc20:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003bc30:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003bc40:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003bc50:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003bc60:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003b | 0003bbd0:·696f·6e20·5368·656c·6c20·7363·7269·7074··ion·Shell·script | ||
| 0003bbe0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bbf0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bc00:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bc10:·2069·643d·2269·646d·3234·3533·223e·3c74···id="idm2453"><t | |||
| 0003bc20:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bc30:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bc40:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bc50:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003bc60:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003bc70:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003bc80:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bc90:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003bca0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003bcb0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003bcc0:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003bc | 0003bcd0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | ||
| 0003bce0:·626c·653e·3c70·7265·3e3c·636f·6465·3e23··ble><pre><code># | |||
| 0003bcf0:·2052·656d·6564·6961·7469·6f6e·2069·7320···Remediation·is· | |||
| 0003bd00:·6170·706c·6963·6162·6c65·206f·6e6c·7920··applicable·only· | |||
| 0003bd10:·696e·2063·6572·7461·696e·2070·6c61·7466··in·certain·platf | |||
| 0003bd20:·6f72·6d73·0a69·6620·5b20·2120·2d66·202f··orms.if·[·!·-f·/ | |||
| 0003bd30:·2e64·6f63·6b65·7265·6e76·205d·2026·616d··.dockerenv·]·&am | |||
| 0003bd40:·703b·2661·6d70·3b20·5b20·2120·2d66·202f··p;&·[·!·-f·/ | |||
| 0003bd50:·7275·6e2f·2e63·6f6e·7461·696e·6572·656e··run/.containeren | |||
| 0003bd60:·7620·5d3b·2074·6865·6e0a·0a44·4542·4941··v·];·then..DEBIA | |||
| 0003bd70:·4e5f·4652·4f4e·5445·4e44·3d6e·6f6e·696e··N_FRONTEND=nonin | |||
| 0003bd80:·7465·7261·6374·6976·6520·6170·742d·6765··teractive·apt-ge | |||
| 0003bd90:·7420·696e·7374·616c·6c20·2d79·2022·6169··t·install·-y·"ai | |||
| 0003bda0:·6465·220a·0a65·6c73·650a·2020·2020·2667··de"..else.····&g | |||
| 0003bdb0:·743b·2661·6d70·3b32·2065·6368·6f20·2752··t;&2·echo·'R | |||
| 0003bdc0:·656d·6564·6961·7469·6f6e·2069·7320·6e6f··emediation·is·no | |||
| 0003bdd0:·7420·6170·706c·6963·6162·6c65·2c20·6e6f··t·applicable,·no | |||
| 0003bde0:·7468·696e·6720·7761·7320·646f·6e65·270a··thing·was·done'. | |||
| 0003bc90:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003bca0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bcb0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bcc0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003bcd0:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003bce0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003bcf0:·653e·2d20·6e61·6d65·3a20·456e·7375·7265··e>-·name:·Ensure | |||
| 0003bd00:·2061·6964·6520·6973·2069·6e73·7461·6c6c···aide·is·install | |||
| 0003bd10:·6564·0a20·2070·6163·6b61·6765·3a0a·2020··ed.··package:.·· | |||
| 0003bd20:·2020·6e61·6d65·3a20·6169·6465·0a20·2020····name:·aide.··· | |||
| 0003bd30:·2073·7461·7465·3a20·7072·6573·656e·740a···state:·present. | |||
| 0003bd40:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003bd50:·7669·7274·7561·6c69·7a61·7469·6f6e·5f74··virtualization_t | |||
| 0003bd60:·7970·6520·6e6f·7420·696e·205b·2264·6f63··ype·not·in·["doc | |||
| 0003bd70:·6b65·7222·2c20·226c·7863·222c·2022·6f70··ker",·"lxc",·"op | |||
| 0003bd80:·656e·767a·222c·2022·706f·646d·616e·222c··envz",·"podman", | |||
| 0003bd90:·2022·636f·6e74·6169·6e65·7222·5d0a·2020···"container"].·· | |||
| 0003bda0:·7461·6773·3a0a·2020·2d20·434a·4953·2d35··tags:.··-·CJIS-5 | |||
| 0003bdb0:·2e31·302e·312e·330a·2020·2d20·4e49·5354··.10.1.3.··-·NIST | |||
| 0003bdc0:·2d38·3030·2d35·332d·434d·2d36·2861·290a··-800-53-CM-6(a). | |||
| 0003bdd0:·2020·2d20·5043·492d·4453·532d·5265·712d····-·PCI-DSS-Req- | |||
| 0003bde0:·3131·2e35·0a20·202d·2065·6e61·626c·655f··11.5.··-·enable_ | |||
| 0003bdf0:·7374·7261·7465·6779·0a20·202d·206c·6f77··strategy.··-·low | |||
| 0003be00:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003be10:·6c6f·775f·6469·7372·7570·7469·6f6e·0a20··low_disruption.· | |||
| 0003be20:·202d·206d·6564·6975·6d5f·7365·7665·7269···-·medium_severi | |||
| 0003be30:·7479·0a20·202d·206e·6f5f·7265·626f·6f74··ty.··-·no_reboot | |||
| 0003be40:·5f6e·6565·6465·640a·2020·2d20·7061·636b··_needed.··-·pack | |||
| 0003be50:·6167·655f·6169·6465·5f69·6e73·7461·6c6c··age_aide_install | |||
| 0003b | 0003bdf0:·6669·0a3c·2f63·6f64·653e·3c2f·7072·653e··fi.</code></pre> | ||
| 0003be | 0003be00:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | ||
| 0003be | 0003be10:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | ||
| 0003be | 0003be20:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | ||
| 0003be | 0003be30:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | ||
| 0003be | 0003be40:·6765·743d·2223·6964·6d32·3435·3422·2074··get="#idm2454"·t | ||
| 0003be | 0003be50:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003be | 0003be60:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003be | 0003be70:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003be | 0003be80:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003b | 0003be90:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003b | 0003bea0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003bf20:·204f·5342·7569·6c64·2042·6c75·6570·7269···OSBuild·Bluepri | |||
| 0003bf30:·6e74·2073·6e69·7070·6574·20e2·87b2·3c2f··nt·snippet·...</ | |||
| 0003bf40:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bf50:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bf60:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bf70:·646d·3234·3534·223e·3c70·7265·3e3c·636f··dm2454"><pre><co | |||
| 0003bf80:·6465·3e0a·5b5b·7061·636b·6167·6573·5d5d··de>.[[packages]] | |||
| 0003bf90:·0a6e·616d·6520·3d20·2261·6964·6522·0a76··.name·=·"aide".v | |||
| 0003bfa0:·6572·7369·6f6e·203d·2022·2a22·0a3c·2f63··ersion·=·"*".</c | |||
| 0003bfb0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003bfc0:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003bfd0:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003bfe0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003bff0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c000:·6964·6d32·3435·3522·2074·6162·696e·6465··idm2455"·tabinde | |||
| 0003c010:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c020:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c030:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c040:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| Max diff block lines reached; 13624265/13640879 bytes (99.88%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·CIS·Ubuntu·22.04·Level·2·Workstation·Benchmark | 38 | Profile·Title·CIS·Ubuntu·22.04·Level·2·Workstation·Benchmark |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level2_workstation | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_level2_workstation |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ | 41 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 117, 14 lines modified | Offset 117, 26 lines modified | ||
| 117 | include·install_aide | 117 | include·install_aide |
| 118 | class·install_aide·{ | 118 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 119 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 120 | ····ensure·=>·'installed', |
| 121 | ··} | 121 | ··} |
| 122 | } | 122 | } |
| 123 | Remediation_Shell_script_⇲ | ||
| 124 | Complexity:·low | ||
| 125 | Disruption:·low | ||
| 126 | Strategy:···enable | ||
| 127 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 128 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 129 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 130 | else | ||
| 131 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 132 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 133 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 134 | Complexity:·low |
| 125 | Disruption:·low | 135 | Disruption:·low |
| 126 | Strategy:···enable | 136 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 137 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 138 | ··package: |
| 129 | ····name:·aide | 139 | ····name:·aide |
| Offset 141, 26 lines modified | Offset 153, 14 lines modified | ||
| 141 | ··-·no_reboot_needed | 153 | ··-·no_reboot_needed |
| 142 | ··-·package_aide_installed | 154 | ··-·package_aide_installed |
| 143 | Remediation_OSBuild_Blueprint_snippet_⇲ | 155 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 144 | [[packages]] | 156 | [[packages]] |
| 145 | name·=·"aide" | 157 | name·=·"aide" |
| 146 | version·=·"*" | 158 | version·=·"*" |
| 147 | Remediation_Shell_script_⇲ | ||
| 148 | Complexity:·low | ||
| 149 | Disruption:·low | ||
| 150 | Strategy:···enable | ||
| 151 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 152 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 153 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 154 | else | ||
| 155 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 156 | fi | ||
| 157 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 159 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 158 | Run·the·following·command·to·generate·a·new·database: | 160 | Run·the·following·command·to·generate·a·new·database: |
| 159 | $·sudo·aideinit | 161 | $·sudo·aideinit |
| 160 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 162 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 161 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure | 163 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide.wrapper·(or·hashes·of·these·files),·in·a·secure |
| 162 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 164 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 163 | database·can·be·installed·as·follows: | 165 | database·can·be·installed·as·follows: |
| Offset 174, 14 lines modified | Offset 174, 26 lines modified | ||
| 174 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 174 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 175 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 175 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 176 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 176 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 177 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 177 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 178 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 178 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 179 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 179 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 180 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 180 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 181 | Remediation_Shell_script_⇲ | ||
| 182 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 183 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 184 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 185 | /usr/sbin/aideinit | ||
| 186 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 187 | else | ||
| 188 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 189 | fi | ||
| 181 | Remediation_Ansible_snippet_⇲ | 190 | Remediation_Ansible_snippet_⇲ |
| 182 | Complexity:·low | 191 | Complexity:·low |
| 183 | Disruption:·low | 192 | Disruption:·low |
| 184 | Strategy:···restrict | 193 | Strategy:···restrict |
| 185 | -·name:·Ensure·AIDE·is·installed | 194 | -·name:·Ensure·AIDE·is·installed |
| 186 | ··package: | 195 | ··package: |
| 187 | ····name:·'{{·item·}}' | 196 | ····name:·'{{·item·}}' |
| Offset 246, 26 lines modified | Offset 258, 14 lines modified | ||
| 246 | ··-·PCI-DSS-Req-11.5 | 258 | ··-·PCI-DSS-Req-11.5 |
| 247 | ··-·aide_build_database | 259 | ··-·aide_build_database |
| 248 | ··-·low_complexity | 260 | ··-·low_complexity |
| 249 | ··-·low_disruption | 261 | ··-·low_disruption |
| 250 | ··-·medium_severity | 262 | ··-·medium_severity |
| 251 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 252 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 253 | Remediation_Shell_script_⇲ | ||
| 254 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 255 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 256 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"aide" | ||
| 257 | /usr/sbin/aideinit | ||
| 258 | /bin/mv·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 259 | else | ||
| 260 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 261 | fi | ||
| 262 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 265 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 263 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 266 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 264 | using·cron,·add·the·following·line·to·/etc/crontab: | 267 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 265 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 268 | 05·4·*·*·*·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 266 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 269 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 267 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check | 270 | 05·4·*·*·0·root·/usr/bin/aide.wrapper·--config·/etc/aide/aide.conf·--check |
| 268 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 271 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 288, 14 lines modified | Offset 288, 29 lines modified | ||
| 288 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 288 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 289 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 289 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 290 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 290 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 1080896/1085994 bytes (99.53%) of diff not shown. | |||
| Offset 14287, 16 lines modified | Offset 14287, 16 lines modified | ||
| 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00037ce0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00037cf0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00037d00:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00037d10:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00037d20:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00037d30:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·2020·2020·2028·6173·206f·6620·3230·323 | 00037d50:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00037d60:·2d30·3 | 00037d60:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00037d70:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00037d80:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00037d90:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00037da0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00037db0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00037dc0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00037dd0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 17532, 131 lines modified | Offset 17532, 131 lines modified | ||
| 000447b0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 000447b0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 000447c0:·743d·2223·6964·6d38·3636·3222·2074·6162··t="#idm8662"·tab | 000447c0:·743d·2223·6964·6d38·3636·3222·2074·6162··t="#idm8662"·tab | ||
| 000447d0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 000447d0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 000447e0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 000447e0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 000447f0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 000447f0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 00044800:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 00044800:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 00044810:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 00044810:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 00044820:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 00044820:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 00044830:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | |||
| 00044840:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 00044850:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 00044860:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 00044870:·6964·6d38·3636·3222·3e3c·7461·626c·6520··idm8662"><table· | |||
| 00044880:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 00044890:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 000448a0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 000448b0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 000448c0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 000448d0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 000448e0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 000448f0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 00044900:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 00044910:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 00044920:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 00044930:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 00044940:·7072·653e·3c63·6f64·653e·2320·5265·6d65··pre><code>#·Reme | |||
| 00044950:·6469·6174·696f·6e20·6973·2061·7070·6c69··diation·is·appli | |||
| 00044960:·6361·626c·6520·6f6e·6c79·2069·6e20·6365··cable·only·in·ce | |||
| 00044970:·7274·6169·6e20·706c·6174·666f·726d·730a··rtain·platforms. | |||
| 00044980:·6966·205b·2021·202d·6620·2f2e·646f·636b··if·[·!·-f·/.dock | |||
| 00044990:·6572·656e·7620·5d20·2661·6d70·3b26·616d··erenv·]·&&am | |||
| 000449a0:·703b·205b·2021·202d·6620·2f72·756e·2f2e··p;·[·!·-f·/run/. | |||
| 000449b0:·636f·6e74·6169·6e65·7265·6e76·205d·3b20··containerenv·];· | |||
| 000449c0:·7468·656e·0a0a·4445·4249·414e·5f46·524f··then..DEBIAN_FRO | |||
| 000449d0:·4e54·454e·443d·6e6f·6e69·6e74·6572·6163··NTEND=noninterac | |||
| 000449e0:·7469·7665·2061·7074·2d67·6574·2069·6e73··tive·apt-get·ins | |||
| 000449f0:·7461·6c6c·202d·7920·2261·7564·6974·220a··tall·-y·"audit". | |||
| 00044a00:·0a65·6c73·650a·2020·2020·2667·743b·2661··.else.····>&a | |||
| 00044a10:·6d70·3b32·2065·6368·6f20·2752·656d·6564··mp;2·echo·'Remed | |||
| 00044a20:·6961·7469·6f6e·2069·7320·6e6f·7420·6170··iation·is·not·ap | |||
| 00044a30:·706c·6963·6162·6c65·2c20·6e6f·7468·696e··plicable,·nothin | |||
| 00044a40:·6720·7761·7320·646f·6e65·270a·6669·0a3c··g·was·done'.fi.< | |||
| 00044a50:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 00044a60:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 00044a70:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 00044a80:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 00044a90:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 00044aa0:·2223·6964·6d38·3636·3322·2074·6162·696e··"#idm8663"·tabin | |||
| 00044ab0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 00044ac0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 00044ad0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 00044ae0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 00044af0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 00044b00:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 00044 | 00044b10:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | ||
| 00044 | 00044b20:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 00044 | 00044b30:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 00044 | 00044b40:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 00044 | 00044b50:·2269·646d·3836·3633·223e·3c74·6162·6c65··"idm8663"><table | ||
| 00044 | 00044b60:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 00044 | 00044b70:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 00044 | 00044b80:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 00044 | 00044b90:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 00044 | 00044ba0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 00044 | 00044bb0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 00044 | 00044bc0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 00044 | 00044bd0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 00044900:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 00044910:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 00044920:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 00044930:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 00044940:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 00044950:·616d·653a·2045·6e73·7572·6520·6175·6469··ame:·Ensure·audi | |||
| 00044960:·7420·6973·2069·6e73·7461·6c6c·6564·0a20··t·is·installed.· | |||
| 00044970:·2070·6163·6b61·6765·3a0a·2020·2020·6e61···package:.····na | |||
| 00044980:·6d65·3a20·6175·6469·740a·2020·2020·7374··me:·audit.····st | |||
| 00044990:·6174·653a·2070·7265·7365·6e74·0a20·2077··ate:·present.··w | |||
| 000449a0:·6865·6e3a·2061·6e73·6962·6c65·5f76·6972··hen:·ansible_vir | |||
| 000449b0:·7475·616c·697a·6174·696f·6e5f·7479·7065··tualization_type | |||
| 000449c0:·206e·6f74·2069·6e20·5b22·646f·636b·6572···not·in·["docker | |||
| 000449d0:·222c·2022·6c78·6322·2c20·226f·7065·6e76··",·"lxc",·"openv | |||
| 000449e0:·7a22·2c20·2270·6f64·6d61·6e22·2c20·2263··z",·"podman",·"c | |||
| 000449f0:·6f6e·7461·696e·6572·225d·0a20·2074·6167··ontainer"].··tag | |||
| 00044a00:·733a·0a20·202d·204e·4953·542d·3830·302d··s:.··-·NIST-800- | |||
| 00044a10:·3533·2d41·432d·3728·6129·0a20·202d·204e··53-AC-7(a).··-·N | |||
| 00044a20:·4953·542d·3830·302d·3533·2d41·552d·3132··IST-800-53-AU-12 | |||
| 00044a30:·2832·290a·2020·2d20·4e49·5354·2d38·3030··(2).··-·NIST-800 | |||
| 00044a40:·2d35·332d·4155·2d31·340a·2020·2d20·4e49··-53-AU-14.··-·NI | |||
| 00044a50:·5354·2d38·3030·2d35·332d·4155·2d32·2861··ST-800-53-AU-2(a | |||
| 00044a60:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 00044a70:·332d·4155·2d37·2831·290a·2020·2d20·4e49··3-AU-7(1).··-·NI | |||
| 00044a80:·5354·2d38·3030·2d35·332d·4155·2d37·2832··ST-800-53-AU-7(2 | |||
| 00044a90:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 00044aa0:·332d·434d·2d36·2861·290a·2020·2d20·5043··3-CM-6(a).··-·PC | |||
| 00044ab0:·492d·4453·532d·5265·712d·3130·2e32·2e31··I-DSS-Req-10.2.1 | |||
| 00044ac0:·0a20·202d·2065·6e61·626c·655f·7374·7261··.··-·enable_stra | |||
| 00044ad0:·7465·6779·0a20·202d·206c·6f77·5f63·6f6d··tegy.··-·low_com | |||
| 00044ae0:·706c·6578·6974·790a·2020·2d20·6c6f·775f··plexity.··-·low_ | |||
| 00044af0:·6469·7372·7570·7469·6f6e·0a20·202d·206d··disruption.··-·m | |||
| 00044b00:·6564·6975·6d5f·7365·7665·7269·7479·0a20··edium_severity.· | |||
| 00044b10:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 00044b20:·6465·640a·2020·2d20·7061·636b·6167·655f··ded.··-·package_ | |||
| 00044b30:·6175·6469·745f·696e·7374·616c·6c65·640a··audit_installed. | |||
| 00044b40:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 00044b50:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 00044b60:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 00044b70:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 00044b80:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 00044b90:·3d22·2369·646d·3836·3633·2220·7461·6269··="#idm8663"·tabi | |||
| 00044ba0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| Max diff block lines reached; 675598/693592 bytes (97.41%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·22.04 | 39 | Profile·Title·Standard·System·Security·Profile·for·Ubuntu·22.04 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ | 42 | ····*·cpe:/o:canonical:ubuntu_linux:22.04::~~lts~~~ |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 272, 14 lines modified | Offset 272, 26 lines modified | ||
| 272 | include·install_audit | 272 | include·install_audit |
| 273 | class·install_audit·{ | 273 | class·install_audit·{ |
| 274 | ··package·{·'audit': | 274 | ··package·{·'audit': |
| 275 | ····ensure·=>·'installed', | 275 | ····ensure·=>·'installed', |
| 276 | ··} | 276 | ··} |
| 277 | } | 277 | } |
| 278 | Remediation_Shell_script_⇲ | ||
| 279 | Complexity:·low | ||
| 280 | Disruption:·low | ||
| 281 | Strategy:···enable | ||
| 282 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 283 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 284 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"audit" | ||
| 285 | else | ||
| 286 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 287 | fi | ||
| 278 | Remediation_Ansible_snippet_⇲ | 288 | Remediation_Ansible_snippet_⇲ |
| 279 | Complexity:·low | 289 | Complexity:·low |
| 280 | Disruption:·low | 290 | Disruption:·low |
| 281 | Strategy:···enable | 291 | Strategy:···enable |
| 282 | -·name:·Ensure·audit·is·installed | 292 | -·name:·Ensure·audit·is·installed |
| 283 | ··package: | 293 | ··package: |
| 284 | ····name:·audit | 294 | ····name:·audit |
| Offset 301, 26 lines modified | Offset 313, 14 lines modified | ||
| 301 | ··-·no_reboot_needed | 313 | ··-·no_reboot_needed |
| 302 | ··-·package_audit_installed | 314 | ··-·package_audit_installed |
| 303 | Remediation_OSBuild_Blueprint_snippet_⇲ | 315 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 304 | [[packages]] | 316 | [[packages]] |
| 305 | name·=·"audit" | 317 | name·=·"audit" |
| 306 | version·=·"*" | 318 | version·=·"*" |
| 307 | Remediation_Shell_script_⇲ | ||
| 308 | Complexity:·low | ||
| 309 | Disruption:·low | ||
| 310 | Strategy:···enable | ||
| 311 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 312 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 313 | DEBIAN_FRONTEND=noninteractive·apt-get·install·-y·"audit" | ||
| 314 | else | ||
| 315 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 316 | fi | ||
| 317 | ***·Rule ·Enable·auditd·Service· [ref]·*** | 319 | ***·Rule ·Enable·auditd·Service· [ref]·*** |
| 318 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is | 320 | The·auditd·service·is·an·essential·userspace·component·of·the·Linux·Auditing·System,·as·it·is |
| 319 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following | 321 | responsible·for·writing·audit·records·to·disk.·The·auditd·service·can·be·enabled·with·the·following |
| 320 | command: | 322 | command: |
| 321 | $·sudo·systemctl·enable·auditd.service | 323 | $·sudo·systemctl·enable·auditd.service |
| 322 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, | 324 | ············Without·establishing·what·type·of·events·occurred,·it·would·be·difficult·to·establish, |
| 323 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the | 325 | ············correlate,·and·investigate·the·events·leading·up·to·an·outage·or·attack.·Ensuring·the |
| Offset 367, 14 lines modified | Offset 367, 30 lines modified | ||
| 367 | class·enable_auditd·{ | 367 | class·enable_auditd·{ |
| 368 | ··service·{'auditd': | 368 | ··service·{'auditd': |
| 369 | ····enable·=>·true, | 369 | ····enable·=>·true, |
| 370 | ····ensure·=>·'running', | 370 | ····ensure·=>·'running', |
| 371 | ··} | 371 | ··} |
| 372 | } | 372 | } |
| 373 | Remediation_Shell_script_⇲ | ||
| 374 | Complexity:·low | ||
| 375 | Disruption:·low | ||
| 376 | Strategy:···enable | ||
| 377 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 378 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 379 | Status-Status}\n'·'auditd'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 380 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 381 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 382 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 383 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 384 | else | ||
| 385 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 386 | fi | ||
| 373 | Remediation_Ansible_snippet_⇲ | 387 | Remediation_Ansible_snippet_⇲ |
| 374 | Complexity:·low | 388 | Complexity:·low |
| 375 | Disruption:·low | 389 | Disruption:·low |
| 376 | Strategy:···enable | 390 | Strategy:···enable |
| 377 | -·name:·Gather·the·package·facts | 391 | -·name:·Gather·the·package·facts |
| 378 | ··package_facts: | 392 | ··package_facts: |
| 379 | ····manager:·auto | 393 | ····manager:·auto |
| Offset 439, 30 lines modified | Offset 455, 14 lines modified | ||
| 439 | ··-·medium_severity | 455 | ··-·medium_severity |
| 440 | ··-·no_reboot_needed | 456 | ··-·no_reboot_needed |
| 441 | ··-·service_auditd_enabled | 457 | ··-·service_auditd_enabled |
| 442 | Remediation_OSBuild_Blueprint_snippet_⇲ | 458 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 443 | [customizations.services] | 459 | [customizations.services] |
| 444 | enabled·=·["auditd"] | 460 | enabled·=·["auditd"] |
| 445 | Remediation_Shell_script_⇲ | ||
| 446 | Complexity:·low | ||
| 447 | Disruption:·low | ||
| 448 | Strategy:···enable | ||
| 449 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 450 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·dpkg-query·--show·--showformat='${db: | ||
| 451 | Status-Status}\n'·'auditd'·2>/dev/null·|·grep·-q·installed;·};·then | ||
| 452 | SYSTEMCTL_EXEC='/usr/bin/systemctl' | ||
| 453 | "$SYSTEMCTL_EXEC"·unmask·'auditd.service' | ||
| 454 | "$SYSTEMCTL_EXEC"·start·'auditd.service' | ||
| 455 | "$SYSTEMCTL_EXEC"·enable·'auditd.service' | ||
| 456 | else | ||
| 457 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 458 | fi | ||
| 459 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules | 461 | Group ·Configure·Syslog· Group·contains·2·groups·and·6·rules |
| 460 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It | 462 | [ref] ·The·syslog·service·has·been·the·default·Unix·logging·mechanism·for·many·years.·It |
| 461 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for | 463 | has·a·number·of·downsides,·including·inconsistent·log·format,·lack·of·authentication·for |
| Max diff block lines reached; 87387/91510 bytes (95.49%) of diff not shown. | |||
| Offset 138, 16 lines modified | Offset 138, 16 lines modified | ||
| 138 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 138 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 139 | ······find: | 139 | ······find: |
| 140 | ········paths:·/etc/audit/rules.d | 140 | ········paths:·/etc/audit/rules.d |
| 141 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 141 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 142 | ········patterns:·'*.rules' | 142 | ········patterns:·'*.rules' |
| 143 | ······register:·find_existing_watch_rules_d | 143 | ······register:·find_existing_watch_rules_d |
| 144 | ······when: | 144 | ······when: |
| 145 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 146 | ······-·'"audit"·in·ansible_facts.packages' | 145 | ······-·'"audit"·in·ansible_facts.packages' |
| 146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 147 | ······tags: | 147 | ······tags: |
| 148 | ······-·CJIS-5.4.1.1 | 148 | ······-·CJIS-5.4.1.1 |
| 149 | ······-·NIST-800-171-3.1.7 | 149 | ······-·NIST-800-171-3.1.7 |
| 150 | ······-·NIST-800-53-AC-2(7)(b) | 150 | ······-·NIST-800-53-AC-2(7)(b) |
| 151 | ······-·NIST-800-53-AC-6(9) | 151 | ······-·NIST-800-53-AC-6(9) |
| 152 | ······-·NIST-800-53-AU-12(c) | 152 | ······-·NIST-800-53-AU-12(c) |
| 153 | ······-·NIST-800-53-AU-2(d) | 153 | ······-·NIST-800-53-AU-2(d) |
| Offset 164, 16 lines modified | Offset 164, 16 lines modified | ||
| 164 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 164 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| 165 | ······find: | 165 | ······find: |
| 166 | ········paths:·/etc/audit/rules.d | 166 | ········paths:·/etc/audit/rules.d |
| 167 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ | 167 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ |
| 168 | ········patterns:·'*.rules' | 168 | ········patterns:·'*.rules' |
| 169 | ······register:·find_watch_key | 169 | ······register:·find_watch_key |
| 170 | ······when: | 170 | ······when: |
| 171 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 172 | ······-·'"audit"·in·ansible_facts.packages' | 171 | ······-·'"audit"·in·ansible_facts.packages' |
| 172 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 173 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 173 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 174 | ········==·0 | 174 | ········==·0 |
| 175 | ······tags: | 175 | ······tags: |
| 176 | ······-·CJIS-5.4.1.1 | 176 | ······-·CJIS-5.4.1.1 |
| 177 | ······-·NIST-800-171-3.1.7 | 177 | ······-·NIST-800-171-3.1.7 |
| 178 | ······-·NIST-800-53-AC-2(7)(b) | 178 | ······-·NIST-800-53-AC-2(7)(b) |
| 179 | ······-·NIST-800-53-AC-6(9) | 179 | ······-·NIST-800-53-AC-6(9) |
| Offset 190, 16 lines modified | Offset 190, 16 lines modified | ||
| 190 | ······-·restrict_strategy | 190 | ······-·restrict_strategy |
| 191 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule | 191 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule |
| 192 | ······set_fact: | 192 | ······set_fact: |
| 193 | ········all_files: | 193 | ········all_files: |
| 194 | ········-·/etc/audit/rules.d/actions.rules | 194 | ········-·/etc/audit/rules.d/actions.rules |
| 195 | ······when: | 195 | ······when: |
| 196 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 197 | ······-·'"audit"·in·ansible_facts.packages' | 196 | ······-·'"audit"·in·ansible_facts.packages' |
| 197 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 198 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 198 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 199 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 199 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 200 | ······tags: | 200 | ······tags: |
| 201 | ······-·CJIS-5.4.1.1 | 201 | ······-·CJIS-5.4.1.1 |
| 202 | ······-·NIST-800-171-3.1.7 | 202 | ······-·NIST-800-171-3.1.7 |
| 203 | ······-·NIST-800-53-AC-2(7)(b) | 203 | ······-·NIST-800-53-AC-2(7)(b) |
| 204 | ······-·NIST-800-53-AC-6(9) | 204 | ······-·NIST-800-53-AC-6(9) |
| Offset 216, 16 lines modified | Offset 216, 16 lines modified | ||
| 216 | ······-·restrict_strategy | 216 | ······-·restrict_strategy |
| 217 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 217 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 218 | ······set_fact: | 218 | ······set_fact: |
| 219 | ········all_files: | 219 | ········all_files: |
| 220 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 220 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 221 | ······when: | 221 | ······when: |
| 222 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 223 | ······-·'"audit"·in·ansible_facts.packages' | 222 | ······-·'"audit"·in·ansible_facts.packages' |
| 223 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 224 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 224 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 225 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 225 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 226 | ······tags: | 226 | ······tags: |
| 227 | ······-·CJIS-5.4.1.1 | 227 | ······-·CJIS-5.4.1.1 |
| 228 | ······-·NIST-800-171-3.1.7 | 228 | ······-·NIST-800-171-3.1.7 |
| 229 | ······-·NIST-800-53-AC-2(7)(b) | 229 | ······-·NIST-800-53-AC-2(7)(b) |
| 230 | ······-·NIST-800-53-AC-6(9) | 230 | ······-·NIST-800-53-AC-6(9) |
| Offset 244, 16 lines modified | Offset 244, 16 lines modified | ||
| 244 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ | 244 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ |
| 245 | ······lineinfile: | 245 | ······lineinfile: |
| 246 | ········path:·'{{·all_files[0]·}}' | 246 | ········path:·'{{·all_files[0]·}}' |
| 247 | ········line:·-w·/etc/sudoers·-p·wa·-k·actions | 247 | ········line:·-w·/etc/sudoers·-p·wa·-k·actions |
| 248 | ········create:·true | 248 | ········create:·true |
| 249 | ········mode:·'0640' | 249 | ········mode:·'0640' |
| 250 | ······when: | 250 | ······when: |
| 251 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 252 | ······-·'"audit"·in·ansible_facts.packages' | 251 | ······-·'"audit"·in·ansible_facts.packages' |
| 252 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 253 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 253 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 254 | ········==·0 | 254 | ········==·0 |
| 255 | ······tags: | 255 | ······tags: |
| 256 | ······-·CJIS-5.4.1.1 | 256 | ······-·CJIS-5.4.1.1 |
| 257 | ······-·NIST-800-171-3.1.7 | 257 | ······-·NIST-800-171-3.1.7 |
| 258 | ······-·NIST-800-53-AC-2(7)(b) | 258 | ······-·NIST-800-53-AC-2(7)(b) |
| 259 | ······-·NIST-800-53-AC-6(9) | 259 | ······-·NIST-800-53-AC-6(9) |
| Offset 272, 16 lines modified | Offset 272, 16 lines modified | ||
| 272 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/audit.rules | 272 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/audit.rules |
| 273 | ······find: | 273 | ······find: |
| 274 | ········paths:·/etc/audit/ | 274 | ········paths:·/etc/audit/ |
| 275 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 275 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 276 | ········patterns:·audit.rules | 276 | ········patterns:·audit.rules |
| 277 | ······register:·find_existing_watch_audit_rules | 277 | ······register:·find_existing_watch_audit_rules |
| 278 | ······when: | 278 | ······when: |
| 279 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 280 | ······-·'"audit"·in·ansible_facts.packages' | 279 | ······-·'"audit"·in·ansible_facts.packages' |
| 280 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 281 | ······tags: | 281 | ······tags: |
| 282 | ······-·CJIS-5.4.1.1 | 282 | ······-·CJIS-5.4.1.1 |
| 283 | ······-·NIST-800-171-3.1.7 | 283 | ······-·NIST-800-171-3.1.7 |
| 284 | ······-·NIST-800-53-AC-2(7)(b) | 284 | ······-·NIST-800-53-AC-2(7)(b) |
| 285 | ······-·NIST-800-53-AC-6(9) | 285 | ······-·NIST-800-53-AC-6(9) |
| 286 | ······-·NIST-800-53-AU-12(c) | 286 | ······-·NIST-800-53-AU-12(c) |
| 287 | ······-·NIST-800-53-AU-2(d) | 287 | ······-·NIST-800-53-AU-2(d) |
| Offset 299, 16 lines modified | Offset 299, 16 lines modified | ||
| 299 | ······lineinfile: | 299 | ······lineinfile: |
| 300 | ········line:·-w·/etc/sudoers·-p·wa·-k·actions | 300 | ········line:·-w·/etc/sudoers·-p·wa·-k·actions |
| 301 | ········state:·present | 301 | ········state:·present |
| 302 | ········dest:·/etc/audit/audit.rules | 302 | ········dest:·/etc/audit/audit.rules |
| 303 | ········create:·true | 303 | ········create:·true |
| 304 | ········mode:·'0640' | 304 | ········mode:·'0640' |
| 305 | ······when: | 305 | ······when: |
| 306 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 307 | ······-·'"audit"·in·ansible_facts.packages' | 306 | ······-·'"audit"·in·ansible_facts.packages' |
| 307 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 308 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched | 308 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched |
| 309 | ········==·0 | 309 | ········==·0 |
| 310 | ······tags: | 310 | ······tags: |
| 311 | ······-·CJIS-5.4.1.1 | 311 | ······-·CJIS-5.4.1.1 |
| 312 | ······-·NIST-800-171-3.1.7 | 312 | ······-·NIST-800-171-3.1.7 |
| 313 | ······-·NIST-800-53-AC-2(7)(b) | 313 | ······-·NIST-800-53-AC-2(7)(b) |
| 314 | ······-·NIST-800-53-AC-6(9) | 314 | ······-·NIST-800-53-AC-6(9) |
| Offset 327, 16 lines modified | Offset 327, 16 lines modified | ||
| 327 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers.d/·already·exists·in·/etc/audit/rules.d/ | 327 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers.d/·already·exists·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 7162/12423 bytes (57.65%) of diff not shown. | |||
| Offset 1092, 16 lines modified | Offset 1092, 16 lines modified | ||
| 1092 | ······-·no_reboot_needed | 1092 | ······-·no_reboot_needed |
| 1093 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg | 1093 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg |
| 1094 | ······stat: | 1094 | ······stat: |
| 1095 | ········path:·/boot/grub/grub.cfg | 1095 | ········path:·/boot/grub/grub.cfg |
| 1096 | ······register:·file_exists | 1096 | ······register:·file_exists |
| 1097 | ······when: | 1097 | ······when: |
| 1098 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1099 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1098 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1099 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1100 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1100 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1101 | ······tags: | 1101 | ······tags: |
| 1102 | ······-·CJIS-5.5.2.2 | 1102 | ······-·CJIS-5.5.2.2 |
| 1103 | ······-·NIST-800-171-3.4.5 | 1103 | ······-·NIST-800-171-3.4.5 |
| 1104 | ······-·NIST-800-53-AC-6(1) | 1104 | ······-·NIST-800-53-AC-6(1) |
| 1105 | ······-·NIST-800-53-CM-6(a) | 1105 | ······-·NIST-800-53-CM-6(a) |
| 1106 | ······-·PCI-DSS-Req-7.1 | 1106 | ······-·PCI-DSS-Req-7.1 |
| Offset 1113, 16 lines modified | Offset 1113, 16 lines modified | ||
| 1113 | ······-·no_reboot_needed | 1113 | ······-·no_reboot_needed |
| 1114 | ····-·name:·Ensure·owner·0·on·/boot/grub/grub.cfg | 1114 | ····-·name:·Ensure·owner·0·on·/boot/grub/grub.cfg |
| 1115 | ······file: | 1115 | ······file: |
| 1116 | ········path:·/boot/grub/grub.cfg | 1116 | ········path:·/boot/grub/grub.cfg |
| 1117 | ········owner:·'0' | 1117 | ········owner:·'0' |
| 1118 | ······when: | 1118 | ······when: |
| 1119 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1120 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1119 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1120 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1121 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1121 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1122 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1122 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1123 | ······tags: | 1123 | ······tags: |
| 1124 | ······-·CJIS-5.5.2.2 | 1124 | ······-·CJIS-5.5.2.2 |
| 1125 | ······-·NIST-800-171-3.4.5 | 1125 | ······-·NIST-800-171-3.4.5 |
| 1126 | ······-·NIST-800-53-AC-6(1) | 1126 | ······-·NIST-800-53-AC-6(1) |
| 1127 | ······-·NIST-800-53-CM-6(a) | 1127 | ······-·NIST-800-53-CM-6(a) |
| Offset 1150, 16 lines modified | Offset 1150, 16 lines modified | ||
| 1150 | ······-·no_reboot_needed | 1150 | ······-·no_reboot_needed |
| 1151 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg | 1151 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg |
| 1152 | ······stat: | 1152 | ······stat: |
| 1153 | ········path:·/boot/grub/grub.cfg | 1153 | ········path:·/boot/grub/grub.cfg |
| 1154 | ······register:·file_exists | 1154 | ······register:·file_exists |
| 1155 | ······when: | 1155 | ······when: |
| 1156 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1157 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1156 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1157 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1158 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1158 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1159 | ······tags: | 1159 | ······tags: |
| 1160 | ······-·NIST-800-171-3.4.5 | 1160 | ······-·NIST-800-171-3.4.5 |
| 1161 | ······-·NIST-800-53-AC-6(1) | 1161 | ······-·NIST-800-53-AC-6(1) |
| 1162 | ······-·NIST-800-53-CM-6(a) | 1162 | ······-·NIST-800-53-CM-6(a) |
| 1163 | ······-·configure_strategy | 1163 | ······-·configure_strategy |
| 1164 | ······-·file_permissions_grub2_cfg | 1164 | ······-·file_permissions_grub2_cfg |
| Offset 1169, 16 lines modified | Offset 1169, 16 lines modified | ||
| 1169 | ······-·no_reboot_needed | 1169 | ······-·no_reboot_needed |
| 1170 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub/grub.cfg | 1170 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub/grub.cfg |
| 1171 | ······file: | 1171 | ······file: |
| 1172 | ········path:·/boot/grub/grub.cfg | 1172 | ········path:·/boot/grub/grub.cfg |
| 1173 | ········mode:·u-xs,g-xwrs,o-xwrt | 1173 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 1174 | ······when: | 1174 | ······when: |
| 1175 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1176 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1175 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1176 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1177 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1177 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1178 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1178 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1179 | ······tags: | 1179 | ······tags: |
| 1180 | ······-·NIST-800-171-3.4.5 | 1180 | ······-·NIST-800-171-3.4.5 |
| 1181 | ······-·NIST-800-53-AC-6(1) | 1181 | ······-·NIST-800-53-AC-6(1) |
| 1182 | ······-·NIST-800-53-CM-6(a) | 1182 | ······-·NIST-800-53-CM-6(a) |
| 1183 | ······-·configure_strategy | 1183 | ······-·configure_strategy |
| Offset 1061, 16 lines modified | Offset 1061, 16 lines modified | ||
| 1061 | ······-·no_reboot_needed | 1061 | ······-·no_reboot_needed |
| 1062 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg | 1062 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg |
| 1063 | ······stat: | 1063 | ······stat: |
| 1064 | ········path:·/boot/grub/grub.cfg | 1064 | ········path:·/boot/grub/grub.cfg |
| 1065 | ······register:·file_exists | 1065 | ······register:·file_exists |
| 1066 | ······when: | 1066 | ······when: |
| 1067 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1068 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1067 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1068 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1069 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1069 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1070 | ······tags: | 1070 | ······tags: |
| 1071 | ······-·CJIS-5.5.2.2 | 1071 | ······-·CJIS-5.5.2.2 |
| 1072 | ······-·NIST-800-171-3.4.5 | 1072 | ······-·NIST-800-171-3.4.5 |
| 1073 | ······-·NIST-800-53-AC-6(1) | 1073 | ······-·NIST-800-53-AC-6(1) |
| 1074 | ······-·NIST-800-53-CM-6(a) | 1074 | ······-·NIST-800-53-CM-6(a) |
| 1075 | ······-·PCI-DSS-Req-7.1 | 1075 | ······-·PCI-DSS-Req-7.1 |
| Offset 1082, 16 lines modified | Offset 1082, 16 lines modified | ||
| 1082 | ······-·no_reboot_needed | 1082 | ······-·no_reboot_needed |
| 1083 | ····-·name:·Ensure·owner·0·on·/boot/grub/grub.cfg | 1083 | ····-·name:·Ensure·owner·0·on·/boot/grub/grub.cfg |
| 1084 | ······file: | 1084 | ······file: |
| 1085 | ········path:·/boot/grub/grub.cfg | 1085 | ········path:·/boot/grub/grub.cfg |
| 1086 | ········owner:·'0' | 1086 | ········owner:·'0' |
| 1087 | ······when: | 1087 | ······when: |
| 1088 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1089 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1088 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1089 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1090 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1090 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1091 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1091 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1092 | ······tags: | 1092 | ······tags: |
| 1093 | ······-·CJIS-5.5.2.2 | 1093 | ······-·CJIS-5.5.2.2 |
| 1094 | ······-·NIST-800-171-3.4.5 | 1094 | ······-·NIST-800-171-3.4.5 |
| 1095 | ······-·NIST-800-53-AC-6(1) | 1095 | ······-·NIST-800-53-AC-6(1) |
| 1096 | ······-·NIST-800-53-CM-6(a) | 1096 | ······-·NIST-800-53-CM-6(a) |
| Offset 1119, 16 lines modified | Offset 1119, 16 lines modified | ||
| 1119 | ······-·no_reboot_needed | 1119 | ······-·no_reboot_needed |
| 1120 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg | 1120 | ····-·name:·Test·for·existence·/boot/grub/grub.cfg |
| 1121 | ······stat: | 1121 | ······stat: |
| 1122 | ········path:·/boot/grub/grub.cfg | 1122 | ········path:·/boot/grub/grub.cfg |
| 1123 | ······register:·file_exists | 1123 | ······register:·file_exists |
| 1124 | ······when: | 1124 | ······when: |
| 1125 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1126 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1125 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1126 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1127 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1127 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1128 | ······tags: | 1128 | ······tags: |
| 1129 | ······-·NIST-800-171-3.4.5 | 1129 | ······-·NIST-800-171-3.4.5 |
| 1130 | ······-·NIST-800-53-AC-6(1) | 1130 | ······-·NIST-800-53-AC-6(1) |
| 1131 | ······-·NIST-800-53-CM-6(a) | 1131 | ······-·NIST-800-53-CM-6(a) |
| 1132 | ······-·configure_strategy | 1132 | ······-·configure_strategy |
| 1133 | ······-·file_permissions_grub2_cfg | 1133 | ······-·file_permissions_grub2_cfg |
| Offset 1138, 16 lines modified | Offset 1138, 16 lines modified | ||
| 1138 | ······-·no_reboot_needed | 1138 | ······-·no_reboot_needed |
| 1139 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub/grub.cfg | 1139 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub/grub.cfg |
| 1140 | ······file: | 1140 | ······file: |
| 1141 | ········path:·/boot/grub/grub.cfg | 1141 | ········path:·/boot/grub/grub.cfg |
| 1142 | ········mode:·u-xs,g-xwrs,o-xwrt | 1142 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 1143 | ······when: | 1143 | ······when: |
| 1144 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1145 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1144 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1145 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1147 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1147 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1148 | ······tags: | 1148 | ······tags: |
| 1149 | ······-·NIST-800-171-3.4.5 | 1149 | ······-·NIST-800-171-3.4.5 |
| 1150 | ······-·NIST-800-53-AC-6(1) | 1150 | ······-·NIST-800-53-AC-6(1) |
| 1151 | ······-·NIST-800-53-CM-6(a) | 1151 | ······-·NIST-800-53-CM-6(a) |
| 1152 | ······-·configure_strategy | 1152 | ······-·configure_strategy |
| Offset 1183, 16 lines modified | Offset 1183, 16 lines modified | ||
| 1183 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 1183 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 1184 | ······find: | 1184 | ······find: |
| 1185 | ········paths:·/etc/audit/rules.d/ | 1185 | ········paths:·/etc/audit/rules.d/ |
| 1186 | ········patterns:·'*.rules' | 1186 | ········patterns:·'*.rules' |
| 1187 | ······register:·find_rules_d | 1187 | ······register:·find_rules_d |
| 1188 | ······when: | 1188 | ······when: |
| 1189 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1190 | ······-·'"auditd"·in·ansible_facts.packages' | 1189 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1190 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1191 | ······tags: | 1191 | ······tags: |
| 1192 | ······-·CJIS-5.4.1.1 | 1192 | ······-·CJIS-5.4.1.1 |
| 1193 | ······-·NIST-800-171-3.3.1 | 1193 | ······-·NIST-800-171-3.3.1 |
| 1194 | ······-·NIST-800-171-3.4.3 | 1194 | ······-·NIST-800-171-3.4.3 |
| 1195 | ······-·NIST-800-53-AC-6(9) | 1195 | ······-·NIST-800-53-AC-6(9) |
| 1196 | ······-·NIST-800-53-CM-6(a) | 1196 | ······-·NIST-800-53-CM-6(a) |
| 1197 | ······-·PCI-DSS-Req-10.5.2 | 1197 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1207, 16 lines modified | Offset 1207, 16 lines modified | ||
| 1207 | ······lineinfile: | 1207 | ······lineinfile: |
| 1208 | ········path:·'{{·item·}}' | 1208 | ········path:·'{{·item·}}' |
| 1209 | ········regexp:·^\s*(?:-e)\s+.*$ | 1209 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 1210 | ········state:·absent | 1210 | ········state:·absent |
| 1211 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 1211 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 1212 | ········}}' | 1212 | ········}}' |
| 1213 | ······when: | 1213 | ······when: |
| 1214 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1215 | ······-·'"auditd"·in·ansible_facts.packages' | 1214 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1215 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1216 | ······tags: | 1216 | ······tags: |
| 1217 | ······-·CJIS-5.4.1.1 | 1217 | ······-·CJIS-5.4.1.1 |
| 1218 | ······-·NIST-800-171-3.3.1 | 1218 | ······-·NIST-800-171-3.3.1 |
| 1219 | ······-·NIST-800-171-3.4.3 | 1219 | ······-·NIST-800-171-3.4.3 |
| 1220 | ······-·NIST-800-53-AC-6(9) | 1220 | ······-·NIST-800-53-AC-6(9) |
| 1221 | ······-·NIST-800-53-CM-6(a) | 1221 | ······-·NIST-800-53-CM-6(a) |
| 1222 | ······-·PCI-DSS-Req-10.5.2 | 1222 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1233, 16 lines modified | Offset 1233, 16 lines modified | ||
| 1233 | ········create:·true | 1233 | ········create:·true |
| 1234 | ········line:·-e·2 | 1234 | ········line:·-e·2 |
| 1235 | ········mode:·o-rwx | 1235 | ········mode:·o-rwx |
| 1236 | ······loop: | 1236 | ······loop: |
| 1237 | ······-·/etc/audit/audit.rules | 1237 | ······-·/etc/audit/audit.rules |
| 1238 | ······-·/etc/audit/rules.d/immutable.rules | 1238 | ······-·/etc/audit/rules.d/immutable.rules |
| 1239 | ······when: | 1239 | ······when: |
| 1240 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1241 | ······-·'"auditd"·in·ansible_facts.packages' | 1240 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1241 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1242 | ······tags: | 1242 | ······tags: |
| 1243 | ······-·CJIS-5.4.1.1 | 1243 | ······-·CJIS-5.4.1.1 |
| 1244 | ······-·NIST-800-171-3.3.1 | 1244 | ······-·NIST-800-171-3.3.1 |
| 1245 | ······-·NIST-800-171-3.4.3 | 1245 | ······-·NIST-800-171-3.4.3 |
| 1246 | ······-·NIST-800-53-AC-6(9) | 1246 | ······-·NIST-800-53-AC-6(9) |
| 1247 | ······-·NIST-800-53-CM-6(a) | 1247 | ······-·NIST-800-53-CM-6(a) |
| 1248 | ······-·PCI-DSS-Req-10.5.2 | 1248 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1277, 16 lines modified | Offset 1277, 16 lines modified | ||
| 1277 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 1277 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 1278 | ······find: | 1278 | ······find: |
| 1279 | ········paths:·/etc/audit/rules.d | 1279 | ········paths:·/etc/audit/rules.d |
| 1280 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 1280 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 1281 | ········patterns:·'*.rules' | 1281 | ········patterns:·'*.rules' |
| 1282 | ······register:·find_existing_watch_rules_d | 1282 | ······register:·find_existing_watch_rules_d |
| 1283 | ······when: | 1283 | ······when: |
| 1284 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1285 | ······-·'"auditd"·in·ansible_facts.packages' | 1284 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1285 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1286 | ······tags: | 1286 | ······tags: |
| 1287 | ······-·CJIS-5.4.1.1 | 1287 | ······-·CJIS-5.4.1.1 |
| 1288 | ······-·NIST-800-171-3.1.7 | 1288 | ······-·NIST-800-171-3.1.7 |
| 1289 | ······-·NIST-800-53-AC-2(7)(b) | 1289 | ······-·NIST-800-53-AC-2(7)(b) |
| 1290 | ······-·NIST-800-53-AC-6(9) | 1290 | ······-·NIST-800-53-AC-6(9) |
| 1291 | ······-·NIST-800-53-AU-12(c) | 1291 | ······-·NIST-800-53-AU-12(c) |
| 1292 | ······-·NIST-800-53-AU-2(d) | 1292 | ······-·NIST-800-53-AU-2(d) |
| Offset 1303, 16 lines modified | Offset 1303, 16 lines modified | ||
| 1303 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 1303 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| 1304 | ······find: | 1304 | ······find: |
| 1305 | ········paths:·/etc/audit/rules.d | 1305 | ········paths:·/etc/audit/rules.d |
| 1306 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ | 1306 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ |
| 1307 | ········patterns:·'*.rules' | 1307 | ········patterns:·'*.rules' |
| 1308 | ······register:·find_watch_key | 1308 | ······register:·find_watch_key |
| 1309 | ······when: | 1309 | ······when: |
| 1310 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1311 | ······-·'"auditd"·in·ansible_facts.packages' | 1310 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1311 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1312 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1312 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1313 | ········==·0 | 1313 | ········==·0 |
| 1314 | ······tags: | 1314 | ······tags: |
| 1315 | ······-·CJIS-5.4.1.1 | 1315 | ······-·CJIS-5.4.1.1 |
| 1316 | ······-·NIST-800-171-3.1.7 | 1316 | ······-·NIST-800-171-3.1.7 |
| 1317 | ······-·NIST-800-53-AC-2(7)(b) | 1317 | ······-·NIST-800-53-AC-2(7)(b) |
| 1318 | ······-·NIST-800-53-AC-6(9) | 1318 | ······-·NIST-800-53-AC-6(9) |
| Offset 1329, 16 lines modified | Offset 1329, 16 lines modified | ||
| 1329 | ······-·restrict_strategy | 1329 | ······-·restrict_strategy |
| 1330 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule | 1330 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule |
| 1331 | ······set_fact: | 1331 | ······set_fact: |
| 1332 | ········all_files: | 1332 | ········all_files: |
| 1333 | ········-·/etc/audit/rules.d/actions.rules | 1333 | ········-·/etc/audit/rules.d/actions.rules |
| 1334 | ······when: | 1334 | ······when: |
| 1335 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1336 | ······-·'"auditd"·in·ansible_facts.packages' | 1335 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1336 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1337 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1337 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1338 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1338 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1339 | ······tags: | 1339 | ······tags: |
| 1340 | ······-·CJIS-5.4.1.1 | 1340 | ······-·CJIS-5.4.1.1 |
| 1341 | ······-·NIST-800-171-3.1.7 | 1341 | ······-·NIST-800-171-3.1.7 |
| 1342 | ······-·NIST-800-53-AC-2(7)(b) | 1342 | ······-·NIST-800-53-AC-2(7)(b) |
| 1343 | ······-·NIST-800-53-AC-6(9) | 1343 | ······-·NIST-800-53-AC-6(9) |
| Offset 1355, 16 lines modified | Offset 1355, 16 lines modified | ||
| 1355 | ······-·restrict_strategy | 1355 | ······-·restrict_strategy |
| 1356 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1356 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1357 | ······set_fact: | 1357 | ······set_fact: |
| 1358 | ········all_files: | 1358 | ········all_files: |
| 1359 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1359 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1360 | ······when: | 1360 | ······when: |
| 1361 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1362 | ······-·'"auditd"·in·ansible_facts.packages' | 1361 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1363 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1363 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1364 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1364 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1365 | ······tags: | 1365 | ······tags: |
| 1366 | ······-·CJIS-5.4.1.1 | 1366 | ······-·CJIS-5.4.1.1 |
| 1367 | ······-·NIST-800-171-3.1.7 | 1367 | ······-·NIST-800-171-3.1.7 |
| 1368 | ······-·NIST-800-53-AC-2(7)(b) | 1368 | ······-·NIST-800-53-AC-2(7)(b) |
| 1369 | ······-·NIST-800-53-AC-6(9) | 1369 | ······-·NIST-800-53-AC-6(9) |
| Offset 1383, 16 lines modified | Offset 1383, 16 lines modified | ||
| 1383 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ | 1383 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 133550/138587 bytes (96.37%) of diff not shown. | |||
| Offset 1152, 16 lines modified | Offset 1152, 16 lines modified | ||
| 1152 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 1152 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 1153 | ······find: | 1153 | ······find: |
| 1154 | ········paths:·/etc/audit/rules.d/ | 1154 | ········paths:·/etc/audit/rules.d/ |
| 1155 | ········patterns:·'*.rules' | 1155 | ········patterns:·'*.rules' |
| 1156 | ······register:·find_rules_d | 1156 | ······register:·find_rules_d |
| 1157 | ······when: | 1157 | ······when: |
| 1158 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1159 | ······-·'"auditd"·in·ansible_facts.packages' | 1158 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1159 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1160 | ······tags: | 1160 | ······tags: |
| 1161 | ······-·CJIS-5.4.1.1 | 1161 | ······-·CJIS-5.4.1.1 |
| 1162 | ······-·NIST-800-171-3.3.1 | 1162 | ······-·NIST-800-171-3.3.1 |
| 1163 | ······-·NIST-800-171-3.4.3 | 1163 | ······-·NIST-800-171-3.4.3 |
| 1164 | ······-·NIST-800-53-AC-6(9) | 1164 | ······-·NIST-800-53-AC-6(9) |
| 1165 | ······-·NIST-800-53-CM-6(a) | 1165 | ······-·NIST-800-53-CM-6(a) |
| 1166 | ······-·PCI-DSS-Req-10.5.2 | 1166 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1176, 16 lines modified | Offset 1176, 16 lines modified | ||
| 1176 | ······lineinfile: | 1176 | ······lineinfile: |
| 1177 | ········path:·'{{·item·}}' | 1177 | ········path:·'{{·item·}}' |
| 1178 | ········regexp:·^\s*(?:-e)\s+.*$ | 1178 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 1179 | ········state:·absent | 1179 | ········state:·absent |
| 1180 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 1180 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 1181 | ········}}' | 1181 | ········}}' |
| 1182 | ······when: | 1182 | ······when: |
| 1183 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1184 | ······-·'"auditd"·in·ansible_facts.packages' | 1183 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1184 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1185 | ······tags: | 1185 | ······tags: |
| 1186 | ······-·CJIS-5.4.1.1 | 1186 | ······-·CJIS-5.4.1.1 |
| 1187 | ······-·NIST-800-171-3.3.1 | 1187 | ······-·NIST-800-171-3.3.1 |
| 1188 | ······-·NIST-800-171-3.4.3 | 1188 | ······-·NIST-800-171-3.4.3 |
| 1189 | ······-·NIST-800-53-AC-6(9) | 1189 | ······-·NIST-800-53-AC-6(9) |
| 1190 | ······-·NIST-800-53-CM-6(a) | 1190 | ······-·NIST-800-53-CM-6(a) |
| 1191 | ······-·PCI-DSS-Req-10.5.2 | 1191 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1202, 16 lines modified | Offset 1202, 16 lines modified | ||
| 1202 | ········create:·true | 1202 | ········create:·true |
| 1203 | ········line:·-e·2 | 1203 | ········line:·-e·2 |
| 1204 | ········mode:·o-rwx | 1204 | ········mode:·o-rwx |
| 1205 | ······loop: | 1205 | ······loop: |
| 1206 | ······-·/etc/audit/audit.rules | 1206 | ······-·/etc/audit/audit.rules |
| 1207 | ······-·/etc/audit/rules.d/immutable.rules | 1207 | ······-·/etc/audit/rules.d/immutable.rules |
| 1208 | ······when: | 1208 | ······when: |
| 1209 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1210 | ······-·'"auditd"·in·ansible_facts.packages' | 1209 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1210 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1211 | ······tags: | 1211 | ······tags: |
| 1212 | ······-·CJIS-5.4.1.1 | 1212 | ······-·CJIS-5.4.1.1 |
| 1213 | ······-·NIST-800-171-3.3.1 | 1213 | ······-·NIST-800-171-3.3.1 |
| 1214 | ······-·NIST-800-171-3.4.3 | 1214 | ······-·NIST-800-171-3.4.3 |
| 1215 | ······-·NIST-800-53-AC-6(9) | 1215 | ······-·NIST-800-53-AC-6(9) |
| 1216 | ······-·NIST-800-53-CM-6(a) | 1216 | ······-·NIST-800-53-CM-6(a) |
| 1217 | ······-·PCI-DSS-Req-10.5.2 | 1217 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1246, 16 lines modified | Offset 1246, 16 lines modified | ||
| 1246 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 1246 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 1247 | ······find: | 1247 | ······find: |
| 1248 | ········paths:·/etc/audit/rules.d | 1248 | ········paths:·/etc/audit/rules.d |
| 1249 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 1249 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 1250 | ········patterns:·'*.rules' | 1250 | ········patterns:·'*.rules' |
| 1251 | ······register:·find_existing_watch_rules_d | 1251 | ······register:·find_existing_watch_rules_d |
| 1252 | ······when: | 1252 | ······when: |
| 1253 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1254 | ······-·'"auditd"·in·ansible_facts.packages' | 1253 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1254 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1255 | ······tags: | 1255 | ······tags: |
| 1256 | ······-·CJIS-5.4.1.1 | 1256 | ······-·CJIS-5.4.1.1 |
| 1257 | ······-·NIST-800-171-3.1.7 | 1257 | ······-·NIST-800-171-3.1.7 |
| 1258 | ······-·NIST-800-53-AC-2(7)(b) | 1258 | ······-·NIST-800-53-AC-2(7)(b) |
| 1259 | ······-·NIST-800-53-AC-6(9) | 1259 | ······-·NIST-800-53-AC-6(9) |
| 1260 | ······-·NIST-800-53-AU-12(c) | 1260 | ······-·NIST-800-53-AU-12(c) |
| 1261 | ······-·NIST-800-53-AU-2(d) | 1261 | ······-·NIST-800-53-AU-2(d) |
| Offset 1272, 16 lines modified | Offset 1272, 16 lines modified | ||
| 1272 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 1272 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| 1273 | ······find: | 1273 | ······find: |
| 1274 | ········paths:·/etc/audit/rules.d | 1274 | ········paths:·/etc/audit/rules.d |
| 1275 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ | 1275 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ |
| 1276 | ········patterns:·'*.rules' | 1276 | ········patterns:·'*.rules' |
| 1277 | ······register:·find_watch_key | 1277 | ······register:·find_watch_key |
| 1278 | ······when: | 1278 | ······when: |
| 1279 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1280 | ······-·'"auditd"·in·ansible_facts.packages' | 1279 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1280 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1281 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1281 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1282 | ········==·0 | 1282 | ········==·0 |
| 1283 | ······tags: | 1283 | ······tags: |
| 1284 | ······-·CJIS-5.4.1.1 | 1284 | ······-·CJIS-5.4.1.1 |
| 1285 | ······-·NIST-800-171-3.1.7 | 1285 | ······-·NIST-800-171-3.1.7 |
| 1286 | ······-·NIST-800-53-AC-2(7)(b) | 1286 | ······-·NIST-800-53-AC-2(7)(b) |
| 1287 | ······-·NIST-800-53-AC-6(9) | 1287 | ······-·NIST-800-53-AC-6(9) |
| Offset 1298, 16 lines modified | Offset 1298, 16 lines modified | ||
| 1298 | ······-·restrict_strategy | 1298 | ······-·restrict_strategy |
| 1299 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule | 1299 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule |
| 1300 | ······set_fact: | 1300 | ······set_fact: |
| 1301 | ········all_files: | 1301 | ········all_files: |
| 1302 | ········-·/etc/audit/rules.d/actions.rules | 1302 | ········-·/etc/audit/rules.d/actions.rules |
| 1303 | ······when: | 1303 | ······when: |
| 1304 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1305 | ······-·'"auditd"·in·ansible_facts.packages' | 1304 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1305 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1306 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1306 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1307 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1307 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1308 | ······tags: | 1308 | ······tags: |
| 1309 | ······-·CJIS-5.4.1.1 | 1309 | ······-·CJIS-5.4.1.1 |
| 1310 | ······-·NIST-800-171-3.1.7 | 1310 | ······-·NIST-800-171-3.1.7 |
| 1311 | ······-·NIST-800-53-AC-2(7)(b) | 1311 | ······-·NIST-800-53-AC-2(7)(b) |
| 1312 | ······-·NIST-800-53-AC-6(9) | 1312 | ······-·NIST-800-53-AC-6(9) |
| Offset 1324, 16 lines modified | Offset 1324, 16 lines modified | ||
| 1324 | ······-·restrict_strategy | 1324 | ······-·restrict_strategy |
| 1325 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1325 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1326 | ······set_fact: | 1326 | ······set_fact: |
| 1327 | ········all_files: | 1327 | ········all_files: |
| 1328 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1328 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1329 | ······when: | 1329 | ······when: |
| 1330 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1331 | ······-·'"auditd"·in·ansible_facts.packages' | 1330 | ······-·'"auditd"·in·ansible_facts.packages' |
| 1331 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1332 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1332 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1333 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1333 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1334 | ······tags: | 1334 | ······tags: |
| 1335 | ······-·CJIS-5.4.1.1 | 1335 | ······-·CJIS-5.4.1.1 |
| 1336 | ······-·NIST-800-171-3.1.7 | 1336 | ······-·NIST-800-171-3.1.7 |
| 1337 | ······-·NIST-800-53-AC-2(7)(b) | 1337 | ······-·NIST-800-53-AC-2(7)(b) |
| 1338 | ······-·NIST-800-53-AC-6(9) | 1338 | ······-·NIST-800-53-AC-6(9) |
| Offset 1352, 16 lines modified | Offset 1352, 16 lines modified | ||
| 1352 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ | 1352 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 133550/138587 bytes (96.37%) of diff not shown. | |||
| Offset 779, 16 lines modified | Offset 779, 16 lines modified | ||
| 779 | ····-·name:·Check·if·watch·rule·for·/etc/group·already·exists·in·/etc/audit/rules.d/ | 779 | ····-·name:·Check·if·watch·rule·for·/etc/group·already·exists·in·/etc/audit/rules.d/ |
| 780 | ······find: | 780 | ······find: |
| 781 | ········paths:·/etc/audit/rules.d | 781 | ········paths:·/etc/audit/rules.d |
| 782 | ········contains:·^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+ | 782 | ········contains:·^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+ |
| 783 | ········patterns:·'*.rules' | 783 | ········patterns:·'*.rules' |
| 784 | ······register:·find_existing_watch_rules_d | 784 | ······register:·find_existing_watch_rules_d |
| 785 | ······when: | 785 | ······when: |
| 786 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 787 | ······-·'"auditd"·in·ansible_facts.packages' | 786 | ······-·'"auditd"·in·ansible_facts.packages' |
| 787 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 788 | ······tags: | 788 | ······tags: |
| 789 | ······-·CJIS-5.4.1.1 | 789 | ······-·CJIS-5.4.1.1 |
| 790 | ······-·DISA-STIG-UBTU-20-010101 | 790 | ······-·DISA-STIG-UBTU-20-010101 |
| 791 | ······-·NIST-800-171-3.1.7 | 791 | ······-·NIST-800-171-3.1.7 |
| 792 | ······-·NIST-800-53-AC-2(4) | 792 | ······-·NIST-800-53-AC-2(4) |
| 793 | ······-·NIST-800-53-AC-6(9) | 793 | ······-·NIST-800-53-AC-6(9) |
| 794 | ······-·NIST-800-53-AU-12(c) | 794 | ······-·NIST-800-53-AU-12(c) |
| Offset 805, 16 lines modified | Offset 805, 16 lines modified | ||
| 805 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_usergroup_modification | 805 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_usergroup_modification |
| 806 | ······find: | 806 | ······find: |
| 807 | ········paths:·/etc/audit/rules.d | 807 | ········paths:·/etc/audit/rules.d |
| 808 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_usergroup_modification$ | 808 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_usergroup_modification$ |
| 809 | ········patterns:·'*.rules' | 809 | ········patterns:·'*.rules' |
| 810 | ······register:·find_watch_key | 810 | ······register:·find_watch_key |
| 811 | ······when: | 811 | ······when: |
| 812 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 813 | ······-·'"auditd"·in·ansible_facts.packages' | 812 | ······-·'"auditd"·in·ansible_facts.packages' |
| 813 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 814 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 814 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 815 | ········==·0 | 815 | ········==·0 |
| 816 | ······tags: | 816 | ······tags: |
| 817 | ······-·CJIS-5.4.1.1 | 817 | ······-·CJIS-5.4.1.1 |
| 818 | ······-·DISA-STIG-UBTU-20-010101 | 818 | ······-·DISA-STIG-UBTU-20-010101 |
| 819 | ······-·NIST-800-171-3.1.7 | 819 | ······-·NIST-800-171-3.1.7 |
| 820 | ······-·NIST-800-53-AC-2(4) | 820 | ······-·NIST-800-53-AC-2(4) |
| Offset 832, 16 lines modified | Offset 832, 16 lines modified | ||
| 832 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_usergroup_modification.rules·as·the·recipient | 832 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_usergroup_modification.rules·as·the·recipient |
| 833 | ········for·the·rule | 833 | ········for·the·rule |
| 834 | ······set_fact: | 834 | ······set_fact: |
| 835 | ········all_files: | 835 | ········all_files: |
| 836 | ········-·/etc/audit/rules.d/audit_rules_usergroup_modification.rules | 836 | ········-·/etc/audit/rules.d/audit_rules_usergroup_modification.rules |
| 837 | ······when: | 837 | ······when: |
| 838 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 839 | ······-·'"auditd"·in·ansible_facts.packages' | 838 | ······-·'"auditd"·in·ansible_facts.packages' |
| 839 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 840 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 840 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 841 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 841 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 842 | ······tags: | 842 | ······tags: |
| 843 | ······-·CJIS-5.4.1.1 | 843 | ······-·CJIS-5.4.1.1 |
| 844 | ······-·DISA-STIG-UBTU-20-010101 | 844 | ······-·DISA-STIG-UBTU-20-010101 |
| 845 | ······-·NIST-800-171-3.1.7 | 845 | ······-·NIST-800-171-3.1.7 |
| 846 | ······-·NIST-800-53-AC-2(4) | 846 | ······-·NIST-800-53-AC-2(4) |
| Offset 858, 16 lines modified | Offset 858, 16 lines modified | ||
| 858 | ······-·restrict_strategy | 858 | ······-·restrict_strategy |
| 859 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 859 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 860 | ······set_fact: | 860 | ······set_fact: |
| 861 | ········all_files: | 861 | ········all_files: |
| 862 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 862 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 863 | ······when: | 863 | ······when: |
| 864 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 865 | ······-·'"auditd"·in·ansible_facts.packages' | 864 | ······-·'"auditd"·in·ansible_facts.packages' |
| 865 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 866 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 866 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 867 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 867 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 868 | ······tags: | 868 | ······tags: |
| 869 | ······-·CJIS-5.4.1.1 | 869 | ······-·CJIS-5.4.1.1 |
| 870 | ······-·DISA-STIG-UBTU-20-010101 | 870 | ······-·DISA-STIG-UBTU-20-010101 |
| 871 | ······-·NIST-800-171-3.1.7 | 871 | ······-·NIST-800-171-3.1.7 |
| 872 | ······-·NIST-800-53-AC-2(4) | 872 | ······-·NIST-800-53-AC-2(4) |
| Offset 886, 16 lines modified | Offset 886, 16 lines modified | ||
| 886 | ····-·name:·Add·watch·rule·for·/etc/group·in·/etc/audit/rules.d/ | 886 | ····-·name:·Add·watch·rule·for·/etc/group·in·/etc/audit/rules.d/ |
| 887 | ······lineinfile: | 887 | ······lineinfile: |
| 888 | ········path:·'{{·all_files[0]·}}' | 888 | ········path:·'{{·all_files[0]·}}' |
| 889 | ········line:·-w·/etc/group·-p·wa·-k·audit_rules_usergroup_modification | 889 | ········line:·-w·/etc/group·-p·wa·-k·audit_rules_usergroup_modification |
| 890 | ········create:·true | 890 | ········create:·true |
| 891 | ········mode:·'0640' | 891 | ········mode:·'0640' |
| 892 | ······when: | 892 | ······when: |
| 893 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 894 | ······-·'"auditd"·in·ansible_facts.packages' | 893 | ······-·'"auditd"·in·ansible_facts.packages' |
| 894 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 895 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 895 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 896 | ········==·0 | 896 | ········==·0 |
| 897 | ······tags: | 897 | ······tags: |
| 898 | ······-·CJIS-5.4.1.1 | 898 | ······-·CJIS-5.4.1.1 |
| 899 | ······-·DISA-STIG-UBTU-20-010101 | 899 | ······-·DISA-STIG-UBTU-20-010101 |
| 900 | ······-·NIST-800-171-3.1.7 | 900 | ······-·NIST-800-171-3.1.7 |
| 901 | ······-·NIST-800-53-AC-2(4) | 901 | ······-·NIST-800-53-AC-2(4) |
| Offset 914, 16 lines modified | Offset 914, 16 lines modified | ||
| 914 | ····-·name:·Check·if·watch·rule·for·/etc/group·already·exists·in·/etc/audit/audit.rules | 914 | ····-·name:·Check·if·watch·rule·for·/etc/group·already·exists·in·/etc/audit/audit.rules |
| 915 | ······find: | 915 | ······find: |
| 916 | ········paths:·/etc/audit/ | 916 | ········paths:·/etc/audit/ |
| 917 | ········contains:·^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+ | 917 | ········contains:·^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+ |
| 918 | ········patterns:·audit.rules | 918 | ········patterns:·audit.rules |
| 919 | ······register:·find_existing_watch_audit_rules | 919 | ······register:·find_existing_watch_audit_rules |
| 920 | ······when: | 920 | ······when: |
| 921 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 922 | ······-·'"auditd"·in·ansible_facts.packages' | 921 | ······-·'"auditd"·in·ansible_facts.packages' |
| 922 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 923 | ······tags: | 923 | ······tags: |
| 924 | ······-·CJIS-5.4.1.1 | 924 | ······-·CJIS-5.4.1.1 |
| 925 | ······-·DISA-STIG-UBTU-20-010101 | 925 | ······-·DISA-STIG-UBTU-20-010101 |
| 926 | ······-·NIST-800-171-3.1.7 | 926 | ······-·NIST-800-171-3.1.7 |
| 927 | ······-·NIST-800-53-AC-2(4) | 927 | ······-·NIST-800-53-AC-2(4) |
| 928 | ······-·NIST-800-53-AC-6(9) | 928 | ······-·NIST-800-53-AC-6(9) |
| 929 | ······-·NIST-800-53-AU-12(c) | 929 | ······-·NIST-800-53-AU-12(c) |
| Offset 941, 16 lines modified | Offset 941, 16 lines modified | ||
| 941 | ······lineinfile: | 941 | ······lineinfile: |
| 942 | ········line:·-w·/etc/group·-p·wa·-k·audit_rules_usergroup_modification | 942 | ········line:·-w·/etc/group·-p·wa·-k·audit_rules_usergroup_modification |
| 943 | ········state:·present | 943 | ········state:·present |
| 944 | ········dest:·/etc/audit/audit.rules | 944 | ········dest:·/etc/audit/audit.rules |
| 945 | ········create:·true | 945 | ········create:·true |
| 946 | ········mode:·'0640' | 946 | ········mode:·'0640' |
| 947 | ······when: | 947 | ······when: |
| 948 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 949 | ······-·'"auditd"·in·ansible_facts.packages' | 948 | ······-·'"auditd"·in·ansible_facts.packages' |
| 949 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 950 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched | 950 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched |
| 951 | ········==·0 | 951 | ········==·0 |
| 952 | ······tags: | 952 | ······tags: |
| 953 | ······-·CJIS-5.4.1.1 | 953 | ······-·CJIS-5.4.1.1 |
| 954 | ······-·DISA-STIG-UBTU-20-010101 | 954 | ······-·DISA-STIG-UBTU-20-010101 |
| 955 | ······-·NIST-800-171-3.1.7 | 955 | ······-·NIST-800-171-3.1.7 |
| 956 | ······-·NIST-800-53-AC-2(4) | 956 | ······-·NIST-800-53-AC-2(4) |
| Offset 990, 16 lines modified | Offset 990, 16 lines modified | ||
| 990 | ····-·name:·Check·if·watch·rule·for·/etc/gshadow·already·exists·in·/etc/audit/rules.d/ | 990 | ····-·name:·Check·if·watch·rule·for·/etc/gshadow·already·exists·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 123095/128504 bytes (95.79%) of diff not shown. | |||
| Offset 3, 1933 lines modified | Offset 3, 1933 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title> | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 12 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_ | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 14 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 15 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 16 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 17 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 18 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg- | 22 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>A | 23 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 24 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 29 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 30 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"> | ||
| 35 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> | ||
| 36 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> | 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> | 41 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 42 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> | 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1"> | ||
| 47 | ······<ocil:title>Ensure·Only·Users·Logged·In·To·Real·tty·Can·Execute·Sudo·-·sudo·requiretty</ocil:title> | ||
| 48 | ······<ocil:actions> | ||
| 49 | ········<ocil:test_action_ref>ocil:ssg-sudo_add_requiretty_action:testaction:1</ocil:test_action_ref> | ||
| 50 | ······</ocil:actions> | ||
| 51 | ····</ocil:questionnaire> | ||
| 52 | ····<ocil:questionnaire·id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"> | ||
| 53 | ······<ocil:title>Ensure·syslog-ng·is·Installed</ocil:title> | ||
| 54 | ······<ocil:actions> | ||
| 55 | ········<ocil:test_action_ref>ocil:ssg-package_syslogng_installed_action:testaction:1</ocil:test_action_ref> | ||
| 56 | ······</ocil:actions> | ||
| 57 | ····</ocil:questionnaire> | ||
| 58 | ····<ocil:questionnaire·id="ocil:ssg-ss | 46 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 47 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 60 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg-ss | 49 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_randomize_base_ocil:questionnaire:1"> | ||
| 65 | ···· | 52 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 53 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> | ||
| 66 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 59 | ······<ocil:title>Disable·kernel·support·for·MISC·binaries</ocil:title> |
| 72 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1"> | ||
| 77 | ····· | 64 | ····<ocil:questionnaire·id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"> |
| 65 | ······<ocil:title>Configure·System·to·Forward·All·Mail·From·Postmaster·to·The·Root·Account</ocil:title> | ||
| 78 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1"> | ||
| 83 | ···· | 70 | ····<ocil:questionnaire·id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"> |
| 71 | ······<ocil:title>Remove·Rsh·Trust·Files</ocil:title> | ||
| 84 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-s | 76 | ····<ocil:questionnaire·id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 77 | ······<ocil:title>Verify·iptables·Enabled</ocil:title> |
| 90 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-s | 79 | ········<ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 83 | ······<ocil:title>Unmap·kernel·when·running·in·userspace·(aka·KAISER)</ocil:title> |
| 96 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"> | ||
| 101 | ···· | 88 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"> |
| 89 | ······<ocil:title>Verify·Group·Who·Owns·Backup·gshadow·File</ocil:title> | ||
| 102 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 95 | ······<ocil:title>Configure·L1·Terminal·Fault·mitigations</ocil:title> |
| 108 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-grub2_l1tf_argument_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg-accounts_passwords_pam_faillock_audit_ocil:questionnaire:1"> | ||
| 113 | ···· | 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Ensure·auditd·Collects·File·Deletion·Events·by·User·-·renameat</ocil:title> | ||
| 114 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg-a | 103 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1"> | ||
| 119 | ···· | 106 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Verify·Permissions·on·Backup·group·File</ocil:title> | ||
| 120 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 109 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_group_action:testaction:1</ocil:test_action_ref> |
| Max diff block lines reached; 652943/664341 bytes (98.28%) of diff not shown. | |||
| Offset 3, 3211 lines modified | Offset 3, 3211 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>Enable·PAM</ocil:title> | ||
| 11 | ······<ocil:title>Disable·Kerberos·Authentication</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 17 | ······<ocil:title>Disallow·Configuration·to·Bypass·Password·Requirements·for·Privilege·Escalation</ocil:title> | ||
| 18 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg- | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 23 | ······<ocil:title> | 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> |
| 24 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg- | 22 | ····<ocil:questionnaire·id="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 23 | ······<ocil:title>Add·nosuid·Option·to·/tmp</ocil:title> |
| 30 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-mount_option_tmp_nosuid_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 35 | ······<ocil:title> | 29 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 36 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg- | 34 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 41 | ······<ocil:title> | 35 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 42 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg- | 40 | ····<ocil:questionnaire·id="ocil:ssg-mount_option_var_tmp_nodev_ocil:questionnaire:1"> |
| 47 | ······<ocil:title> | 41 | ······<ocil:title>Add·nodev·Option·to·/var/tmp</ocil:title> |
| 48 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-mount_option_var_tmp_nodev_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"> | ||
| 53 | ···· | 46 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> | ||
| 54 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 52 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 53 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 60 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 59 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 66 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 65 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> |
| 72 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 71 | ······<ocil:title>Disable·kernel·support·for·MISC·binaries</ocil:title> |
| 78 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1"> | ||
| 83 | ···· | 76 | ····<ocil:questionnaire·id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>Configure·System·to·Forward·All·Mail·From·Postmaster·to·The·Root·Account</ocil:title> | ||
| 84 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 83 | ······<ocil:title>Remove·Rsh·Trust·Files</ocil:title> |
| 90 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-s | 88 | ····<ocil:questionnaire·id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 89 | ······<ocil:title>Verify·iptables·Enabled</ocil:title> |
| 96 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg-s | 91 | ········<ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"> | ||
| 101 | ···· | 94 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"> |
| 95 | ······<ocil:title>Unmap·kernel·when·running·in·userspace·(aka·KAISER)</ocil:title> | ||
| 102 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 100 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 101 | ······<ocil:title>Verify·Group·Who·Owns·Backup·gshadow·File</ocil:title> |
| 108 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 103 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 106 | ····<ocil:questionnaire·id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 107 | ······<ocil:title>Configure·L1·Terminal·Fault·mitigations</ocil:title> |
| 114 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 109 | ········<ocil:test_action_ref>ocil:ssg-grub2_l1tf_argument_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1"> | ||
| 119 | ···· | 112 | ····<ocil:questionnaire·id="ocil:ssg-partition_for_var_tmp_ocil:questionnaire:1"> |
| 113 | ······<ocil:title>Ensure·/var/tmp·Located·On·Separate·Partition</ocil:title> | ||
| 120 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 115 | ········<ocil:test_action_ref>ocil:ssg-partition_for_var_tmp_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg-grub2_systemd_debug-shell_argument_absent_ocil:questionnaire:1"> | ||
| Max diff block lines reached; 680290/692482 bytes (98.24%) of diff not shown. | |||
| Offset 3, 5974 lines modified | Offset 3, 5974 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> | ||
| 11 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg- | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 17 | ······<ocil:title> | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 18 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1"> | ||
| 23 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 24 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg- | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 23 | ······<ocil:title>Record·Attempts·to·Alter·Logon·and·Logout·Events·-·lastlog</ocil:title> |
| 30 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 35 | ···· | 28 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_privileged_commands_apparmor_parser_ocil:questionnaire:1"> |
| 29 | ······<ocil:title>Record·Any·Attempts·to·Run·apparmor_parser</ocil:title> | ||
| 36 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg-dis | 31 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_apparmor_parser_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 41 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Disable·the·GNOME3·Login·User·List</ocil:title> | ||
| 42 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 47 | ···· | 40 | ····<ocil:questionnaire·id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Ensure·PAM·Enforces·Password·Requirements·-·Minimum·Uppercase·Characters</ocil:title> | ||
| 48 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 47 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 54 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 52 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 53 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 60 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 59 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> |
| 66 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 65 | ······<ocil:title>Verify·ownership·of·System·Login·Banner</ocil:title> |
| 72 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 71 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 78 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_session_events_btmp_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 77 | ······<ocil:title>Record·Attempts·to·Alter·Process·and·Session·Initiation·Information·btmp</ocil:title> |
| 84 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_session_events_btmp_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 83 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> |
| 90 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_ | 88 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_cron_allow_ocil:questionnaire:1"> |
| 95 | ······<ocil:title>Verify·Permissions·on·/ | 89 | ······<ocil:title>Verify·Permissions·on·/etc/cron.allow·file</ocil:title> |
| 96 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_ | 91 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_cron_allow_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 95 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 102 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_ocil:questionnaire:1"> | ||
| 107 | ···· | 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_privileged_commands_ssh_agent_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Record·Any·Attempts·to·Run·ssh-agent</ocil:title> | ||
| 108 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg-audit | 103 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 106 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 107 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> |
| 114 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 109 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 112 | ····<ocil:questionnaire·id="ocil:ssg-service_sshd_enabled_ocil:questionnaire:1"> |
| 119 | ······<ocil:title> | 113 | ······<ocil:title>Enable·the·OpenSSH·Service</ocil:title> |
| 120 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 115 | ········<ocil:test_action_ref>ocil:ssg-service_sshd_enabled_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg- | 118 | ····<ocil:questionnaire·id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1"> |
| Max diff block lines reached; 1213580/1225976 bytes (98.99%) of diff not shown. | |||
| Offset 3, 5974 lines modified | Offset 3, 5974 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> | ||
| 11 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg- | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 17 | ······<ocil:title> | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 18 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_privileged_commands_newgidmap_ocil:questionnaire:1"> | ||
| 23 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 24 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg- | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 23 | ······<ocil:title>Record·Attempts·to·Alter·Logon·and·Logout·Events·-·lastlog</ocil:title> |
| 30 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 35 | ···· | 28 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_privileged_commands_apparmor_parser_ocil:questionnaire:1"> |
| 29 | ······<ocil:title>Record·Any·Attempts·to·Run·apparmor_parser</ocil:title> | ||
| 36 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg-dis | 31 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_apparmor_parser_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 41 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-dconf_gnome_disable_user_list_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Disable·the·GNOME3·Login·User·List</ocil:title> | ||
| 42 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-dconf_gnome_disable_user_list_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 47 | ···· | 40 | ····<ocil:questionnaire·id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Ensure·PAM·Enforces·Password·Requirements·-·Minimum·Uppercase·Characters</ocil:title> | ||
| 48 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 47 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 54 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 52 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 53 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 60 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 59 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> |
| 66 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 65 | ······<ocil:title>Verify·ownership·of·System·Login·Banner</ocil:title> |
| 72 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 71 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 78 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_session_events_btmp_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 77 | ······<ocil:title>Record·Attempts·to·Alter·Process·and·Session·Initiation·Information·btmp</ocil:title> |
| 84 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_session_events_btmp_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 83 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> |
| 90 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_ | 88 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_cron_allow_ocil:questionnaire:1"> |
| 95 | ······<ocil:title>Verify·Permissions·on·/ | 89 | ······<ocil:title>Verify·Permissions·on·/etc/cron.allow·file</ocil:title> |
| 96 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_ | 91 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_cron_allow_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 95 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 102 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-auditd_audispd_configure_sufficiently_large_partition_ocil:questionnaire:1"> | ||
| 107 | ···· | 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_privileged_commands_ssh_agent_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Record·Any·Attempts·to·Run·ssh-agent</ocil:title> | ||
| 108 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg-audit | 103 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_privileged_commands_ssh_agent_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 106 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 107 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> |
| 114 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 109 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 112 | ····<ocil:questionnaire·id="ocil:ssg-service_sshd_enabled_ocil:questionnaire:1"> |
| 119 | ······<ocil:title> | 113 | ······<ocil:title>Enable·the·OpenSSH·Service</ocil:title> |
| 120 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 115 | ········<ocil:test_action_ref>ocil:ssg-service_sshd_enabled_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg- | 118 | ····<ocil:questionnaire·id="ocil:ssg-package_vsftpd_removed_ocil:questionnaire:1"> |
| Max diff block lines reached; 1213720/1226116 bytes (98.99%) of diff not shown. | |||
| Offset 1, 3 lines modified | Offset 1, 3 lines modified | ||
| 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary | 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary |
| 2 | -rw-r--r--···0········0········0·····1820·2022-12-20·09:54:05.000000·control.tar.xz | 2 | -rw-r--r--···0········0········0·····1820·2022-12-20·09:54:05.000000·control.tar.xz |
| 3 | -rw-r--r--···0········0········0···829 | 3 | -rw-r--r--···0········0········0···829448·2022-12-20·09:54:05.000000·data.tar.xz |
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00037cb0:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00037cc0:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00037cc0:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00037cd0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00037cd0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00037ce0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00037ce0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00037cf0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00037cf0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 00037d00:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 00037d00:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 00037d10:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 00037d10:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 00037d20:·323 | 00037d20:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 00037d30:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 00037d30:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00037d40:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00037d40:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00037d50:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00037d50:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00037d60:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00037d60:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00037d70:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00037d70:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00037d80:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00037d80:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00037d90:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00037d90:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 16724, 139 lines modified | Offset 16724, 139 lines modified | ||
| 00041530:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | 00041530:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | ||
| 00041540:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | 00041540:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | ||
| 00041550:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 00041550:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 00041560:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 00041560:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 00041570:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 00041570:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 00041580:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 00041580:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 00041590:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 00041590:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 000415a0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 000415b0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 000415c0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 000415d0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 000415e0:·6170·7365·2220·6964·3d22·6964·6d32·3732··apse"·id="idm272 | |||
| 000415f0:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 00041600:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 00041610:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 00041620:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 00041630:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 00041640:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 00041650:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 00041660:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 00041670:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 00041680:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 00041690:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 000416a0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 000416b0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 000416c0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4669··<code>-·name:·Fi | |||
| 000416d0:·6e64·202f·6574·632f·7375·646f·6572·732e··nd·/etc/sudoers. | |||
| 000416e0:·642f·2066·696c·6573·0a20·2066·696e·643a··d/·files.··find: | |||
| 000416f0:·0a20·2020·2070·6174·6873·3a0a·2020·2020··.····paths:.···· | |||
| 00041700:·2d20·2f65·7463·2f73·7564·6f65·7273·2e64··-·/etc/sudoers.d | |||
| 00041710:·2f0a·2020·7265·6769·7374·6572·3a20·7375··/.··register:·su | |||
| 00041720:·646f·6572·730a·2020·7461·6773·3a0a·2020··doers.··tags:.·· | |||
| 00041730:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 00041740:·2d36·2861·290a·2020·2d20·4e49·5354·2d38··-6(a).··-·NIST-8 | |||
| 00041750:·3030·2d35·332d·4941·2d31·310a·2020·2d20··00-53-IA-11.··-· | |||
| 00041760:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 00041770:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 00041780:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | |||
| 00041790:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 000417a0:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 000417b0:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 000417c0:·0a20·202d·2073·7564·6f5f·7265·6d6f·7665··.··-·sudo_remove | |||
| 000417d0:·5f6e·6f5f·6175·7468·656e·7469·6361·7465··_no_authenticate | |||
| 000417e0:·0a0a·2d20·6e61·6d65·3a20·5265·6d6f·7665··..-·name:·Remove | |||
| 000417f0:·206c·696e·6573·2063·6f6e·7461·696e·696e···lines·containin | |||
| 00041800:·6720·2161·7574·6865·6e74·6963·6174·6520··g·!authenticate· | |||
| 00041810:·6672·6f6d·2073·7564·6f65·7273·2066·696c··from·sudoers·fil | |||
| 00041820:·6573·0a20·2072·6570·6c61·6365·3a0a·2020··es.··replace:.·· | |||
| 00041830:·2020·7265·6765·7870·3a20·285e·283f·2123····regexp:·(^(?!# | |||
| 00041840:·292e·2a5b·5c73·5d2b·5c21·6175·7468·656e··).*[\s]+\!authen | |||
| 00041850:·7469·6361·7465·2e2a·2429·0a20·2020·2072··ticate.*$).····r | |||
| 00041860:·6570·6c61·6365·3a20·2723·205c·6726·6c74··eplace:·'#·\g< | |||
| 00041870:·3b31·2667·743b·270a·2020·2020·7061·7468··;1>'.····path | |||
| 00041880:·3a20·277b·7b20·6974·656d·2e70·6174·6820··:·'{{·item.path· | |||
| 00041890:·7d7d·270a·2020·2020·7661·6c69·6461·7465··}}'.····validate | |||
| 000418a0:·3a20·2f75·7372·2f73·6269·6e2f·7669·7375··:·/usr/sbin/visu | |||
| 000418b0:·646f·202d·6366·2025·730a·2020·7769·7468··do·-cf·%s.··with | |||
| 000418c0:·5f69·7465·6d73·3a0a·2020·2d20·7061·7468··_items:.··-·path | |||
| 000418d0:·3a20·2f65·7463·2f73·7564·6f65·7273·0a20··:·/etc/sudoers.· | |||
| 000418e0:·202d·2027·7b7b·2073·7564·6f65·7273·2e66···-·'{{·sudoers.f | |||
| 000418f0:·696c·6573·207d·7d27·0a20·2074·6167·733a··iles·}}'.··tags: | |||
| 00041900:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00041910:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 00041920:·542d·3830·302d·3533·2d49·412d·3131·0a20··T-800-53-IA-11.· | |||
| 00041930:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 00041940:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 00041950:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 00041960:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 00041970:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 00041980:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 00041990:·6567·790a·2020·2d20·7375·646f·5f72·656d··egy.··-·sudo_rem | |||
| 000419a0:·6f76·655f·6e6f·5f61·7574·6865·6e74·6963··ove_no_authentic | |||
| 000419b0:·6174·650a·3c2f·636f·6465·3e3c·2f70·7265··ate.</code></pre | |||
| 000419c0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 000419d0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 000419e0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 000419f0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 00041a00:·7267·6574·3d22·2369·646d·3237·3236·2220··rget="#idm2726"· | |||
| 00041a10:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 00041a20:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 00041a30:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 00041a40:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 00041a50:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 00041a60:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 00041a7 | 000415a0:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | ||
| 000415b0:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 000415c0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 000415d0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 000415e0:·6522·2069·643d·2269·646d·3237·3235·223e··e"·id="idm2725"> | |||
| 000415f0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 00041600:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 00041610:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 00041620:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 00041630:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 00041640:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 00041650:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 00041660:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 00041670:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 00041680:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 00041690:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 000416a0:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 000416b0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 000416c0:·6465·3e0a·666f·7220·6620·696e·202f·6574··de>.for·f·in·/et | |||
| 000416d0:·632f·7375·646f·6572·7320·2f65·7463·2f73··c/sudoers·/etc/s | |||
| 000416e0:·7564·6f65·7273·2e64·2f2a·203b·2064·6f0a··udoers.d/*·;·do. | |||
| 000416f0:·2020·6966·205b·2021·202d·6520·2224·6622····if·[·!·-e·"$f" | |||
| 00041700:·205d·203b·2074·6865·6e0a·2020·2020·636f···]·;·then.····co | |||
| 00041710:·6e74·696e·7565·0a20·2066·690a·2020·6d61··ntinue.··fi.··ma | |||
| 00041720:·7463·6869·6e67·5f6c·6973·743d·2428·6772··tching_list=$(gr | |||
| 00041730:·6570·202d·5020·275e·283f·2123·292e·2a5b··ep·-P·'^(?!#).*[ | |||
| 00041740:·5c73·5d2b·5c21·6175·7468·656e·7469·6361··\s]+\!authentica | |||
| Max diff block lines reached; 359960/378920 bytes (95.00%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:debian:debian_linux:10 | 41 | ····*·cpe:/o:debian:debian_linux:10 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Configure_Syslog | 48 | ·········2.·Configure_Syslog |
| 49 | ·········3.·File_Permissions_and_Masks | 49 | ·········3.·File_Permissions_and_Masks |
| 50 | ···2.·Services | 50 | ···2.·Services |
| 51 | ·········1.·APT_service_configuration | 51 | ·········1.·APT_service_configuration |
| Offset 167, 14 lines modified | Offset 167, 33 lines modified | ||
| 167 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 167 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 168 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 168 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 169 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 169 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 170 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 170 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 171 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 171 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 172 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 172 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 173 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 173 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 174 | Remediation_Shell_script_⇲ | ||
| 175 | Complexity:·low | ||
| 176 | Disruption:·low | ||
| 177 | Strategy:···restrict | ||
| 178 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 179 | ··if·[·!·-e·"$f"·]·;·then | ||
| 180 | ····continue | ||
| 181 | ··fi | ||
| 182 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 183 | ··if·!·test·-z·"$matching_list";·then | ||
| 184 | ····while·IFS=·read·-r·entry;·do | ||
| 185 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 186 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 187 | ····done·<<<·"$matching_list" | ||
| 188 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 189 | ··fi | ||
| 190 | done | ||
| 174 | Remediation_Ansible_snippet_⇲ | 191 | Remediation_Ansible_snippet_⇲ |
| 175 | Complexity:·low | 192 | Complexity:·low |
| 176 | Disruption:·low | 193 | Disruption:·low |
| 177 | Strategy:···restrict | 194 | Strategy:···restrict |
| 178 | -·name:·Find·/etc/sudoers.d/·files | 195 | -·name:·Find·/etc/sudoers.d/·files |
| 179 | ··find: | 196 | ··find: |
| 180 | ····paths: | 197 | ····paths: |
| Offset 204, 33 lines modified | Offset 223, 14 lines modified | ||
| 204 | ··-·NIST-800-53-IA-11 | 223 | ··-·NIST-800-53-IA-11 |
| 205 | ··-·low_complexity | 224 | ··-·low_complexity |
| 206 | ··-·low_disruption | 225 | ··-·low_disruption |
| 207 | ··-·medium_severity | 226 | ··-·medium_severity |
| 208 | ··-·no_reboot_needed | 227 | ··-·no_reboot_needed |
| 209 | ··-·restrict_strategy | 228 | ··-·restrict_strategy |
| 210 | ··-·sudo_remove_no_authenticate | 229 | ··-·sudo_remove_no_authenticate |
| 211 | Remediation_Shell_script_⇲ | ||
| 212 | Complexity:·low | ||
| 213 | Disruption:·low | ||
| 214 | Strategy:···restrict | ||
| 215 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 216 | ··if·[·!·-e·"$f"·]·;·then | ||
| 217 | ····continue | ||
| 218 | ··fi | ||
| 219 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 220 | ··if·!·test·-z·"$matching_list";·then | ||
| 221 | ····while·IFS=·read·-r·entry;·do | ||
| 222 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 223 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 224 | ····done·<<<·"$matching_list" | ||
| 225 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 226 | ··fi | ||
| 227 | done | ||
| 228 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 230 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 229 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 231 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 230 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 232 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 231 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 233 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 232 | sudoers.d/. | 234 | sudoers.d/. |
| 233 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 235 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 234 | ············they·do·not·have·authorization. | 236 | ············they·do·not·have·authorization. |
| Offset 242, 14 lines modified | Offset 242, 33 lines modified | ||
| 242 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 242 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 243 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 243 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 244 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 244 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 245 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 245 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 246 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 246 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 247 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 247 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 248 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 248 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 249 | Remediation_Shell_script_⇲ | ||
| 250 | Complexity:·low | ||
| 251 | Disruption:·low | ||
| 252 | Strategy:···restrict | ||
| 253 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 254 | ··if·[·!·-e·"$f"·]·;·then | ||
| 255 | ····continue | ||
| 256 | ··fi | ||
| 257 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 258 | ··if·!·test·-z·"$matching_list";·then | ||
| 259 | ····while·IFS=·read·-r·entry;·do | ||
| 260 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 261 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 262 | ····done·<<<·"$matching_list" | ||
| 263 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 264 | ··fi | ||
| 265 | done | ||
| 249 | Remediation_Ansible_snippet_⇲ | 266 | Remediation_Ansible_snippet_⇲ |
| 250 | Complexity:·low | 267 | Complexity:·low |
| 251 | Disruption:·low | 268 | Disruption:·low |
| 252 | Strategy:···restrict | 269 | Strategy:···restrict |
| 253 | -·name:·Find·/etc/sudoers.d/·files | 270 | -·name:·Find·/etc/sudoers.d/·files |
| 254 | ··find: | 271 | ··find: |
| 255 | ····paths: | 272 | ····paths: |
| Offset 279, 33 lines modified | Offset 298, 14 lines modified | ||
| 279 | ··-·NIST-800-53-IA-11 | 298 | ··-·NIST-800-53-IA-11 |
| 280 | ··-·low_complexity | 299 | ··-·low_complexity |
| 281 | ··-·low_disruption | 300 | ··-·low_disruption |
| 282 | ··-·medium_severity | 301 | ··-·medium_severity |
| 283 | ··-·no_reboot_needed | 302 | ··-·no_reboot_needed |
| 284 | ··-·restrict_strategy | 303 | ··-·restrict_strategy |
| 285 | ··-·sudo_remove_nopasswd | 304 | ··-·sudo_remove_nopasswd |
| 286 | Remediation_Shell_script_⇲ | ||
| 287 | Complexity:·low | ||
| Max diff block lines reached; 45638/51040 bytes (89.42%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d30:·206f·6620·3230·323 | 00037d30:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 16744, 139 lines modified | Offset 16744, 139 lines modified | ||
| 00041670:·6765·743d·2223·6964·6d32·3732·3522·2074··get="#idm2725"·t | 00041670:·6765·743d·2223·6964·6d32·3732·3522·2074··get="#idm2725"·t | ||
| 00041680:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 00041680:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 00041690:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 00041690:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 000416a0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 000416a0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 000416b0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 000416b0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 000416c0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 000416c0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 000416d0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 000416d0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 000416e0:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 000416f0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 00041700:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 00041710:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 00041720:·3d22·6964·6d32·3732·3522·3e3c·7461·626c··="idm2725"><tabl | |||
| 00041730:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 00041740:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 00041750:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 00041760:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 00041770:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 000416e0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 000416f0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 00041700:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 00041710:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 00041720:·2069·643d·2269·646d·3237·3235·223e·3c74···id="idm2725"><t | |||
| 00041730:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 00041740:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 00041750:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 00041760:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 00041770:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 00041780:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 00041790:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 000417a0:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 000417 | 00041780:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 00041790:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 000417a0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 000417b0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 000417c0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 000417d0:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 000417e0:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 000417f0:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a66··le><pre><code>.f | |||
| 00041800:·6f72·2066·2069·6e20·2f65·7463·2f73·7564··or·f·in·/etc/sud | |||
| 00041810:·6f65·7273·202f·6574·632f·7375·646f·6572··oers·/etc/sudoer | |||
| 00041820:·732e·642f·2a20·3b20·646f·0a20·2069·6620··s.d/*·;·do.··if· | |||
| 00041830:·5b20·2120·2d65·2022·2466·2220·5d20·3b20··[·!·-e·"$f"·]·;· | |||
| 00041840:·7468·656e·0a20·2020·2063·6f6e·7469·6e75··then.····continu | |||
| 00041850:·650a·2020·6669·0a20·206d·6174·6368·696e··e.··fi.··matchin | |||
| 00041860:·675f·6c69·7374·3d24·2867·7265·7020·2d50··g_list=$(grep·-P | |||
| 00041870:·2027·5e28·3f21·2329·2e2a·5b5c·735d·2b5c···'^(?!#).*[\s]+\ | |||
| 000417c0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 000417d0:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 000417e0:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 000417f0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 00041800:·3e2d·206e·616d·653a·2046·696e·6420·2f65··>-·name:·Find·/e | |||
| 00041810:·7463·2f73·7564·6f65·7273·2e64·2f20·6669··tc/sudoers.d/·fi | |||
| 00041820:·6c65·730a·2020·6669·6e64·3a0a·2020·2020··les.··find:.···· | |||
| 00041830:·7061·7468·733a·0a20·2020·202d·202f·6574··paths:.····-·/et | |||
| 00041840:·632f·7375·646f·6572·732e·642f·0a20·2072··c/sudoers.d/.··r | |||
| 00041850:·6567·6973·7465·723a·2073·7564·6f65·7273··egister:·sudoers | |||
| 00041860:·0a20·2074·6167·733a·0a20·202d·204e·4953··.··tags:.··-·NIS | |||
| 00041870:·542d·3830·302d·3533·2d43·4d2d·3628·6129··T-800-53-CM-6(a) | |||
| 00041880:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00041890:·2d49·412d·3131·0a20·202d·206c·6f77·5f63··-IA-11.··-·low_c | |||
| 000418a0:·6f6d·706c·6578·6974·790a·2020·2d20·6c6f··omplexity.··-·lo | |||
| 000418b0:·775f·6469·7372·7570·7469·6f6e·0a20·202d··w_disruption.··- | |||
| 000418c0:·206d·6564·6975·6d5f·7365·7665·7269·7479···medium_severity | |||
| 000418d0:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 000418e0:·6565·6465·640a·2020·2d20·7265·7374·7269··eeded.··-·restri | |||
| 000418f0:·6374·5f73·7472·6174·6567·790a·2020·2d20··ct_strategy.··-· | |||
| 00041900:·7375·646f·5f72·656d·6f76·655f·6e6f·5f61··sudo_remove_no_a | |||
| 00041 | 00041880:·2161·7574·6865·6e74·6963·6174·652e·2a24··!authenticate.*$ | ||
| 00041890:·2720·2466·207c·2075·6e69·7120·290a·2020··'·$f·|·uniq·).·· | |||
| 000418a0:·6966·2021·2074·6573·7420·2d7a·2022·246d··if·!·test·-z·"$m | |||
| 000418b0:·6174·6368·696e·675f·6c69·7374·223b·2074··atching_list";·t | |||
| 000418c0:·6865·6e0a·2020·2020·7768·696c·6520·4946··hen.····while·IF | |||
| 000418d0:·533d·2072·6561·6420·2d72·2065·6e74·7279··S=·read·-r·entry | |||
| 000418e0:·3b20·646f·0a20·2020·2020·2023·2063·6f6d··;·do.······#·com | |||
| 000418f0:·6d65·6e74·206f·7574·2022·2161·7574·6865··ment·out·"!authe | |||
| 00041900:·6e74·6963·6174·6522·206d·6174·6368·6573··nticate"·matches | |||
| 00041910:·2074·6f20·7072·6573·6572·7665·2075·7365···to·preserve·use | |||
| 00041920:·7220·6461·7461·0a20·2020·2020·2073·6564··r·data.······sed | |||
| 00041930:·202d·6920·2273·2f5e·247b·656e·7472·797d···-i·"s/^${entry} | |||
| 00041940:·242f·2320·2661·6d70·3b2f·6722·2024·660a··$/#·&/g"·$f. | |||
| 00041950:·2020·2020·646f·6e65·2026·6c74·3b26·6c74······done·<< | |||
| 00041960:·3b26·6c74·3b20·2224·6d61·7463·6869·6e67··;<·"$matching | |||
| 00041970:·5f6c·6973·7422·0a0a·2020·2020·2f75·7372··_list"..····/usr | |||
| 00041980:·2f73·6269·6e2f·7669·7375·646f·202d·6366··/sbin/visudo·-cf | |||
| 00041990:·2024·6620·2661·6d70·3b26·6774·3b20·2f64···$f·&>·/d | |||
| 000419a0:·6576·2f6e·756c·6c20·7c7c·2065·6368·6f20··ev/null·||·echo· | |||
| 000419b0:·2246·6169·6c20·746f·2076·616c·6964·6174··"Fail·to·validat | |||
| 000419c0:·6520·2466·2077·6974·6820·7669·7375·646f··e·$f·with·visudo | |||
| 000419d0:·220a·2020·6669·0a64·6f6e·650a·3c2f·636f··".··fi.done.</co | |||
| 000419e0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 000419f0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 00041a00:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 00041a10:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 00041a20:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 00041a30:·646d·3237·3236·2220·7461·6269·6e64·6578··dm2726"·tabindex | |||
| 00041a40:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 00041a50:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 00041a60:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 00041a70:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 00041a80:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 00041a90:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 00041920:·616d·653a·2052·656d·6f76·6520·6c69·6e65··ame:·Remove·line | |||
| 00041930:·7320·636f·6e74·6169·6e69·6e67·2021·6175··s·containing·!au | |||
| 00041940:·7468·656e·7469·6361·7465·2066·726f·6d20··thenticate·from· | |||
| 00041950:·7375·646f·6572·7320·6669·6c65·730a·2020··sudoers·files.·· | |||
| 00041960:·7265·706c·6163·653a·0a20·2020·2072·6567··replace:.····reg | |||
| 00041970:·6578·703a·2028·5e28·3f21·2329·2e2a·5b5c··exp:·(^(?!#).*[\ | |||
| 00041980:·735d·2b5c·2161·7574·6865·6e74·6963·6174··s]+\!authenticat | |||
| 00041990:·652e·2a24·290a·2020·2020·7265·706c·6163··e.*$).····replac | |||
| 000419a0:·653a·2027·2320·5c67·266c·743b·3126·6774··e:·'#·\g<1> | |||
| 000419b0:·3b27·0a20·2020·2070·6174·683a·2027·7b7b··;'.····path:·'{{ | |||
| Max diff block lines reached; 360650/379610 bytes (95.01%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level | 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:debian:debian_linux:10 | 42 | ····*·cpe:/o:debian:debian_linux:10 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·GRUB2_bootloader_configuration | 50 | ·········3.·GRUB2_bootloader_configuration |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 171, 14 lines modified | Offset 171, 33 lines modified | ||
| 171 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 171 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 172 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 172 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 173 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 173 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 174 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 174 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 175 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 175 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 176 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 176 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 177 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 177 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 178 | Remediation_Shell_script_⇲ | ||
| 179 | Complexity:·low | ||
| 180 | Disruption:·low | ||
| 181 | Strategy:···restrict | ||
| 182 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 183 | ··if·[·!·-e·"$f"·]·;·then | ||
| 184 | ····continue | ||
| 185 | ··fi | ||
| 186 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 187 | ··if·!·test·-z·"$matching_list";·then | ||
| 188 | ····while·IFS=·read·-r·entry;·do | ||
| 189 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 190 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 191 | ····done·<<<·"$matching_list" | ||
| 192 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 193 | ··fi | ||
| 194 | done | ||
| 178 | Remediation_Ansible_snippet_⇲ | 195 | Remediation_Ansible_snippet_⇲ |
| 179 | Complexity:·low | 196 | Complexity:·low |
| 180 | Disruption:·low | 197 | Disruption:·low |
| 181 | Strategy:···restrict | 198 | Strategy:···restrict |
| 182 | -·name:·Find·/etc/sudoers.d/·files | 199 | -·name:·Find·/etc/sudoers.d/·files |
| 183 | ··find: | 200 | ··find: |
| 184 | ····paths: | 201 | ····paths: |
| Offset 208, 33 lines modified | Offset 227, 14 lines modified | ||
| 208 | ··-·NIST-800-53-IA-11 | 227 | ··-·NIST-800-53-IA-11 |
| 209 | ··-·low_complexity | 228 | ··-·low_complexity |
| 210 | ··-·low_disruption | 229 | ··-·low_disruption |
| 211 | ··-·medium_severity | 230 | ··-·medium_severity |
| 212 | ··-·no_reboot_needed | 231 | ··-·no_reboot_needed |
| 213 | ··-·restrict_strategy | 232 | ··-·restrict_strategy |
| 214 | ··-·sudo_remove_no_authenticate | 233 | ··-·sudo_remove_no_authenticate |
| 215 | Remediation_Shell_script_⇲ | ||
| 216 | Complexity:·low | ||
| 217 | Disruption:·low | ||
| 218 | Strategy:···restrict | ||
| 219 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 220 | ··if·[·!·-e·"$f"·]·;·then | ||
| 221 | ····continue | ||
| 222 | ··fi | ||
| 223 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 224 | ··if·!·test·-z·"$matching_list";·then | ||
| 225 | ····while·IFS=·read·-r·entry;·do | ||
| 226 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 227 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 228 | ····done·<<<·"$matching_list" | ||
| 229 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 230 | ··fi | ||
| 231 | done | ||
| 232 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 234 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 233 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 235 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 234 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 236 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 235 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 237 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 236 | sudoers.d/. | 238 | sudoers.d/. |
| 237 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 239 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 238 | ············they·do·not·have·authorization. | 240 | ············they·do·not·have·authorization. |
| Offset 246, 14 lines modified | Offset 246, 33 lines modified | ||
| 246 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 246 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 247 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 247 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 248 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 248 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 249 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 249 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 250 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 250 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 251 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 251 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 252 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 252 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 253 | Remediation_Shell_script_⇲ | ||
| 254 | Complexity:·low | ||
| 255 | Disruption:·low | ||
| 256 | Strategy:···restrict | ||
| 257 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 258 | ··if·[·!·-e·"$f"·]·;·then | ||
| 259 | ····continue | ||
| 260 | ··fi | ||
| 261 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 262 | ··if·!·test·-z·"$matching_list";·then | ||
| 263 | ····while·IFS=·read·-r·entry;·do | ||
| 264 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 265 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 266 | ····done·<<<·"$matching_list" | ||
| 267 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 268 | ··fi | ||
| 269 | done | ||
| 253 | Remediation_Ansible_snippet_⇲ | 270 | Remediation_Ansible_snippet_⇲ |
| 254 | Complexity:·low | 271 | Complexity:·low |
| 255 | Disruption:·low | 272 | Disruption:·low |
| 256 | Strategy:···restrict | 273 | Strategy:···restrict |
| 257 | -·name:·Find·/etc/sudoers.d/·files | 274 | -·name:·Find·/etc/sudoers.d/·files |
| 258 | ··find: | 275 | ··find: |
| 259 | ····paths: | 276 | ····paths: |
| Offset 283, 33 lines modified | Offset 302, 14 lines modified | ||
| 283 | ··-·NIST-800-53-IA-11 | 302 | ··-·NIST-800-53-IA-11 |
| 284 | ··-·low_complexity | 303 | ··-·low_complexity |
| 285 | ··-·low_disruption | 304 | ··-·low_disruption |
| 286 | ··-·medium_severity | 305 | ··-·medium_severity |
| 287 | ··-·no_reboot_needed | 306 | ··-·no_reboot_needed |
| 288 | ··-·restrict_strategy | 307 | ··-·restrict_strategy |
| 289 | ··-·sudo_remove_nopasswd | 308 | ··-·sudo_remove_nopasswd |
| 290 | Remediation_Shell_script_⇲ | ||
| 291 | Complexity:·low | ||
| Max diff block lines reached; 45674/51098 bytes (89.39%) of diff not shown. | |||
| Offset 14278, 15 lines modified | Offset 14278, 15 lines modified | ||
| 00037c50:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037c50:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037c60:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037c60:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037c70:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037c70:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037c80:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037c80:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037c90:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037c90:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037ca0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037ca0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037cb0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037cb0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037cc0:·6173·206f·6620·3230·323 | 00037cc0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037cd0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037cd0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037ce0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037ce0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037cf0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037cf0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037d00:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037d00:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037d10:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037d10:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037d20:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037d20:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037d30:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037d30:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 14945, 139 lines modified | Offset 14945, 139 lines modified | ||
| 0003a600:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | 0003a600:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | ||
| 0003a610:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | 0003a610:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | ||
| 0003a620:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003a620:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003a630:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003a630:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003a640:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003a640:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003a650:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003a650:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003a660:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003a660:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003a670:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | |||
| 0003a680:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003a690:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003a6a0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003a6b0:·6522·2069·643d·2269·646d·3237·3235·223e··e"·id="idm2725"> | |||
| 0003a6c0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003a6d0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003a670:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003a680:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003a690:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003a6a0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003a6b0:·6170·7365·2220·6964·3d22·6964·6d32·3732··apse"·id="idm272 | |||
| 0003a6c0:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 0003a6d0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003a6e0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003a6 | 0003a6e0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003a6f0:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003a700:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003a700:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003a710:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003a720:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003a730:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003a7 | 0003a710:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003a7 | 0003a720:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003a730:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003a740:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003a750:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003a760:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003a770:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003a780:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003a790:·6465·3e0a·666f·7220·6620·696e·202f·6574··de>.for·f·in·/et | |||
| 0003a7a0:·632f·7375·646f·6572·7320·2f65·7463·2f73··c/sudoers·/etc/s | |||
| 0003a7b0:·7564·6f65·7273·2e64·2f2a·203b·2064·6f0a··udoers.d/*·;·do. | |||
| 0003a7c0:·2020·6966·205b·2021·202d·6520·2224·6622····if·[·!·-e·"$f" | |||
| 0003a7d0:·205d·203b·2074·6865·6e0a·2020·2020·636f···]·;·then.····co | |||
| 0003a7e0:·6e74·696e·7565·0a20·2066·690a·2020·6d61··ntinue.··fi.··ma | |||
| 0003a7f0:·7463·6869·6e67·5f6c·6973·743d·2428·6772··tching_list=$(gr | |||
| 0003a800:·6570·202d·5020·275e·283f·2123·292e·2a5b··ep·-P·'^(?!#).*[ | |||
| 0003a760:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003a770:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003a780:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003a790:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4669··<code>-·name:·Fi | |||
| 0003a7a0:·6e64·202f·6574·632f·7375·646f·6572·732e··nd·/etc/sudoers. | |||
| 0003a7b0:·642f·2066·696c·6573·0a20·2066·696e·643a··d/·files.··find: | |||
| 0003a7c0:·0a20·2020·2070·6174·6873·3a0a·2020·2020··.····paths:.···· | |||
| 0003a7d0:·2d20·2f65·7463·2f73·7564·6f65·7273·2e64··-·/etc/sudoers.d | |||
| 0003a7e0:·2f0a·2020·7265·6769·7374·6572·3a20·7375··/.··register:·su | |||
| 0003a7f0:·646f·6572·730a·2020·7461·6773·3a0a·2020··doers.··tags:.·· | |||
| 0003a800:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003a810:·2d36·2861·290a·2020·2d20·4e49·5354·2d38··-6(a).··-·NIST-8 | |||
| 0003a820:·3030·2d35·332d·4941·2d31·310a·2020·2d20··00-53-IA-11.··-· | |||
| 0003a830:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 0003a840:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 0003a850:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | |||
| 0003a860:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 0003a870:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 0003a880:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 0003a890:·0a20·202d·2073·7564·6f5f·7265·6d6f·7665··.··-·sudo_remove | |||
| 0003a8a0:·5f6e·6f5f·6175·7468·656e·7469·6361·7465··_no_authenticate | |||
| 0003a8b0:·0a0a·2d20·6e61·6d65·3a20·5265·6d6f·7665··..-·name:·Remove | |||
| 0003a8c0:·206c·696e·6573·2063·6f6e·7461·696e·696e···lines·containin | |||
| 0003a8d0:·6720·2161·7574·6865·6e74·6963·6174·6520··g·!authenticate· | |||
| 0003a8e0:·6672·6f6d·2073·7564·6f65·7273·2066·696c··from·sudoers·fil | |||
| 0003a8f0:·6573·0a20·2072·6570·6c61·6365·3a0a·2020··es.··replace:.·· | |||
| 0003a900:·2020·7265·6765·7870·3a20·285e·283f·2123····regexp:·(^(?!# | |||
| 0003a | 0003a810:·5c73·5d2b·5c21·6175·7468·656e·7469·6361··\s]+\!authentica | ||
| 0003a820:·7465·2e2a·2427·2024·6620·7c20·756e·6971··te.*$'·$f·|·uniq | |||
| 0003a830:·2029·0a20·2069·6620·2120·7465·7374·202d···).··if·!·test·- | |||
| 0003a840:·7a20·2224·6d61·7463·6869·6e67·5f6c·6973··z·"$matching_lis | |||
| 0003a850:·7422·3b20·7468·656e·0a20·2020·2077·6869··t";·then.····whi | |||
| 0003a860:·6c65·2049·4653·3d20·7265·6164·202d·7220··le·IFS=·read·-r· | |||
| 0003a870:·656e·7472·793b·2064·6f0a·2020·2020·2020··entry;·do.······ | |||
| 0003a880:·2320·636f·6d6d·656e·7420·6f75·7420·2221··#·comment·out·"! | |||
| 0003a890:·6175·7468·656e·7469·6361·7465·2220·6d61··authenticate"·ma | |||
| 0003a8a0:·7463·6865·7320·746f·2070·7265·7365·7276··tches·to·preserv | |||
| 0003a8b0:·6520·7573·6572·2064·6174·610a·2020·2020··e·user·data.···· | |||
| 0003a8c0:·2020·7365·6420·2d69·2022·732f·5e24·7b65····sed·-i·"s/^${e | |||
| 0003a8d0:·6e74·7279·7d24·2f23·2026·616d·703b·2f67··ntry}$/#·&/g | |||
| 0003a8e0:·2220·2466·0a20·2020·2064·6f6e·6520·266c··"·$f.····done·&l | |||
| 0003a8f0:·743b·266c·743b·266c·743b·2022·246d·6174··t;<<·"$mat | |||
| 0003a900:·6368·696e·675f·6c69·7374·220a·0a20·2020··ching_list"..··· | |||
| 0003a910:·202f·7573·722f·7362·696e·2f76·6973·7564···/usr/sbin/visud | |||
| 0003a920:·6f20·2d63·6620·2466·2026·616d·703b·2667··o·-cf·$f·&&g | |||
| 0003a930:·743b·202f·6465·762f·6e75·6c6c·207c·7c20··t;·/dev/null·||· | |||
| 0003a940:·6563·686f·2022·4661·696c·2074·6f20·7661··echo·"Fail·to·va | |||
| 0003a950:·6c69·6461·7465·2024·6620·7769·7468·2076··lidate·$f·with·v | |||
| 0003a960:·6973·7564·6f22·0a20·2066·690a·646f·6e65··isudo".··fi.done | |||
| 0003a970:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003a980:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003a990:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003a9a0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003a9b0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003a9c0:·743d·2223·6964·6d32·3732·3622·2074·6162··t="#idm2726"·tab | |||
| 0003a9d0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003a9e0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003a9f0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003aa00:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003aa10:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003aa20:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003aa30:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003a920:·7469·6361·7465·2e2a·2429·0a20·2020·2072··ticate.*$).····r | |||
| 0003a930:·6570·6c61·6365·3a20·2723·205c·6726·6c74··eplace:·'#·\g< | |||
| 0003a940:·3b31·2667·743b·270a·2020·2020·7061·7468··;1>'.····path | |||
| 0003a950:·3a20·277b·7b20·6974·656d·2e70·6174·6820··:·'{{·item.path· | |||
| Max diff block lines reached; 235484/254444 bytes (92.55%) of diff not shown. | |||
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | *****·Profile·Information·***** | 36 | *****·Profile·Information·***** |
| 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level | 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level |
| 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal | 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal |
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:debian:debian_linux:10 | 40 | ····*·cpe:/o:debian:debian_linux:10 |
| 41 | *****·Revision·History·***** | 41 | *****·Revision·History·***** |
| 42 | Current·version:·0.1.65 | 42 | Current·version:·0.1.65 |
| 43 | ····*·draft·(as·of·202 | 43 | ····*·draft·(as·of·2025-02-23) |
| 44 | *****·Table·of·Contents·***** | 44 | *****·Table·of·Contents·***** |
| 45 | ···1.·System_Settings | 45 | ···1.·System_Settings |
| 46 | ·········1.·Installing_and_Maintaining_Software | 46 | ·········1.·Installing_and_Maintaining_Software |
| 47 | ·········2.·Configure_Syslog | 47 | ·········2.·Configure_Syslog |
| 48 | ·········3.·File_Permissions_and_Masks | 48 | ·········3.·File_Permissions_and_Masks |
| 49 | ···2.·Services | 49 | ···2.·Services |
| 50 | ·········1.·APT_service_configuration | 50 | ·········1.·APT_service_configuration |
| Offset 81, 14 lines modified | Offset 81, 33 lines modified | ||
| 81 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 81 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 82 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 82 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 83 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 83 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 84 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 84 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 85 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 85 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 86 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 86 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 87 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 87 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 88 | Remediation_Shell_script_⇲ | ||
| 89 | Complexity:·low | ||
| 90 | Disruption:·low | ||
| 91 | Strategy:···restrict | ||
| 92 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 93 | ··if·[·!·-e·"$f"·]·;·then | ||
| 94 | ····continue | ||
| 95 | ··fi | ||
| 96 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 97 | ··if·!·test·-z·"$matching_list";·then | ||
| 98 | ····while·IFS=·read·-r·entry;·do | ||
| 99 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 100 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 101 | ····done·<<<·"$matching_list" | ||
| 102 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 103 | ··fi | ||
| 104 | done | ||
| 88 | Remediation_Ansible_snippet_⇲ | 105 | Remediation_Ansible_snippet_⇲ |
| 89 | Complexity:·low | 106 | Complexity:·low |
| 90 | Disruption:·low | 107 | Disruption:·low |
| 91 | Strategy:···restrict | 108 | Strategy:···restrict |
| 92 | -·name:·Find·/etc/sudoers.d/·files | 109 | -·name:·Find·/etc/sudoers.d/·files |
| 93 | ··find: | 110 | ··find: |
| 94 | ····paths: | 111 | ····paths: |
| Offset 118, 33 lines modified | Offset 137, 14 lines modified | ||
| 118 | ··-·NIST-800-53-IA-11 | 137 | ··-·NIST-800-53-IA-11 |
| 119 | ··-·low_complexity | 138 | ··-·low_complexity |
| 120 | ··-·low_disruption | 139 | ··-·low_disruption |
| 121 | ··-·medium_severity | 140 | ··-·medium_severity |
| 122 | ··-·no_reboot_needed | 141 | ··-·no_reboot_needed |
| 123 | ··-·restrict_strategy | 142 | ··-·restrict_strategy |
| 124 | ··-·sudo_remove_no_authenticate | 143 | ··-·sudo_remove_no_authenticate |
| 125 | Remediation_Shell_script_⇲ | ||
| 126 | Complexity:·low | ||
| 127 | Disruption:·low | ||
| 128 | Strategy:···restrict | ||
| 129 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 130 | ··if·[·!·-e·"$f"·]·;·then | ||
| 131 | ····continue | ||
| 132 | ··fi | ||
| 133 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 134 | ··if·!·test·-z·"$matching_list";·then | ||
| 135 | ····while·IFS=·read·-r·entry;·do | ||
| 136 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 137 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 138 | ····done·<<<·"$matching_list" | ||
| 139 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 140 | ··fi | ||
| 141 | done | ||
| 142 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 144 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 143 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 145 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 144 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 146 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 145 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 147 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 146 | sudoers.d/. | 148 | sudoers.d/. |
| 147 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 149 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 148 | ············they·do·not·have·authorization. | 150 | ············they·do·not·have·authorization. |
| Offset 156, 14 lines modified | Offset 156, 33 lines modified | ||
| 156 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 156 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 157 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 157 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 158 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 158 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 159 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 159 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 160 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 160 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 161 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 161 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 162 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 162 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 163 | Remediation_Shell_script_⇲ | ||
| 164 | Complexity:·low | ||
| 165 | Disruption:·low | ||
| 166 | Strategy:···restrict | ||
| 167 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 168 | ··if·[·!·-e·"$f"·]·;·then | ||
| 169 | ····continue | ||
| 170 | ··fi | ||
| 171 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 172 | ··if·!·test·-z·"$matching_list";·then | ||
| 173 | ····while·IFS=·read·-r·entry;·do | ||
| 174 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 175 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 176 | ····done·<<<·"$matching_list" | ||
| 177 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 178 | ··fi | ||
| 179 | done | ||
| 163 | Remediation_Ansible_snippet_⇲ | 180 | Remediation_Ansible_snippet_⇲ |
| 164 | Complexity:·low | 181 | Complexity:·low |
| 165 | Disruption:·low | 182 | Disruption:·low |
| 166 | Strategy:···restrict | 183 | Strategy:···restrict |
| 167 | -·name:·Find·/etc/sudoers.d/·files | 184 | -·name:·Find·/etc/sudoers.d/·files |
| 168 | ··find: | 185 | ··find: |
| 169 | ····paths: | 186 | ····paths: |
| Offset 193, 33 lines modified | Offset 212, 14 lines modified | ||
| 193 | ··-·NIST-800-53-IA-11 | 212 | ··-·NIST-800-53-IA-11 |
| 194 | ··-·low_complexity | 213 | ··-·low_complexity |
| 195 | ··-·low_disruption | 214 | ··-·low_disruption |
| 196 | ··-·medium_severity | 215 | ··-·medium_severity |
| 197 | ··-·no_reboot_needed | 216 | ··-·no_reboot_needed |
| 198 | ··-·restrict_strategy | 217 | ··-·restrict_strategy |
| 199 | ··-·sudo_remove_nopasswd | 218 | ··-·sudo_remove_nopasswd |
| 200 | Remediation_Shell_script_⇲ | ||
| 201 | Complexity:·low | ||
| Max diff block lines reached; 26541/31925 bytes (83.14%) of diff not shown. | |||
| Offset 14282, 15 lines modified | Offset 14282, 15 lines modified | ||
| 00037c90:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037c90:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037ca0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037ca0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037cb0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037cb0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037cc0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037cc0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037cd0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037cd0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037ce0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037ce0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037cf0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037cf0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037d00:·6173·206f·6620·3230·323 | 00037d00:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037d10:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037d10:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037d20:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037d20:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037d30:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037d30:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037d40:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037d40:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037d50:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037d50:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037d60:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037d60:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037d70:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037d70:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 16734, 139 lines modified | Offset 16734, 139 lines modified | ||
| 000415d0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 000415d0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 000415e0:·6d32·3732·3522·2074·6162·696e·6465·783d··m2725"·tabindex= | 000415e0:·6d32·3732·3522·2074·6162·696e·6465·783d··m2725"·tabindex= | ||
| 000415f0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 000415f0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 00041600:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 00041600:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 00041610:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 00041610:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 00041620:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 00041620:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 00041630:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 00041630:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 00041640:·6564·6961·7469·6f6e·20 | 00041640:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 00041650:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | |||
| 00041660:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 00041670:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 00041680:·6170·7365·2220·6964·3d22·6964·6d32·3732··apse"·id="idm272 | |||
| 00041690:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 000416a0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 000416b0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 000416c0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 000416d0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 000416e0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 00041650:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 00041660:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 00041670:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 00041680:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 00041690:·3237·3235·223e·3c74·6162·6c65·2063·6c61··2725"><table·cla | |||
| 000416a0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 000416b0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 000416c0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 000416d0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 000416e0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 000416f0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 00041700:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 00041710:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 00041 | 000416f0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 00041700:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 00041710:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 00041720:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 00041730:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 00041740:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 00041750:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 00041760:·3c63·6f64·653e·0a66·6f72·2066·2069·6e20··<code>.for·f·in· | |||
| 00041770:·2f65·7463·2f73·7564·6f65·7273·202f·6574··/etc/sudoers·/et | |||
| 00041780:·632f·7375·646f·6572·732e·642f·2a20·3b20··c/sudoers.d/*·;· | |||
| 00041790:·646f·0a20·2069·6620·5b20·2120·2d65·2022··do.··if·[·!·-e·" | |||
| 000417a0:·2466·2220·5d20·3b20·7468·656e·0a20·2020··$f"·]·;·then.··· | |||
| 000417b0:·2063·6f6e·7469·6e75·650a·2020·6669·0a20···continue.··fi.· | |||
| 000417c0:·206d·6174·6368·696e·675f·6c69·7374·3d24···matching_list=$ | |||
| 000417d0:·2867·7265·7020·2d50·2027·5e28·3f21·2329··(grep·-P·'^(?!#) | |||
| 00041730:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 00041740:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 00041750:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 00041760:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 00041770:·2046·696e·6420·2f65·7463·2f73·7564·6f65···Find·/etc/sudoe | |||
| 00041780:·7273·2e64·2f20·6669·6c65·730a·2020·6669··rs.d/·files.··fi | |||
| 00041790:·6e64·3a0a·2020·2020·7061·7468·733a·0a20··nd:.····paths:.· | |||
| 000417a0:·2020·202d·202f·6574·632f·7375·646f·6572·····-·/etc/sudoer | |||
| 000417b0:·732e·642f·0a20·2072·6567·6973·7465·723a··s.d/.··register: | |||
| 000417c0:·2073·7564·6f65·7273·0a20·2074·6167·733a···sudoers.··tags: | |||
| 000417d0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 000417e0:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 000417f0:·542d·3830·302d·3533·2d49·412d·3131·0a20··T-800-53-IA-11.· | |||
| 00041800:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 00041810:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 00041820:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 00041830:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 00041840:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 00041850:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 00041860:·6567·790a·2020·2d20·7375·646f·5f72·656d··egy.··-·sudo_rem | |||
| 00041870:·6f76·655f·6e6f·5f61·7574·6865·6e74·6963··ove_no_authentic | |||
| 00041880:·6174·650a·0a2d·206e·616d·653a·2052·656d··ate..-·name:·Rem | |||
| 00041890:·6f76·6520·6c69·6e65·7320·636f·6e74·6169··ove·lines·contai | |||
| 000418a0:·6e69·6e67·2021·6175·7468·656e·7469·6361··ning·!authentica | |||
| 000418b0:·7465·2066·726f·6d20·7375·646f·6572·7320··te·from·sudoers· | |||
| 000418c0:·6669·6c65·730a·2020·7265·706c·6163·653a··files.··replace: | |||
| 000418d0:·0a20·2020·2072·6567·6578·703a·2028·5e28··.····regexp:·(^( | |||
| 00041 | 000417e0:·2e2a·5b5c·735d·2b5c·2161·7574·6865·6e74··.*[\s]+\!authent | ||
| 000417f0:·6963·6174·652e·2a24·2720·2466·207c·2075··icate.*$'·$f·|·u | |||
| 00041800:·6e69·7120·290a·2020·6966·2021·2074·6573··niq·).··if·!·tes | |||
| 00041810:·7420·2d7a·2022·246d·6174·6368·696e·675f··t·-z·"$matching_ | |||
| 00041820:·6c69·7374·223b·2074·6865·6e0a·2020·2020··list";·then.···· | |||
| 00041830:·7768·696c·6520·4946·533d·2072·6561·6420··while·IFS=·read· | |||
| 00041840:·2d72·2065·6e74·7279·3b20·646f·0a20·2020··-r·entry;·do.··· | |||
| 00041850:·2020·2023·2063·6f6d·6d65·6e74·206f·7574·····#·comment·out | |||
| 00041860:·2022·2161·7574·6865·6e74·6963·6174·6522···"!authenticate" | |||
| 00041870:·206d·6174·6368·6573·2074·6f20·7072·6573···matches·to·pres | |||
| 00041880:·6572·7665·2075·7365·7220·6461·7461·0a20··erve·user·data.· | |||
| 00041890:·2020·2020·2073·6564·202d·6920·2273·2f5e·······sed·-i·"s/^ | |||
| 000418a0:·247b·656e·7472·797d·242f·2320·2661·6d70··${entry}$/#·& | |||
| 000418b0:·3b2f·6722·2024·660a·2020·2020·646f·6e65··;/g"·$f.····done | |||
| 000418c0:·2026·6c74·3b26·6c74·3b26·6c74·3b20·2224···<<<·"$ | |||
| 000418d0:·6d61·7463·6869·6e67·5f6c·6973·7422·0a0a··matching_list".. | |||
| 000418e0:·2020·2020·2f75·7372·2f73·6269·6e2f·7669······/usr/sbin/vi | |||
| 000418f0:·7375·646f·202d·6366·2024·6620·2661·6d70··sudo·-cf·$f·& | |||
| 00041900:·3b26·6774·3b20·2f64·6576·2f6e·756c·6c20··;>·/dev/null· | |||
| 00041910:·7c7c·2065·6368·6f20·2246·6169·6c20·746f··||·echo·"Fail·to | |||
| 00041920:·2076·616c·6964·6174·6520·2466·2077·6974···validate·$f·wit | |||
| 00041930:·6820·7669·7375·646f·220a·2020·6669·0a64··h·visudo".··fi.d | |||
| 00041940:·6f6e·650a·3c2f·636f·6465·3e3c·2f70·7265··one.</code></pre | |||
| 00041950:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 00041960:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 00041970:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 00041980:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 00041990:·7267·6574·3d22·2369·646d·3237·3236·2220··rget="#idm2726"· | |||
| 000419a0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 000419b0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 000419c0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 000419d0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 000419e0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 000419f0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 00041a00:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 000418f0:·6865·6e74·6963·6174·652e·2a24·290a·2020··henticate.*$).·· | |||
| 00041900:·2020·7265·706c·6163·653a·2027·2320·5c67····replace:·'#·\g | |||
| 00041910:·266c·743b·3126·6774·3b27·0a20·2020·2070··<1>'.····p | |||
| Max diff block lines reached; 360374/379334 bytes (95.00%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:debian:debian_linux:10 | 41 | ····*·cpe:/o:debian:debian_linux:10 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·System_Accounting_with_auditd | 48 | ·········2.·System_Accounting_with_auditd |
| 49 | ·········3.·Configure_Syslog | 49 | ·········3.·Configure_Syslog |
| 50 | ·········4.·File_Permissions_and_Masks | 50 | ·········4.·File_Permissions_and_Masks |
| 51 | ···2.·Services | 51 | ···2.·Services |
| Offset 169, 14 lines modified | Offset 169, 33 lines modified | ||
| 169 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 169 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 170 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 170 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 171 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 171 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 172 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 172 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 173 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 173 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 174 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 174 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 175 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 175 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 176 | Remediation_Shell_script_⇲ | ||
| 177 | Complexity:·low | ||
| 178 | Disruption:·low | ||
| 179 | Strategy:···restrict | ||
| 180 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 181 | ··if·[·!·-e·"$f"·]·;·then | ||
| 182 | ····continue | ||
| 183 | ··fi | ||
| 184 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 185 | ··if·!·test·-z·"$matching_list";·then | ||
| 186 | ····while·IFS=·read·-r·entry;·do | ||
| 187 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 188 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 189 | ····done·<<<·"$matching_list" | ||
| 190 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 191 | ··fi | ||
| 192 | done | ||
| 176 | Remediation_Ansible_snippet_⇲ | 193 | Remediation_Ansible_snippet_⇲ |
| 177 | Complexity:·low | 194 | Complexity:·low |
| 178 | Disruption:·low | 195 | Disruption:·low |
| 179 | Strategy:···restrict | 196 | Strategy:···restrict |
| 180 | -·name:·Find·/etc/sudoers.d/·files | 197 | -·name:·Find·/etc/sudoers.d/·files |
| 181 | ··find: | 198 | ··find: |
| 182 | ····paths: | 199 | ····paths: |
| Offset 206, 33 lines modified | Offset 225, 14 lines modified | ||
| 206 | ··-·NIST-800-53-IA-11 | 225 | ··-·NIST-800-53-IA-11 |
| 207 | ··-·low_complexity | 226 | ··-·low_complexity |
| 208 | ··-·low_disruption | 227 | ··-·low_disruption |
| 209 | ··-·medium_severity | 228 | ··-·medium_severity |
| 210 | ··-·no_reboot_needed | 229 | ··-·no_reboot_needed |
| 211 | ··-·restrict_strategy | 230 | ··-·restrict_strategy |
| 212 | ··-·sudo_remove_no_authenticate | 231 | ··-·sudo_remove_no_authenticate |
| 213 | Remediation_Shell_script_⇲ | ||
| 214 | Complexity:·low | ||
| 215 | Disruption:·low | ||
| 216 | Strategy:···restrict | ||
| 217 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 218 | ··if·[·!·-e·"$f"·]·;·then | ||
| 219 | ····continue | ||
| 220 | ··fi | ||
| 221 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 222 | ··if·!·test·-z·"$matching_list";·then | ||
| 223 | ····while·IFS=·read·-r·entry;·do | ||
| 224 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 225 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 226 | ····done·<<<·"$matching_list" | ||
| 227 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 228 | ··fi | ||
| 229 | done | ||
| 230 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 232 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 231 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 233 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 232 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 234 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 233 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 235 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 234 | sudoers.d/. | 236 | sudoers.d/. |
| 235 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 237 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 236 | ············they·do·not·have·authorization. | 238 | ············they·do·not·have·authorization. |
| Offset 244, 14 lines modified | Offset 244, 33 lines modified | ||
| 244 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 244 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 245 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 245 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 246 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 246 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 247 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 247 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 248 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 248 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 249 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 249 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 250 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 250 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | Complexity:·low | ||
| 253 | Disruption:·low | ||
| 254 | Strategy:···restrict | ||
| 255 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 256 | ··if·[·!·-e·"$f"·]·;·then | ||
| 257 | ····continue | ||
| 258 | ··fi | ||
| 259 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 260 | ··if·!·test·-z·"$matching_list";·then | ||
| 261 | ····while·IFS=·read·-r·entry;·do | ||
| 262 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 263 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 264 | ····done·<<<·"$matching_list" | ||
| 265 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 266 | ··fi | ||
| 267 | done | ||
| 251 | Remediation_Ansible_snippet_⇲ | 268 | Remediation_Ansible_snippet_⇲ |
| 252 | Complexity:·low | 269 | Complexity:·low |
| 253 | Disruption:·low | 270 | Disruption:·low |
| 254 | Strategy:···restrict | 271 | Strategy:···restrict |
| 255 | -·name:·Find·/etc/sudoers.d/·files | 272 | -·name:·Find·/etc/sudoers.d/·files |
| 256 | ··find: | 273 | ··find: |
| 257 | ····paths: | 274 | ····paths: |
| Offset 281, 33 lines modified | Offset 300, 14 lines modified | ||
| 281 | ··-·NIST-800-53-IA-11 | 300 | ··-·NIST-800-53-IA-11 |
| 282 | ··-·low_complexity | 301 | ··-·low_complexity |
| 283 | ··-·low_disruption | 302 | ··-·low_disruption |
| 284 | ··-·medium_severity | 303 | ··-·medium_severity |
| 285 | ··-·no_reboot_needed | 304 | ··-·no_reboot_needed |
| 286 | ··-·restrict_strategy | 305 | ··-·restrict_strategy |
| 287 | ··-·sudo_remove_nopasswd | 306 | ··-·sudo_remove_nopasswd |
| 288 | Remediation_Shell_script_⇲ | ||
| 289 | Complexity:·low | ||
| Max diff block lines reached; 45674/51073 bytes (89.43%) of diff not shown. | |||
| Offset 14284, 16 lines modified | Offset 14284, 16 lines modified | ||
| 00037cb0:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037cb0:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037cc0:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037cc0:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037cd0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037cd0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037ce0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037ce0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037cf0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037cf0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037d00:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037d00:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d20:·2020·2861·7320·6f66·2032·3032·3 | 00037d20:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037d30:·2d32·3 | 00037d30:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037d40:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037d40:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037d50:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037d50:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037d60:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037d60:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037d70:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037d70:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037d80:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037d80:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037d90:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037d90:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037da0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037da0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 20339, 204 lines modified | Offset 20339, 204 lines modified | ||
| 0004f720:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0004f720:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0004f730:·3135·3736·3022·2074·6162·696e·6465·783d··15760"·tabindex= | 0004f730:·3135·3736·3022·2074·6162·696e·6465·783d··15760"·tabindex= | ||
| 0004f740:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0004f740:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0004f750:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0004f750:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0004f760:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0004f760:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0004f770:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0004f770:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0004f780:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0004f780:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0004f790:·6564·6961·7469·6f6e·20 | 0004f790:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0004f7a0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | |||
| 0004f7b0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0004f7c0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0004f7d0:·6170·7365·2220·6964·3d22·6964·6d31·3537··apse"·id="idm157 | |||
| 0004f7e0:·3630·223e·3c70·7265·3e3c·636f·6465·3e23··60"><pre><code># | |||
| 0004f7f0:·2052·656d·6564·6961·7469·6f6e·2069·7320···Remediation·is· | |||
| 0004f800:·6170·706c·6963·6162·6c65·206f·6e6c·7920··applicable·only· | |||
| 0004f810:·696e·2063·6572·7461·696e·2070·6c61·7466··in·certain·platf | |||
| 0004f820:·6f72·6d73·0a69·6620·5b20·2120·2d66·202f··orms.if·[·!·-f·/ | |||
| 0004f830:·2e64·6f63·6b65·7265·6e76·205d·2026·616d··.dockerenv·]·&am | |||
| 0004f840:·703b·2661·6d70·3b20·5b20·2120·2d66·202f··p;&·[·!·-f·/ | |||
| 0004f850:·7275·6e2f·2e63·6f6e·7461·696e·6572·656e··run/.containeren | |||
| 0004f860:·7620·5d3b·2074·6865·6e0a·0a4c·4f47·524f··v·];·then..LOGRO | |||
| 0004f870:·5441·5445·5f43·4f4e·465f·4649·4c45·3d22··TATE_CONF_FILE=" | |||
| 0004f7a0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0004f7b0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0004f7c0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0004f7d0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0004f7e0:·3135·3736·3022·3e3c·7461·626c·6520·636c··15760"><table·cl | |||
| 0004f7f0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0004f800:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0004f810:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0004f820:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0004f830:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0004f840:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0004f850:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0004f860:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0004f870:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0004f880:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0004f890:·3e3c·7464·3e63·6f6e·6669·6775·7265·3c2f··><td>configure</ | |||
| 0004f8a0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0004f8b0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0004f8c0:·653a·2043·6f6e·6669·6775·7265·2064·6169··e:·Configure·dai | |||
| 0004f8d0:·6c79·206c·6f67·2072·6f74·6174·696f·6e20··ly·log·rotation· | |||
| 0004f8e0:·696e·202f·6574·632f·6c6f·6772·6f74·6174··in·/etc/logrotat | |||
| 0004f8f0:·652e·636f·6e66·0a20·206c·696e·6569·6e66··e.conf.··lineinf | |||
| 0004f900:·696c·653a·0a20·2020·2063·7265·6174·653a··ile:.····create: | |||
| 0004f910:·2074·7275·650a·2020·2020·6465·7374·3a20···true.····dest:· | |||
| 0004f | 0004f880:·2f65·7463·2f6c·6f67·726f·7461·7465·2e63··/etc/logrotate.c | ||
| 0004f930:·6f6e·660a·2020·2020·7265·6765·7870·3a20··onf.····regexp:· | |||
| 0004f940:·5e64·6169·6c79·240a·2020·2020·6c69·6e65··^daily$.····line | |||
| 0004f950:·3a20·6461·696c·790a·2020·7768·656e·3a20··:·daily.··when:· | |||
| 0004f960:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0004f970:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0004f980:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0004f990:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0004f9a0:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0004f9b0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0004f9c0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0004f9d0:·2d36·2861·290a·2020·2d20·5043·492d·4453··-6(a).··-·PCI-DS | |||
| 0004f9e0:·532d·5265·712d·3130·2e37·0a20·202d·2063··S-Req-10.7.··-·c | |||
| 0004f9f0:·6f6e·6669·6775·7265·5f73·7472·6174·6567··onfigure_strateg | |||
| 0004fa00:·790a·2020·2d20·656e·7375·7265·5f6c·6f67··y.··-·ensure_log | |||
| 0004fa10:·726f·7461·7465·5f61·6374·6976·6174·6564··rotate_activated | |||
| 0004fa20:·0a20·202d·206c·6f77·5f63·6f6d·706c·6578··.··-·low_complex | |||
| 0004fa30:·6974·790a·2020·2d20·6c6f·775f·6469·7372··ity.··-·low_disr | |||
| 0004fa40:·7570·7469·6f6e·0a20·202d·206d·6564·6975··uption.··-·mediu | |||
| 0004fa50:·6d5f·7365·7665·7269·7479·0a20·202d·206e··m_severity.··-·n | |||
| 0004fa60:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 0004fa70:·0a2d·206e·616d·653a·204d·616b·6520·7375··.-·name:·Make·su | |||
| 0004fa80:·7265·2064·6169·6c79·206c·6f67·2072·6f74··re·daily·log·rot | |||
| 0004fa90:·6174·696f·6e20·7365·7474·696e·6720·6973··ation·setting·is | |||
| 0004f | 0004f890:·6f6e·6622·0a43·524f·4e5f·4441·494c·595f··onf".CRON_DAILY_ | ||
| 0004f8a0:·4c4f·4752·4f54·4154·455f·4649·4c45·3d22··LOGROTATE_FILE=" | |||
| 0004f8b0:·2f65·7463·2f63·726f·6e2e·6461·696c·792f··/etc/cron.daily/ | |||
| 0004f8c0:·6c6f·6772·6f74·6174·6522·0a0a·2320·6461··logrotate"..#·da | |||
| 0004f8d0:·696c·7920·726f·7461·7469·6f6e·2069·7320··ily·rotation·is· | |||
| 0004f8e0:·636f·6e66·6967·7572·6564·0a67·7265·7020··configured.grep· | |||
| 0004f8f0:·2d71·2022·5e64·6169·6c79·2422·2024·4c4f··-q·"^daily$"·$LO | |||
| 0004f900:·4752·4f54·4154·455f·434f·4e46·5f46·494c··GROTATE_CONF_FIL | |||
| 0004f910:·457c·7c20·6563·686f·2022·6461·696c·7922··E||·echo·"daily" | |||
| 0004f920:·2026·6774·3b26·6774·3b20·244c·4f47·524f···>>·$LOGRO | |||
| 0004f930:·5441·5445·5f43·4f4e·465f·4649·4c45·0a0a··TATE_CONF_FILE.. | |||
| 0004f940:·2320·7265·6d6f·7665·2061·6e79·206c·696e··#·remove·any·lin | |||
| 0004f950:·6520·636f·6e66·6967·7572·696e·6720·7765··e·configuring·we | |||
| 0004f960:·656b·6c79·2c20·6d6f·6e74·686c·7920·6f72··ekly,·monthly·or | |||
| 0004f970:·2079·6561·726c·7920·726f·7461·7469·6f6e···yearly·rotation | |||
| 0004f980:·0a73·6564·202d·6920·272f·5e5c·732a·5c28··.sed·-i·'/^\s*\( | |||
| 0004f990:·7765·656b·6c79·5c7c·6d6f·6e74·686c·795c··weekly\|monthly\ | |||
| 0004f9a0:·7c79·6561·726c·795c·292e·2a24·2f64·2720··|yearly\).*$/d'· | |||
| 0004f9b0:·244c·4f47·524f·5441·5445·5f43·4f4e·465f··$LOGROTATE_CONF_ | |||
| 0004f9c0:·4649·4c45·0a0a·2320·636f·6e66·6967·7572··FILE..#·configur | |||
| 0004f9d0:·6520·6372·6f6e·2e64·6169·6c79·2069·6620··e·cron.daily·if· | |||
| 0004f9e0:·6e6f·7420·616c·7265·6164·790a·6966·2021··not·already.if·! | |||
| 0004f9f0:·2067·7265·7020·2d71·2022·5e5b·5b3a·7370···grep·-q·"^[[:sp | |||
| 0004fa00:·6163·653a·5d5d·2a2f·7573·722f·7362·696e··ace:]]*/usr/sbin | |||
| 0004fa10:·2f6c·6f67·726f·7461·7465·5b5b·3a61·6c6e··/logrotate[[:aln | |||
| 0004fa20:·756d·3a5d·5b3a·626c·616e·6b3a·5d5b·3a70··um:][:blank:][:p | |||
| 0004fa30:·756e·6374·3a5d·5d2a·244c·4f47·524f·5441··unct:]]*$LOGROTA | |||
| 0004fa40:·5445·5f43·4f4e·465f·4649·4c45·2422·2024··TE_CONF_FILE$"·$ | |||
| 0004fa50:·4352·4f4e·5f44·4149·4c59·5f4c·4f47·524f··CRON_DAILY_LOGRO | |||
| 0004fa60:·5441·5445·5f46·494c·453b·2074·6865·6e0a··TATE_FILE;·then. | |||
| 0004fa70:·0965·6368·6f20·2223·212f·6269·6e2f·7368··.echo·"#!/bin/sh | |||
| 0004fa80:·2220·2667·743b·2024·4352·4f4e·5f44·4149··"·>·$CRON_DAI | |||
| 0004fa90:·4c59·5f4c·4f47·524f·5441·5445·5f46·494c··LY_LOGROTATE_FIL | |||
| 0004faa0:·450a·0965·6368·6f20·222f·7573·722f·7362··E..echo·"/usr/sb | |||
| 0004fab0:·696e·2f6c·6f67·726f·7461·7465·2024·4c4f··in/logrotate·$LO | |||
| 0004fac0:·4752·4f54·4154·455f·434f·4e46·5f46·494c··GROTATE_CONF_FIL | |||
| 0004fad0:·4522·2026·6774·3b26·6774·3b20·2443·524f··E"·>>·$CRO | |||
| 0004fae0:·4e5f·4441·494c·595f·4c4f·4752·4f54·4154··N_DAILY_LOGROTAT | |||
| 0004faf0:·455f·4649·4c45·0a66·690a·0a65·6c73·650a··E_FILE.fi..else. | |||
| 0004fb00:·2020·2020·2667·743b·2661·6d70·3b32·2065······>&2·e | |||
| Max diff block lines reached; 314916/342984 bytes (91.82%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Debian·10 | 39 | Profile·Title·Standard·System·Security·Profile·for·Debian·10 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:debian:debian_linux:10 | 42 | ····*·cpe:/o:debian:debian_linux:10 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·Configure_Syslog | 50 | ·········3.·Configure_Syslog |
| 51 | ·········4.·File_Permissions_and_Masks | 51 | ·········4.·File_Permissions_and_Masks |
| 52 | ···2.·Services | 52 | ···2.·Services |
| Offset 521, 14 lines modified | Offset 521, 37 lines modified | ||
| 521 | ············partition·becomes·full. | 521 | ············partition·becomes·full. |
| 522 | Severity: ·medium | 522 | Severity: ·medium |
| 523 | Rule·ID:····xccdf_org.ssgproject.content_rule_ensure_logrotate_activated | 523 | Rule·ID:····xccdf_org.ssgproject.content_rule_ensure_logrotate_activated |
| 524 | Identifiers·References: ·BP28(R43),·NT12(R18),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, | 524 | Identifiers·References: ·BP28(R43),·NT12(R18),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, |
| 525 | and·········DSS05.07,·MEA02.01,·CCI-000366,·4.3.3.3.9,·4.3.3.5.8,·4.3.4.4.7,·4.4.2.1,·4.4.2.2, | 525 | and·········DSS05.07,·MEA02.01,·CCI-000366,·4.3.3.3.9,·4.3.3.5.8,·4.3.4.4.7,·4.4.2.1,·4.4.2.2, |
| 526 | References··4.4.2.4,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·A.12.4.1,·A.12.4.2,·A.12.4.3, | 526 | References··4.4.2.4,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·A.12.4.1,·A.12.4.2,·A.12.4.3, |
| 527 | ············A.12.4.4,·A.12.7.1,·CM-6(a),·PR.PT-1,·Req-10.7 | 527 | ············A.12.4.4,·A.12.7.1,·CM-6(a),·PR.PT-1,·Req-10.7 |
| 528 | Remediation_Shell_script_⇲ | ||
| 529 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 530 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 531 | LOGROTATE_CONF_FILE="/etc/logrotate.conf" | ||
| 532 | CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate" | ||
| 533 | #·daily·rotation·is·configured | ||
| 534 | grep·-q·"^daily$"·$LOGROTATE_CONF_FILE||·echo·"daily"·>>·$LOGROTATE_CONF_FILE | ||
| 535 | #·remove·any·line·configuring·weekly,·monthly·or·yearly·rotation | ||
| 536 | sed·-i·'/^\s*\(weekly\|monthly\|yearly\).*$/d'·$LOGROTATE_CONF_FILE | ||
| 537 | #·configure·cron.daily·if·not·already | ||
| 538 | if·!·grep·-q·"^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" | ||
| 539 | $CRON_DAILY_LOGROTATE_FILE;·then | ||
| 540 | » echo·"#!/bin/sh"·>·$CRON_DAILY_LOGROTATE_FILE | ||
| 541 | » echo·"/usr/sbin/logrotate·$LOGROTATE_CONF_FILE"·>>·$CRON_DAILY_LOGROTATE_FILE | ||
| 542 | fi | ||
| 543 | else | ||
| 544 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 545 | fi | ||
| 528 | Remediation_Ansible_snippet_⇲ | 546 | Remediation_Ansible_snippet_⇲ |
| 529 | Complexity:·low | 547 | Complexity:·low |
| 530 | Disruption:·low | 548 | Disruption:·low |
| 531 | Strategy:···configure | 549 | Strategy:···configure |
| 532 | -·name:·Configure·daily·log·rotation·in·/etc/logrotate.conf | 550 | -·name:·Configure·daily·log·rotation·in·/etc/logrotate.conf |
| 533 | ··lineinfile: | 551 | ··lineinfile: |
| 534 | ····create:·true | 552 | ····create:·true |
| Offset 584, 37 lines modified | Offset 607, 14 lines modified | ||
| 584 | ··-·PCI-DSS-Req-10.7 | 607 | ··-·PCI-DSS-Req-10.7 |
| 585 | ··-·configure_strategy | 608 | ··-·configure_strategy |
| 586 | ··-·ensure_logrotate_activated | 609 | ··-·ensure_logrotate_activated |
| 587 | ··-·low_complexity | 610 | ··-·low_complexity |
| 588 | ··-·low_disruption | 611 | ··-·low_disruption |
| 589 | ··-·medium_severity | 612 | ··-·medium_severity |
| 590 | ··-·no_reboot_needed | 613 | ··-·no_reboot_needed |
| 591 | Remediation_Shell_script_⇲ | ||
| 592 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 593 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 594 | LOGROTATE_CONF_FILE="/etc/logrotate.conf" | ||
| 595 | CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate" | ||
| 596 | #·daily·rotation·is·configured | ||
| 597 | grep·-q·"^daily$"·$LOGROTATE_CONF_FILE||·echo·"daily"·>>·$LOGROTATE_CONF_FILE | ||
| 598 | #·remove·any·line·configuring·weekly,·monthly·or·yearly·rotation | ||
| 599 | sed·-i·'/^\s*\(weekly\|monthly\|yearly\).*$/d'·$LOGROTATE_CONF_FILE | ||
| 600 | #·configure·cron.daily·if·not·already | ||
| 601 | if·!·grep·-q·"^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" | ||
| 602 | $CRON_DAILY_LOGROTATE_FILE;·then | ||
| 603 | » echo·"#!/bin/sh"·>·$CRON_DAILY_LOGROTATE_FILE | ||
| 604 | » echo·"/usr/sbin/logrotate·$LOGROTATE_CONF_FILE"·>>·$CRON_DAILY_LOGROTATE_FILE | ||
| 605 | fi | ||
| 606 | else | ||
| 607 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 608 | fi | ||
| 609 | ***·Rule ·Ensure·rsyslog·is·Installed· [ref]·*** | 614 | ***·Rule ·Ensure·rsyslog·is·Installed· [ref]·*** |
| 610 | Rsyslog·is·installed·by·default.·The·rsyslog·package·can·be·installed·with·the·following·command: | 615 | Rsyslog·is·installed·by·default.·The·rsyslog·package·can·be·installed·with·the·following·command: |
| 611 | ·$·apt-get·install·rsyslog | 616 | ·$·apt-get·install·rsyslog |
| 612 | Rationale:··The·rsyslog·package·provides·the·rsyslog·daemon,·which·provides·system·logging·services. | 617 | Rationale:··The·rsyslog·package·provides·the·rsyslog·daemon,·which·provides·system·logging·services. |
| 613 | Severity: ·medium | 618 | Severity: ·medium |
| 614 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_rsyslog_installed | 619 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_rsyslog_installed |
| 615 | ············References: ·BP28(R5),·NT28(R46),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, | 620 | ············References: ·BP28(R5),·NT28(R46),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, |
| Offset 756, 14 lines modified | Offset 756, 22 lines modified | ||
| 756 | ············References: ·12,·13,·14,·15,·16,·18,·3,·5,·5.5.2.2,·APO01.06,·DSS05.04,·DSS05.07, | 756 | ············References: ·12,·13,·14,·15,·16,·18,·3,·5,·5.5.2.2,·APO01.06,·DSS05.04,·DSS05.07, |
| 757 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 757 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 758 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, | 758 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, |
| 759 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, | 759 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, |
| 760 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- | 760 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- |
| 761 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- | 761 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- |
| 762 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227 | 762 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227 |
| 763 | Remediation_Shell_script_⇲ | ||
| 764 | Complexity:·low | ||
| 765 | Disruption:·low | ||
| 766 | Strategy:···configure | ||
| 767 | chgrp·0·/etc/group | ||
| 763 | Remediation_Ansible_snippet_⇲ | 768 | Remediation_Ansible_snippet_⇲ |
| 764 | Complexity:·low | 769 | Complexity:·low |
| 765 | Disruption:·low | 770 | Disruption:·low |
| 766 | Strategy:···configure | 771 | Strategy:···configure |
| 767 | -·name:·Test·for·existence·/etc/group | 772 | -·name:·Test·for·existence·/etc/group |
| 768 | ··stat: | 773 | ··stat: |
| 769 | ····path:·/etc/group | 774 | ····path:·/etc/group |
| Offset 792, 36 lines modified | Offset 800, 36 lines modified | ||
| 792 | ··-·PCI-DSS-Req-8.7.c | 800 | ··-·PCI-DSS-Req-8.7.c |
| 793 | ··-·configure_strategy | 801 | ··-·configure_strategy |
| 794 | ··-·file_groupowner_etc_group | 802 | ··-·file_groupowner_etc_group |
| 795 | ··-·low_complexity | 803 | ··-·low_complexity |
| 796 | ··-·low_disruption | 804 | ··-·low_disruption |
| 797 | ··-·medium_severity | 805 | ··-·medium_severity |
| 798 | ··-·no_reboot_needed | 806 | ··-·no_reboot_needed |
| 799 | Remediation_Shell_script_⇲ | ||
| 800 | Complexity:·low | ||
| 801 | Disruption:·low | ||
| 802 | Strategy:···configure | ||
| Max diff block lines reached; 40860/45843 bytes (89.13%) of diff not shown. | |||
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00037cb0:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00037cc0:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00037cc0:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00037cd0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00037cd0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00037ce0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00037ce0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00037cf0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00037cf0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 00037d00:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 00037d00:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 00037d10:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 00037d10:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 00037d20:·323 | 00037d20:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 00037d30:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 00037d30:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00037d40:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00037d40:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00037d50:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00037d50:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00037d60:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00037d60:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00037d70:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00037d70:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00037d80:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00037d80:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00037d90:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00037d90:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 16724, 139 lines modified | Offset 16724, 139 lines modified | ||
| 00041530:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | 00041530:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | ||
| 00041540:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | 00041540:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | ||
| 00041550:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 00041550:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 00041560:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 00041560:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 00041570:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 00041570:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 00041580:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 00041580:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 00041590:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 00041590:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 000415a0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 000415b0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 000415c0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 000415d0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 000415e0:·6170·7365·2220·6964·3d22·6964·6d32·3732··apse"·id="idm272 | |||
| 000415f0:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 00041600:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 00041610:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 00041620:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 00041630:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 00041640:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 00041650:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 00041660:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 00041670:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 00041680:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 00041690:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 000416a0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 000416b0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 000416c0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4669··<code>-·name:·Fi | |||
| 000416d0:·6e64·202f·6574·632f·7375·646f·6572·732e··nd·/etc/sudoers. | |||
| 000416e0:·642f·2066·696c·6573·0a20·2066·696e·643a··d/·files.··find: | |||
| 000416f0:·0a20·2020·2070·6174·6873·3a0a·2020·2020··.····paths:.···· | |||
| 00041700:·2d20·2f65·7463·2f73·7564·6f65·7273·2e64··-·/etc/sudoers.d | |||
| 00041710:·2f0a·2020·7265·6769·7374·6572·3a20·7375··/.··register:·su | |||
| 00041720:·646f·6572·730a·2020·7461·6773·3a0a·2020··doers.··tags:.·· | |||
| 00041730:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 00041740:·2d36·2861·290a·2020·2d20·4e49·5354·2d38··-6(a).··-·NIST-8 | |||
| 00041750:·3030·2d35·332d·4941·2d31·310a·2020·2d20··00-53-IA-11.··-· | |||
| 00041760:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 00041770:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 00041780:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | |||
| 00041790:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 000417a0:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 000417b0:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 000417c0:·0a20·202d·2073·7564·6f5f·7265·6d6f·7665··.··-·sudo_remove | |||
| 000417d0:·5f6e·6f5f·6175·7468·656e·7469·6361·7465··_no_authenticate | |||
| 000417e0:·0a0a·2d20·6e61·6d65·3a20·5265·6d6f·7665··..-·name:·Remove | |||
| 000417f0:·206c·696e·6573·2063·6f6e·7461·696e·696e···lines·containin | |||
| 00041800:·6720·2161·7574·6865·6e74·6963·6174·6520··g·!authenticate· | |||
| 00041810:·6672·6f6d·2073·7564·6f65·7273·2066·696c··from·sudoers·fil | |||
| 00041820:·6573·0a20·2072·6570·6c61·6365·3a0a·2020··es.··replace:.·· | |||
| 00041830:·2020·7265·6765·7870·3a20·285e·283f·2123····regexp:·(^(?!# | |||
| 00041840:·292e·2a5b·5c73·5d2b·5c21·6175·7468·656e··).*[\s]+\!authen | |||
| 00041850:·7469·6361·7465·2e2a·2429·0a20·2020·2072··ticate.*$).····r | |||
| 00041860:·6570·6c61·6365·3a20·2723·205c·6726·6c74··eplace:·'#·\g< | |||
| 00041870:·3b31·2667·743b·270a·2020·2020·7061·7468··;1>'.····path | |||
| 00041880:·3a20·277b·7b20·6974·656d·2e70·6174·6820··:·'{{·item.path· | |||
| 00041890:·7d7d·270a·2020·2020·7661·6c69·6461·7465··}}'.····validate | |||
| 000418a0:·3a20·2f75·7372·2f73·6269·6e2f·7669·7375··:·/usr/sbin/visu | |||
| 000418b0:·646f·202d·6366·2025·730a·2020·7769·7468··do·-cf·%s.··with | |||
| 000418c0:·5f69·7465·6d73·3a0a·2020·2d20·7061·7468··_items:.··-·path | |||
| 000418d0:·3a20·2f65·7463·2f73·7564·6f65·7273·0a20··:·/etc/sudoers.· | |||
| 000418e0:·202d·2027·7b7b·2073·7564·6f65·7273·2e66···-·'{{·sudoers.f | |||
| 000418f0:·696c·6573·207d·7d27·0a20·2074·6167·733a··iles·}}'.··tags: | |||
| 00041900:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00041910:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 00041920:·542d·3830·302d·3533·2d49·412d·3131·0a20··T-800-53-IA-11.· | |||
| 00041930:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 00041940:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 00041950:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 00041960:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 00041970:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 00041980:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 00041990:·6567·790a·2020·2d20·7375·646f·5f72·656d··egy.··-·sudo_rem | |||
| 000419a0:·6f76·655f·6e6f·5f61·7574·6865·6e74·6963··ove_no_authentic | |||
| 000419b0:·6174·650a·3c2f·636f·6465·3e3c·2f70·7265··ate.</code></pre | |||
| 000419c0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 000419d0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 000419e0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 000419f0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 00041a00:·7267·6574·3d22·2369·646d·3237·3236·2220··rget="#idm2726"· | |||
| 00041a10:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 00041a20:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 00041a30:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 00041a40:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 00041a50:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 00041a60:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 00041a7 | 000415a0:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | ||
| 000415b0:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 000415c0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 000415d0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 000415e0:·6522·2069·643d·2269·646d·3237·3235·223e··e"·id="idm2725"> | |||
| 000415f0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 00041600:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 00041610:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 00041620:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 00041630:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 00041640:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 00041650:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 00041660:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 00041670:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 00041680:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 00041690:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 000416a0:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 000416b0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 000416c0:·6465·3e0a·666f·7220·6620·696e·202f·6574··de>.for·f·in·/et | |||
| 000416d0:·632f·7375·646f·6572·7320·2f65·7463·2f73··c/sudoers·/etc/s | |||
| 000416e0:·7564·6f65·7273·2e64·2f2a·203b·2064·6f0a··udoers.d/*·;·do. | |||
| 000416f0:·2020·6966·205b·2021·202d·6520·2224·6622····if·[·!·-e·"$f" | |||
| 00041700:·205d·203b·2074·6865·6e0a·2020·2020·636f···]·;·then.····co | |||
| 00041710:·6e74·696e·7565·0a20·2066·690a·2020·6d61··ntinue.··fi.··ma | |||
| 00041720:·7463·6869·6e67·5f6c·6973·743d·2428·6772··tching_list=$(gr | |||
| 00041730:·6570·202d·5020·275e·283f·2123·292e·2a5b··ep·-P·'^(?!#).*[ | |||
| 00041740:·5c73·5d2b·5c21·6175·7468·656e·7469·6361··\s]+\!authentica | |||
| Max diff block lines reached; 359960/378920 bytes (95.00%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Average·(Intermediate)·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_average |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:debian:debian_linux:11 | 41 | ····*·cpe:/o:debian:debian_linux:11 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Configure_Syslog | 48 | ·········2.·Configure_Syslog |
| 49 | ·········3.·File_Permissions_and_Masks | 49 | ·········3.·File_Permissions_and_Masks |
| 50 | ···2.·Services | 50 | ···2.·Services |
| 51 | ·········1.·APT_service_configuration | 51 | ·········1.·APT_service_configuration |
| Offset 167, 14 lines modified | Offset 167, 33 lines modified | ||
| 167 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 167 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 168 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 168 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 169 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 169 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 170 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 170 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 171 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 171 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 172 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 172 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 173 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 173 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 174 | Remediation_Shell_script_⇲ | ||
| 175 | Complexity:·low | ||
| 176 | Disruption:·low | ||
| 177 | Strategy:···restrict | ||
| 178 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 179 | ··if·[·!·-e·"$f"·]·;·then | ||
| 180 | ····continue | ||
| 181 | ··fi | ||
| 182 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 183 | ··if·!·test·-z·"$matching_list";·then | ||
| 184 | ····while·IFS=·read·-r·entry;·do | ||
| 185 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 186 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 187 | ····done·<<<·"$matching_list" | ||
| 188 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 189 | ··fi | ||
| 190 | done | ||
| 174 | Remediation_Ansible_snippet_⇲ | 191 | Remediation_Ansible_snippet_⇲ |
| 175 | Complexity:·low | 192 | Complexity:·low |
| 176 | Disruption:·low | 193 | Disruption:·low |
| 177 | Strategy:···restrict | 194 | Strategy:···restrict |
| 178 | -·name:·Find·/etc/sudoers.d/·files | 195 | -·name:·Find·/etc/sudoers.d/·files |
| 179 | ··find: | 196 | ··find: |
| 180 | ····paths: | 197 | ····paths: |
| Offset 204, 33 lines modified | Offset 223, 14 lines modified | ||
| 204 | ··-·NIST-800-53-IA-11 | 223 | ··-·NIST-800-53-IA-11 |
| 205 | ··-·low_complexity | 224 | ··-·low_complexity |
| 206 | ··-·low_disruption | 225 | ··-·low_disruption |
| 207 | ··-·medium_severity | 226 | ··-·medium_severity |
| 208 | ··-·no_reboot_needed | 227 | ··-·no_reboot_needed |
| 209 | ··-·restrict_strategy | 228 | ··-·restrict_strategy |
| 210 | ··-·sudo_remove_no_authenticate | 229 | ··-·sudo_remove_no_authenticate |
| 211 | Remediation_Shell_script_⇲ | ||
| 212 | Complexity:·low | ||
| 213 | Disruption:·low | ||
| 214 | Strategy:···restrict | ||
| 215 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 216 | ··if·[·!·-e·"$f"·]·;·then | ||
| 217 | ····continue | ||
| 218 | ··fi | ||
| 219 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 220 | ··if·!·test·-z·"$matching_list";·then | ||
| 221 | ····while·IFS=·read·-r·entry;·do | ||
| 222 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 223 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 224 | ····done·<<<·"$matching_list" | ||
| 225 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 226 | ··fi | ||
| 227 | done | ||
| 228 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 230 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 229 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 231 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 230 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 232 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 231 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 233 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 232 | sudoers.d/. | 234 | sudoers.d/. |
| 233 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 235 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 234 | ············they·do·not·have·authorization. | 236 | ············they·do·not·have·authorization. |
| Offset 242, 14 lines modified | Offset 242, 33 lines modified | ||
| 242 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 242 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 243 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 243 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 244 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 244 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 245 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 245 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 246 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 246 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 247 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 247 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 248 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 248 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 249 | Remediation_Shell_script_⇲ | ||
| 250 | Complexity:·low | ||
| 251 | Disruption:·low | ||
| 252 | Strategy:···restrict | ||
| 253 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 254 | ··if·[·!·-e·"$f"·]·;·then | ||
| 255 | ····continue | ||
| 256 | ··fi | ||
| 257 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 258 | ··if·!·test·-z·"$matching_list";·then | ||
| 259 | ····while·IFS=·read·-r·entry;·do | ||
| 260 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 261 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 262 | ····done·<<<·"$matching_list" | ||
| 263 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 264 | ··fi | ||
| 265 | done | ||
| 249 | Remediation_Ansible_snippet_⇲ | 266 | Remediation_Ansible_snippet_⇲ |
| 250 | Complexity:·low | 267 | Complexity:·low |
| 251 | Disruption:·low | 268 | Disruption:·low |
| 252 | Strategy:···restrict | 269 | Strategy:···restrict |
| 253 | -·name:·Find·/etc/sudoers.d/·files | 270 | -·name:·Find·/etc/sudoers.d/·files |
| 254 | ··find: | 271 | ··find: |
| 255 | ····paths: | 272 | ····paths: |
| Offset 279, 33 lines modified | Offset 298, 14 lines modified | ||
| 279 | ··-·NIST-800-53-IA-11 | 298 | ··-·NIST-800-53-IA-11 |
| 280 | ··-·low_complexity | 299 | ··-·low_complexity |
| 281 | ··-·low_disruption | 300 | ··-·low_disruption |
| 282 | ··-·medium_severity | 301 | ··-·medium_severity |
| 283 | ··-·no_reboot_needed | 302 | ··-·no_reboot_needed |
| 284 | ··-·restrict_strategy | 303 | ··-·restrict_strategy |
| 285 | ··-·sudo_remove_nopasswd | 304 | ··-·sudo_remove_nopasswd |
| 286 | Remediation_Shell_script_⇲ | ||
| 287 | Complexity:·low | ||
| Max diff block lines reached; 45638/51040 bytes (89.42%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037cc0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037cd0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ce0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037cf0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d00:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d10:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d20:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d30:·206f·6620·3230·323 | 00037d30:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d40:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d50:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037d60:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037d70:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037d80:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037d90:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037da0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 16744, 139 lines modified | Offset 16744, 139 lines modified | ||
| 00041670:·6765·743d·2223·6964·6d32·3732·3522·2074··get="#idm2725"·t | 00041670:·6765·743d·2223·6964·6d32·3732·3522·2074··get="#idm2725"·t | ||
| 00041680:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 00041680:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 00041690:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 00041690:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 000416a0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 000416a0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 000416b0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 000416b0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 000416c0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 000416c0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 000416d0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 000416d0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 000416e0:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 000416f0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 00041700:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 00041710:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 00041720:·3d22·6964·6d32·3732·3522·3e3c·7461·626c··="idm2725"><tabl | |||
| 00041730:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 00041740:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 00041750:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 00041760:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 00041770:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 000416e0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 000416f0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 00041700:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 00041710:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 00041720:·2069·643d·2269·646d·3237·3235·223e·3c74···id="idm2725"><t | |||
| 00041730:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 00041740:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 00041750:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 00041760:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 00041770:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 00041780:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 00041790:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 000417a0:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 000417 | 00041780:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 00041790:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 000417a0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 000417b0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 000417c0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 000417d0:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 000417e0:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 000417f0:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a66··le><pre><code>.f | |||
| 00041800:·6f72·2066·2069·6e20·2f65·7463·2f73·7564··or·f·in·/etc/sud | |||
| 00041810:·6f65·7273·202f·6574·632f·7375·646f·6572··oers·/etc/sudoer | |||
| 00041820:·732e·642f·2a20·3b20·646f·0a20·2069·6620··s.d/*·;·do.··if· | |||
| 00041830:·5b20·2120·2d65·2022·2466·2220·5d20·3b20··[·!·-e·"$f"·]·;· | |||
| 00041840:·7468·656e·0a20·2020·2063·6f6e·7469·6e75··then.····continu | |||
| 00041850:·650a·2020·6669·0a20·206d·6174·6368·696e··e.··fi.··matchin | |||
| 00041860:·675f·6c69·7374·3d24·2867·7265·7020·2d50··g_list=$(grep·-P | |||
| 00041870:·2027·5e28·3f21·2329·2e2a·5b5c·735d·2b5c···'^(?!#).*[\s]+\ | |||
| 000417c0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 000417d0:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 000417e0:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 000417f0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 00041800:·3e2d·206e·616d·653a·2046·696e·6420·2f65··>-·name:·Find·/e | |||
| 00041810:·7463·2f73·7564·6f65·7273·2e64·2f20·6669··tc/sudoers.d/·fi | |||
| 00041820:·6c65·730a·2020·6669·6e64·3a0a·2020·2020··les.··find:.···· | |||
| 00041830:·7061·7468·733a·0a20·2020·202d·202f·6574··paths:.····-·/et | |||
| 00041840:·632f·7375·646f·6572·732e·642f·0a20·2072··c/sudoers.d/.··r | |||
| 00041850:·6567·6973·7465·723a·2073·7564·6f65·7273··egister:·sudoers | |||
| 00041860:·0a20·2074·6167·733a·0a20·202d·204e·4953··.··tags:.··-·NIS | |||
| 00041870:·542d·3830·302d·3533·2d43·4d2d·3628·6129··T-800-53-CM-6(a) | |||
| 00041880:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00041890:·2d49·412d·3131·0a20·202d·206c·6f77·5f63··-IA-11.··-·low_c | |||
| 000418a0:·6f6d·706c·6578·6974·790a·2020·2d20·6c6f··omplexity.··-·lo | |||
| 000418b0:·775f·6469·7372·7570·7469·6f6e·0a20·202d··w_disruption.··- | |||
| 000418c0:·206d·6564·6975·6d5f·7365·7665·7269·7479···medium_severity | |||
| 000418d0:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 000418e0:·6565·6465·640a·2020·2d20·7265·7374·7269··eeded.··-·restri | |||
| 000418f0:·6374·5f73·7472·6174·6567·790a·2020·2d20··ct_strategy.··-· | |||
| 00041900:·7375·646f·5f72·656d·6f76·655f·6e6f·5f61··sudo_remove_no_a | |||
| 00041 | 00041880:·2161·7574·6865·6e74·6963·6174·652e·2a24··!authenticate.*$ | ||
| 00041890:·2720·2466·207c·2075·6e69·7120·290a·2020··'·$f·|·uniq·).·· | |||
| 000418a0:·6966·2021·2074·6573·7420·2d7a·2022·246d··if·!·test·-z·"$m | |||
| 000418b0:·6174·6368·696e·675f·6c69·7374·223b·2074··atching_list";·t | |||
| 000418c0:·6865·6e0a·2020·2020·7768·696c·6520·4946··hen.····while·IF | |||
| 000418d0:·533d·2072·6561·6420·2d72·2065·6e74·7279··S=·read·-r·entry | |||
| 000418e0:·3b20·646f·0a20·2020·2020·2023·2063·6f6d··;·do.······#·com | |||
| 000418f0:·6d65·6e74·206f·7574·2022·2161·7574·6865··ment·out·"!authe | |||
| 00041900:·6e74·6963·6174·6522·206d·6174·6368·6573··nticate"·matches | |||
| 00041910:·2074·6f20·7072·6573·6572·7665·2075·7365···to·preserve·use | |||
| 00041920:·7220·6461·7461·0a20·2020·2020·2073·6564··r·data.······sed | |||
| 00041930:·202d·6920·2273·2f5e·247b·656e·7472·797d···-i·"s/^${entry} | |||
| 00041940:·242f·2320·2661·6d70·3b2f·6722·2024·660a··$/#·&/g"·$f. | |||
| 00041950:·2020·2020·646f·6e65·2026·6c74·3b26·6c74······done·<< | |||
| 00041960:·3b26·6c74·3b20·2224·6d61·7463·6869·6e67··;<·"$matching | |||
| 00041970:·5f6c·6973·7422·0a0a·2020·2020·2f75·7372··_list"..····/usr | |||
| 00041980:·2f73·6269·6e2f·7669·7375·646f·202d·6366··/sbin/visudo·-cf | |||
| 00041990:·2024·6620·2661·6d70·3b26·6774·3b20·2f64···$f·&>·/d | |||
| 000419a0:·6576·2f6e·756c·6c20·7c7c·2065·6368·6f20··ev/null·||·echo· | |||
| 000419b0:·2246·6169·6c20·746f·2076·616c·6964·6174··"Fail·to·validat | |||
| 000419c0:·6520·2466·2077·6974·6820·7669·7375·646f··e·$f·with·visudo | |||
| 000419d0:·220a·2020·6669·0a64·6f6e·650a·3c2f·636f··".··fi.done.</co | |||
| 000419e0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 000419f0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 00041a00:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 00041a10:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 00041a20:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 00041a30:·646d·3237·3236·2220·7461·6269·6e64·6578··dm2726"·tabindex | |||
| 00041a40:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 00041a50:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 00041a60:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 00041a70:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 00041a80:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 00041a90:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 00041920:·616d·653a·2052·656d·6f76·6520·6c69·6e65··ame:·Remove·line | |||
| 00041930:·7320·636f·6e74·6169·6e69·6e67·2021·6175··s·containing·!au | |||
| 00041940:·7468·656e·7469·6361·7465·2066·726f·6d20··thenticate·from· | |||
| 00041950:·7375·646f·6572·7320·6669·6c65·730a·2020··sudoers·files.·· | |||
| 00041960:·7265·706c·6163·653a·0a20·2020·2072·6567··replace:.····reg | |||
| 00041970:·6578·703a·2028·5e28·3f21·2329·2e2a·5b5c··exp:·(^(?!#).*[\ | |||
| 00041980:·735d·2b5c·2161·7574·6865·6e74·6963·6174··s]+\!authenticat | |||
| 00041990:·652e·2a24·290a·2020·2020·7265·706c·6163··e.*$).····replac | |||
| 000419a0:·653a·2027·2320·5c67·266c·743b·3126·6774··e:·'#·\g<1> | |||
| 000419b0:·3b27·0a20·2020·2070·6174·683a·2027·7b7b··;'.····path:·'{{ | |||
| Max diff block lines reached; 360650/379610 bytes (95.01%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level | 39 | Profile·Title·Profile·for·ANSSI·DAT-NT28·High·(Enforced)·Level |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_high |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:debian:debian_linux:11 | 42 | ····*·cpe:/o:debian:debian_linux:11 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·GRUB2_bootloader_configuration | 50 | ·········3.·GRUB2_bootloader_configuration |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 171, 14 lines modified | Offset 171, 33 lines modified | ||
| 171 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 171 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 172 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 172 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 173 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 173 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 174 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 174 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 175 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 175 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 176 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 176 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 177 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 177 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 178 | Remediation_Shell_script_⇲ | ||
| 179 | Complexity:·low | ||
| 180 | Disruption:·low | ||
| 181 | Strategy:···restrict | ||
| 182 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 183 | ··if·[·!·-e·"$f"·]·;·then | ||
| 184 | ····continue | ||
| 185 | ··fi | ||
| 186 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 187 | ··if·!·test·-z·"$matching_list";·then | ||
| 188 | ····while·IFS=·read·-r·entry;·do | ||
| 189 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 190 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 191 | ····done·<<<·"$matching_list" | ||
| 192 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 193 | ··fi | ||
| 194 | done | ||
| 178 | Remediation_Ansible_snippet_⇲ | 195 | Remediation_Ansible_snippet_⇲ |
| 179 | Complexity:·low | 196 | Complexity:·low |
| 180 | Disruption:·low | 197 | Disruption:·low |
| 181 | Strategy:···restrict | 198 | Strategy:···restrict |
| 182 | -·name:·Find·/etc/sudoers.d/·files | 199 | -·name:·Find·/etc/sudoers.d/·files |
| 183 | ··find: | 200 | ··find: |
| 184 | ····paths: | 201 | ····paths: |
| Offset 208, 33 lines modified | Offset 227, 14 lines modified | ||
| 208 | ··-·NIST-800-53-IA-11 | 227 | ··-·NIST-800-53-IA-11 |
| 209 | ··-·low_complexity | 228 | ··-·low_complexity |
| 210 | ··-·low_disruption | 229 | ··-·low_disruption |
| 211 | ··-·medium_severity | 230 | ··-·medium_severity |
| 212 | ··-·no_reboot_needed | 231 | ··-·no_reboot_needed |
| 213 | ··-·restrict_strategy | 232 | ··-·restrict_strategy |
| 214 | ··-·sudo_remove_no_authenticate | 233 | ··-·sudo_remove_no_authenticate |
| 215 | Remediation_Shell_script_⇲ | ||
| 216 | Complexity:·low | ||
| 217 | Disruption:·low | ||
| 218 | Strategy:···restrict | ||
| 219 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 220 | ··if·[·!·-e·"$f"·]·;·then | ||
| 221 | ····continue | ||
| 222 | ··fi | ||
| 223 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 224 | ··if·!·test·-z·"$matching_list";·then | ||
| 225 | ····while·IFS=·read·-r·entry;·do | ||
| 226 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 227 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 228 | ····done·<<<·"$matching_list" | ||
| 229 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 230 | ··fi | ||
| 231 | done | ||
| 232 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 234 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 233 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 235 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 234 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 236 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 235 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 237 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 236 | sudoers.d/. | 238 | sudoers.d/. |
| 237 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 239 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 238 | ············they·do·not·have·authorization. | 240 | ············they·do·not·have·authorization. |
| Offset 246, 14 lines modified | Offset 246, 33 lines modified | ||
| 246 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 246 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 247 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 247 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 248 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 248 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 249 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 249 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 250 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 250 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 251 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 251 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 252 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 252 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 253 | Remediation_Shell_script_⇲ | ||
| 254 | Complexity:·low | ||
| 255 | Disruption:·low | ||
| 256 | Strategy:···restrict | ||
| 257 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 258 | ··if·[·!·-e·"$f"·]·;·then | ||
| 259 | ····continue | ||
| 260 | ··fi | ||
| 261 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 262 | ··if·!·test·-z·"$matching_list";·then | ||
| 263 | ····while·IFS=·read·-r·entry;·do | ||
| 264 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 265 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 266 | ····done·<<<·"$matching_list" | ||
| 267 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 268 | ··fi | ||
| 269 | done | ||
| 253 | Remediation_Ansible_snippet_⇲ | 270 | Remediation_Ansible_snippet_⇲ |
| 254 | Complexity:·low | 271 | Complexity:·low |
| 255 | Disruption:·low | 272 | Disruption:·low |
| 256 | Strategy:···restrict | 273 | Strategy:···restrict |
| 257 | -·name:·Find·/etc/sudoers.d/·files | 274 | -·name:·Find·/etc/sudoers.d/·files |
| 258 | ··find: | 275 | ··find: |
| 259 | ····paths: | 276 | ····paths: |
| Offset 283, 33 lines modified | Offset 302, 14 lines modified | ||
| 283 | ··-·NIST-800-53-IA-11 | 302 | ··-·NIST-800-53-IA-11 |
| 284 | ··-·low_complexity | 303 | ··-·low_complexity |
| 285 | ··-·low_disruption | 304 | ··-·low_disruption |
| 286 | ··-·medium_severity | 305 | ··-·medium_severity |
| 287 | ··-·no_reboot_needed | 306 | ··-·no_reboot_needed |
| 288 | ··-·restrict_strategy | 307 | ··-·restrict_strategy |
| 289 | ··-·sudo_remove_nopasswd | 308 | ··-·sudo_remove_nopasswd |
| 290 | Remediation_Shell_script_⇲ | ||
| 291 | Complexity:·low | ||
| Max diff block lines reached; 45674/51098 bytes (89.39%) of diff not shown. | |||
| Offset 14278, 15 lines modified | Offset 14278, 15 lines modified | ||
| 00037c50:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037c50:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037c60:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037c60:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037c70:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037c70:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037c80:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037c80:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037c90:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037c90:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037ca0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037ca0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037cb0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037cb0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037cc0:·6173·206f·6620·3230·323 | 00037cc0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037cd0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037cd0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037ce0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037ce0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037cf0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037cf0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037d00:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037d00:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037d10:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037d10:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037d20:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037d20:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037d30:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037d30:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 14945, 139 lines modified | Offset 14945, 139 lines modified | ||
| 0003a600:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | 0003a600:·612d·7461·7267·6574·3d22·2369·646d·3237··a-target="#idm27 | ||
| 0003a610:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | 0003a610:·3235·2220·7461·6269·6e64·6578·3d22·3022··25"·tabindex="0" | ||
| 0003a620:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003a620:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003a630:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003a630:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003a640:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003a640:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003a650:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003a650:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003a660:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003a660:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003a670:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | |||
| 0003a680:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003a690:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003a6a0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003a6b0:·6522·2069·643d·2269·646d·3237·3235·223e··e"·id="idm2725"> | |||
| 0003a6c0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003a6d0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003a670:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003a680:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003a690:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003a6a0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003a6b0:·6170·7365·2220·6964·3d22·6964·6d32·3732··apse"·id="idm272 | |||
| 0003a6c0:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 0003a6d0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003a6e0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003a6 | 0003a6e0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003a6f0:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003a700:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003a700:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003a710:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003a720:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003a730:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003a7 | 0003a710:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003a7 | 0003a720:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003a730:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003a740:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003a750:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003a760:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003a770:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003a780:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003a790:·6465·3e0a·666f·7220·6620·696e·202f·6574··de>.for·f·in·/et | |||
| 0003a7a0:·632f·7375·646f·6572·7320·2f65·7463·2f73··c/sudoers·/etc/s | |||
| 0003a7b0:·7564·6f65·7273·2e64·2f2a·203b·2064·6f0a··udoers.d/*·;·do. | |||
| 0003a7c0:·2020·6966·205b·2021·202d·6520·2224·6622····if·[·!·-e·"$f" | |||
| 0003a7d0:·205d·203b·2074·6865·6e0a·2020·2020·636f···]·;·then.····co | |||
| 0003a7e0:·6e74·696e·7565·0a20·2066·690a·2020·6d61··ntinue.··fi.··ma | |||
| 0003a7f0:·7463·6869·6e67·5f6c·6973·743d·2428·6772··tching_list=$(gr | |||
| 0003a800:·6570·202d·5020·275e·283f·2123·292e·2a5b··ep·-P·'^(?!#).*[ | |||
| 0003a760:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003a770:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003a780:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003a790:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4669··<code>-·name:·Fi | |||
| 0003a7a0:·6e64·202f·6574·632f·7375·646f·6572·732e··nd·/etc/sudoers. | |||
| 0003a7b0:·642f·2066·696c·6573·0a20·2066·696e·643a··d/·files.··find: | |||
| 0003a7c0:·0a20·2020·2070·6174·6873·3a0a·2020·2020··.····paths:.···· | |||
| 0003a7d0:·2d20·2f65·7463·2f73·7564·6f65·7273·2e64··-·/etc/sudoers.d | |||
| 0003a7e0:·2f0a·2020·7265·6769·7374·6572·3a20·7375··/.··register:·su | |||
| 0003a7f0:·646f·6572·730a·2020·7461·6773·3a0a·2020··doers.··tags:.·· | |||
| 0003a800:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003a810:·2d36·2861·290a·2020·2d20·4e49·5354·2d38··-6(a).··-·NIST-8 | |||
| 0003a820:·3030·2d35·332d·4941·2d31·310a·2020·2d20··00-53-IA-11.··-· | |||
| 0003a830:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 0003a840:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 0003a850:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | |||
| 0003a860:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 0003a870:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 0003a880:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 0003a890:·0a20·202d·2073·7564·6f5f·7265·6d6f·7665··.··-·sudo_remove | |||
| 0003a8a0:·5f6e·6f5f·6175·7468·656e·7469·6361·7465··_no_authenticate | |||
| 0003a8b0:·0a0a·2d20·6e61·6d65·3a20·5265·6d6f·7665··..-·name:·Remove | |||
| 0003a8c0:·206c·696e·6573·2063·6f6e·7461·696e·696e···lines·containin | |||
| 0003a8d0:·6720·2161·7574·6865·6e74·6963·6174·6520··g·!authenticate· | |||
| 0003a8e0:·6672·6f6d·2073·7564·6f65·7273·2066·696c··from·sudoers·fil | |||
| 0003a8f0:·6573·0a20·2072·6570·6c61·6365·3a0a·2020··es.··replace:.·· | |||
| 0003a900:·2020·7265·6765·7870·3a20·285e·283f·2123····regexp:·(^(?!# | |||
| 0003a | 0003a810:·5c73·5d2b·5c21·6175·7468·656e·7469·6361··\s]+\!authentica | ||
| 0003a820:·7465·2e2a·2427·2024·6620·7c20·756e·6971··te.*$'·$f·|·uniq | |||
| 0003a830:·2029·0a20·2069·6620·2120·7465·7374·202d···).··if·!·test·- | |||
| 0003a840:·7a20·2224·6d61·7463·6869·6e67·5f6c·6973··z·"$matching_lis | |||
| 0003a850:·7422·3b20·7468·656e·0a20·2020·2077·6869··t";·then.····whi | |||
| 0003a860:·6c65·2049·4653·3d20·7265·6164·202d·7220··le·IFS=·read·-r· | |||
| 0003a870:·656e·7472·793b·2064·6f0a·2020·2020·2020··entry;·do.······ | |||
| 0003a880:·2320·636f·6d6d·656e·7420·6f75·7420·2221··#·comment·out·"! | |||
| 0003a890:·6175·7468·656e·7469·6361·7465·2220·6d61··authenticate"·ma | |||
| 0003a8a0:·7463·6865·7320·746f·2070·7265·7365·7276··tches·to·preserv | |||
| 0003a8b0:·6520·7573·6572·2064·6174·610a·2020·2020··e·user·data.···· | |||
| 0003a8c0:·2020·7365·6420·2d69·2022·732f·5e24·7b65····sed·-i·"s/^${e | |||
| 0003a8d0:·6e74·7279·7d24·2f23·2026·616d·703b·2f67··ntry}$/#·&/g | |||
| 0003a8e0:·2220·2466·0a20·2020·2064·6f6e·6520·266c··"·$f.····done·&l | |||
| 0003a8f0:·743b·266c·743b·266c·743b·2022·246d·6174··t;<<·"$mat | |||
| 0003a900:·6368·696e·675f·6c69·7374·220a·0a20·2020··ching_list"..··· | |||
| 0003a910:·202f·7573·722f·7362·696e·2f76·6973·7564···/usr/sbin/visud | |||
| 0003a920:·6f20·2d63·6620·2466·2026·616d·703b·2667··o·-cf·$f·&&g | |||
| 0003a930:·743b·202f·6465·762f·6e75·6c6c·207c·7c20··t;·/dev/null·||· | |||
| 0003a940:·6563·686f·2022·4661·696c·2074·6f20·7661··echo·"Fail·to·va | |||
| 0003a950:·6c69·6461·7465·2024·6620·7769·7468·2076··lidate·$f·with·v | |||
| 0003a960:·6973·7564·6f22·0a20·2066·690a·646f·6e65··isudo".··fi.done | |||
| 0003a970:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003a980:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003a990:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003a9a0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003a9b0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003a9c0:·743d·2223·6964·6d32·3732·3622·2074·6162··t="#idm2726"·tab | |||
| 0003a9d0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003a9e0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003a9f0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003aa00:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003aa10:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003aa20:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003aa30:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003a920:·7469·6361·7465·2e2a·2429·0a20·2020·2072··ticate.*$).····r | |||
| 0003a930:·6570·6c61·6365·3a20·2723·205c·6726·6c74··eplace:·'#·\g< | |||
| 0003a940:·3b31·2667·743b·270a·2020·2020·7061·7468··;1>'.····path | |||
| 0003a950:·3a20·277b·7b20·6974·656d·2e70·6174·6820··:·'{{·item.path· | |||
| Max diff block lines reached; 235484/254444 bytes (92.55%) of diff not shown. | |||
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | *****·Profile·Information·***** | 36 | *****·Profile·Information·***** |
| 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level | 37 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Minimal·Level |
| 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal | 38 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_minimal |
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:debian:debian_linux:11 | 40 | ····*·cpe:/o:debian:debian_linux:11 |
| 41 | *****·Revision·History·***** | 41 | *****·Revision·History·***** |
| 42 | Current·version:·0.1.65 | 42 | Current·version:·0.1.65 |
| 43 | ····*·draft·(as·of·202 | 43 | ····*·draft·(as·of·2025-02-23) |
| 44 | *****·Table·of·Contents·***** | 44 | *****·Table·of·Contents·***** |
| 45 | ···1.·System_Settings | 45 | ···1.·System_Settings |
| 46 | ·········1.·Installing_and_Maintaining_Software | 46 | ·········1.·Installing_and_Maintaining_Software |
| 47 | ·········2.·Configure_Syslog | 47 | ·········2.·Configure_Syslog |
| 48 | ·········3.·File_Permissions_and_Masks | 48 | ·········3.·File_Permissions_and_Masks |
| 49 | ···2.·Services | 49 | ···2.·Services |
| 50 | ·········1.·APT_service_configuration | 50 | ·········1.·APT_service_configuration |
| Offset 81, 14 lines modified | Offset 81, 33 lines modified | ||
| 81 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 81 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 82 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 82 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 83 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 83 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 84 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 84 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 85 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 85 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 86 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 86 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 87 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 87 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 88 | Remediation_Shell_script_⇲ | ||
| 89 | Complexity:·low | ||
| 90 | Disruption:·low | ||
| 91 | Strategy:···restrict | ||
| 92 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 93 | ··if·[·!·-e·"$f"·]·;·then | ||
| 94 | ····continue | ||
| 95 | ··fi | ||
| 96 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 97 | ··if·!·test·-z·"$matching_list";·then | ||
| 98 | ····while·IFS=·read·-r·entry;·do | ||
| 99 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 100 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 101 | ····done·<<<·"$matching_list" | ||
| 102 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 103 | ··fi | ||
| 104 | done | ||
| 88 | Remediation_Ansible_snippet_⇲ | 105 | Remediation_Ansible_snippet_⇲ |
| 89 | Complexity:·low | 106 | Complexity:·low |
| 90 | Disruption:·low | 107 | Disruption:·low |
| 91 | Strategy:···restrict | 108 | Strategy:···restrict |
| 92 | -·name:·Find·/etc/sudoers.d/·files | 109 | -·name:·Find·/etc/sudoers.d/·files |
| 93 | ··find: | 110 | ··find: |
| 94 | ····paths: | 111 | ····paths: |
| Offset 118, 33 lines modified | Offset 137, 14 lines modified | ||
| 118 | ··-·NIST-800-53-IA-11 | 137 | ··-·NIST-800-53-IA-11 |
| 119 | ··-·low_complexity | 138 | ··-·low_complexity |
| 120 | ··-·low_disruption | 139 | ··-·low_disruption |
| 121 | ··-·medium_severity | 140 | ··-·medium_severity |
| 122 | ··-·no_reboot_needed | 141 | ··-·no_reboot_needed |
| 123 | ··-·restrict_strategy | 142 | ··-·restrict_strategy |
| 124 | ··-·sudo_remove_no_authenticate | 143 | ··-·sudo_remove_no_authenticate |
| 125 | Remediation_Shell_script_⇲ | ||
| 126 | Complexity:·low | ||
| 127 | Disruption:·low | ||
| 128 | Strategy:···restrict | ||
| 129 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 130 | ··if·[·!·-e·"$f"·]·;·then | ||
| 131 | ····continue | ||
| 132 | ··fi | ||
| 133 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 134 | ··if·!·test·-z·"$matching_list";·then | ||
| 135 | ····while·IFS=·read·-r·entry;·do | ||
| 136 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 137 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 138 | ····done·<<<·"$matching_list" | ||
| 139 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 140 | ··fi | ||
| 141 | done | ||
| 142 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 144 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 143 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 145 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 144 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 146 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 145 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 147 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 146 | sudoers.d/. | 148 | sudoers.d/. |
| 147 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 149 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 148 | ············they·do·not·have·authorization. | 150 | ············they·do·not·have·authorization. |
| Offset 156, 14 lines modified | Offset 156, 33 lines modified | ||
| 156 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 156 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 157 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 157 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 158 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 158 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 159 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 159 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 160 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 160 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 161 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 161 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 162 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 162 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 163 | Remediation_Shell_script_⇲ | ||
| 164 | Complexity:·low | ||
| 165 | Disruption:·low | ||
| 166 | Strategy:···restrict | ||
| 167 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 168 | ··if·[·!·-e·"$f"·]·;·then | ||
| 169 | ····continue | ||
| 170 | ··fi | ||
| 171 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 172 | ··if·!·test·-z·"$matching_list";·then | ||
| 173 | ····while·IFS=·read·-r·entry;·do | ||
| 174 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 175 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 176 | ····done·<<<·"$matching_list" | ||
| 177 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 178 | ··fi | ||
| 179 | done | ||
| 163 | Remediation_Ansible_snippet_⇲ | 180 | Remediation_Ansible_snippet_⇲ |
| 164 | Complexity:·low | 181 | Complexity:·low |
| 165 | Disruption:·low | 182 | Disruption:·low |
| 166 | Strategy:···restrict | 183 | Strategy:···restrict |
| 167 | -·name:·Find·/etc/sudoers.d/·files | 184 | -·name:·Find·/etc/sudoers.d/·files |
| 168 | ··find: | 185 | ··find: |
| 169 | ····paths: | 186 | ····paths: |
| Offset 193, 33 lines modified | Offset 212, 14 lines modified | ||
| 193 | ··-·NIST-800-53-IA-11 | 212 | ··-·NIST-800-53-IA-11 |
| 194 | ··-·low_complexity | 213 | ··-·low_complexity |
| 195 | ··-·low_disruption | 214 | ··-·low_disruption |
| 196 | ··-·medium_severity | 215 | ··-·medium_severity |
| 197 | ··-·no_reboot_needed | 216 | ··-·no_reboot_needed |
| 198 | ··-·restrict_strategy | 217 | ··-·restrict_strategy |
| 199 | ··-·sudo_remove_nopasswd | 218 | ··-·sudo_remove_nopasswd |
| 200 | Remediation_Shell_script_⇲ | ||
| 201 | Complexity:·low | ||
| Max diff block lines reached; 26541/31925 bytes (83.14%) of diff not shown. | |||
| Offset 14282, 15 lines modified | Offset 14282, 15 lines modified | ||
| 00037c90:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037c90:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037ca0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037ca0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037cb0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037cb0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037cc0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037cc0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037cd0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037cd0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037ce0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037ce0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037cf0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037cf0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037d00:·6173·206f·6620·3230·323 | 00037d00:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037d10:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037d10:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037d20:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037d20:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037d30:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037d30:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037d40:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037d40:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037d50:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037d50:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037d60:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037d60:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037d70:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037d70:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 16734, 139 lines modified | Offset 16734, 139 lines modified | ||
| 000415d0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 000415d0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 000415e0:·6d32·3732·3522·2074·6162·696e·6465·783d··m2725"·tabindex= | 000415e0:·6d32·3732·3522·2074·6162·696e·6465·783d··m2725"·tabindex= | ||
| 000415f0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 000415f0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 00041600:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 00041600:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 00041610:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 00041610:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 00041620:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 00041620:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 00041630:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 00041630:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 00041640:·6564·6961·7469·6f6e·20 | 00041640:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 00041650:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | |||
| 00041660:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 00041670:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 00041680:·6170·7365·2220·6964·3d22·6964·6d32·3732··apse"·id="idm272 | |||
| 00041690:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 000416a0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 000416b0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 000416c0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 000416d0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 000416e0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 00041650:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 00041660:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 00041670:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 00041680:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 00041690:·3237·3235·223e·3c74·6162·6c65·2063·6c61··2725"><table·cla | |||
| 000416a0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 000416b0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 000416c0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 000416d0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 000416e0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 000416f0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 00041700:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 00041710:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 00041 | 000416f0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 00041700:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 00041710:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 00041720:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 00041730:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 00041740:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 00041750:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 00041760:·3c63·6f64·653e·0a66·6f72·2066·2069·6e20··<code>.for·f·in· | |||
| 00041770:·2f65·7463·2f73·7564·6f65·7273·202f·6574··/etc/sudoers·/et | |||
| 00041780:·632f·7375·646f·6572·732e·642f·2a20·3b20··c/sudoers.d/*·;· | |||
| 00041790:·646f·0a20·2069·6620·5b20·2120·2d65·2022··do.··if·[·!·-e·" | |||
| 000417a0:·2466·2220·5d20·3b20·7468·656e·0a20·2020··$f"·]·;·then.··· | |||
| 000417b0:·2063·6f6e·7469·6e75·650a·2020·6669·0a20···continue.··fi.· | |||
| 000417c0:·206d·6174·6368·696e·675f·6c69·7374·3d24···matching_list=$ | |||
| 000417d0:·2867·7265·7020·2d50·2027·5e28·3f21·2329··(grep·-P·'^(?!#) | |||
| 00041730:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 00041740:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 00041750:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 00041760:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 00041770:·2046·696e·6420·2f65·7463·2f73·7564·6f65···Find·/etc/sudoe | |||
| 00041780:·7273·2e64·2f20·6669·6c65·730a·2020·6669··rs.d/·files.··fi | |||
| 00041790:·6e64·3a0a·2020·2020·7061·7468·733a·0a20··nd:.····paths:.· | |||
| 000417a0:·2020·202d·202f·6574·632f·7375·646f·6572·····-·/etc/sudoer | |||
| 000417b0:·732e·642f·0a20·2072·6567·6973·7465·723a··s.d/.··register: | |||
| 000417c0:·2073·7564·6f65·7273·0a20·2074·6167·733a···sudoers.··tags: | |||
| 000417d0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 000417e0:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 000417f0:·542d·3830·302d·3533·2d49·412d·3131·0a20··T-800-53-IA-11.· | |||
| 00041800:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 00041810:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 00041820:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 00041830:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 00041840:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 00041850:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 00041860:·6567·790a·2020·2d20·7375·646f·5f72·656d··egy.··-·sudo_rem | |||
| 00041870:·6f76·655f·6e6f·5f61·7574·6865·6e74·6963··ove_no_authentic | |||
| 00041880:·6174·650a·0a2d·206e·616d·653a·2052·656d··ate..-·name:·Rem | |||
| 00041890:·6f76·6520·6c69·6e65·7320·636f·6e74·6169··ove·lines·contai | |||
| 000418a0:·6e69·6e67·2021·6175·7468·656e·7469·6361··ning·!authentica | |||
| 000418b0:·7465·2066·726f·6d20·7375·646f·6572·7320··te·from·sudoers· | |||
| 000418c0:·6669·6c65·730a·2020·7265·706c·6163·653a··files.··replace: | |||
| 000418d0:·0a20·2020·2072·6567·6578·703a·2028·5e28··.····regexp:·(^( | |||
| 00041 | 000417e0:·2e2a·5b5c·735d·2b5c·2161·7574·6865·6e74··.*[\s]+\!authent | ||
| 000417f0:·6963·6174·652e·2a24·2720·2466·207c·2075··icate.*$'·$f·|·u | |||
| 00041800:·6e69·7120·290a·2020·6966·2021·2074·6573··niq·).··if·!·tes | |||
| 00041810:·7420·2d7a·2022·246d·6174·6368·696e·675f··t·-z·"$matching_ | |||
| 00041820:·6c69·7374·223b·2074·6865·6e0a·2020·2020··list";·then.···· | |||
| 00041830:·7768·696c·6520·4946·533d·2072·6561·6420··while·IFS=·read· | |||
| 00041840:·2d72·2065·6e74·7279·3b20·646f·0a20·2020··-r·entry;·do.··· | |||
| 00041850:·2020·2023·2063·6f6d·6d65·6e74·206f·7574·····#·comment·out | |||
| 00041860:·2022·2161·7574·6865·6e74·6963·6174·6522···"!authenticate" | |||
| 00041870:·206d·6174·6368·6573·2074·6f20·7072·6573···matches·to·pres | |||
| 00041880:·6572·7665·2075·7365·7220·6461·7461·0a20··erve·user·data.· | |||
| 00041890:·2020·2020·2073·6564·202d·6920·2273·2f5e·······sed·-i·"s/^ | |||
| 000418a0:·247b·656e·7472·797d·242f·2320·2661·6d70··${entry}$/#·& | |||
| 000418b0:·3b2f·6722·2024·660a·2020·2020·646f·6e65··;/g"·$f.····done | |||
| 000418c0:·2026·6c74·3b26·6c74·3b26·6c74·3b20·2224···<<<·"$ | |||
| 000418d0:·6d61·7463·6869·6e67·5f6c·6973·7422·0a0a··matching_list".. | |||
| 000418e0:·2020·2020·2f75·7372·2f73·6269·6e2f·7669······/usr/sbin/vi | |||
| 000418f0:·7375·646f·202d·6366·2024·6620·2661·6d70··sudo·-cf·$f·& | |||
| 00041900:·3b26·6774·3b20·2f64·6576·2f6e·756c·6c20··;>·/dev/null· | |||
| 00041910:·7c7c·2065·6368·6f20·2246·6169·6c20·746f··||·echo·"Fail·to | |||
| 00041920:·2076·616c·6964·6174·6520·2466·2077·6974···validate·$f·wit | |||
| 00041930:·6820·7669·7375·646f·220a·2020·6669·0a64··h·visudo".··fi.d | |||
| 00041940:·6f6e·650a·3c2f·636f·6465·3e3c·2f70·7265··one.</code></pre | |||
| 00041950:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 00041960:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 00041970:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 00041980:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 00041990:·7267·6574·3d22·2369·646d·3237·3236·2220··rget="#idm2726"· | |||
| 000419a0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 000419b0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 000419c0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 000419d0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 000419e0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 000419f0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 00041a00:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 000418f0:·6865·6e74·6963·6174·652e·2a24·290a·2020··henticate.*$).·· | |||
| 00041900:·2020·7265·706c·6163·653a·2027·2320·5c67····replace:·'#·\g | |||
| 00041910:·266c·743b·3126·6774·3b27·0a20·2020·2070··<1>'.····p | |||
| Max diff block lines reached; 360374/379334 bytes (95.00%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level | 38 | Profile·Title·Profile·for·ANSSI·DAT-NT28·Restrictive·Level |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_np_nt28_restrictive |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:debian:debian_linux:11 | 41 | ····*·cpe:/o:debian:debian_linux:11 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·System_Accounting_with_auditd | 48 | ·········2.·System_Accounting_with_auditd |
| 49 | ·········3.·Configure_Syslog | 49 | ·········3.·Configure_Syslog |
| 50 | ·········4.·File_Permissions_and_Masks | 50 | ·········4.·File_Permissions_and_Masks |
| 51 | ···2.·Services | 51 | ···2.·Services |
| Offset 169, 14 lines modified | Offset 169, 33 lines modified | ||
| 169 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 169 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 170 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 170 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 171 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 171 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 172 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 172 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 173 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 173 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 174 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 174 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 175 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 175 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 176 | Remediation_Shell_script_⇲ | ||
| 177 | Complexity:·low | ||
| 178 | Disruption:·low | ||
| 179 | Strategy:···restrict | ||
| 180 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 181 | ··if·[·!·-e·"$f"·]·;·then | ||
| 182 | ····continue | ||
| 183 | ··fi | ||
| 184 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 185 | ··if·!·test·-z·"$matching_list";·then | ||
| 186 | ····while·IFS=·read·-r·entry;·do | ||
| 187 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 188 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 189 | ····done·<<<·"$matching_list" | ||
| 190 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 191 | ··fi | ||
| 192 | done | ||
| 176 | Remediation_Ansible_snippet_⇲ | 193 | Remediation_Ansible_snippet_⇲ |
| 177 | Complexity:·low | 194 | Complexity:·low |
| 178 | Disruption:·low | 195 | Disruption:·low |
| 179 | Strategy:···restrict | 196 | Strategy:···restrict |
| 180 | -·name:·Find·/etc/sudoers.d/·files | 197 | -·name:·Find·/etc/sudoers.d/·files |
| 181 | ··find: | 198 | ··find: |
| 182 | ····paths: | 199 | ····paths: |
| Offset 206, 33 lines modified | Offset 225, 14 lines modified | ||
| 206 | ··-·NIST-800-53-IA-11 | 225 | ··-·NIST-800-53-IA-11 |
| 207 | ··-·low_complexity | 226 | ··-·low_complexity |
| 208 | ··-·low_disruption | 227 | ··-·low_disruption |
| 209 | ··-·medium_severity | 228 | ··-·medium_severity |
| 210 | ··-·no_reboot_needed | 229 | ··-·no_reboot_needed |
| 211 | ··-·restrict_strategy | 230 | ··-·restrict_strategy |
| 212 | ··-·sudo_remove_no_authenticate | 231 | ··-·sudo_remove_no_authenticate |
| 213 | Remediation_Shell_script_⇲ | ||
| 214 | Complexity:·low | ||
| 215 | Disruption:·low | ||
| 216 | Strategy:···restrict | ||
| 217 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 218 | ··if·[·!·-e·"$f"·]·;·then | ||
| 219 | ····continue | ||
| 220 | ··fi | ||
| 221 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 222 | ··if·!·test·-z·"$matching_list";·then | ||
| 223 | ····while·IFS=·read·-r·entry;·do | ||
| 224 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 225 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 226 | ····done·<<<·"$matching_list" | ||
| 227 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 228 | ··fi | ||
| 229 | done | ||
| 230 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 232 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 231 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without | 233 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without |
| 232 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not | 234 | having·to·authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not |
| 233 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ | 235 | exist·in·/etc/sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/ |
| 234 | sudoers.d/. | 236 | sudoers.d/. |
| 235 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which | 237 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which |
| 236 | ············they·do·not·have·authorization. | 238 | ············they·do·not·have·authorization. |
| Offset 244, 14 lines modified | Offset 244, 33 lines modified | ||
| 244 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, | 244 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03, |
| 245 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, | 245 | ············DSS06.10,·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4, |
| 246 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR | 246 | Identifiers·4.3.3.6.5,·4.3.3.6.6,·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR |
| 247 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, | 247 | and·········1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3, |
| 248 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, | 248 | References··A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2,·A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7, |
| 249 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- | 249 | ············SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS-00157,·SRG-OS-000373-GPOS-00158,·SRG- |
| 250 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 | 250 | ············OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS-000373-VMM-001490 |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | Complexity:·low | ||
| 253 | Disruption:·low | ||
| 254 | Strategy:···restrict | ||
| 255 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 256 | ··if·[·!·-e·"$f"·]·;·then | ||
| 257 | ····continue | ||
| 258 | ··fi | ||
| 259 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 260 | ··if·!·test·-z·"$matching_list";·then | ||
| 261 | ····while·IFS=·read·-r·entry;·do | ||
| 262 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 263 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 264 | ····done·<<<·"$matching_list" | ||
| 265 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 266 | ··fi | ||
| 267 | done | ||
| 251 | Remediation_Ansible_snippet_⇲ | 268 | Remediation_Ansible_snippet_⇲ |
| 252 | Complexity:·low | 269 | Complexity:·low |
| 253 | Disruption:·low | 270 | Disruption:·low |
| 254 | Strategy:···restrict | 271 | Strategy:···restrict |
| 255 | -·name:·Find·/etc/sudoers.d/·files | 272 | -·name:·Find·/etc/sudoers.d/·files |
| 256 | ··find: | 273 | ··find: |
| 257 | ····paths: | 274 | ····paths: |
| Offset 281, 33 lines modified | Offset 300, 14 lines modified | ||
| 281 | ··-·NIST-800-53-IA-11 | 300 | ··-·NIST-800-53-IA-11 |
| 282 | ··-·low_complexity | 301 | ··-·low_complexity |
| 283 | ··-·low_disruption | 302 | ··-·low_disruption |
| 284 | ··-·medium_severity | 303 | ··-·medium_severity |
| 285 | ··-·no_reboot_needed | 304 | ··-·no_reboot_needed |
| 286 | ··-·restrict_strategy | 305 | ··-·restrict_strategy |
| 287 | ··-·sudo_remove_nopasswd | 306 | ··-·sudo_remove_nopasswd |
| 288 | Remediation_Shell_script_⇲ | ||
| 289 | Complexity:·low | ||
| Max diff block lines reached; 45674/51073 bytes (89.43%) of diff not shown. | |||
| Offset 14284, 16 lines modified | Offset 14284, 16 lines modified | ||
| 00037cb0:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037cb0:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037cc0:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037cc0:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037cd0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037cd0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037ce0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037ce0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037cf0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037cf0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037d00:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037d00:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d20:·2020·2861·7320·6f66·2032·3032·3 | 00037d20:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037d30:·2d32·3 | 00037d30:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037d40:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037d40:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037d50:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037d50:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037d60:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037d60:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037d70:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037d70:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037d80:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037d80:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037d90:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037d90:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037da0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037da0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 20339, 204 lines modified | Offset 20339, 204 lines modified | ||
| 0004f720:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0004f720:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0004f730:·3135·3736·3022·2074·6162·696e·6465·783d··15760"·tabindex= | 0004f730:·3135·3736·3022·2074·6162·696e·6465·783d··15760"·tabindex= | ||
| 0004f740:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0004f740:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0004f750:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0004f750:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0004f760:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0004f760:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0004f770:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0004f770:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0004f780:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0004f780:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0004f790:·6564·6961·7469·6f6e·20 | 0004f790:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0004f7a0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | |||
| 0004f7b0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0004f7c0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0004f7d0:·6170·7365·2220·6964·3d22·6964·6d31·3537··apse"·id="idm157 | |||
| 0004f7e0:·3630·223e·3c70·7265·3e3c·636f·6465·3e23··60"><pre><code># | |||
| 0004f7f0:·2052·656d·6564·6961·7469·6f6e·2069·7320···Remediation·is· | |||
| 0004f800:·6170·706c·6963·6162·6c65·206f·6e6c·7920··applicable·only· | |||
| 0004f810:·696e·2063·6572·7461·696e·2070·6c61·7466··in·certain·platf | |||
| 0004f820:·6f72·6d73·0a69·6620·5b20·2120·2d66·202f··orms.if·[·!·-f·/ | |||
| 0004f830:·2e64·6f63·6b65·7265·6e76·205d·2026·616d··.dockerenv·]·&am | |||
| 0004f840:·703b·2661·6d70·3b20·5b20·2120·2d66·202f··p;&·[·!·-f·/ | |||
| 0004f850:·7275·6e2f·2e63·6f6e·7461·696e·6572·656e··run/.containeren | |||
| 0004f860:·7620·5d3b·2074·6865·6e0a·0a4c·4f47·524f··v·];·then..LOGRO | |||
| 0004f870:·5441·5445·5f43·4f4e·465f·4649·4c45·3d22··TATE_CONF_FILE=" | |||
| 0004f7a0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0004f7b0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0004f7c0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0004f7d0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0004f7e0:·3135·3736·3022·3e3c·7461·626c·6520·636c··15760"><table·cl | |||
| 0004f7f0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0004f800:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0004f810:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0004f820:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0004f830:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0004f840:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0004f850:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0004f860:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0004f870:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0004f880:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0004f890:·3e3c·7464·3e63·6f6e·6669·6775·7265·3c2f··><td>configure</ | |||
| 0004f8a0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0004f8b0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0004f8c0:·653a·2043·6f6e·6669·6775·7265·2064·6169··e:·Configure·dai | |||
| 0004f8d0:·6c79·206c·6f67·2072·6f74·6174·696f·6e20··ly·log·rotation· | |||
| 0004f8e0:·696e·202f·6574·632f·6c6f·6772·6f74·6174··in·/etc/logrotat | |||
| 0004f8f0:·652e·636f·6e66·0a20·206c·696e·6569·6e66··e.conf.··lineinf | |||
| 0004f900:·696c·653a·0a20·2020·2063·7265·6174·653a··ile:.····create: | |||
| 0004f910:·2074·7275·650a·2020·2020·6465·7374·3a20···true.····dest:· | |||
| 0004f | 0004f880:·2f65·7463·2f6c·6f67·726f·7461·7465·2e63··/etc/logrotate.c | ||
| 0004f930:·6f6e·660a·2020·2020·7265·6765·7870·3a20··onf.····regexp:· | |||
| 0004f940:·5e64·6169·6c79·240a·2020·2020·6c69·6e65··^daily$.····line | |||
| 0004f950:·3a20·6461·696c·790a·2020·7768·656e·3a20··:·daily.··when:· | |||
| 0004f960:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0004f970:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0004f980:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0004f990:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0004f9a0:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0004f9b0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0004f9c0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0004f9d0:·2d36·2861·290a·2020·2d20·5043·492d·4453··-6(a).··-·PCI-DS | |||
| 0004f9e0:·532d·5265·712d·3130·2e37·0a20·202d·2063··S-Req-10.7.··-·c | |||
| 0004f9f0:·6f6e·6669·6775·7265·5f73·7472·6174·6567··onfigure_strateg | |||
| 0004fa00:·790a·2020·2d20·656e·7375·7265·5f6c·6f67··y.··-·ensure_log | |||
| 0004fa10:·726f·7461·7465·5f61·6374·6976·6174·6564··rotate_activated | |||
| 0004fa20:·0a20·202d·206c·6f77·5f63·6f6d·706c·6578··.··-·low_complex | |||
| 0004fa30:·6974·790a·2020·2d20·6c6f·775f·6469·7372··ity.··-·low_disr | |||
| 0004fa40:·7570·7469·6f6e·0a20·202d·206d·6564·6975··uption.··-·mediu | |||
| 0004fa50:·6d5f·7365·7665·7269·7479·0a20·202d·206e··m_severity.··-·n | |||
| 0004fa60:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 0004fa70:·0a2d·206e·616d·653a·204d·616b·6520·7375··.-·name:·Make·su | |||
| 0004fa80:·7265·2064·6169·6c79·206c·6f67·2072·6f74··re·daily·log·rot | |||
| 0004fa90:·6174·696f·6e20·7365·7474·696e·6720·6973··ation·setting·is | |||
| 0004f | 0004f890:·6f6e·6622·0a43·524f·4e5f·4441·494c·595f··onf".CRON_DAILY_ | ||
| 0004f8a0:·4c4f·4752·4f54·4154·455f·4649·4c45·3d22··LOGROTATE_FILE=" | |||
| 0004f8b0:·2f65·7463·2f63·726f·6e2e·6461·696c·792f··/etc/cron.daily/ | |||
| 0004f8c0:·6c6f·6772·6f74·6174·6522·0a0a·2320·6461··logrotate"..#·da | |||
| 0004f8d0:·696c·7920·726f·7461·7469·6f6e·2069·7320··ily·rotation·is· | |||
| 0004f8e0:·636f·6e66·6967·7572·6564·0a67·7265·7020··configured.grep· | |||
| 0004f8f0:·2d71·2022·5e64·6169·6c79·2422·2024·4c4f··-q·"^daily$"·$LO | |||
| 0004f900:·4752·4f54·4154·455f·434f·4e46·5f46·494c··GROTATE_CONF_FIL | |||
| 0004f910:·457c·7c20·6563·686f·2022·6461·696c·7922··E||·echo·"daily" | |||
| 0004f920:·2026·6774·3b26·6774·3b20·244c·4f47·524f···>>·$LOGRO | |||
| 0004f930:·5441·5445·5f43·4f4e·465f·4649·4c45·0a0a··TATE_CONF_FILE.. | |||
| 0004f940:·2320·7265·6d6f·7665·2061·6e79·206c·696e··#·remove·any·lin | |||
| 0004f950:·6520·636f·6e66·6967·7572·696e·6720·7765··e·configuring·we | |||
| 0004f960:·656b·6c79·2c20·6d6f·6e74·686c·7920·6f72··ekly,·monthly·or | |||
| 0004f970:·2079·6561·726c·7920·726f·7461·7469·6f6e···yearly·rotation | |||
| 0004f980:·0a73·6564·202d·6920·272f·5e5c·732a·5c28··.sed·-i·'/^\s*\( | |||
| 0004f990:·7765·656b·6c79·5c7c·6d6f·6e74·686c·795c··weekly\|monthly\ | |||
| 0004f9a0:·7c79·6561·726c·795c·292e·2a24·2f64·2720··|yearly\).*$/d'· | |||
| 0004f9b0:·244c·4f47·524f·5441·5445·5f43·4f4e·465f··$LOGROTATE_CONF_ | |||
| 0004f9c0:·4649·4c45·0a0a·2320·636f·6e66·6967·7572··FILE..#·configur | |||
| 0004f9d0:·6520·6372·6f6e·2e64·6169·6c79·2069·6620··e·cron.daily·if· | |||
| 0004f9e0:·6e6f·7420·616c·7265·6164·790a·6966·2021··not·already.if·! | |||
| 0004f9f0:·2067·7265·7020·2d71·2022·5e5b·5b3a·7370···grep·-q·"^[[:sp | |||
| 0004fa00:·6163·653a·5d5d·2a2f·7573·722f·7362·696e··ace:]]*/usr/sbin | |||
| 0004fa10:·2f6c·6f67·726f·7461·7465·5b5b·3a61·6c6e··/logrotate[[:aln | |||
| 0004fa20:·756d·3a5d·5b3a·626c·616e·6b3a·5d5b·3a70··um:][:blank:][:p | |||
| 0004fa30:·756e·6374·3a5d·5d2a·244c·4f47·524f·5441··unct:]]*$LOGROTA | |||
| 0004fa40:·5445·5f43·4f4e·465f·4649·4c45·2422·2024··TE_CONF_FILE$"·$ | |||
| 0004fa50:·4352·4f4e·5f44·4149·4c59·5f4c·4f47·524f··CRON_DAILY_LOGRO | |||
| 0004fa60:·5441·5445·5f46·494c·453b·2074·6865·6e0a··TATE_FILE;·then. | |||
| 0004fa70:·0965·6368·6f20·2223·212f·6269·6e2f·7368··.echo·"#!/bin/sh | |||
| 0004fa80:·2220·2667·743b·2024·4352·4f4e·5f44·4149··"·>·$CRON_DAI | |||
| 0004fa90:·4c59·5f4c·4f47·524f·5441·5445·5f46·494c··LY_LOGROTATE_FIL | |||
| 0004faa0:·450a·0965·6368·6f20·222f·7573·722f·7362··E..echo·"/usr/sb | |||
| 0004fab0:·696e·2f6c·6f67·726f·7461·7465·2024·4c4f··in/logrotate·$LO | |||
| 0004fac0:·4752·4f54·4154·455f·434f·4e46·5f46·494c··GROTATE_CONF_FIL | |||
| 0004fad0:·4522·2026·6774·3b26·6774·3b20·2443·524f··E"·>>·$CRO | |||
| 0004fae0:·4e5f·4441·494c·595f·4c4f·4752·4f54·4154··N_DAILY_LOGROTAT | |||
| 0004faf0:·455f·4649·4c45·0a66·690a·0a65·6c73·650a··E_FILE.fi..else. | |||
| 0004fb00:·2020·2020·2667·743b·2661·6d70·3b32·2065······>&2·e | |||
| Max diff block lines reached; 314916/342984 bytes (91.82%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Debian·11 | 39 | Profile·Title·Standard·System·Security·Profile·for·Debian·11 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:debian:debian_linux:11 | 42 | ····*·cpe:/o:debian:debian_linux:11 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·System_Accounting_with_auditd | 49 | ·········2.·System_Accounting_with_auditd |
| 50 | ·········3.·Configure_Syslog | 50 | ·········3.·Configure_Syslog |
| 51 | ·········4.·File_Permissions_and_Masks | 51 | ·········4.·File_Permissions_and_Masks |
| 52 | ···2.·Services | 52 | ···2.·Services |
| Offset 521, 14 lines modified | Offset 521, 37 lines modified | ||
| 521 | ············partition·becomes·full. | 521 | ············partition·becomes·full. |
| 522 | Severity: ·medium | 522 | Severity: ·medium |
| 523 | Rule·ID:····xccdf_org.ssgproject.content_rule_ensure_logrotate_activated | 523 | Rule·ID:····xccdf_org.ssgproject.content_rule_ensure_logrotate_activated |
| 524 | Identifiers·References: ·BP28(R43),·NT12(R18),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, | 524 | Identifiers·References: ·BP28(R43),·NT12(R18),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, |
| 525 | and·········DSS05.07,·MEA02.01,·CCI-000366,·4.3.3.3.9,·4.3.3.5.8,·4.3.4.4.7,·4.4.2.1,·4.4.2.2, | 525 | and·········DSS05.07,·MEA02.01,·CCI-000366,·4.3.3.3.9,·4.3.3.5.8,·4.3.4.4.7,·4.4.2.1,·4.4.2.2, |
| 526 | References··4.4.2.4,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·A.12.4.1,·A.12.4.2,·A.12.4.3, | 526 | References··4.4.2.4,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·A.12.4.1,·A.12.4.2,·A.12.4.3, |
| 527 | ············A.12.4.4,·A.12.7.1,·CM-6(a),·PR.PT-1,·Req-10.7 | 527 | ············A.12.4.4,·A.12.7.1,·CM-6(a),·PR.PT-1,·Req-10.7 |
| 528 | Remediation_Shell_script_⇲ | ||
| 529 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 530 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 531 | LOGROTATE_CONF_FILE="/etc/logrotate.conf" | ||
| 532 | CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate" | ||
| 533 | #·daily·rotation·is·configured | ||
| 534 | grep·-q·"^daily$"·$LOGROTATE_CONF_FILE||·echo·"daily"·>>·$LOGROTATE_CONF_FILE | ||
| 535 | #·remove·any·line·configuring·weekly,·monthly·or·yearly·rotation | ||
| 536 | sed·-i·'/^\s*\(weekly\|monthly\|yearly\).*$/d'·$LOGROTATE_CONF_FILE | ||
| 537 | #·configure·cron.daily·if·not·already | ||
| 538 | if·!·grep·-q·"^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" | ||
| 539 | $CRON_DAILY_LOGROTATE_FILE;·then | ||
| 540 | » echo·"#!/bin/sh"·>·$CRON_DAILY_LOGROTATE_FILE | ||
| 541 | » echo·"/usr/sbin/logrotate·$LOGROTATE_CONF_FILE"·>>·$CRON_DAILY_LOGROTATE_FILE | ||
| 542 | fi | ||
| 543 | else | ||
| 544 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 545 | fi | ||
| 528 | Remediation_Ansible_snippet_⇲ | 546 | Remediation_Ansible_snippet_⇲ |
| 529 | Complexity:·low | 547 | Complexity:·low |
| 530 | Disruption:·low | 548 | Disruption:·low |
| 531 | Strategy:···configure | 549 | Strategy:···configure |
| 532 | -·name:·Configure·daily·log·rotation·in·/etc/logrotate.conf | 550 | -·name:·Configure·daily·log·rotation·in·/etc/logrotate.conf |
| 533 | ··lineinfile: | 551 | ··lineinfile: |
| 534 | ····create:·true | 552 | ····create:·true |
| Offset 584, 37 lines modified | Offset 607, 14 lines modified | ||
| 584 | ··-·PCI-DSS-Req-10.7 | 607 | ··-·PCI-DSS-Req-10.7 |
| 585 | ··-·configure_strategy | 608 | ··-·configure_strategy |
| 586 | ··-·ensure_logrotate_activated | 609 | ··-·ensure_logrotate_activated |
| 587 | ··-·low_complexity | 610 | ··-·low_complexity |
| 588 | ··-·low_disruption | 611 | ··-·low_disruption |
| 589 | ··-·medium_severity | 612 | ··-·medium_severity |
| 590 | ··-·no_reboot_needed | 613 | ··-·no_reboot_needed |
| 591 | Remediation_Shell_script_⇲ | ||
| 592 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 593 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 594 | LOGROTATE_CONF_FILE="/etc/logrotate.conf" | ||
| 595 | CRON_DAILY_LOGROTATE_FILE="/etc/cron.daily/logrotate" | ||
| 596 | #·daily·rotation·is·configured | ||
| 597 | grep·-q·"^daily$"·$LOGROTATE_CONF_FILE||·echo·"daily"·>>·$LOGROTATE_CONF_FILE | ||
| 598 | #·remove·any·line·configuring·weekly,·monthly·or·yearly·rotation | ||
| 599 | sed·-i·'/^\s*\(weekly\|monthly\|yearly\).*$/d'·$LOGROTATE_CONF_FILE | ||
| 600 | #·configure·cron.daily·if·not·already | ||
| 601 | if·!·grep·-q·"^[[:space:]]*/usr/sbin/logrotate[[:alnum:][:blank:][:punct:]]*$LOGROTATE_CONF_FILE$" | ||
| 602 | $CRON_DAILY_LOGROTATE_FILE;·then | ||
| 603 | » echo·"#!/bin/sh"·>·$CRON_DAILY_LOGROTATE_FILE | ||
| 604 | » echo·"/usr/sbin/logrotate·$LOGROTATE_CONF_FILE"·>>·$CRON_DAILY_LOGROTATE_FILE | ||
| 605 | fi | ||
| 606 | else | ||
| 607 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 608 | fi | ||
| 609 | ***·Rule ·Ensure·rsyslog·is·Installed· [ref]·*** | 614 | ***·Rule ·Ensure·rsyslog·is·Installed· [ref]·*** |
| 610 | Rsyslog·is·installed·by·default.·The·rsyslog·package·can·be·installed·with·the·following·command: | 615 | Rsyslog·is·installed·by·default.·The·rsyslog·package·can·be·installed·with·the·following·command: |
| 611 | ·$·apt-get·install·rsyslog | 616 | ·$·apt-get·install·rsyslog |
| 612 | Rationale:··The·rsyslog·package·provides·the·rsyslog·daemon,·which·provides·system·logging·services. | 617 | Rationale:··The·rsyslog·package·provides·the·rsyslog·daemon,·which·provides·system·logging·services. |
| 613 | Severity: ·medium | 618 | Severity: ·medium |
| 614 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_rsyslog_installed | 619 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_rsyslog_installed |
| 615 | ············References: ·BP28(R5),·NT28(R46),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, | 620 | ············References: ·BP28(R5),·NT28(R46),·1,·14,·15,·16,·3,·5,·6,·APO11.04,·BAI03.05,·DSS05.04, |
| Offset 756, 14 lines modified | Offset 756, 22 lines modified | ||
| 756 | ············References: ·12,·13,·14,·15,·16,·18,·3,·5,·5.5.2.2,·APO01.06,·DSS05.04,·DSS05.07, | 756 | ············References: ·12,·13,·14,·15,·16,·18,·3,·5,·5.5.2.2,·APO01.06,·DSS05.04,·DSS05.07, |
| 757 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 757 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 758 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, | 758 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, |
| 759 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, | 759 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, |
| 760 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- | 760 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- |
| 761 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- | 761 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- |
| 762 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227 | 762 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227 |
| 763 | Remediation_Shell_script_⇲ | ||
| 764 | Complexity:·low | ||
| 765 | Disruption:·low | ||
| 766 | Strategy:···configure | ||
| 767 | chgrp·0·/etc/group | ||
| 763 | Remediation_Ansible_snippet_⇲ | 768 | Remediation_Ansible_snippet_⇲ |
| 764 | Complexity:·low | 769 | Complexity:·low |
| 765 | Disruption:·low | 770 | Disruption:·low |
| 766 | Strategy:···configure | 771 | Strategy:···configure |
| 767 | -·name:·Test·for·existence·/etc/group | 772 | -·name:·Test·for·existence·/etc/group |
| 768 | ··stat: | 773 | ··stat: |
| 769 | ····path:·/etc/group | 774 | ····path:·/etc/group |
| Offset 792, 36 lines modified | Offset 800, 36 lines modified | ||
| 792 | ··-·PCI-DSS-Req-8.7.c | 800 | ··-·PCI-DSS-Req-8.7.c |
| 793 | ··-·configure_strategy | 801 | ··-·configure_strategy |
| 794 | ··-·file_groupowner_etc_group | 802 | ··-·file_groupowner_etc_group |
| 795 | ··-·low_complexity | 803 | ··-·low_complexity |
| 796 | ··-·low_disruption | 804 | ··-·low_disruption |
| 797 | ··-·medium_severity | 805 | ··-·medium_severity |
| 798 | ··-·no_reboot_needed | 806 | ··-·no_reboot_needed |
| 799 | Remediation_Shell_script_⇲ | ||
| 800 | Complexity:·low | ||
| 801 | Disruption:·low | ||
| 802 | Strategy:···configure | ||
| Max diff block lines reached; 40860/45843 bytes (89.13%) of diff not shown. | |||
| Offset 96, 15 lines modified | Offset 96, 15 lines modified | ||
| 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·10</cpe-dict:title> | 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·10</cpe-dict:title> |
| 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian10-cpe-oval.xml">oval:ssg-installed_OS_is_debian10:def:1</cpe-dict:check> | 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian10-cpe-oval.xml">oval:ssg-installed_OS_is_debian10:def:1</cpe-dict:check> |
| 98 | ······</cpe-dict:cpe-item> | 98 | ······</cpe-dict:cpe-item> |
| 99 | ····</cpe-dict:cpe-list> | 99 | ····</cpe-dict:cpe-list> |
| 100 | ··</ds:component> | 100 | ··</ds:component> |
| 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian10-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian10-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-10"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-10"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 103 | ······<xccdf-1.2:status·date="202 | 103 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·10</xccdf-1.2:title> | 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·10</xccdf-1.2:title> |
| 105 | ······<xccdf-1.2:description> | 105 | ······<xccdf-1.2:description> |
| 106 | ········This·guide·presents·a·catalog·of·security-relevant | 106 | ········This·guide·presents·a·catalog·of·security-relevant |
| 107 | configuration·settings·for·Debian·10.·It·is·a·rendering·of | 107 | configuration·settings·for·Debian·10.·It·is·a·rendering·of |
| 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 109 | in·order·to·support·security·automation.··The·SCAP·content·is | 109 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 110 | is·available·in·the | 110 | is·available·in·the |
| Offset 147, 97 lines modified | Offset 147, 97 lines modified | ||
| 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 148 | ······</xccdf-1.2:front-matter> | 148 | ······</xccdf-1.2:front-matter> |
| 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 152 | respective·companies.</xccdf-1.2:rear-matter> | 152 | respective·companies.</xccdf-1.2:rear-matter> |
| 153 | ······<cpe-lang:platform-specification> | 153 | ······<cpe-lang:platform-specification> |
| 154 | ········<cpe-lang:platform·id=" | 154 | ········<cpe-lang:platform·id="login_defs"> |
| 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 156 | ············<cpe-lang:fact-ref·name="cpe:/a: | 156 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 157 | ··········</cpe-lang:logical-test> | 157 | ··········</cpe-lang:logical-test> |
| 158 | ········</cpe-lang:platform> | 158 | ········</cpe-lang:platform> |
| 159 | ········<cpe-lang:platform·id=" | 159 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 161 | ············<cpe-lang:fact-ref·name="cpe:/a: | 161 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 162 | ··········</cpe-lang:logical-test> | 162 | ··········</cpe-lang:logical-test> |
| 163 | ········</cpe-lang:platform> | 163 | ········</cpe-lang:platform> |
| 164 | ········<cpe-lang:platform·id=" | 164 | ········<cpe-lang:platform·id="machine"> |
| 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 166 | ············<cpe-lang:fact-ref·name="cpe:/a: | 166 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 167 | ··········</cpe-lang:logical-test> | 167 | ··········</cpe-lang:logical-test> |
| 168 | ········</cpe-lang:platform> | 168 | ········</cpe-lang:platform> |
| 169 | ········<cpe-lang:platform·id=" | 169 | ········<cpe-lang:platform·id="sudo"> |
| 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 171 | ············<cpe-lang:fact-ref·name="cpe:/a: | 171 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 172 | ··········</cpe-lang:logical-test> | 172 | ··········</cpe-lang:logical-test> |
| 173 | ········</cpe-lang:platform> | 173 | ········</cpe-lang:platform> |
| 174 | ········<cpe-lang:platform·id=" | 174 | ········<cpe-lang:platform·id="postfix"> |
| 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 176 | ············<cpe-lang:fact-ref·name="cpe:/a: | 176 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 177 | ··········</cpe-lang:logical-test> | 177 | ··········</cpe-lang:logical-test> |
| 178 | ········</cpe-lang:platform> | 178 | ········</cpe-lang:platform> |
| 179 | ········<cpe-lang:platform·id=" | 179 | ········<cpe-lang:platform·id="s390x_arch"> |
| 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 181 | ············<cpe-lang:fact-ref·name="cpe:/a: | 181 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 182 | ··········</cpe-lang:logical-test> | 182 | ··········</cpe-lang:logical-test> |
| 183 | ········</cpe-lang:platform> | 183 | ········</cpe-lang:platform> |
| 184 | ········<cpe-lang:platform·id="gdm"> | 184 | ········<cpe-lang:platform·id="gdm"> |
| 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 187 | ··········</cpe-lang:logical-test> | 187 | ··········</cpe-lang:logical-test> |
| 188 | ········</cpe-lang:platform> | 188 | ········</cpe-lang:platform> |
| 189 | ········<cpe-lang:platform·id=" | 189 | ········<cpe-lang:platform·id="chrony"> |
| 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 191 | ············<cpe-lang:fact-ref·name="cpe:/a: | 191 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 192 | ··········</cpe-lang:logical-test> | 192 | ··········</cpe-lang:logical-test> |
| 193 | ········</cpe-lang:platform> | 193 | ········</cpe-lang:platform> |
| 194 | ········<cpe-lang:platform·id=" | 194 | ········<cpe-lang:platform·id="non-uefi"> |
| 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a: | 196 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 197 | ··········</cpe-lang:logical-test> | 197 | ··········</cpe-lang:logical-test> |
| 198 | ········</cpe-lang:platform> | 198 | ········</cpe-lang:platform> |
| 199 | ········<cpe-lang:platform·id=" | 199 | ········<cpe-lang:platform·id="ntp"> |
| 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 201 | ············<cpe-lang:fact-ref·name="cpe:/a: | 201 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 202 | ··········</cpe-lang:logical-test> | 202 | ··········</cpe-lang:logical-test> |
| 203 | ········</cpe-lang:platform> | 203 | ········</cpe-lang:platform> |
| 204 | ········<cpe-lang:platform·id=" | 204 | ········<cpe-lang:platform·id="grub2"> |
| 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 206 | ············<cpe-lang:fact-ref·name="cpe:/a: | 206 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 207 | ··········</cpe-lang:logical-test> | 207 | ··········</cpe-lang:logical-test> |
| 208 | ········</cpe-lang:platform> | 208 | ········</cpe-lang:platform> |
| 209 | ········<cpe-lang:platform·id="ntp"> | 209 | ········<cpe-lang:platform·id="net-snmp"> |
| 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 211 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:net-snmp"/> |
| 212 | ··········</cpe-lang:logical-test> | 212 | ··········</cpe-lang:logical-test> |
| 213 | ········</cpe-lang:platform> | 213 | ········</cpe-lang:platform> |
| 214 | ········<cpe-lang:platform·id=" | 214 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 216 | ············<cpe-lang:fact-ref·name="cpe:/a: | 216 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 217 | ··········</cpe-lang:logical-test> | 217 | ··········</cpe-lang:logical-test> |
| 218 | ········</cpe-lang:platform> | 218 | ········</cpe-lang:platform> |
| 219 | ········<cpe-lang:platform·id="audit"> | 219 | ········<cpe-lang:platform·id="audit"> |
| 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 222 | ··········</cpe-lang:logical-test> | 222 | ··········</cpe-lang:logical-test> |
| 223 | ········</cpe-lang:platform> | 223 | ········</cpe-lang:platform> |
| 224 | ········<cpe-lang:platform·id=" | 224 | ········<cpe-lang:platform·id="pam"> |
| 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a: | 226 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 227 | ··········</cpe-lang:logical-test> | 227 | ··········</cpe-lang:logical-test> |
| 228 | ········</cpe-lang:platform> | 228 | ········</cpe-lang:platform> |
| 229 | ········<cpe-lang:platform·id=" | 229 | ········<cpe-lang:platform·id="uefi"> |
| 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 231 | ············<cpe-lang:fact-ref·name="cpe:/a: | 231 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 232 | ··········</cpe-lang:logical-test> | 232 | ··········</cpe-lang:logical-test> |
| 233 | ········</cpe-lang:platform> | 233 | ········</cpe-lang:platform> |
| 234 | ········<cpe-lang:platform·id=" | 234 | ········<cpe-lang:platform·id="sssd"> |
| 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 236 | ············<cpe-lang:fact-ref·name="cpe:/a: | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 237 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 238 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 239 | ······</cpe-lang:platform-specification> | 239 | ······</cpe-lang:platform-specification> |
| 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:10"/> | 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:10"/> |
| 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 242 | ······<xccdf-1.2:metadata> | 242 | ······<xccdf-1.2:metadata> |
| 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 3303, 27 lines modified | Offset 3303, 14 lines modified | ||
| 3303 | in | 3303 | in |
| 3304 | ················<html:code>/etc/sudoers.d/</html:code> | 3304 | ················<html:code>/etc/sudoers.d/</html:code> |
| 3305 | ················. | 3305 | ················. |
| 3306 | ··············</xccdf-1.2:description> | 3306 | ··············</xccdf-1.2:description> |
| 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 3310 | ··············<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 3311 | ··lineinfile: | ||
| 3312 | ····path:·/etc/sudoers | ||
| 3313 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 3314 | ····line:·Defaults·noexec | ||
| 3315 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| Max diff block lines reached; 1147903/1156516 bytes (99.26%) of diff not shown. | |||
| Offset 96, 15 lines modified | Offset 96, 15 lines modified | ||
| 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·10</cpe-dict:title> | 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·10</cpe-dict:title> |
| 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian10-cpe-oval.xml">oval:ssg-installed_OS_is_debian10:def:1</cpe-dict:check> | 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian10-cpe-oval.xml">oval:ssg-installed_OS_is_debian10:def:1</cpe-dict:check> |
| 98 | ······</cpe-dict:cpe-item> | 98 | ······</cpe-dict:cpe-item> |
| 99 | ····</cpe-dict:cpe-list> | 99 | ····</cpe-dict:cpe-list> |
| 100 | ··</ds:component> | 100 | ··</ds:component> |
| 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian10-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian10-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-10"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-10"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 103 | ······<xccdf-1.2:status·date="202 | 103 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·10</xccdf-1.2:title> | 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·10</xccdf-1.2:title> |
| 105 | ······<xccdf-1.2:description> | 105 | ······<xccdf-1.2:description> |
| 106 | ········This·guide·presents·a·catalog·of·security-relevant | 106 | ········This·guide·presents·a·catalog·of·security-relevant |
| 107 | configuration·settings·for·Debian·10.·It·is·a·rendering·of | 107 | configuration·settings·for·Debian·10.·It·is·a·rendering·of |
| 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 109 | in·order·to·support·security·automation.··The·SCAP·content·is | 109 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 110 | is·available·in·the | 110 | is·available·in·the |
| Offset 147, 97 lines modified | Offset 147, 97 lines modified | ||
| 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 148 | ······</xccdf-1.2:front-matter> | 148 | ······</xccdf-1.2:front-matter> |
| 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 152 | respective·companies.</xccdf-1.2:rear-matter> | 152 | respective·companies.</xccdf-1.2:rear-matter> |
| 153 | ······<cpe-lang:platform-specification> | 153 | ······<cpe-lang:platform-specification> |
| 154 | ········<cpe-lang:platform·id=" | 154 | ········<cpe-lang:platform·id="login_defs"> |
| 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 156 | ············<cpe-lang:fact-ref·name="cpe:/a: | 156 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 157 | ··········</cpe-lang:logical-test> | 157 | ··········</cpe-lang:logical-test> |
| 158 | ········</cpe-lang:platform> | 158 | ········</cpe-lang:platform> |
| 159 | ········<cpe-lang:platform·id=" | 159 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 161 | ············<cpe-lang:fact-ref·name="cpe:/a: | 161 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 162 | ··········</cpe-lang:logical-test> | 162 | ··········</cpe-lang:logical-test> |
| 163 | ········</cpe-lang:platform> | 163 | ········</cpe-lang:platform> |
| 164 | ········<cpe-lang:platform·id=" | 164 | ········<cpe-lang:platform·id="machine"> |
| 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 166 | ············<cpe-lang:fact-ref·name="cpe:/a: | 166 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 167 | ··········</cpe-lang:logical-test> | 167 | ··········</cpe-lang:logical-test> |
| 168 | ········</cpe-lang:platform> | 168 | ········</cpe-lang:platform> |
| 169 | ········<cpe-lang:platform·id=" | 169 | ········<cpe-lang:platform·id="sudo"> |
| 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 171 | ············<cpe-lang:fact-ref·name="cpe:/a: | 171 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 172 | ··········</cpe-lang:logical-test> | 172 | ··········</cpe-lang:logical-test> |
| 173 | ········</cpe-lang:platform> | 173 | ········</cpe-lang:platform> |
| 174 | ········<cpe-lang:platform·id=" | 174 | ········<cpe-lang:platform·id="postfix"> |
| 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 176 | ············<cpe-lang:fact-ref·name="cpe:/a: | 176 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 177 | ··········</cpe-lang:logical-test> | 177 | ··········</cpe-lang:logical-test> |
| 178 | ········</cpe-lang:platform> | 178 | ········</cpe-lang:platform> |
| 179 | ········<cpe-lang:platform·id=" | 179 | ········<cpe-lang:platform·id="s390x_arch"> |
| 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 181 | ············<cpe-lang:fact-ref·name="cpe:/a: | 181 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 182 | ··········</cpe-lang:logical-test> | 182 | ··········</cpe-lang:logical-test> |
| 183 | ········</cpe-lang:platform> | 183 | ········</cpe-lang:platform> |
| 184 | ········<cpe-lang:platform·id="gdm"> | 184 | ········<cpe-lang:platform·id="gdm"> |
| 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 187 | ··········</cpe-lang:logical-test> | 187 | ··········</cpe-lang:logical-test> |
| 188 | ········</cpe-lang:platform> | 188 | ········</cpe-lang:platform> |
| 189 | ········<cpe-lang:platform·id=" | 189 | ········<cpe-lang:platform·id="chrony"> |
| 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 191 | ············<cpe-lang:fact-ref·name="cpe:/a: | 191 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 192 | ··········</cpe-lang:logical-test> | 192 | ··········</cpe-lang:logical-test> |
| 193 | ········</cpe-lang:platform> | 193 | ········</cpe-lang:platform> |
| 194 | ········<cpe-lang:platform·id=" | 194 | ········<cpe-lang:platform·id="non-uefi"> |
| 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a: | 196 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 197 | ··········</cpe-lang:logical-test> | 197 | ··········</cpe-lang:logical-test> |
| 198 | ········</cpe-lang:platform> | 198 | ········</cpe-lang:platform> |
| 199 | ········<cpe-lang:platform·id=" | 199 | ········<cpe-lang:platform·id="ntp"> |
| 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 201 | ············<cpe-lang:fact-ref·name="cpe:/a: | 201 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 202 | ··········</cpe-lang:logical-test> | 202 | ··········</cpe-lang:logical-test> |
| 203 | ········</cpe-lang:platform> | 203 | ········</cpe-lang:platform> |
| 204 | ········<cpe-lang:platform·id=" | 204 | ········<cpe-lang:platform·id="grub2"> |
| 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 206 | ············<cpe-lang:fact-ref·name="cpe:/a: | 206 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 207 | ··········</cpe-lang:logical-test> | 207 | ··········</cpe-lang:logical-test> |
| 208 | ········</cpe-lang:platform> | 208 | ········</cpe-lang:platform> |
| 209 | ········<cpe-lang:platform·id="ntp"> | 209 | ········<cpe-lang:platform·id="net-snmp"> |
| 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 211 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:net-snmp"/> |
| 212 | ··········</cpe-lang:logical-test> | 212 | ··········</cpe-lang:logical-test> |
| 213 | ········</cpe-lang:platform> | 213 | ········</cpe-lang:platform> |
| 214 | ········<cpe-lang:platform·id=" | 214 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 216 | ············<cpe-lang:fact-ref·name="cpe:/a: | 216 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 217 | ··········</cpe-lang:logical-test> | 217 | ··········</cpe-lang:logical-test> |
| 218 | ········</cpe-lang:platform> | 218 | ········</cpe-lang:platform> |
| 219 | ········<cpe-lang:platform·id="audit"> | 219 | ········<cpe-lang:platform·id="audit"> |
| 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 222 | ··········</cpe-lang:logical-test> | 222 | ··········</cpe-lang:logical-test> |
| 223 | ········</cpe-lang:platform> | 223 | ········</cpe-lang:platform> |
| 224 | ········<cpe-lang:platform·id=" | 224 | ········<cpe-lang:platform·id="pam"> |
| 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a: | 226 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 227 | ··········</cpe-lang:logical-test> | 227 | ··········</cpe-lang:logical-test> |
| 228 | ········</cpe-lang:platform> | 228 | ········</cpe-lang:platform> |
| 229 | ········<cpe-lang:platform·id=" | 229 | ········<cpe-lang:platform·id="uefi"> |
| 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 231 | ············<cpe-lang:fact-ref·name="cpe:/a: | 231 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 232 | ··········</cpe-lang:logical-test> | 232 | ··········</cpe-lang:logical-test> |
| 233 | ········</cpe-lang:platform> | 233 | ········</cpe-lang:platform> |
| 234 | ········<cpe-lang:platform·id=" | 234 | ········<cpe-lang:platform·id="sssd"> |
| 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 236 | ············<cpe-lang:fact-ref·name="cpe:/a: | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 237 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 238 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 239 | ······</cpe-lang:platform-specification> | 239 | ······</cpe-lang:platform-specification> |
| 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:10"/> | 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:10"/> |
| 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 242 | ······<xccdf-1.2:metadata> | 242 | ······<xccdf-1.2:metadata> |
| 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 3303, 27 lines modified | Offset 3303, 14 lines modified | ||
| 3303 | in | 3303 | in |
| 3304 | ················<html:code>/etc/sudoers.d/</html:code> | 3304 | ················<html:code>/etc/sudoers.d/</html:code> |
| 3305 | ················. | 3305 | ················. |
| 3306 | ··············</xccdf-1.2:description> | 3306 | ··············</xccdf-1.2:description> |
| 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 3310 | ··············<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 3311 | ··lineinfile: | ||
| 3312 | ····path:·/etc/sudoers | ||
| 3313 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 3314 | ····line:·Defaults·noexec | ||
| 3315 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| Max diff block lines reached; 1147903/1156516 bytes (99.26%) of diff not shown. | |||
| Offset 3, 3259 lines modified | Offset 3, 3259 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>Enable·PAM</ocil:title> | ||
| 11 | ······<ocil:title>Disable·Kerberos·Authentication</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 17 | ······<ocil:title>Disallow·Configuration·to·Bypass·Password·Requirements·for·Privilege·Escalation</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 23 | ······<ocil:title>Audit·Configuration·Files·Must·Be·Owned·By·Group·root</ocil:title> | ||
| 24 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 29 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 30 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"> | ||
| 35 | ····· | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>Ensure·auditd·Collects·Unauthorized·Access·Attempts·to·Files·(unsuccessful)</ocil:title> | ||
| 36 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"> |
| 41 | ······<ocil:title> | 29 | ······<ocil:title>Record·Attempts·to·Alter·Logon·and·Logout·Events·-·lastlog</ocil:title> |
| 42 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg- | 34 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 47 | ······<ocil:title> | 35 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 48 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 40 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 41 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 54 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 47 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> |
| 60 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_ | 52 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 53 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 66 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_ | 55 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1"> | ||
| 71 | ···· | 58 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 59 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> | ||
| 72 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1"> | ||
| 77 | ···· | 64 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 65 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> | ||
| 78 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_ | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"> |
| 83 | ······<ocil:title>Disable· | 71 | ······<ocil:title>Disable·kernel·support·for·MISC·binaries</ocil:title> |
| 84 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_ | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1"> | ||
| 89 | ···· | 76 | ····<ocil:questionnaire·id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>Configure·System·to·Forward·All·Mail·From·Postmaster·to·The·Root·Account</ocil:title> | ||
| 90 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-s | 79 | ········<ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 83 | ······<ocil:title>Remove·Rsh·Trust·Files</ocil:title> |
| 96 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"> | ||
| 101 | ···· | 88 | ····<ocil:questionnaire·id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"> |
| 89 | ······<ocil:title>Verify·iptables·Enabled</ocil:title> | ||
| 102 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 95 | ······<ocil:title>Unmap·kernel·when·running·in·userspace·(aka·KAISER)</ocil:title> |
| 108 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg-accounts_passwords_pam_faillock_audit_ocil:questionnaire:1"> | ||
| 113 | ···· | 100 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Verify·Group·Who·Owns·Backup·gshadow·File</ocil:title> | ||
| 114 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 103 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1"> | ||
| 119 | ···· | 106 | ····<ocil:questionnaire·id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Configure·L1·Terminal·Fault·mitigations</ocil:title> | ||
| 120 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| Max diff block lines reached; 694737/706404 bytes (98.35%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-10"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-10"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·10</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·10</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Debian·10.·It·is·a·rendering·of | 7 | configuration·settings·for·Debian·10.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 97 lines modified | Offset 47, 97 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 57 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 58 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 59 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 61 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 62 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 63 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 64 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 67 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 68 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 69 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 71 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 72 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 73 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 74 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 77 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 79 | ····<cpe-lang:platform·id="s390x_arch"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 82 | ······</cpe-lang:logical-test> | 82 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 83 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id="gdm"> | 84 | ····<cpe-lang:platform·id="gdm"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 87 | ······</cpe-lang:logical-test> | 87 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 88 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id=" | 89 | ····<cpe-lang:platform·id="chrony"> |
| 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a: | 91 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 92 | ······</cpe-lang:logical-test> | 92 | ······</cpe-lang:logical-test> |
| 93 | ····</cpe-lang:platform> | 93 | ····</cpe-lang:platform> |
| 94 | ····<cpe-lang:platform·id=" | 94 | ····<cpe-lang:platform·id="non-uefi"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a: | 96 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 97 | ······</cpe-lang:logical-test> | 97 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 98 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id=" | 99 | ····<cpe-lang:platform·id="ntp"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a: | 101 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 102 | ······</cpe-lang:logical-test> | 102 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 103 | ····</cpe-lang:platform> |
| 104 | ····<cpe-lang:platform·id=" | 104 | ····<cpe-lang:platform·id="grub2"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a: | 106 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 107 | ······</cpe-lang:logical-test> | 107 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 108 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id="ntp"> | 109 | ····<cpe-lang:platform·id="net-snmp"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | 111 | ········<cpe-lang:fact-ref·name="cpe:/a:net-snmp"/> |
| 112 | ······</cpe-lang:logical-test> | 112 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 113 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id=" | 114 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a: | 116 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 117 | ······</cpe-lang:logical-test> | 117 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 118 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id="audit"> | 119 | ····<cpe-lang:platform·id="audit"> |
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 121 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 122 | ······</cpe-lang:logical-test> | 122 | ······</cpe-lang:logical-test> |
| 123 | ····</cpe-lang:platform> | 123 | ····</cpe-lang:platform> |
| 124 | ····<cpe-lang:platform·id=" | 124 | ····<cpe-lang:platform·id="pam"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a: | 126 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 127 | ······</cpe-lang:logical-test> | 127 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 128 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 129 | ····<cpe-lang:platform·id="uefi"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 131 | ········<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 132 | ······</cpe-lang:logical-test> | 132 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 133 | ····</cpe-lang:platform> |
| 134 | ····<cpe-lang:platform·id=" | 134 | ····<cpe-lang:platform·id="sssd"> |
| 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a: | 136 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 137 | ······</cpe-lang:logical-test> | 137 | ······</cpe-lang:logical-test> |
| 138 | ····</cpe-lang:platform> | 138 | ····</cpe-lang:platform> |
| 139 | ··</cpe-lang:platform-specification> | 139 | ··</cpe-lang:platform-specification> |
| 140 | ··<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:10"/> | 140 | ··<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:10"/> |
| 141 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 141 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 142 | ··<xccdf-1.2:metadata> | 142 | ··<xccdf-1.2:metadata> |
| 143 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 143 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 3203, 27 lines modified | Offset 3203, 14 lines modified | ||
| 3203 | in | 3203 | in |
| 3204 | ············<html:code>/etc/sudoers.d/</html:code> | 3204 | ············<html:code>/etc/sudoers.d/</html:code> |
| 3205 | ············. | 3205 | ············. |
| 3206 | ··········</xccdf-1.2:description> | 3206 | ··········</xccdf-1.2:description> |
| 3207 | ··········<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 3207 | ··········<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 3208 | ··········<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 3208 | ··········<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 3209 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 3209 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 3210 | ··········<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 3211 | ··lineinfile: | ||
| 3212 | ····path:·/etc/sudoers | ||
| 3213 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 3214 | ····line:·Defaults·noexec | ||
| 3215 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| 3216 | ··tags: | ||
| 3217 | ··-·high_severity | ||
| 3218 | ··-·low_complexity | ||
| 3219 | ··-·low_disruption | ||
| 3220 | ··-·no_reboot_needed | ||
| Max diff block lines reached; 402926/410848 bytes (98.07%) of diff not shown. | |||
| Offset 96, 15 lines modified | Offset 96, 15 lines modified | ||
| 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·11</cpe-dict:title> | 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·11</cpe-dict:title> |
| 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian11-cpe-oval.xml">oval:ssg-installed_OS_is_debian11:def:1</cpe-dict:check> | 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian11-cpe-oval.xml">oval:ssg-installed_OS_is_debian11:def:1</cpe-dict:check> |
| 98 | ······</cpe-dict:cpe-item> | 98 | ······</cpe-dict:cpe-item> |
| 99 | ····</cpe-dict:cpe-list> | 99 | ····</cpe-dict:cpe-list> |
| 100 | ··</ds:component> | 100 | ··</ds:component> |
| 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian11-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian11-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-11"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-11"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 103 | ······<xccdf-1.2:status·date="202 | 103 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·11</xccdf-1.2:title> | 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·11</xccdf-1.2:title> |
| 105 | ······<xccdf-1.2:description> | 105 | ······<xccdf-1.2:description> |
| 106 | ········This·guide·presents·a·catalog·of·security-relevant | 106 | ········This·guide·presents·a·catalog·of·security-relevant |
| 107 | configuration·settings·for·Debian·11.·It·is·a·rendering·of | 107 | configuration·settings·for·Debian·11.·It·is·a·rendering·of |
| 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 109 | in·order·to·support·security·automation.··The·SCAP·content·is | 109 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 110 | is·available·in·the | 110 | is·available·in·the |
| Offset 147, 97 lines modified | Offset 147, 97 lines modified | ||
| 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 148 | ······</xccdf-1.2:front-matter> | 148 | ······</xccdf-1.2:front-matter> |
| 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 152 | respective·companies.</xccdf-1.2:rear-matter> | 152 | respective·companies.</xccdf-1.2:rear-matter> |
| 153 | ······<cpe-lang:platform-specification> | 153 | ······<cpe-lang:platform-specification> |
| 154 | ········<cpe-lang:platform·id=" | 154 | ········<cpe-lang:platform·id="login_defs"> |
| 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 156 | ············<cpe-lang:fact-ref·name="cpe:/a: | 156 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 157 | ··········</cpe-lang:logical-test> | 157 | ··········</cpe-lang:logical-test> |
| 158 | ········</cpe-lang:platform> | 158 | ········</cpe-lang:platform> |
| 159 | ········<cpe-lang:platform·id=" | 159 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 161 | ············<cpe-lang:fact-ref·name="cpe:/a: | 161 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 162 | ··········</cpe-lang:logical-test> | 162 | ··········</cpe-lang:logical-test> |
| 163 | ········</cpe-lang:platform> | 163 | ········</cpe-lang:platform> |
| 164 | ········<cpe-lang:platform·id=" | 164 | ········<cpe-lang:platform·id="machine"> |
| 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 166 | ············<cpe-lang:fact-ref·name="cpe:/a: | 166 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 167 | ··········</cpe-lang:logical-test> | 167 | ··········</cpe-lang:logical-test> |
| 168 | ········</cpe-lang:platform> | 168 | ········</cpe-lang:platform> |
| 169 | ········<cpe-lang:platform·id=" | 169 | ········<cpe-lang:platform·id="sudo"> |
| 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 171 | ············<cpe-lang:fact-ref·name="cpe:/a: | 171 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 172 | ··········</cpe-lang:logical-test> | 172 | ··········</cpe-lang:logical-test> |
| 173 | ········</cpe-lang:platform> | 173 | ········</cpe-lang:platform> |
| 174 | ········<cpe-lang:platform·id=" | 174 | ········<cpe-lang:platform·id="postfix"> |
| 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 176 | ············<cpe-lang:fact-ref·name="cpe:/a: | 176 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 177 | ··········</cpe-lang:logical-test> | 177 | ··········</cpe-lang:logical-test> |
| 178 | ········</cpe-lang:platform> | 178 | ········</cpe-lang:platform> |
| 179 | ········<cpe-lang:platform·id=" | 179 | ········<cpe-lang:platform·id="s390x_arch"> |
| 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 181 | ············<cpe-lang:fact-ref·name="cpe:/a: | 181 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 182 | ··········</cpe-lang:logical-test> | 182 | ··········</cpe-lang:logical-test> |
| 183 | ········</cpe-lang:platform> | 183 | ········</cpe-lang:platform> |
| 184 | ········<cpe-lang:platform·id="gdm"> | 184 | ········<cpe-lang:platform·id="gdm"> |
| 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 187 | ··········</cpe-lang:logical-test> | 187 | ··········</cpe-lang:logical-test> |
| 188 | ········</cpe-lang:platform> | 188 | ········</cpe-lang:platform> |
| 189 | ········<cpe-lang:platform·id=" | 189 | ········<cpe-lang:platform·id="chrony"> |
| 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 191 | ············<cpe-lang:fact-ref·name="cpe:/a: | 191 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 192 | ··········</cpe-lang:logical-test> | 192 | ··········</cpe-lang:logical-test> |
| 193 | ········</cpe-lang:platform> | 193 | ········</cpe-lang:platform> |
| 194 | ········<cpe-lang:platform·id=" | 194 | ········<cpe-lang:platform·id="non-uefi"> |
| 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a: | 196 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 197 | ··········</cpe-lang:logical-test> | 197 | ··········</cpe-lang:logical-test> |
| 198 | ········</cpe-lang:platform> | 198 | ········</cpe-lang:platform> |
| 199 | ········<cpe-lang:platform·id=" | 199 | ········<cpe-lang:platform·id="ntp"> |
| 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 201 | ············<cpe-lang:fact-ref·name="cpe:/a: | 201 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 202 | ··········</cpe-lang:logical-test> | 202 | ··········</cpe-lang:logical-test> |
| 203 | ········</cpe-lang:platform> | 203 | ········</cpe-lang:platform> |
| 204 | ········<cpe-lang:platform·id=" | 204 | ········<cpe-lang:platform·id="grub2"> |
| 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 206 | ············<cpe-lang:fact-ref·name="cpe:/a: | 206 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 207 | ··········</cpe-lang:logical-test> | 207 | ··········</cpe-lang:logical-test> |
| 208 | ········</cpe-lang:platform> | 208 | ········</cpe-lang:platform> |
| 209 | ········<cpe-lang:platform·id="ntp"> | 209 | ········<cpe-lang:platform·id="net-snmp"> |
| 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 211 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:net-snmp"/> |
| 212 | ··········</cpe-lang:logical-test> | 212 | ··········</cpe-lang:logical-test> |
| 213 | ········</cpe-lang:platform> | 213 | ········</cpe-lang:platform> |
| 214 | ········<cpe-lang:platform·id=" | 214 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 216 | ············<cpe-lang:fact-ref·name="cpe:/a: | 216 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 217 | ··········</cpe-lang:logical-test> | 217 | ··········</cpe-lang:logical-test> |
| 218 | ········</cpe-lang:platform> | 218 | ········</cpe-lang:platform> |
| 219 | ········<cpe-lang:platform·id="audit"> | 219 | ········<cpe-lang:platform·id="audit"> |
| 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 222 | ··········</cpe-lang:logical-test> | 222 | ··········</cpe-lang:logical-test> |
| 223 | ········</cpe-lang:platform> | 223 | ········</cpe-lang:platform> |
| 224 | ········<cpe-lang:platform·id=" | 224 | ········<cpe-lang:platform·id="pam"> |
| 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a: | 226 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 227 | ··········</cpe-lang:logical-test> | 227 | ··········</cpe-lang:logical-test> |
| 228 | ········</cpe-lang:platform> | 228 | ········</cpe-lang:platform> |
| 229 | ········<cpe-lang:platform·id=" | 229 | ········<cpe-lang:platform·id="uefi"> |
| 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 231 | ············<cpe-lang:fact-ref·name="cpe:/a: | 231 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 232 | ··········</cpe-lang:logical-test> | 232 | ··········</cpe-lang:logical-test> |
| 233 | ········</cpe-lang:platform> | 233 | ········</cpe-lang:platform> |
| 234 | ········<cpe-lang:platform·id=" | 234 | ········<cpe-lang:platform·id="sssd"> |
| 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 236 | ············<cpe-lang:fact-ref·name="cpe:/a: | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 237 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 238 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 239 | ······</cpe-lang:platform-specification> | 239 | ······</cpe-lang:platform-specification> |
| 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:11"/> | 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:11"/> |
| 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 242 | ······<xccdf-1.2:metadata> | 242 | ······<xccdf-1.2:metadata> |
| 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 3303, 27 lines modified | Offset 3303, 14 lines modified | ||
| 3303 | in | 3303 | in |
| 3304 | ················<html:code>/etc/sudoers.d/</html:code> | 3304 | ················<html:code>/etc/sudoers.d/</html:code> |
| 3305 | ················. | 3305 | ················. |
| 3306 | ··············</xccdf-1.2:description> | 3306 | ··············</xccdf-1.2:description> |
| 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 3310 | ··············<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 3311 | ··lineinfile: | ||
| 3312 | ····path:·/etc/sudoers | ||
| 3313 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 3314 | ····line:·Defaults·noexec | ||
| 3315 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| Max diff block lines reached; 1106383/1114996 bytes (99.23%) of diff not shown. | |||
| Offset 96, 15 lines modified | Offset 96, 15 lines modified | ||
| 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·11</cpe-dict:title> | 96 | ········<cpe-dict:title·xml:lang="en-us">Debian·Linux·11</cpe-dict:title> |
| 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian11-cpe-oval.xml">oval:ssg-installed_OS_is_debian11:def:1</cpe-dict:check> | 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-debian11-cpe-oval.xml">oval:ssg-installed_OS_is_debian11:def:1</cpe-dict:check> |
| 98 | ······</cpe-dict:cpe-item> | 98 | ······</cpe-dict:cpe-item> |
| 99 | ····</cpe-dict:cpe-list> | 99 | ····</cpe-dict:cpe-list> |
| 100 | ··</ds:component> | 100 | ··</ds:component> |
| 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian11-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-debian11-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-11"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-11"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 103 | ······<xccdf-1.2:status·date="202 | 103 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·11</xccdf-1.2:title> | 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·11</xccdf-1.2:title> |
| 105 | ······<xccdf-1.2:description> | 105 | ······<xccdf-1.2:description> |
| 106 | ········This·guide·presents·a·catalog·of·security-relevant | 106 | ········This·guide·presents·a·catalog·of·security-relevant |
| 107 | configuration·settings·for·Debian·11.·It·is·a·rendering·of | 107 | configuration·settings·for·Debian·11.·It·is·a·rendering·of |
| 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 109 | in·order·to·support·security·automation.··The·SCAP·content·is | 109 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 110 | is·available·in·the | 110 | is·available·in·the |
| Offset 147, 97 lines modified | Offset 147, 97 lines modified | ||
| 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 148 | ······</xccdf-1.2:front-matter> | 148 | ······</xccdf-1.2:front-matter> |
| 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 152 | respective·companies.</xccdf-1.2:rear-matter> | 152 | respective·companies.</xccdf-1.2:rear-matter> |
| 153 | ······<cpe-lang:platform-specification> | 153 | ······<cpe-lang:platform-specification> |
| 154 | ········<cpe-lang:platform·id=" | 154 | ········<cpe-lang:platform·id="login_defs"> |
| 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 156 | ············<cpe-lang:fact-ref·name="cpe:/a: | 156 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 157 | ··········</cpe-lang:logical-test> | 157 | ··········</cpe-lang:logical-test> |
| 158 | ········</cpe-lang:platform> | 158 | ········</cpe-lang:platform> |
| 159 | ········<cpe-lang:platform·id=" | 159 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 161 | ············<cpe-lang:fact-ref·name="cpe:/a: | 161 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 162 | ··········</cpe-lang:logical-test> | 162 | ··········</cpe-lang:logical-test> |
| 163 | ········</cpe-lang:platform> | 163 | ········</cpe-lang:platform> |
| 164 | ········<cpe-lang:platform·id=" | 164 | ········<cpe-lang:platform·id="machine"> |
| 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 166 | ············<cpe-lang:fact-ref·name="cpe:/a: | 166 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 167 | ··········</cpe-lang:logical-test> | 167 | ··········</cpe-lang:logical-test> |
| 168 | ········</cpe-lang:platform> | 168 | ········</cpe-lang:platform> |
| 169 | ········<cpe-lang:platform·id=" | 169 | ········<cpe-lang:platform·id="sudo"> |
| 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 171 | ············<cpe-lang:fact-ref·name="cpe:/a: | 171 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 172 | ··········</cpe-lang:logical-test> | 172 | ··········</cpe-lang:logical-test> |
| 173 | ········</cpe-lang:platform> | 173 | ········</cpe-lang:platform> |
| 174 | ········<cpe-lang:platform·id=" | 174 | ········<cpe-lang:platform·id="postfix"> |
| 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 176 | ············<cpe-lang:fact-ref·name="cpe:/a: | 176 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 177 | ··········</cpe-lang:logical-test> | 177 | ··········</cpe-lang:logical-test> |
| 178 | ········</cpe-lang:platform> | 178 | ········</cpe-lang:platform> |
| 179 | ········<cpe-lang:platform·id=" | 179 | ········<cpe-lang:platform·id="s390x_arch"> |
| 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 181 | ············<cpe-lang:fact-ref·name="cpe:/a: | 181 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 182 | ··········</cpe-lang:logical-test> | 182 | ··········</cpe-lang:logical-test> |
| 183 | ········</cpe-lang:platform> | 183 | ········</cpe-lang:platform> |
| 184 | ········<cpe-lang:platform·id="gdm"> | 184 | ········<cpe-lang:platform·id="gdm"> |
| 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 187 | ··········</cpe-lang:logical-test> | 187 | ··········</cpe-lang:logical-test> |
| 188 | ········</cpe-lang:platform> | 188 | ········</cpe-lang:platform> |
| 189 | ········<cpe-lang:platform·id=" | 189 | ········<cpe-lang:platform·id="chrony"> |
| 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 191 | ············<cpe-lang:fact-ref·name="cpe:/a: | 191 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 192 | ··········</cpe-lang:logical-test> | 192 | ··········</cpe-lang:logical-test> |
| 193 | ········</cpe-lang:platform> | 193 | ········</cpe-lang:platform> |
| 194 | ········<cpe-lang:platform·id=" | 194 | ········<cpe-lang:platform·id="non-uefi"> |
| 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a: | 196 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 197 | ··········</cpe-lang:logical-test> | 197 | ··········</cpe-lang:logical-test> |
| 198 | ········</cpe-lang:platform> | 198 | ········</cpe-lang:platform> |
| 199 | ········<cpe-lang:platform·id=" | 199 | ········<cpe-lang:platform·id="ntp"> |
| 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 201 | ············<cpe-lang:fact-ref·name="cpe:/a: | 201 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 202 | ··········</cpe-lang:logical-test> | 202 | ··········</cpe-lang:logical-test> |
| 203 | ········</cpe-lang:platform> | 203 | ········</cpe-lang:platform> |
| 204 | ········<cpe-lang:platform·id=" | 204 | ········<cpe-lang:platform·id="grub2"> |
| 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 206 | ············<cpe-lang:fact-ref·name="cpe:/a: | 206 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 207 | ··········</cpe-lang:logical-test> | 207 | ··········</cpe-lang:logical-test> |
| 208 | ········</cpe-lang:platform> | 208 | ········</cpe-lang:platform> |
| 209 | ········<cpe-lang:platform·id="ntp"> | 209 | ········<cpe-lang:platform·id="net-snmp"> |
| 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 211 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:net-snmp"/> |
| 212 | ··········</cpe-lang:logical-test> | 212 | ··········</cpe-lang:logical-test> |
| 213 | ········</cpe-lang:platform> | 213 | ········</cpe-lang:platform> |
| 214 | ········<cpe-lang:platform·id=" | 214 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 216 | ············<cpe-lang:fact-ref·name="cpe:/a: | 216 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 217 | ··········</cpe-lang:logical-test> | 217 | ··········</cpe-lang:logical-test> |
| 218 | ········</cpe-lang:platform> | 218 | ········</cpe-lang:platform> |
| 219 | ········<cpe-lang:platform·id="audit"> | 219 | ········<cpe-lang:platform·id="audit"> |
| 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 221 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 222 | ··········</cpe-lang:logical-test> | 222 | ··········</cpe-lang:logical-test> |
| 223 | ········</cpe-lang:platform> | 223 | ········</cpe-lang:platform> |
| 224 | ········<cpe-lang:platform·id=" | 224 | ········<cpe-lang:platform·id="pam"> |
| 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a: | 226 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 227 | ··········</cpe-lang:logical-test> | 227 | ··········</cpe-lang:logical-test> |
| 228 | ········</cpe-lang:platform> | 228 | ········</cpe-lang:platform> |
| 229 | ········<cpe-lang:platform·id=" | 229 | ········<cpe-lang:platform·id="uefi"> |
| 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 231 | ············<cpe-lang:fact-ref·name="cpe:/a: | 231 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 232 | ··········</cpe-lang:logical-test> | 232 | ··········</cpe-lang:logical-test> |
| 233 | ········</cpe-lang:platform> | 233 | ········</cpe-lang:platform> |
| 234 | ········<cpe-lang:platform·id=" | 234 | ········<cpe-lang:platform·id="sssd"> |
| 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 236 | ············<cpe-lang:fact-ref·name="cpe:/a: | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 237 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 238 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 239 | ······</cpe-lang:platform-specification> | 239 | ······</cpe-lang:platform-specification> |
| 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:11"/> | 240 | ······<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:11"/> |
| 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 242 | ······<xccdf-1.2:metadata> | 242 | ······<xccdf-1.2:metadata> |
| 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 3303, 27 lines modified | Offset 3303, 14 lines modified | ||
| 3303 | in | 3303 | in |
| 3304 | ················<html:code>/etc/sudoers.d/</html:code> | 3304 | ················<html:code>/etc/sudoers.d/</html:code> |
| 3305 | ················. | 3305 | ················. |
| 3306 | ··············</xccdf-1.2:description> | 3306 | ··············</xccdf-1.2:description> |
| 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 3307 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 3308 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 3309 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 3310 | ··············<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 3311 | ··lineinfile: | ||
| 3312 | ····path:·/etc/sudoers | ||
| 3313 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 3314 | ····line:·Defaults·noexec | ||
| 3315 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| Max diff block lines reached; 1106383/1114996 bytes (99.23%) of diff not shown. | |||
| Offset 3, 3259 lines modified | Offset 3, 3259 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>Enable·PAM</ocil:title> | ||
| 11 | ······<ocil:title>Disable·Kerberos·Authentication</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 17 | ······<ocil:title>Disallow·Configuration·to·Bypass·Password·Requirements·for·Privilege·Escalation</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 23 | ······<ocil:title>Audit·Configuration·Files·Must·Be·Owned·By·Group·root</ocil:title> | ||
| 24 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 29 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 30 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"> | ||
| 35 | ····· | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>Ensure·auditd·Collects·Unauthorized·Access·Attempts·to·Files·(unsuccessful)</ocil:title> | ||
| 36 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"> |
| 41 | ······<ocil:title> | 29 | ······<ocil:title>Record·Attempts·to·Alter·Logon·and·Logout·Events·-·lastlog</ocil:title> |
| 42 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg- | 34 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 47 | ······<ocil:title> | 35 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 48 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 40 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 41 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 54 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 47 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> |
| 60 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_ | 52 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 53 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 66 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_ | 55 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_var_log_ocil:questionnaire:1"> | ||
| 71 | ···· | 58 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 59 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> | ||
| 72 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1"> | ||
| 77 | ···· | 64 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 65 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> | ||
| 78 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_ | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"> |
| 83 | ······<ocil:title>Disable· | 71 | ······<ocil:title>Disable·kernel·support·for·MISC·binaries</ocil:title> |
| 84 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_ | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1"> | ||
| 89 | ···· | 76 | ····<ocil:questionnaire·id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>Configure·System·to·Forward·All·Mail·From·Postmaster·to·The·Root·Account</ocil:title> | ||
| 90 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-s | 79 | ········<ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 83 | ······<ocil:title>Remove·Rsh·Trust·Files</ocil:title> |
| 96 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"> | ||
| 101 | ···· | 88 | ····<ocil:questionnaire·id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"> |
| 89 | ······<ocil:title>Verify·iptables·Enabled</ocil:title> | ||
| 102 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 95 | ······<ocil:title>Unmap·kernel·when·running·in·userspace·(aka·KAISER)</ocil:title> |
| 108 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg-accounts_passwords_pam_faillock_audit_ocil:questionnaire:1"> | ||
| 113 | ···· | 100 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Verify·Group·Who·Owns·Backup·gshadow·File</ocil:title> | ||
| 114 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 103 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg-accounts_max_concurrent_login_sessions_ocil:questionnaire:1"> | ||
| 119 | ···· | 106 | ····<ocil:questionnaire·id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Configure·L1·Terminal·Fault·mitigations</ocil:title> | ||
| 120 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| Max diff block lines reached; 694709/706376 bytes (98.35%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-11"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_DEBIAN-11"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·11</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Debian·11</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Debian·11.·It·is·a·rendering·of | 7 | configuration·settings·for·Debian·11.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 97 lines modified | Offset 47, 97 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 57 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 58 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 59 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 61 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 62 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 63 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 64 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 67 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 68 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 69 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 71 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 72 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 73 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 74 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 77 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 79 | ····<cpe-lang:platform·id="s390x_arch"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 82 | ······</cpe-lang:logical-test> | 82 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 83 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id="gdm"> | 84 | ····<cpe-lang:platform·id="gdm"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 87 | ······</cpe-lang:logical-test> | 87 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 88 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id=" | 89 | ····<cpe-lang:platform·id="chrony"> |
| 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a: | 91 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 92 | ······</cpe-lang:logical-test> | 92 | ······</cpe-lang:logical-test> |
| 93 | ····</cpe-lang:platform> | 93 | ····</cpe-lang:platform> |
| 94 | ····<cpe-lang:platform·id=" | 94 | ····<cpe-lang:platform·id="non-uefi"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a: | 96 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 97 | ······</cpe-lang:logical-test> | 97 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 98 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id=" | 99 | ····<cpe-lang:platform·id="ntp"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a: | 101 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 102 | ······</cpe-lang:logical-test> | 102 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 103 | ····</cpe-lang:platform> |
| 104 | ····<cpe-lang:platform·id=" | 104 | ····<cpe-lang:platform·id="grub2"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a: | 106 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 107 | ······</cpe-lang:logical-test> | 107 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 108 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id="ntp"> | 109 | ····<cpe-lang:platform·id="net-snmp"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | 111 | ········<cpe-lang:fact-ref·name="cpe:/a:net-snmp"/> |
| 112 | ······</cpe-lang:logical-test> | 112 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 113 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id=" | 114 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a: | 116 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 117 | ······</cpe-lang:logical-test> | 117 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 118 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id="audit"> | 119 | ····<cpe-lang:platform·id="audit"> |
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 121 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 122 | ······</cpe-lang:logical-test> | 122 | ······</cpe-lang:logical-test> |
| 123 | ····</cpe-lang:platform> | 123 | ····</cpe-lang:platform> |
| 124 | ····<cpe-lang:platform·id=" | 124 | ····<cpe-lang:platform·id="pam"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a: | 126 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 127 | ······</cpe-lang:logical-test> | 127 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 128 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 129 | ····<cpe-lang:platform·id="uefi"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 131 | ········<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 132 | ······</cpe-lang:logical-test> | 132 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 133 | ····</cpe-lang:platform> |
| 134 | ····<cpe-lang:platform·id=" | 134 | ····<cpe-lang:platform·id="sssd"> |
| 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a: | 136 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 137 | ······</cpe-lang:logical-test> | 137 | ······</cpe-lang:logical-test> |
| 138 | ····</cpe-lang:platform> | 138 | ····</cpe-lang:platform> |
| 139 | ··</cpe-lang:platform-specification> | 139 | ··</cpe-lang:platform-specification> |
| 140 | ··<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:11"/> | 140 | ··<xccdf-1.2:platform·idref="cpe:/o:debian:debian_linux:11"/> |
| 141 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 141 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 142 | ··<xccdf-1.2:metadata> | 142 | ··<xccdf-1.2:metadata> |
| 143 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 143 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 3203, 27 lines modified | Offset 3203, 14 lines modified | ||
| 3203 | in | 3203 | in |
| 3204 | ············<html:code>/etc/sudoers.d/</html:code> | 3204 | ············<html:code>/etc/sudoers.d/</html:code> |
| 3205 | ············. | 3205 | ············. |
| 3206 | ··········</xccdf-1.2:description> | 3206 | ··········</xccdf-1.2:description> |
| 3207 | ··········<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 3207 | ··········<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 3208 | ··········<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 3208 | ··········<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 3209 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 3209 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 3210 | ··········<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 3211 | ··lineinfile: | ||
| 3212 | ····path:·/etc/sudoers | ||
| 3213 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 3214 | ····line:·Defaults·noexec | ||
| 3215 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| 3216 | ··tags: | ||
| 3217 | ··-·high_severity | ||
| 3218 | ··-·low_complexity | ||
| 3219 | ··-·low_disruption | ||
| 3220 | ··-·no_reboot_needed | ||
| Max diff block lines reached; 361590/369512 bytes (97.86%) of diff not shown. | |||
| Offset 1, 3 lines modified | Offset 1, 3 lines modified | ||
| 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary | 1 | -rw-r--r--···0········0········0········4·2022-12-20·09:54:05.000000·debian-binary |
| 2 | -rw-r--r--···0········0········0····1544 | 2 | -rw-r--r--···0········0········0····15448·2022-12-20·09:54:05.000000·control.tar.xz |
| 3 | -rw-r--r--···0········0········0·404 | 3 | -rw-r--r--···0········0········0·40437604·2022-12-20·09:54:05.000000·data.tar.xz |
| Offset 14293, 16 lines modified | Offset 14293, 16 lines modified | ||
| 00037d40:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037d40:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037d50:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037d50:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037d60:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037d60:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037d70:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037d70:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037d80:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037d80:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037d90:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037d90:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037da0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037da0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037db0:·2861·7320·6f66·2032·3032·3 | 00037db0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037dc0:·3 | 00037dc0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037dd0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037dd0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037de0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037de0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037df0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037df0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037e00:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037e00:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037e10:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037e10:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037e20:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037e20:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037e30:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037e30:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 21109, 96 lines modified | Offset 21109, 96 lines modified | ||
| 00052740:·6765·743d·2223·6964·6d33·3630·3722·2074··get="#idm3607"·t | 00052740:·6765·743d·2223·6964·6d33·3630·3722·2074··get="#idm3607"·t | ||
| 00052750:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 00052750:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 00052760:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 00052760:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 00052770:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 00052770:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 00052780:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 00052780:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 00052790:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 00052790:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 000527a0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 000527a0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 000527b0:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 000527c0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 000527d0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 000527e0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 000527f0:·3d22·6964·6d33·3630·3722·3e3c·7461·626c··="idm3607"><tabl | |||
| 00052800:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 00052810:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 00052820:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 00052830:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 00052840:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 00052850:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 00052860:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 00052870:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 00052880:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 00052890:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 000528a0:·3c2f·7468·3e3c·7464·3e63·6f6e·6669·6775··</th><td>configu | |||
| 000528b0:·7265·3c2f·7464·3e3c·2f74·723e·3c2f·7461··re</td></tr></ta | |||
| 000528c0:·626c·653e·3c70·7265·3e3c·636f·6465·3e0a··ble><pre><code>. | |||
| 000528d0:·0a0a·6368·6772·7020·3020·2f65·7463·2f69··..chgrp·0·/etc/i | |||
| 000528e0:·7373·7565·0a3c·2f63·6f64·653e·3c2f·7072··ssue.</code></pr | |||
| 000528f0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 00052900:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 00052910:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 00052920:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 00052930:·6172·6765·743d·2223·6964·6d33·3630·3822··arget="#idm3608" | |||
| 00052940:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 00052950:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 00052960:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 00052970:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 00052980:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 00052990:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 00052 | 000529a0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | ||
| 00052 | 000529b0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 00052 | 000529c0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 00052 | 000529d0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 00052 | 000529e0:·6522·2069·643d·2269·646d·3336·3038·223e··e"·id="idm3608"> | ||
| 00052 | 000529f0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 00052 | 00052a00:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 00052 | 00052a10:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 00052 | 00052a20:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 00052 | 00052a30:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 00052 | 00052a40:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 00052 | 00052a50:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 00052 | 00052a60:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 00052 | 00052a70:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 00052 | 00052a80:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | ||
| 00052 | 00052a90:·7465·6779·3a3c·2f74·683e·3c74·643e·636f··tegy:</th><td>co | ||
| 00052 | 00052aa0:·6e66·6967·7572·653c·2f74·643e·3c2f·7472··nfigure</td></tr | ||
| 00052 | 00052ab0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | ||
| 00052 | 00052ac0:·6f64·653e·2d20·6e61·6d65·3a20·5465·7374··ode>-·name:·Test | ||
| 00052 | 00052ad0:·2066·6f72·2065·7869·7374·656e·6365·202f···for·existence·/ | ||
| 00052 | 00052ae0:·6574·632f·6973·7375·650a·2020·7374·6174··etc/issue.··stat | ||
| 00052 | 00052af0:·3a0a·2020·2020·7061·7468·3a20·2f65·7463··:.····path:·/etc | ||
| 00052 | 00052b00:·2f69·7373·7565·0a20·2072·6567·6973·7465··/issue.··registe | ||
| 00052 | 00052b10:·723a·2066·696c·655f·6578·6973·7473·0a20··r:·file_exists.· | ||
| 00052 | 00052b20:·2074·6167·733a·0a20·202d·2063·6f6e·6669···tags:.··-·confi | ||
| 00052 | 00052b30:·6775·7265·5f73·7472·6174·6567·790a·2020··gure_strategy.·· | ||
| 00052 | 00052b40:·2d20·6669·6c65·5f67·726f·7570·6f77·6e65··-·file_groupowne | ||
| 00052 | 00052b50:·725f·6574·635f·6973·7375·650a·2020·2d20··r_etc_issue.··-· | ||
| 00052970:·775f·636f·6d70·6c65·7869·7479·0a20·202d··w_complexity.··- | |||
| 00052980:·206c·6f77·5f64·6973·7275·7074·696f·6e0a···low_disruption. | |||
| 00052990:·2020·2d20·6d65·6469·756d·5f73·6576·6572····-·medium_sever | |||
| 000529a0:·6974·790a·2020·2d20·6e6f·5f72·6562·6f6f··ity.··-·no_reboo | |||
| 000529b0:·745f·6e65·6564·6564·0a0a·2d20·6e61·6d65··t_needed..-·name | |||
| 000529c0:·3a20·456e·7375·7265·2067·726f·7570·206f··:·Ensure·group·o | |||
| 000529d0:·776e·6572·2030·206f·6e20·2f65·7463·2f69··wner·0·on·/etc/i | |||
| 000529e0:·7373·7565·0a20·2066·696c·653a·0a20·2020··ssue.··file:.··· | |||
| 000529f0:·2070·6174·683a·202f·6574·632f·6973·7375···path:·/etc/issu | |||
| 00052a00:·650a·2020·2020·6772·6f75·703a·2027·3027··e.····group:·'0' | |||
| 00052a10:·0a20·2077·6865·6e3a·2066·696c·655f·6578··.··when:·file_ex | |||
| 00052a20:·6973·7473·2e73·7461·7420·6973·2064·6566··ists.stat·is·def | |||
| 00052a30:·696e·6564·2061·6e64·2066·696c·655f·6578··ined·and·file_ex | |||
| 00052a40:·6973·7473·2e73·7461·742e·6578·6973·7473··ists.stat.exists | |||
| 00052a50:·0a20·2074·6167·733a·0a20·202d·2063·6f6e··.··tags:.··-·con | |||
| 00052a60:·6669·6775·7265·5f73·7472·6174·6567·790a··figure_strategy. | |||
| 00052a70:·2020·2d20·6669·6c65·5f67·726f·7570·6f77····-·file_groupow | |||
| 00052a80:·6e65·725f·6574·635f·6973·7375·650a·2020··ner_etc_issue.·· | |||
| 00052 | 00052b60:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | ||
| 00052 | 00052b70:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | ||
| 00052 | 00052b80:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | ||
| 00052b90:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 00052ba0:·6f6f·745f·6e65·6564·6564·0a0a·2d20·6e61··oot_needed..-·na | |||
| 00052bb0:·6d65·3a20·456e·7375·7265·2067·726f·7570··me:·Ensure·group | |||
| 00052bc0:·206f·776e·6572·2030·206f·6e20·2f65·7463···owner·0·on·/etc | |||
| 00052bd0:·2f69·7373·7565·0a20·2066·696c·653a·0a20··/issue.··file:.· | |||
| 00052be0:·2020·2070·6174·683a·202f·6574·632f·6973·····path:·/etc/is | |||
| 00052bf0:·7375·650a·2020·2020·6772·6f75·703a·2027··sue.····group:·' | |||
| 00052c00:·3027·0a20·2077·6865·6e3a·2066·696c·655f··0'.··when:·file_ | |||
| 00052c10:·6578·6973·7473·2e73·7461·7420·6973·2064··exists.stat·is·d | |||
| 00052c20:·6566·696e·6564·2061·6e64·2066·696c·655f··efined·and·file_ | |||
| 00052c30:·6578·6973·7473·2e73·7461·742e·6578·6973··exists.stat.exis | |||
| 00052c40:·7473·0a20·2074·6167·733a·0a20·202d·2063··ts.··tags:.··-·c | |||
| 00052c50:·6f6e·6669·6775·7265·5f73·7472·6174·6567··onfigure_strateg | |||
| 00052c60:·790a·2020·2d20·6669·6c65·5f67·726f·7570··y.··-·file_group | |||
| 00052c70:·6f77·6e65·725f·6574·635f·6973·7375·650a··owner_etc_issue. | |||
| 00052c80:·2020·2d20·6c6f·775f·636f·6d70·6c65·7869····-·low_complexi | |||
| 00052c90:·7479·0a20·202d·206c·6f77·5f64·6973·7275··ty.··-·low_disru | |||
| 00052ca0:·7074·696f·6e0a·2020·2d20·6d65·6469·756d··ption.··-·medium | |||
| 00052 | 00052cb0:·5f73·6576·6572·6974·790a·2020·2d20·6e6f··_severity.··-·no | ||
| 00052 | 00052cc0:·5f72·6562·6f6f·745f·6e65·6564·6564·0a3c··_reboot_needed.< | ||
| 00052ae0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 00052af0:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 00052b00:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| Max diff block lines reached; 2240430/2253592 bytes (99.42%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | *****·Profile·Information·***** | 39 | *****·Profile·Information·***** |
| 40 | Profile·Title·CIS·Aliyun·Linux·2·Benchmark·for·Level·2 | 40 | Profile·Title·CIS·Aliyun·Linux·2·Benchmark·for·Level·2 |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_cis | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_cis |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:2 | 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:2 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·Account_and_Access_Control | 50 | ·········2.·Account_and_Access_Control |
| 51 | ·········3.·System_Accounting_with_auditd | 51 | ·········3.·System_Accounting_with_auditd |
| 52 | ·········4.·GRUB2_bootloader_configuration | 52 | ·········4.·GRUB2_bootloader_configuration |
| 53 | ·········5.·Configure_Syslog | 53 | ·········5.·Configure_Syslog |
| Offset 676, 14 lines modified | Offset 676, 22 lines modified | ||
| 676 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent | 676 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent |
| 677 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, | 677 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, |
| 678 | ···························standards,·and·guidance. | 678 | ···························standards,·and·guidance. |
| 679 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. | 679 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. |
| 680 | Severity: ················medium | 680 | Severity: ················medium |
| 681 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue | 681 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue |
| 682 | Identifiers·and·References·References: ·1.7.1.5 | 682 | Identifiers·and·References·References: ·1.7.1.5 |
| 683 | Remediation_Shell_script_⇲ | ||
| 684 | Complexity:·low | ||
| 685 | Disruption:·low | ||
| 686 | Strategy:···configure | ||
| 687 | chgrp·0·/etc/issue | ||
| 683 | Remediation_Ansible_snippet_⇲ | 688 | Remediation_Ansible_snippet_⇲ |
| 684 | Complexity:·low | 689 | Complexity:·low |
| 685 | Disruption:·low | 690 | Disruption:·low |
| 686 | Strategy:···configure | 691 | Strategy:···configure |
| 687 | -·name:·Test·for·existence·/etc/issue | 692 | -·name:·Test·for·existence·/etc/issue |
| 688 | ··stat: | 693 | ··stat: |
| 689 | ····path:·/etc/issue | 694 | ····path:·/etc/issue |
| Offset 704, 33 lines modified | Offset 712, 33 lines modified | ||
| 704 | ··tags: | 712 | ··tags: |
| 705 | ··-·configure_strategy | 713 | ··-·configure_strategy |
| 706 | ··-·file_groupowner_etc_issue | 714 | ··-·file_groupowner_etc_issue |
| 707 | ··-·low_complexity | 715 | ··-·low_complexity |
| 708 | ··-·low_disruption | 716 | ··-·low_disruption |
| 709 | ··-·medium_severity | 717 | ··-·medium_severity |
| 710 | ··-·no_reboot_needed | 718 | ··-·no_reboot_needed |
| 711 | Remediation_Shell_script_⇲ | ||
| 712 | Complexity:·low | ||
| 713 | Disruption:·low | ||
| 714 | Strategy:···configure | ||
| 715 | chgrp·0·/etc/issue | ||
| 716 | ***·Rule ·Verify·Group·Ownership·of·Message·of·the·Day·Banner· [ref]·*** | 719 | ***·Rule ·Verify·Group·Ownership·of·Message·of·the·Day·Banner· [ref]·*** |
| 717 | To·properly·set·the·group·owner·of·/etc/motd,·run·the·command: | 720 | To·properly·set·the·group·owner·of·/etc/motd,·run·the·command: |
| 718 | $·sudo·chgrp·root·/etc/motd | 721 | $·sudo·chgrp·root·/etc/motd |
| 719 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the | 722 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the |
| 720 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent | 723 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent |
| 721 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, | 724 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, |
| 722 | ···························standards,·and·guidance. | 725 | ···························standards,·and·guidance. |
| 723 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. | 726 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. |
| 724 | Severity: ················medium | 727 | Severity: ················medium |
| 725 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd | 728 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd |
| 726 | Identifiers·and·References·References: ·1.7.1.4 | 729 | Identifiers·and·References·References: ·1.7.1.4 |
| 730 | Remediation_Shell_script_⇲ | ||
| 731 | Complexity:·low | ||
| 732 | Disruption:·low | ||
| 733 | Strategy:···configure | ||
| 734 | chgrp·0·/etc/motd | ||
| 727 | Remediation_Ansible_snippet_⇲ | 735 | Remediation_Ansible_snippet_⇲ |
| 728 | Complexity:·low | 736 | Complexity:·low |
| 729 | Disruption:·low | 737 | Disruption:·low |
| 730 | Strategy:···configure | 738 | Strategy:···configure |
| 731 | -·name:·Test·for·existence·/etc/motd | 739 | -·name:·Test·for·existence·/etc/motd |
| 732 | ··stat: | 740 | ··stat: |
| 733 | ····path:·/etc/motd | 741 | ····path:·/etc/motd |
| Offset 751, 33 lines modified | Offset 759, 33 lines modified | ||
| 751 | ··tags: | 759 | ··tags: |
| 752 | ··-·configure_strategy | 760 | ··-·configure_strategy |
| 753 | ··-·file_groupowner_etc_motd | 761 | ··-·file_groupowner_etc_motd |
| 754 | ··-·low_complexity | 762 | ··-·low_complexity |
| 755 | ··-·low_disruption | 763 | ··-·low_disruption |
| 756 | ··-·medium_severity | 764 | ··-·medium_severity |
| 757 | ··-·no_reboot_needed | 765 | ··-·no_reboot_needed |
| 758 | Remediation_Shell_script_⇲ | ||
| 759 | Complexity:·low | ||
| 760 | Disruption:·low | ||
| 761 | Strategy:···configure | ||
| 762 | chgrp·0·/etc/motd | ||
| 763 | ***·Rule ·Verify·ownership·of·System·Login·Banner· [ref]·*** | 766 | ***·Rule ·Verify·ownership·of·System·Login·Banner· [ref]·*** |
| 764 | To·properly·set·the·owner·of·/etc/issue,·run·the·command: | 767 | To·properly·set·the·owner·of·/etc/issue,·run·the·command: |
| 765 | $·sudo·chown·root·/etc/issue | 768 | $·sudo·chown·root·/etc/issue |
| 766 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the | 769 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the |
| 767 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent | 770 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent |
| 768 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, | 771 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, |
| 769 | ···························standards,·and·guidance. | 772 | ···························standards,·and·guidance. |
| 770 | ···························Proper·ownership·will·ensure·that·only·root·user·can·modify·the·banner. | 773 | ···························Proper·ownership·will·ensure·that·only·root·user·can·modify·the·banner. |
| 771 | Severity: ················medium | 774 | Severity: ················medium |
| 772 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_owner_etc_issue | 775 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_owner_etc_issue |
| 773 | Identifiers·and·References·References: ·1.7.1.5 | 776 | Identifiers·and·References·References: ·1.7.1.5 |
| 777 | Remediation_Shell_script_⇲ | ||
| 778 | Complexity:·low | ||
| 779 | Disruption:·low | ||
| 780 | Strategy:···configure | ||
| 781 | chown·0·/etc/issue | ||
| 774 | Remediation_Ansible_snippet_⇲ | 782 | Remediation_Ansible_snippet_⇲ |
| 775 | Complexity:·low | 783 | Complexity:·low |
| 776 | Disruption:·low | 784 | Disruption:·low |
| 777 | Strategy:···configure | 785 | Strategy:···configure |
| 778 | -·name:·Test·for·existence·/etc/issue | 786 | -·name:·Test·for·existence·/etc/issue |
| 779 | ··stat: | 787 | ··stat: |
| 780 | ····path:·/etc/issue | 788 | ····path:·/etc/issue |
| Offset 798, 33 lines modified | Offset 806, 33 lines modified | ||
| 798 | ··tags: | 806 | ··tags: |
| 799 | ··-·configure_strategy | 807 | ··-·configure_strategy |
| 800 | ··-·file_owner_etc_issue | 808 | ··-·file_owner_etc_issue |
| 801 | ··-·low_complexity | 809 | ··-·low_complexity |
| Max diff block lines reached; 272035/276356 bytes (98.44%) of diff not shown. | |||
| Offset 14293, 16 lines modified | Offset 14293, 16 lines modified | ||
| 00037d40:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00037d40:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00037d50:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00037d50:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00037d60:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00037d60:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00037d70:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00037d70:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00037d80:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00037d80:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00037d90:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00037d90:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00037da0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037da0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037db0:·2020·2028·6173·206f·6620·3230·323 | 00037db0:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00037dc0:·3 | 00037dc0:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00037dd0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00037dd0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00037de0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00037de0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00037df0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00037df0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00037e00:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00037e00:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00037e10:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00037e10:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00037e20:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00037e20:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00037e30:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00037e30:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 19558, 97 lines modified | Offset 19558, 97 lines modified | ||
| 0004c650:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0004c650:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0004c660:·6964·6d33·3630·3722·2074·6162·696e·6465··idm3607"·tabinde | 0004c660:·6964·6d33·3630·3722·2074·6162·696e·6465··idm3607"·tabinde | ||
| 0004c670:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0004c670:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0004c680:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0004c680:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0004c690:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0004c690:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0004c6a0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0004c6a0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0004c6b0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0004c6b0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0004c6c0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| 0004c6d0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0004c6e0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0004c6f0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0004c700:·6c6c·6170·7365·2220·6964·3d22·6964·6d33··llapse"·id="idm3 | |||
| 0004c710:·3630·3722·3e3c·7461·626c·6520·636c·6173··607"><table·clas | |||
| 0004c720:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0004c730:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0004c740:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0004c750:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0004c760:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0004c770:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0004c780:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0004c790:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0004c7a0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0004c7b0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0004c7c0:·7464·3e63·6f6e·6669·6775·7265·3c2f·7464··td>configure</td | |||
| 0004c7d0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0004c7e0:·7265·3e3c·636f·6465·3e0a·0a0a·6368·6772··re><code>...chgr | |||
| 0004c7f0:·7020·3020·2f65·7463·2f69·7373·7565·0a3c··p·0·/etc/issue.< | |||
| 0004c800:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0004c810:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0004c820:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0004c830:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0004c840:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0004c850:·2223·6964·6d33·3630·3822·2074·6162·696e··"#idm3608"·tabin | |||
| 0004c860:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0004c870:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0004c880:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0004c890:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0004c8a0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0004c | 0004c8b0:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | ||
| 0004c | 0004c8c0:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | ||
| 0004c | 0004c8d0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 0004c | 0004c8e0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 0004c | 0004c8f0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 0004c | 0004c900:·2269·646d·3336·3038·223e·3c74·6162·6c65··"idm3608"><table | ||
| 0004c | 0004c910:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 0004c | 0004c920:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 0004c | 0004c930:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 0004c | 0004c940:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 0004c | 0004c950:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 0004c | 0004c960:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0004c | 0004c970:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 0004c | 0004c980:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 0004c | 0004c990:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0004c | 0004c9a0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 0004c | 0004c9b0:·2f74·683e·3c74·643e·636f·6e66·6967·7572··/th><td>configur | ||
| 0004c | 0004c9c0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | ||
| 0004c | 0004c9d0:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | ||
| 0004c | 0004c9e0:·6e61·6d65·3a20·5465·7374·2066·6f72·2065··name:·Test·for·e | ||
| 0004c | 0004c9f0:·7869·7374·656e·6365·202f·6574·632f·6973··xistence·/etc/is | ||
| 0004c | 0004ca00:·7375·650a·2020·7374·6174·3a0a·2020·2020··sue.··stat:.···· | ||
| 0004c | 0004ca10:·7061·7468·3a20·2f65·7463·2f69·7373·7565··path:·/etc/issue | ||
| 0004c | 0004ca20:·0a20·2072·6567·6973·7465·723a·2066·696c··.··register:·fil | ||
| 0004c | 0004ca30:·655f·6578·6973·7473·0a20·2074·6167·733a··e_exists.··tags: | ||
| 0004c | 0004ca40:·0a20·202d·2063·6f6e·6669·6775·7265·5f73··.··-·configure_s | ||
| 0004c | 0004ca50:·7472·6174·6567·790a·2020·2d20·6669·6c65··trategy.··-·file | ||
| 0004c | 0004ca60:·5f67·726f·7570·6f77·6e65·725f·6574·635f··_groupowner_etc_ | ||
| 0004c880:·7375·650a·2020·2d20·6c6f·775f·636f·6d70··sue.··-·low_comp | |||
| 0004c890:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0004c8a0:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0004c8b0:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0004c8c0:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0004c8d0:·6564·0a0a·2d20·6e61·6d65·3a20·456e·7375··ed..-·name:·Ensu | |||
| 0004c8e0:·7265·2067·726f·7570·206f·776e·6572·2030··re·group·owner·0 | |||
| 0004c8f0:·206f·6e20·2f65·7463·2f69·7373·7565·0a20···on·/etc/issue.· | |||
| 0004c900:·2066·696c·653a·0a20·2020·2070·6174·683a···file:.····path: | |||
| 0004c910:·202f·6574·632f·6973·7375·650a·2020·2020···/etc/issue.···· | |||
| 0004c920:·6772·6f75·703a·2027·3027·0a20·2077·6865··group:·'0'.··whe | |||
| 0004c930:·6e3a·2066·696c·655f·6578·6973·7473·2e73··n:·file_exists.s | |||
| 0004c940:·7461·7420·6973·2064·6566·696e·6564·2061··tat·is·defined·a | |||
| 0004c950:·6e64·2066·696c·655f·6578·6973·7473·2e73··nd·file_exists.s | |||
| 0004c960:·7461·742e·6578·6973·7473·0a20·2074·6167··tat.exists.··tag | |||
| 0004c970:·733a·0a20·202d·2063·6f6e·6669·6775·7265··s:.··-·configure | |||
| 0004c980:·5f73·7472·6174·6567·790a·2020·2d20·6669··_strategy.··-·fi | |||
| 0004c990:·6c65·5f67·726f·7570·6f77·6e65·725f·6574··le_groupowner_et | |||
| 0004c | 0004ca70:·6973·7375·650a·2020·2d20·6c6f·775f·636f··issue.··-·low_co | ||
| 0004c | 0004ca80:·6d70·6c65·7869·7479·0a20·202d·206c·6f77··mplexity.··-·low | ||
| 0004c | 0004ca90:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | ||
| 0004c | 0004caa0:·6d65·6469·756d·5f73·6576·6572·6974·790a··medium_severity. | ||
| 0004c | 0004cab0:·2020·2d20·6e6f·5f72·6562·6f6f·745f·6e65····-·no_reboot_ne | ||
| 0004cac0:·6564·6564·0a0a·2d20·6e61·6d65·3a20·456e··eded..-·name:·En | |||
| 0004cad0:·7375·7265·2067·726f·7570·206f·776e·6572··sure·group·owner | |||
| 0004cae0:·2030·206f·6e20·2f65·7463·2f69·7373·7565···0·on·/etc/issue | |||
| 0004caf0:·0a20·2066·696c·653a·0a20·2020·2070·6174··.··file:.····pat | |||
| 0004cb00:·683a·202f·6574·632f·6973·7375·650a·2020··h:·/etc/issue.·· | |||
| 0004cb10:·2020·6772·6f75·703a·2027·3027·0a20·2077····group:·'0'.··w | |||
| 0004cb20:·6865·6e3a·2066·696c·655f·6578·6973·7473··hen:·file_exists | |||
| 0004cb30:·2e73·7461·7420·6973·2064·6566·696e·6564··.stat·is·defined | |||
| 0004cb40:·2061·6e64·2066·696c·655f·6578·6973·7473···and·file_exists | |||
| 0004cb50:·2e73·7461·742e·6578·6973·7473·0a20·2074··.stat.exists.··t | |||
| 0004cb60:·6167·733a·0a20·202d·2063·6f6e·6669·6775··ags:.··-·configu | |||
| 0004cb70:·7265·5f73·7472·6174·6567·790a·2020·2d20··re_strategy.··-· | |||
| 0004cb80:·6669·6c65·5f67·726f·7570·6f77·6e65·725f··file_groupowner_ | |||
| 0004cb90:·6574·635f·6973·7375·650a·2020·2d20·6c6f··etc_issue.··-·lo | |||
| 0004cba0:·775f·636f·6d70·6c65·7869·7479·0a20·202d··w_complexity.··- | |||
| 0004cbb0:·206c·6f77·5f64·6973·7275·7074·696f·6e0a···low_disruption. | |||
| 0004cbc0:·2020·2d20·6d65·6469·756d·5f73·6576·6572····-·medium_sever | |||
| 0004cbd0:·6974·790a·2020·2d20·6e6f·5f72·6562·6f6f··ity.··-·no_reboo | |||
| 0004c | 0004cbe0:·745f·6e65·6564·6564·0a3c·2f63·6f64·653e··t_needed.</code> | ||
| 0004ca00:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0004ca10:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| Max diff block lines reached; 2183425/2196725 bytes (99.39%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | *****·Profile·Information·***** | 39 | *****·Profile·Information·***** |
| 40 | Profile·Title·CIS·Aliyun·Linux·2·Benchmark·for·Level·1 | 40 | Profile·Title·CIS·Aliyun·Linux·2·Benchmark·for·Level·1 |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_l1 | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_l1 |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:2 | 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:2 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·Account_and_Access_Control | 50 | ·········2.·Account_and_Access_Control |
| 51 | ·········3.·GRUB2_bootloader_configuration | 51 | ·········3.·GRUB2_bootloader_configuration |
| 52 | ·········4.·Configure_Syslog | 52 | ·········4.·Configure_Syslog |
| 53 | ·········5.·Network_Configuration_and_Firewalls | 53 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 617, 14 lines modified | Offset 617, 22 lines modified | ||
| 617 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent | 617 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent |
| 618 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, | 618 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, |
| 619 | ···························standards,·and·guidance. | 619 | ···························standards,·and·guidance. |
| 620 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. | 620 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. |
| 621 | Severity: ················medium | 621 | Severity: ················medium |
| 622 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue | 622 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue |
| 623 | Identifiers·and·References·References: ·1.7.1.5 | 623 | Identifiers·and·References·References: ·1.7.1.5 |
| 624 | Remediation_Shell_script_⇲ | ||
| 625 | Complexity:·low | ||
| 626 | Disruption:·low | ||
| 627 | Strategy:···configure | ||
| 628 | chgrp·0·/etc/issue | ||
| 624 | Remediation_Ansible_snippet_⇲ | 629 | Remediation_Ansible_snippet_⇲ |
| 625 | Complexity:·low | 630 | Complexity:·low |
| 626 | Disruption:·low | 631 | Disruption:·low |
| 627 | Strategy:···configure | 632 | Strategy:···configure |
| 628 | -·name:·Test·for·existence·/etc/issue | 633 | -·name:·Test·for·existence·/etc/issue |
| 629 | ··stat: | 634 | ··stat: |
| 630 | ····path:·/etc/issue | 635 | ····path:·/etc/issue |
| Offset 645, 33 lines modified | Offset 653, 33 lines modified | ||
| 645 | ··tags: | 653 | ··tags: |
| 646 | ··-·configure_strategy | 654 | ··-·configure_strategy |
| 647 | ··-·file_groupowner_etc_issue | 655 | ··-·file_groupowner_etc_issue |
| 648 | ··-·low_complexity | 656 | ··-·low_complexity |
| 649 | ··-·low_disruption | 657 | ··-·low_disruption |
| 650 | ··-·medium_severity | 658 | ··-·medium_severity |
| 651 | ··-·no_reboot_needed | 659 | ··-·no_reboot_needed |
| 652 | Remediation_Shell_script_⇲ | ||
| 653 | Complexity:·low | ||
| 654 | Disruption:·low | ||
| 655 | Strategy:···configure | ||
| 656 | chgrp·0·/etc/issue | ||
| 657 | ***·Rule ·Verify·Group·Ownership·of·Message·of·the·Day·Banner· [ref]·*** | 660 | ***·Rule ·Verify·Group·Ownership·of·Message·of·the·Day·Banner· [ref]·*** |
| 658 | To·properly·set·the·group·owner·of·/etc/motd,·run·the·command: | 661 | To·properly·set·the·group·owner·of·/etc/motd,·run·the·command: |
| 659 | $·sudo·chgrp·root·/etc/motd | 662 | $·sudo·chgrp·root·/etc/motd |
| 660 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the | 663 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the |
| 661 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent | 664 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent |
| 662 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, | 665 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, |
| 663 | ···························standards,·and·guidance. | 666 | ···························standards,·and·guidance. |
| 664 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. | 667 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the·banner. |
| 665 | Severity: ················medium | 668 | Severity: ················medium |
| 666 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd | 669 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd |
| 667 | Identifiers·and·References·References: ·1.7.1.4 | 670 | Identifiers·and·References·References: ·1.7.1.4 |
| 671 | Remediation_Shell_script_⇲ | ||
| 672 | Complexity:·low | ||
| 673 | Disruption:·low | ||
| 674 | Strategy:···configure | ||
| 675 | chgrp·0·/etc/motd | ||
| 668 | Remediation_Ansible_snippet_⇲ | 676 | Remediation_Ansible_snippet_⇲ |
| 669 | Complexity:·low | 677 | Complexity:·low |
| 670 | Disruption:·low | 678 | Disruption:·low |
| 671 | Strategy:···configure | 679 | Strategy:···configure |
| 672 | -·name:·Test·for·existence·/etc/motd | 680 | -·name:·Test·for·existence·/etc/motd |
| 673 | ··stat: | 681 | ··stat: |
| 674 | ····path:·/etc/motd | 682 | ····path:·/etc/motd |
| Offset 692, 33 lines modified | Offset 700, 33 lines modified | ||
| 692 | ··tags: | 700 | ··tags: |
| 693 | ··-·configure_strategy | 701 | ··-·configure_strategy |
| 694 | ··-·file_groupowner_etc_motd | 702 | ··-·file_groupowner_etc_motd |
| 695 | ··-·low_complexity | 703 | ··-·low_complexity |
| 696 | ··-·low_disruption | 704 | ··-·low_disruption |
| 697 | ··-·medium_severity | 705 | ··-·medium_severity |
| 698 | ··-·no_reboot_needed | 706 | ··-·no_reboot_needed |
| 699 | Remediation_Shell_script_⇲ | ||
| 700 | Complexity:·low | ||
| 701 | Disruption:·low | ||
| 702 | Strategy:···configure | ||
| 703 | chgrp·0·/etc/motd | ||
| 704 | ***·Rule ·Verify·ownership·of·System·Login·Banner· [ref]·*** | 707 | ***·Rule ·Verify·ownership·of·System·Login·Banner· [ref]·*** |
| 705 | To·properly·set·the·owner·of·/etc/issue,·run·the·command: | 708 | To·properly·set·the·owner·of·/etc/issue,·run·the·command: |
| 706 | $·sudo·chown·root·/etc/issue | 709 | $·sudo·chown·root·/etc/issue |
| 707 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the | 710 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting·access·to·the |
| 708 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent | 711 | ···························operating·system·ensures·privacy·and·security·notification·verbiage·used·is·consistent |
| 709 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, | 712 | Rationale:·················with·applicable·federal·laws,·Executive·Orders,·directives,·policies,·regulations, |
| 710 | ···························standards,·and·guidance. | 713 | ···························standards,·and·guidance. |
| 711 | ···························Proper·ownership·will·ensure·that·only·root·user·can·modify·the·banner. | 714 | ···························Proper·ownership·will·ensure·that·only·root·user·can·modify·the·banner. |
| 712 | Severity: ················medium | 715 | Severity: ················medium |
| 713 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_owner_etc_issue | 716 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_owner_etc_issue |
| 714 | Identifiers·and·References·References: ·1.7.1.5 | 717 | Identifiers·and·References·References: ·1.7.1.5 |
| 718 | Remediation_Shell_script_⇲ | ||
| 719 | Complexity:·low | ||
| 720 | Disruption:·low | ||
| 721 | Strategy:···configure | ||
| 722 | chown·0·/etc/issue | ||
| 715 | Remediation_Ansible_snippet_⇲ | 723 | Remediation_Ansible_snippet_⇲ |
| 716 | Complexity:·low | 724 | Complexity:·low |
| 717 | Disruption:·low | 725 | Disruption:·low |
| 718 | Strategy:···configure | 726 | Strategy:···configure |
| 719 | -·name:·Test·for·existence·/etc/issue | 727 | -·name:·Test·for·existence·/etc/issue |
| 720 | ··stat: | 728 | ··stat: |
| 721 | ····path:·/etc/issue | 729 | ····path:·/etc/issue |
| Offset 739, 33 lines modified | Offset 747, 33 lines modified | ||
| 739 | ··tags: | 747 | ··tags: |
| 740 | ··-·configure_strategy | 748 | ··-·configure_strategy |
| 741 | ··-·file_owner_etc_issue | 749 | ··-·file_owner_etc_issue |
| 742 | ··-·low_complexity | 750 | ··-·low_complexity |
| Max diff block lines reached; 264053/268383 bytes (98.39%) of diff not shown. | |||
| Offset 14290, 15 lines modified | Offset 14290, 15 lines modified | ||
| 00037d10:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037d10:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037d20:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037d20:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037d30:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037d30:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037d40:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037d40:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037d50:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037d50:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037d60:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037d60:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037d70:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037d70:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037d80:·3 | 00037d80:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037d90:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037d90:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037da0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037da0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037db0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037db0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037dc0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037dc0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037dd0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037dd0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037de0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037de0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037df0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037df0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 17337, 168 lines modified | Offset 17337, 168 lines modified | ||
| 00043b80:·7461·7267·6574·3d22·2369·646d·3231·3433··target="#idm2143 | 00043b80:·7461·7267·6574·3d22·2369·646d·3231·3433··target="#idm2143 | ||
| 00043b90:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 00043b90:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 00043ba0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 00043ba0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 00043bb0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 00043bb0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 00043bc0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 00043bc0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 00043bd0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 00043bd0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 00043be0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 00043be0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 00043bf0:·696f·6e20·5368·656c·6c20·7363·7269·7074··ion·Shell·script | |||
| 00043c00:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 00043c10:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 00043c20:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 00043c30:·2069·643d·2269·646d·3231·3433·223e·3c70···id="idm2143"><p | |||
| 00043c40:·7265·3e3c·636f·6465·3e0a·7661·725f·7379··re><code>.var_sy | |||
| 00043c50:·7374·656d·5f63·7279·7074·6f5f·706f·6c69··stem_crypto_poli | |||
| 00043c60:·6379·3d27·3c61·6262·7220·7469·746c·653d··cy='<abbr·title= | |||
| 00043c70:·2266·726f·6d20·4265·6e63·686d·6172·6b2f··"from·Benchmark/ | |||
| 00043c80:·5661·6c75·653a·2078·6363·6466·5f6f·7267··Value:·xccdf_org | |||
| 00043c90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | |||
| 00043ca0:·656e·745f·7661·6c75·655f·7661·725f·7379··ent_value_var_sy | |||
| 00043cb0:·7374·656d·5f63·7279·7074·6f5f·706f·6c69··stem_crypto_poli | |||
| 00043cc0:·6379·223e·4445·4641·554c·543c·2f61·6262··cy">DEFAULT</abb | |||
| 00043cd0:·723e·270a·0a0a·7374·6465·7272·5f6f·665f··r>'...stderr_of_ | |||
| 00043ce0:·6361·6c6c·3d24·2875·7064·6174·652d·6372··call=$(update-cr | |||
| 00043cf0:·7970·746f·2d70·6f6c·6963·6965·7320·2d2d··ypto-policies·-- | |||
| 00043d00:·7365·7420·247b·7661·725f·7379·7374·656d··set·${var_system | |||
| 00043bf0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 00043c00:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 00043c10:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 00043c20:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 00043c30:·7365·2220·6964·3d22·6964·6d32·3134·3322··se"·id="idm2143" | |||
| 00043c40:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 00043c50:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 00043c60:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 00043c70:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 00043c80:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 00043c90:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 00043ca0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 00043cb0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 00043cc0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 00043cd0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 00043ce0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 00043cf0:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 00043d00:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 00043d10:·6f64·653e·2d20·6e61·6d65·3a20·5843·4344··ode>-·name:·XCCD | |||
| 00043d20:·4620·5661·6c75·6520·7661·725f·7379·7374··F·Value·var_syst | |||
| 00043d | 00043d10:·5f63·7279·7074·6f5f·706f·6c69·6379·7d20··_crypto_policy}· | ||
| 00043d20:·3226·6774·3b26·616d·703b·3120·2667·743b··2>&1·> | |||
| 00043d30:·202f·6465·762f·6e75·6c6c·290a·7263·3d24···/dev/null).rc=$ | |||
| 00043d40:·3f0a·0a69·6620·7465·7374·2022·2472·6322··?..if·test·"$rc" | |||
| 00043d50:·203d·2031·3237·3b20·7468·656e·0a09·6563···=·127;·then..ec | |||
| 00043d60:·686f·2022·2473·7464·6572·725f·6f66·5f63··ho·"$stderr_of_c | |||
| 00043d70:·616c·6c22·2026·6774·3b26·616d·703b·320a··all"·>&2. | |||
| 00043d80:·0965·6368·6f20·224d·616b·6520·7375·7265··.echo·"Make·sure | |||
| 00043d90:·2074·6861·7420·7468·6520·7363·7269·7074···that·the·script | |||
| 00043da0:·2069·7320·696e·7374·616c·6c65·6420·6f6e···is·installed·on | |||
| 00043db0:·2074·6865·2072·656d·6564·6961·7465·6420···the·remediated· | |||
| 00043dc0:·7379·7374·656d·2e22·2026·6774·3b26·616d··system."·>&am | |||
| 00043dd0:·703b·320a·0965·6368·6f20·2253·6565·206f··p;2..echo·"See·o | |||
| 00043de0:·7574·7075·7420·6f66·2074·6865·2027·646e··utput·of·the·'dn | |||
| 00043df0:·6620·7072·6f76·6964·6573·2075·7064·6174··f·provides·updat | |||
| 00043d40:·2023·2070·726f·6d6f·7465·2074·6f20·7661···#·promote·to·va | |||
| 00043d50:·7269·6162·6c65·0a20·2073·6574·5f66·6163··riable.··set_fac | |||
| 00043d60:·743a·0a20·2020·2076·6172·5f73·7973·7465··t:.····var_syste | |||
| 00043d70:·6d5f·6372·7970·746f·5f70·6f6c·6963·793a··m_crypto_policy: | |||
| 00043d80:·2021·2173·7472·203c·6162·6272·2074·6974···!!str·<abbr·tit | |||
| 00043d90:·6c65·3d22·6672·6f6d·2042·656e·6368·6d61··le="from·Benchma | |||
| 00043da0:·726b·2f56·616c·7565·3a20·7863·6364·665f··rk/Value:·xccdf_ | |||
| 00043db0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | |||
| 00043dc0:·6f6e·7465·6e74·5f76·616c·7565·5f76·6172··ontent_value_var | |||
| 00043dd0:·5f73·7973·7465·6d5f·6372·7970·746f·5f70··_system_crypto_p | |||
| 00043de0:·6f6c·6963·7922·3e44·4546·4155·4c54·3c2f··olicy">DEFAULT</ | |||
| 00043df0:·6162·6272·3e0a·2020·7461·6773·3a0a·2020··abbr>.··tags:.·· | |||
| 00043e00:·2020·2d20·616c·7761·7973·0a0a·2d20·6e61····-·always..-·na | |||
| 00043e10:·6d65·3a20·436f·6e66·6967·7572·6520·5379··me:·Configure·Sy | |||
| 00043e20:·7374·656d·2043·7279·7074·6f67·7261·7068··stem·Cryptograph | |||
| 00043e30:·7920·506f·6c69·6379·0a20·206c·696e·6569··y·Policy.··linei | |||
| 00043e40:·6e66·696c·653a·0a20·2020·2070·6174·683a··nfile:.····path: | |||
| 00043e50:·202f·6574·632f·6372·7970·746f·2d70·6f6c···/etc/crypto-pol | |||
| 00043e60:·6963·6965·732f·636f·6e66·6967·0a20·2020··icies/config.··· | |||
| 00043e70:·2072·6567·6578·703a·205e·283f·2123·2928···regexp:·^(?!#)( | |||
| 00043e80:·5c53·2b29·240a·2020·2020·6c69·6e65·3a20··\S+)$.····line:· | |||
| 00043e90:·277b·7b20·7661·725f·7379·7374·656d·5f63··'{{·var_system_c | |||
| 00043ea0:·7279·7074·6f5f·706f·6c69·6379·207d·7d27··rypto_policy·}}' | |||
| 00043eb0:·0a20·2020·2063·7265·6174·653a·2074·7275··.····create:·tru | |||
| 00043ec0:·650a·2020·7461·6773·3a0a·2020·2d20·4e49··e.··tags:.··-·NI | |||
| 00043ed0:·5354·2d38·3030·2d35·332d·4143·2d31·3728··ST-800-53-AC-17( | |||
| 00043ee0:·3229·0a20·202d·204e·4953·542d·3830·302d··2).··-·NIST-800- | |||
| 00043ef0:·3533·2d41·432d·3137·2861·290a·2020·2d20··53-AC-17(a).··-· | |||
| 00043f00:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 00043f10:·2861·290a·2020·2d20·4e49·5354·2d38·3030··(a).··-·NIST-800 | |||
| 00043f20:·2d35·332d·4d41·2d34·2836·290a·2020·2d20··-53-MA-4(6).··-· | |||
| 00043f30:·4e49·5354·2d38·3030·2d35·332d·5343·2d31··NIST-800-53-SC-1 | |||
| 00043f40:·3228·3229·0a20·202d·204e·4953·542d·3830··2(2).··-·NIST-80 | |||
| 00043f50:·302d·3533·2d53·432d·3132·2833·290a·2020··0-53-SC-12(3).·· | |||
| 00043f60:·2d20·4e49·5354·2d38·3030·2d35·332d·5343··-·NIST-800-53-SC | |||
| 00043f70:·2d31·330a·2020·2d20·636f·6e66·6967·7572··-13.··-·configur | |||
| 00043f80:·655f·6372·7970·746f·5f70·6f6c·6963·790a··e_crypto_policy. | |||
| 00043f90:·2020·2d20·6869·6768·5f73·6576·6572·6974····-·high_severit | |||
| 00043fa0:·790a·2020·2d20·6c6f·775f·636f·6d70·6c65··y.··-·low_comple | |||
| 00043fb0:·7869·7479·0a20·202d·206c·6f77·5f64·6973··xity.··-·low_dis | |||
| 00043fc0:·7275·7074·696f·6e0a·2020·2d20·6e6f·5f72··ruption.··-·no_r | |||
| 00043fd0:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 00043fe0:·2072·6573·7472·6963·745f·7374·7261·7465···restrict_strate | |||
| 00043ff0:·6779·0a0a·2d20·6e61·6d65·3a20·5665·7269··gy..-·name:·Veri | |||
| 00044000:·6679·2074·6861·7420·4372·7970·746f·2050··fy·that·Crypto·P | |||
| 00044010:·6f6c·6963·7920·6973·2053·6574·2028·7275··olicy·is·Set·(ru | |||
| 00044020:·6e74·696d·6529·0a20·2063·6f6d·6d61·6e64··ntime).··command | |||
| 00044030:·3a20·2f75·7372·2f62·696e·2f75·7064·6174··:·/usr/bin/updat | |||
| 0004 | 00043e00:·652d·6372·7970·746f·2d70·6f6c·6963·6965··e-crypto-policie | ||
| 00044050:·7320·2d2d·7365·7420·7b7b·2076·6172·5f73··s·--set·{{·var_s | |||
| 00044060:·7973·7465·6d5f·6372·7970·746f·5f70·6f6c··ystem_crypto_pol | |||
| Max diff block lines reached; 81004/103966 bytes (77.91%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | *****·Profile·Information·***** | 39 | *****·Profile·Information·***** |
| 40 | Profile·Title·Standard·System·Security·Profile·for·Alibaba·Cloud·Linux·2 | 40 | Profile·Title·Standard·System·Security·Profile·for·Alibaba·Cloud·Linux·2 |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:2 | 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:2 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·System_Accounting_with_auditd | 50 | ·········2.·System_Accounting_with_auditd |
| 51 | ·········3.·Network_Configuration_and_Firewalls | 51 | ·········3.·Network_Configuration_and_Firewalls |
| 52 | ·········4.·File_Permissions_and_Masks | 52 | ·········4.·File_Permissions_and_Masks |
| 53 | ···2.·Services | 53 | ···2.·Services |
| Offset 322, 14 lines modified | Offset 322, 33 lines modified | ||
| 322 | Severity: ·high | 322 | Severity: ·high |
| 323 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy | 323 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 324 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2) | 324 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2) |
| 325 | Identifiers·(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a), | 325 | Identifiers·(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a), |
| 326 | and·········MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1 | 326 | and·········MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1 |
| 327 | References··(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS- | 327 | References··(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS- |
| 328 | ············00173,·SRG-OS-000394-GPOS-00174 | 328 | ············00173,·SRG-OS-000394-GPOS-00174 |
| 329 | Remediation_Shell_script_⇲ | ||
| 330 | var_system_crypto_policy='DEFAULT' | ||
| 331 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 332 | rc=$? | ||
| 333 | if·test·"$rc"·=·127;·then | ||
| 334 | » echo·"$stderr_of_call"·>&2 | ||
| 335 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 336 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 337 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 338 | » false··#·end·with·an·error·code | ||
| 339 | elif·test·"$rc"·!=·0;·then | ||
| 340 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 341 | » false··#·end·with·an·error·code | ||
| 342 | fi | ||
| 329 | Remediation_Ansible_snippet_⇲ | 343 | Remediation_Ansible_snippet_⇲ |
| 330 | Complexity:·low | 344 | Complexity:·low |
| 331 | Disruption:·low | 345 | Disruption:·low |
| 332 | Strategy:···restrict | 346 | Strategy:···restrict |
| 333 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable | 347 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable |
| 334 | ··set_fact: | 348 | ··set_fact: |
| 335 | ····var_system_crypto_policy:·!!str·DEFAULT | 349 | ····var_system_crypto_policy:·!!str·DEFAULT |
| Offset 369, 46 lines modified | Offset 388, 35 lines modified | ||
| 369 | ··-·NIST-800-53-SC-13 | 388 | ··-·NIST-800-53-SC-13 |
| 370 | ··-·configure_crypto_policy | 389 | ··-·configure_crypto_policy |
| 371 | ··-·high_severity | 390 | ··-·high_severity |
| 372 | ··-·low_complexity | 391 | ··-·low_complexity |
| 373 | ··-·low_disruption | 392 | ··-·low_disruption |
| 374 | ··-·no_reboot_needed | 393 | ··-·no_reboot_needed |
| 375 | ··-·restrict_strategy | 394 | ··-·restrict_strategy |
| 376 | Remediation_Shell_script_⇲ | ||
| 377 | var_system_crypto_policy='DEFAULT' | ||
| 378 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 379 | rc=$? | ||
| 380 | if·test·"$rc"·=·127;·then | ||
| 381 | » echo·"$stderr_of_call"·>&2 | ||
| 382 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 383 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 384 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 385 | » false··#·end·with·an·error·code | ||
| 386 | elif·test·"$rc"·!=·0;·then | ||
| 387 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 388 | » false··#·end·with·an·error·code | ||
| 389 | fi | ||
| 390 | ***·Rule ·Configure·Kerberos·to·use·System·Crypto·Policy· [ref]·*** | 395 | ***·Rule ·Configure·Kerberos·to·use·System·Crypto·Policy· [ref]·*** |
| 391 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Kerberos | 396 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Kerberos |
| 392 | is·supported·by·crypto·policy,·but·it's·configuration·may·be·set·up·to·ignore·it.·To·check·that·Crypto | 397 | is·supported·by·crypto·policy,·but·it's·configuration·may·be·set·up·to·ignore·it.·To·check·that·Crypto |
| 393 | Policies·settings·for·Kerberos·are·configured·correctly,·examine·that·there·is·a·symlink·at·/etc/ | 398 | Policies·settings·for·Kerberos·are·configured·correctly,·examine·that·there·is·a·symlink·at·/etc/ |
| 394 | krb5.conf.d/crypto-policies·targeting·/etc/cypto-policies/back-ends/krb5.config.·If·the·symlink | 399 | krb5.conf.d/crypto-policies·targeting·/etc/cypto-policies/back-ends/krb5.config.·If·the·symlink |
| 395 | exists,·Kerberos·is·configured·to·use·the·system-wide·crypto·policy·settings. | 400 | exists,·Kerberos·is·configured·to·use·the·system-wide·crypto·policy·settings. |
| 396 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·Kerberos·violate·expectations, | 401 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·Kerberos·violate·expectations, |
| 397 | ············and·makes·system·configuration·more·fragmented. | 402 | ············and·makes·system·configuration·more·fragmented. |
| 398 | Severity: ·high | 403 | Severity: ·high |
| 399 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy | 404 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy |
| 400 | Identifiers·References: ·0418,·1055,·1402,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-13,·SC-12(2),·SC-12(3), | 405 | Identifiers·References: ·0418,·1055,·1402,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-13,·SC-12(2),·SC-12(3), |
| 401 | and·········SRG-OS-000120-GPOS-00061 | 406 | and·········SRG-OS-000120-GPOS-00061 |
| 402 | References | 407 | References |
| 408 | Remediation_Shell_script_⇲ | ||
| 409 | Complexity:·low | ||
| 410 | Disruption:·low | ||
| 411 | Reboot:·····true | ||
| 412 | Strategy:···configure | ||
| 413 | rm·-f·/etc/krb5.conf.d/crypto-policies | ||
| 414 | ln·-s·/etc/crypto-policies/back-ends/krb5.config·/etc/krb5.conf.d/crypto-policies | ||
| 403 | Remediation_Ansible_snippet_⇲ | 415 | Remediation_Ansible_snippet_⇲ |
| 404 | Complexity:·low | 416 | Complexity:·low |
| 405 | Disruption:·low | 417 | Disruption:·low |
| 406 | Reboot:·····true | 418 | Reboot:·····true |
| 407 | Strategy:···configure | 419 | Strategy:···configure |
| 408 | -·name:·Configure·Kerberos·to·use·System·Crypto·Policy | 420 | -·name:·Configure·Kerberos·to·use·System·Crypto·Policy |
| 409 | ··file: | 421 | ··file: |
| Offset 421, 35 lines modified | Offset 429, 40 lines modified | ||
| 421 | ··-·NIST-800-53-SC-13 | 429 | ··-·NIST-800-53-SC-13 |
| 422 | ··-·configure_kerberos_crypto_policy | 430 | ··-·configure_kerberos_crypto_policy |
| 423 | ··-·configure_strategy | 431 | ··-·configure_strategy |
| 424 | ··-·high_severity | 432 | ··-·high_severity |
| 425 | ··-·low_complexity | 433 | ··-·low_complexity |
| 426 | ··-·low_disruption | 434 | ··-·low_disruption |
| 427 | ··-·reboot_required | 435 | ··-·reboot_required |
| 428 | Remediation_Shell_script_⇲ | ||
| 429 | Complexity:·low | ||
| 430 | Disruption:·low | ||
| 431 | Reboot:·····true | ||
| 432 | Strategy:···configure | ||
| 433 | rm·-f·/etc/krb5.conf.d/crypto-policies | ||
| 434 | ln·-s·/etc/crypto-policies/back-ends/krb5.config·/etc/krb5.conf.d/crypto-policies | ||
| 435 | ***·Rule ·Configure·Libreswan·to·use·System·Crypto·Policy· [ref]·*** | 436 | ***·Rule ·Configure·Libreswan·to·use·System·Crypto·Policy· [ref]·*** |
| 436 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Libreswan | 437 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Libreswan |
| 437 | is·supported·by·system·crypto·policy,·but·the·Libreswan·configuration·may·be·set·up·to·ignore·it.·To | 438 | is·supported·by·system·crypto·policy,·but·the·Libreswan·configuration·may·be·set·up·to·ignore·it.·To |
| 438 | check·that·Crypto·Policies·settings·are·configured·correctly,·ensure·that·the·/etc/ipsec.conf·includes | 439 | check·that·Crypto·Policies·settings·are·configured·correctly,·ensure·that·the·/etc/ipsec.conf·includes |
| 439 | the·appropriate·configuration·file.·In·/etc/ipsec.conf,·make·sure·that·the·following·line·is·not | 440 | the·appropriate·configuration·file.·In·/etc/ipsec.conf,·make·sure·that·the·following·line·is·not |
| 440 | commented·out·or·superseded·by·later·includes:·include·/etc/crypto-policies/back-ends/libreswan.config | 441 | commented·out·or·superseded·by·later·includes:·include·/etc/crypto-policies/back-ends/libreswan.config |
| 441 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·the·Libreswan·service·violate | 442 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·the·Libreswan·service·violate |
| Max diff block lines reached; 8905/14247 bytes (62.50%) of diff not shown. | |||
| Offset 14295, 15 lines modified | Offset 14295, 15 lines modified | ||
| 00037d60:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037d60:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037d70:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037d70:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037d80:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037d80:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037d90:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037d90:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037da0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037da0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037db0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037db0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037dc0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037dc0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037dd0:·6173·206f·6620·3230·323 | 00037dd0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037de0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037de0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037df0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037df0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037e00:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037e00:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037e10:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037e10:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037e20:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037e20:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037e30:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037e30:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037e40:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037e40:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 16623, 168 lines modified | Offset 16623, 168 lines modified | ||
| 00040ee0:·2d74·6172·6765·743d·2223·6964·6d32·3035··-target="#idm205 | 00040ee0:·2d74·6172·6765·743d·2223·6964·6d32·3035··-target="#idm205 | ||
| 00040ef0:·3922·2074·6162·696e·6465·783d·2230·2220··9"·tabindex="0"· | 00040ef0:·3922·2074·6162·696e·6465·783d·2230·2220··9"·tabindex="0"· | ||
| 00040f00:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 00040f00:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 00040f10:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 00040f10:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 00040f20:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 00040f20:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 00040f30:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 00040f30:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 00040f40:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 00040f40:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 00040f50:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | |||
| 00040f60:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 00040f70:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 00040f80:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 00040f90:·2220·6964·3d22·6964·6d32·3035·3922·3e3c··"·id="idm2059">< | |||
| 00040fa0:·7072·653e·3c63·6f64·653e·0a76·6172·5f73··pre><code>.var_s | |||
| 00040f50:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 00040f60:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 00040f70:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 00040f80:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 00040f90:·7073·6522·2069·643d·2269·646d·3230·3539··pse"·id="idm2059 | |||
| 00040fa0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 00040fb0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 00040fc0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 00040fd0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 00040fe0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 00040ff0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 00041000:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 00041010:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 00041020:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 00041030:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 00041040:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 00041050:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 00041060:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 00041070:·636f·6465·3e2d·206e·616d·653a·2058·4343··code>-·name:·XCC | |||
| 00041080:·4446·2056·616c·7565·2076·6172·5f73·7973··DF·Value·var_sys | |||
| 0004 | 00040fb0:·7973·7465·6d5f·6372·7970·746f·5f70·6f6c··ystem_crypto_pol | ||
| 00040fc0:·6963·793d·273c·6162·6272·2074·6974·6c65··icy='<abbr·title | |||
| 00040fd0:·3d22·6672·6f6d·2050·726f·6669·6c65·2f72··="from·Profile/r | |||
| 00040fe0:·6566·696e·652d·7661·6c75·653a·2078·6363··efine-value:·xcc | |||
| 00040ff0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | |||
| 00041000:·742e·636f·6e74·656e·745f·7661·6c75·655f··t.content_value_ | |||
| 000410a0:·7920·2320·7072·6f6d·6f74·6520·746f·2076··y·#·promote·to·v | |||
| 000410b0:·6172·6961·626c·650a·2020·7365·745f·6661··ariable.··set_fa | |||
| 000410c0:·6374·3a0a·2020·2020·7661·725f·7379·7374··ct:.····var_syst | |||
| 000410d0:·656d·5f63·7279·7074·6f5f·706f·6c69·6379··em_crypto_policy | |||
| 000410e0:·3a20·2121·7374·7220·3c61·6262·7220·7469··:·!!str·<abbr·ti | |||
| 000410f0:·746c·653d·2266·726f·6d20·5072·6f66·696c··tle="from·Profil | |||
| 00041100:·652f·7265·6669·6e65·2d76·616c·7565·3a20··e/refine-value:· | |||
| 00041110:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | |||
| 00041120:·6a65·6374·2e63·6f6e·7465·6e74·5f76·616c··ject.content_val | |||
| 00041130:·7565·5f76·6172·5f73·7973·7465·6d5f·6372··ue_var_system_cr | |||
| 00041140:·7970·746f·5f70·6f6c·6963·7922·3e46·5554··ypto_policy">FUT | |||
| 00041150:·5552·453c·2f61·6262·723e·0a20·2074·6167··URE</abbr>.··tag | |||
| 00041160:·733a·0a20·2020·202d·2061·6c77·6179·730a··s:.····-·always. | |||
| 00041170:·0a2d·206e·616d·653a·2043·6f6e·6669·6775··.-·name:·Configu | |||
| 00041180:·7265·2053·7973·7465·6d20·4372·7970·746f··re·System·Crypto | |||
| 00041190:·6772·6170·6879·2050·6f6c·6963·790a·2020··graphy·Policy.·· | |||
| 000411a0:·6c69·6e65·696e·6669·6c65·3a0a·2020·2020··lineinfile:.···· | |||
| 000411b0:·7061·7468·3a20·2f65·7463·2f63·7279·7074··path:·/etc/crypt | |||
| 000411c0:·6f2d·706f·6c69·6369·6573·2f63·6f6e·6669··o-policies/confi | |||
| 000411d0:·670a·2020·2020·7265·6765·7870·3a20·5e28··g.····regexp:·^( | |||
| 000411e0:·3f21·2329·285c·532b·2924·0a20·2020·206c··?!#)(\S+)$.····l | |||
| 000411f0:·696e·653a·2027·7b7b·2076·6172·5f73·7973··ine:·'{{·var_sys | |||
| 00041200:·7465·6d5f·6372·7970·746f·5f70·6f6c·6963··tem_crypto_polic | |||
| 00041210:·7920·7d7d·270a·2020·2020·6372·6561·7465··y·}}'.····create | |||
| 00041220:·3a20·7472·7565·0a20·2074·6167·733a·0a20··:·true.··tags:.· | |||
| 00041230:·202d·204e·4953·542d·3830·302d·3533·2d41···-·NIST-800-53-A | |||
| 00041240:·432d·3137·2832·290a·2020·2d20·4e49·5354··C-17(2).··-·NIST | |||
| 00041250:·2d38·3030·2d35·332d·4143·2d31·3728·6129··-800-53-AC-17(a) | |||
| 00041260:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00041270:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 00041280:·542d·3830·302d·3533·2d4d·412d·3428·3629··T-800-53-MA-4(6) | |||
| 00041290:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 000412a0:·2d53·432d·3132·2832·290a·2020·2d20·4e49··-SC-12(2).··-·NI | |||
| 000412b0:·5354·2d38·3030·2d35·332d·5343·2d31·3228··ST-800-53-SC-12( | |||
| 000412c0:·3329·0a20·202d·204e·4953·542d·3830·302d··3).··-·NIST-800- | |||
| 000412d0:·3533·2d53·432d·3133·0a20·202d·2063·6f6e··53-SC-13.··-·con | |||
| 000412e0:·6669·6775·7265·5f63·7279·7074·6f5f·706f··figure_crypto_po | |||
| 000412f0:·6c69·6379·0a20·202d·2068·6967·685f·7365··licy.··-·high_se | |||
| 00041300:·7665·7269·7479·0a20·202d·206c·6f77·5f63··verity.··-·low_c | |||
| 00041310:·6f6d·706c·6578·6974·790a·2020·2d20·6c6f··omplexity.··-·lo | |||
| 00041320:·775f·6469·7372·7570·7469·6f6e·0a20·202d··w_disruption.··- | |||
| 00041330:·206e·6f5f·7265·626f·6f74·5f6e·6565·6465···no_reboot_neede | |||
| 00041340:·640a·2020·2d20·7265·7374·7269·6374·5f73··d.··-·restrict_s | |||
| 00041350:·7472·6174·6567·790a·0a2d·206e·616d·653a··trategy..-·name: | |||
| 00041360:·2056·6572·6966·7920·7468·6174·2043·7279···Verify·that·Cry | |||
| 00041370:·7074·6f20·506f·6c69·6379·2069·7320·5365··pto·Policy·is·Se | |||
| 00041380:·7420·2872·756e·7469·6d65·290a·2020·636f··t·(runtime).··co | |||
| 00041390:·6d6d·616e·643a·202f·7573·722f·6269·6e2f··mmand:·/usr/bin/ | |||
| 000413a0:·7570·6461·7465·2d63·7279·7074·6f2d·706f··update-crypto-po | |||
| 000413b0:·6c69·6369·6573·202d·2d73·6574·207b·7b20··licies·--set·{{· | |||
| 00041 | 00041010:·7661·725f·7379·7374·656d·5f63·7279·7074··var_system_crypt | ||
| 000413d0:·6f5f·706f·6c69·6379·207d·7d0a·2020·7461··o_policy·}}.··ta | |||
| 000413e0:·6773·3a0a·2020·2d20·4e49·5354·2d38·3030··gs:.··-·NIST-800 | |||
| 000413f0:·2d35·332d·4143·2d31·3728·3229·0a20·202d··-53-AC-17(2).··- | |||
| 00041400:·204e·4953·542d·3830·302d·3533·2d41·432d···NIST-800-53-AC- | |||
| 00041410:·3137·2861·290a·2020·2d20·4e49·5354·2d38··17(a).··-·NIST-8 | |||
| 00041420:·3030·2d35·332d·434d·2d36·2861·290a·2020··00-53-CM-6(a).·· | |||
| 00041430:·2d20·4e49·5354·2d38·3030·2d35·332d·4d41··-·NIST-800-53-MA | |||
| 00041440:·2d34·2836·290a·2020·2d20·4e49·5354·2d38··-4(6).··-·NIST-8 | |||
| 00041450:·3030·2d35·332d·5343·2d31·3228·3229·0a20··00-53-SC-12(2).· | |||
| 00041460:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| 00041470:·432d·3132·2833·290a·2020·2d20·4e49·5354··C-12(3).··-·NIST | |||
| 00041480:·2d38·3030·2d35·332d·5343·2d31·330a·2020··-800-53-SC-13.·· | |||
| 00041490:·2d20·636f·6e66·6967·7572·655f·6372·7970··-·configure_cryp | |||
| 000414a0:·746f·5f70·6f6c·6963·790a·2020·2d20·6869··to_policy.··-·hi | |||
| 000414b0:·6768·5f73·6576·6572·6974·790a·2020·2d20··gh_severity.··-· | |||
| 000414c0:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 000414d0:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 000414e0:·6e0a·2020·2d20·6e6f·5f72·6562·6f6f·745f··n.··-·no_reboot_ | |||
| 000414f0:·6e65·6564·6564·0a20·202d·2072·6573·7472··needed.··-·restr | |||
| 00041500:·6963·745f·7374·7261·7465·6779·0a3c·2f63··ict_strategy.</c | |||
| 00041510:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| Max diff block lines reached; 2350475/2373437 bytes (99.03%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | *****·Profile·Information·***** | 40 | *****·Profile·Information·***** |
| 41 | Profile·Title·CIS·Benchmark·for·Alibaba·Cloud·Linux·3·for·Level·2 | 41 | Profile·Title·CIS·Benchmark·for·Alibaba·Cloud·Linux·3·for·Level·2 |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:alinux:alibaba_cloud_linux:3 | 44 | ····*·cpe:/o:alinux:alibaba_cloud_linux:3 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·System_Accounting_with_auditd | 52 | ·········3.·System_Accounting_with_auditd |
| 53 | ·········4.·GRUB2_bootloader_configuration | 53 | ·········4.·GRUB2_bootloader_configuration |
| 54 | ·········5.·Configure_Syslog | 54 | ·········5.·Configure_Syslog |
| Offset 325, 14 lines modified | Offset 325, 33 lines modified | ||
| 325 | Severity: ·high | 325 | Severity: ·high |
| 326 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy | 326 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 327 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii), | 327 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii), |
| 328 | Identifiers·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC- | 328 | Identifiers·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC- |
| 329 | and·········13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1, | 329 | and·········13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1, |
| 330 | References··FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394- | 330 | References··FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394- |
| 331 | ············GPOS-00174,·1.10 | 331 | ············GPOS-00174,·1.10 |
| 332 | Remediation_Shell_script_⇲ | ||
| 333 | var_system_crypto_policy='FUTURE' | ||
| 334 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 335 | rc=$? | ||
| 336 | if·test·"$rc"·=·127;·then | ||
| 337 | » echo·"$stderr_of_call"·>&2 | ||
| 338 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 339 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 340 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 341 | » false··#·end·with·an·error·code | ||
| 342 | elif·test·"$rc"·!=·0;·then | ||
| 343 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 344 | » false··#·end·with·an·error·code | ||
| 345 | fi | ||
| 332 | Remediation_Ansible_snippet_⇲ | 346 | Remediation_Ansible_snippet_⇲ |
| 333 | Complexity:·low | 347 | Complexity:·low |
| 334 | Disruption:·low | 348 | Disruption:·low |
| 335 | Strategy:···restrict | 349 | Strategy:···restrict |
| 336 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable | 350 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable |
| 337 | ··set_fact: | 351 | ··set_fact: |
| 338 | ····var_system_crypto_policy:·!!str·FUTURE | 352 | ····var_system_crypto_policy:·!!str·FUTURE |
| Offset 372, 33 lines modified | Offset 391, 14 lines modified | ||
| 372 | ··-·NIST-800-53-SC-13 | 391 | ··-·NIST-800-53-SC-13 |
| 373 | ··-·configure_crypto_policy | 392 | ··-·configure_crypto_policy |
| 374 | ··-·high_severity | 393 | ··-·high_severity |
| 375 | ··-·low_complexity | 394 | ··-·low_complexity |
| 376 | ··-·low_disruption | 395 | ··-·low_disruption |
| 377 | ··-·no_reboot_needed | 396 | ··-·no_reboot_needed |
| 378 | ··-·restrict_strategy | 397 | ··-·restrict_strategy |
| 379 | Remediation_Shell_script_⇲ | ||
| 380 | var_system_crypto_policy='FUTURE' | ||
| 381 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 382 | rc=$? | ||
| 383 | if·test·"$rc"·=·127;·then | ||
| 384 | » echo·"$stderr_of_call"·>&2 | ||
| 385 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 386 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 387 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 388 | » false··#·end·with·an·error·code | ||
| 389 | elif·test·"$rc"·!=·0;·then | ||
| 390 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 391 | » false··#·end·with·an·error·code | ||
| 392 | fi | ||
| 393 | Group ·Disk·Partitioning· Group·contains·6·rules | 398 | Group ·Disk·Partitioning· Group·contains·6·rules |
| 394 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which | 399 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which |
| 395 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default | 400 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default |
| 396 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 401 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 397 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify | 402 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify |
| 398 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the | 403 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the |
| 399 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to | 404 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to |
| Offset 496, 14 lines modified | Offset 496, 51 lines modified | ||
| 496 | ***·Rule ·Ensure·Sudo·Logfile·Exists·-·sudo·logfile· [ref]·*** | 496 | ***·Rule ·Ensure·Sudo·Logfile·Exists·-·sudo·logfile· [ref]·*** |
| 497 | A·custom·log·sudo·file·can·be·configured·with·the·'logfile'·tag.·This·rule·configures·a·sudo·custom | 497 | A·custom·log·sudo·file·can·be·configured·with·the·'logfile'·tag.·This·rule·configures·a·sudo·custom |
| 498 | logfile·at·the·default·location·suggested·by·CIS,·which·uses·/var/log/sudo.log. | 498 | logfile·at·the·default·location·suggested·by·CIS,·which·uses·/var/log/sudo.log. |
| 499 | Rationale:·················A·sudo·log·file·simplifies·auditing·of·sudo·commands. | 499 | Rationale:·················A·sudo·log·file·simplifies·auditing·of·sudo·commands. |
| 500 | Severity: ················low | 500 | Severity: ················low |
| 501 | Rule·ID:···················xccdf_org.ssgproject.content_rule_sudo_custom_logfile | 501 | Rule·ID:···················xccdf_org.ssgproject.content_rule_sudo_custom_logfile |
| 502 | Identifiers·and·References·References: ·Req-10.2.1.5,·5.3.3 | 502 | Identifiers·and·References·References: ·Req-10.2.1.5,·5.3.3 |
| 503 | Remediation_Shell_script_⇲ | ||
| 504 | Complexity:·low | ||
| 505 | Disruption:·low | ||
| 506 | Strategy:···restrict | ||
| 507 | var_sudo_logfile='/var/log/sudo.log' | ||
| 508 | if·/usr/sbin/visudo·-qcf·/etc/sudoers;·then | ||
| 509 | ····cp·/etc/sudoers·/etc/sudoers.bak | ||
| 510 | ····if·!·grep·-P·'^[\s]*Defaults[\s]*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ | ||
| 511 | |\\\\|[^",·\\\n])*)\b)\b.*$'·/etc/sudoers;·then | ||
| 512 | ········#·sudoers·file·doesn't·define·Option·logfile | ||
| 513 | ········echo·"Defaults·logfile=${var_sudo_logfile}"·>>·/etc/sudoers | ||
| 514 | ····else | ||
| 515 | ········#·sudoers·file·defines·Option·logfile,·remediate·if·appropriate·value·is·not·set | ||
| 516 | ········if·!·grep·-P·"^[\s]*Defaults.*\blogfile=${var_sudo_logfile}\b.*$"·/etc/sudoers;·then | ||
| 517 | ············escaped_variable=${var_sudo_logfile//$'/'/$'\/'} | ||
| 518 | ············sed·-Ei·"s/(^[\s]*Defaults.*\blogfile=)[-]?.+(\b.*$)/\1$escaped_variable\2/"·/etc/ | ||
| 519 | sudoers | ||
| 520 | ········fi | ||
| 521 | ····fi | ||
| 522 | ····#·Check·validity·of·sudoers·and·cleanup·bak | ||
| 523 | ····if·/usr/sbin/visudo·-qcf·/etc/sudoers;·then | ||
| 524 | ········rm·-f·/etc/sudoers.bak | ||
| 525 | ····else | ||
| 526 | ········echo·"Fail·to·validate·remediated·/etc/sudoers,·reverting·to·original·file." | ||
| 527 | ········mv·/etc/sudoers.bak·/etc/sudoers | ||
| 528 | ········false | ||
| 529 | ····fi | ||
| 530 | else | ||
| 531 | ····echo·"Skipping·remediation,·/etc/sudoers·failed·to·validate" | ||
| 532 | ····false | ||
| Max diff block lines reached; 273315/278523 bytes (98.13%) of diff not shown. | |||
| Offset 14295, 16 lines modified | Offset 14295, 16 lines modified | ||
| 00037d60:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037d60:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037d70:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037d70:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037d80:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037d80:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037d90:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037d90:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037da0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037da0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037db0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037db0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037dc0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037dc0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037dd0:·2020·2861·7320·6f66·2032·3032·3 | 00037dd0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037de0:·2d32·3 | 00037de0:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037df0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037df0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037e00:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037e00:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037e10:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037e10:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037e20:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037e20:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037e30:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037e30:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037e40:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037e40:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037e50:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037e50:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 16617, 169 lines modified | Offset 16617, 169 lines modified | ||
| 00040e80:·7461·2d74·6172·6765·743d·2223·6964·6d32··ta-target="#idm2 | 00040e80:·7461·2d74·6172·6765·743d·2223·6964·6d32··ta-target="#idm2 | ||
| 00040e90:·3035·3922·2074·6162·696e·6465·783d·2230··059"·tabindex="0 | 00040e90:·3035·3922·2074·6162·696e·6465·783d·2230··059"·tabindex="0 | ||
| 00040ea0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 00040ea0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 00040eb0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 00040eb0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 00040ec0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 00040ec0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 00040ed0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 00040ed0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 00040ee0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 00040ee0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 00040ef0:·6961·7469·6f6e·2053·6865·6c6c·2073·6372··iation·Shell·scr | |||
| 00040f00:·6970·7420·e287·b23c·2f61·3e3c·6272·3e3c··ipt·...</a><br>< | |||
| 00040f10:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 00040f20:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 00040f30:·7365·2220·6964·3d22·6964·6d32·3035·3922··se"·id="idm2059" | |||
| 00040f40:·3e3c·7072·653e·3c63·6f64·653e·0a76·6172··><pre><code>.var | |||
| 00040f50:·5f73·7973·7465·6d5f·6372·7970·746f·5f70··_system_crypto_p | |||
| 00040f60:·6f6c·6963·793d·273c·6162·6272·2074·6974··olicy='<abbr·tit | |||
| 00040f70:·6c65·3d22·6672·6f6d·2050·726f·6669·6c65··le="from·Profile | |||
| 00040f80:·2f72·6566·696e·652d·7661·6c75·653a·2078··/refine-value:·x | |||
| 00040f90:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | |||
| 00040fa0:·6563·742e·636f·6e74·656e·745f·7661·6c75··ect.content_valu | |||
| 00040fb0:·655f·7661·725f·7379·7374·656d·5f63·7279··e_var_system_cry | |||
| 00040fc0:·7074·6f5f·706f·6c69·6379·223e·4445·4641··pto_policy">DEFA | |||
| 00040fd0:·554c·543c·2f61·6262·723e·270a·0a0a·7374··ULT</abbr>'...st | |||
| 00040fe0:·6465·7272·5f6f·665f·6361·6c6c·3d24·2875··derr_of_call=$(u | |||
| 00040ff0:·7064·6174·652d·6372·7970·746f·2d70·6f6c··pdate-crypto-pol | |||
| 00041000:·6963·6965·7320·2d2d·7365·7420·247b·7661··icies·--set·${va | |||
| 00041010:·725f·7379·7374·656d·5f63·7279·7074·6f5f··r_system_crypto_ | |||
| 00041020:·706f·6c69·6379·7d20·3226·6774·3b26·616d··policy}·2>&am | |||
| 00041030:·703b·3120·2667·743b·202f·6465·762f·6e75··p;1·>·/dev/nu | |||
| 00041040:·6c6c·290a·7263·3d24·3f0a·0a69·6620·7465··ll).rc=$?..if·te | |||
| 00041050:·7374·2022·2472·6322·203d·2031·3237·3b20··st·"$rc"·=·127;· | |||
| 00041060:·7468·656e·0a09·6563·686f·2022·2473·7464··then..echo·"$std | |||
| 00041070:·6572·725f·6f66·5f63·616c·6c22·2026·6774··err_of_call"·> | |||
| 00041080:·3b26·616d·703b·320a·0965·6368·6f20·224d··;&2..echo·"M | |||
| 00041090:·616b·6520·7375·7265·2074·6861·7420·7468··ake·sure·that·th | |||
| 000410a0:·6520·7363·7269·7074·2069·7320·696e·7374··e·script·is·inst | |||
| 000410b0:·616c·6c65·6420·6f6e·2074·6865·2072·656d··alled·on·the·rem | |||
| 000410c0:·6564·6961·7465·6420·7379·7374·656d·2e22··ediated·system." | |||
| 000410d0:·2026·6774·3b26·616d·703b·320a·0965·6368···>&2..ech | |||
| 000410e0:·6f20·2253·6565·206f·7574·7075·7420·6f66··o·"See·output·of | |||
| 000410f0:·2074·6865·2027·646e·6620·7072·6f76·6964···the·'dnf·provid | |||
| 00041100:·6573·2075·7064·6174·652d·6372·7970·746f··es·update-crypto | |||
| 00041110:·2d70·6f6c·6963·6965·7327·2063·6f6d·6d61··-policies'·comma | |||
| 00041120:·6e64·2220·2667·743b·2661·6d70·3b32·0a09··nd"·>&2.. | |||
| 00041130:·6563·686f·2022·746f·2073·6565·2077·6861··echo·"to·see·wha | |||
| 00041140:·7420·7061·636b·6167·6520·746f·2028·7265··t·package·to·(re | |||
| 00041150:·2969·6e73·7461·6c6c·2220·2667·743b·2661··)install"·>&a | |||
| 00041160:·6d70·3b32·0a0a·0966·616c·7365·2020·2320··mp;2...false··#· | |||
| 00041170:·656e·6420·7769·7468·2061·6e20·6572·726f··end·with·an·erro | |||
| 00041180:·7220·636f·6465·0a65·6c69·6620·7465·7374··r·code.elif·test | |||
| 00041190:·2022·2472·6322·2021·3d20·303b·2074·6865···"$rc"·!=·0;·the | |||
| 000411a0:·6e0a·0965·6368·6f20·2245·7272·6f72·2069··n..echo·"Error·i | |||
| 000411b0:·6e76·6f6b·696e·6720·7468·6520·7570·6461··nvoking·the·upda | |||
| 000411c0:·7465·2d63·7279·7074·6f2d·706f·6c69·6369··te-crypto-polici | |||
| 000411d0:·6573·2073·6372·6970·743a·2024·7374·6465··es·script:·$stde | |||
| 000411e0:·7272·5f6f·665f·6361·6c6c·2220·2667·743b··rr_of_call"·> | |||
| 000411f0:·2661·6d70·3b32·0a09·6661·6c73·6520·2023··&2..false··# | |||
| 00041200:·2065·6e64·2077·6974·6820·616e·2065·7272···end·with·an·err | |||
| 00041210:·6f72·2063·6f64·650a·6669·0a3c·2f63·6f64··or·code.fi.</cod | |||
| 00041220:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 00041230:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 00041240:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 00041250:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 00041260:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 00041270:·6d32·3036·3122·2074·6162·696e·6465·783d··m2061"·tabindex= | |||
| 00041280:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 00041290:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 000412a0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 000412b0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 000412c0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0004 | 000412d0:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | ||
| 00040 | 000412e0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | ||
| 0004 | 000412f0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | ||
| 00040 | 00041300:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | ||
| 0004 | 00041310:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | ||
| 0004 | 00041320:·3230·3631·223e·3c74·6162·6c65·2063·6c61··2061"><table·cla | ||
| 0004 | 00041330:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | ||
| 0004 | 00041340:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | ||
| 00040 | 00041350:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | ||
| 0004 | 00041360:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | ||
| 0004 | 00041370:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | ||
| 0004 | 00041380:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0004 | 00041390:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0004 | 000413a0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | ||
| 0004 | 000413b0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0004 | 000413c0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | ||
| 0004 | 000413d0:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | ||
| 00041 | 000413e0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | ||
| 00041 | 000413f0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | ||
| 00041020 | 00041400:·2058·4343·4446·2056·616c·7565·2076·6172···XCCDF·Value·var | ||
| 00041 | 00041410:·5f73·7973·7465·6d5f·6372·7970·746f·5f70··_system_crypto_p | ||
| 00041 | 00041420:·6f6c·6963·7920·2320·7072·6f6d·6f74·6520··olicy·#·promote· | ||
| 00041 | 00041430:·746f·2076·6172·6961·626c·650a·2020·7365··to·variable.··se | ||
| 00041 | 00041440:·745f·6661·6374·3a0a·2020·2020·7661·725f··t_fact:.····var_ | ||
| 00041070:·7374·656d·5f63·7279·7074·6f5f·706f·6c69··stem_crypto_poli | |||
| 00041080:·6379·3a20·2121·7374·7220·3c61·6262·7220··cy:·!!str·<abbr· | |||
| 00041090:·7469·746c·653d·2266·726f·6d20·5072·6f66··title="from·Prof | |||
| 000410a0:·696c·652f·7265·6669·6e65·2d76·616c·7565··ile/refine-value | |||
| 000410b0:·3a20·7863·6364·665f·6f72·672e·7373·6770··:·xccdf_org.ssgp | |||
| 000410c0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f76··roject.content_v | |||
| 000410d0:·616c·7565·5f76·6172·5f73·7973·7465·6d5f··alue_var_system_ | |||
| 000410e0:·6372·7970·746f·5f70·6f6c·6963·7922·3e44··crypto_policy">D | |||
| 000410f0:·4546·4155·4c54·3c2f·6162·6272·3e0a·2020··EFAULT</abbr>.·· | |||
| 00041100:·7461·6773·3a0a·2020·2020·2d20·616c·7761··tags:.····-·alwa | |||
| 00041110:·7973·0a0a·2d20·6e61·6d65·3a20·436f·6e66··ys..-·name:·Conf | |||
| 00041120:·6967·7572·6520·5379·7374·656d·2043·7279··igure·System·Cry | |||
| 00041130:·7074·6f67·7261·7068·7920·506f·6c69·6379··ptography·Policy | |||
| 00041140:·0a20·206c·696e·6569·6e66·696c·653a·0a20··.··lineinfile:.· | |||
| 00041150:·2020·2070·6174·683a·202f·6574·632f·6372·····path:·/etc/cr | |||
| 00041160:·7970·746f·2d70·6f6c·6963·6965·732f·636f··ypto-policies/co | |||
| 00041170:·6e66·6967·0a20·2020·2072·6567·6578·703a··nfig.····regexp: | |||
| Max diff block lines reached; 2296608/2319846 bytes (99.00%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | *****·Profile·Information·***** | 40 | *****·Profile·Information·***** |
| 41 | Profile·Title·CIS·Benchmark·for·Alibaba·Cloud·Linux·3·for·Level·1 | 41 | Profile·Title·CIS·Benchmark·for·Alibaba·Cloud·Linux·3·for·Level·1 |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_l1 | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_l1 |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:alinux:alibaba_cloud_linux:3 | 44 | ····*·cpe:/o:alinux:alibaba_cloud_linux:3 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·GRUB2_bootloader_configuration | 52 | ·········3.·GRUB2_bootloader_configuration |
| 53 | ·········4.·Configure_Syslog | 53 | ·········4.·Configure_Syslog |
| 54 | ·········5.·Network_Configuration_and_Firewalls | 54 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 324, 14 lines modified | Offset 324, 33 lines modified | ||
| 324 | Severity: ·high | 324 | Severity: ·high |
| 325 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy | 325 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 326 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii), | 326 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii), |
| 327 | Identifiers·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC- | 327 | Identifiers·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC- |
| 328 | and·········13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1, | 328 | and·········13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1, |
| 329 | References··FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394- | 329 | References··FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394- |
| 330 | ············GPOS-00174,·1.10 | 330 | ············GPOS-00174,·1.10 |
| 331 | Remediation_Shell_script_⇲ | ||
| 332 | var_system_crypto_policy='DEFAULT' | ||
| 333 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 334 | rc=$? | ||
| 335 | if·test·"$rc"·=·127;·then | ||
| 336 | » echo·"$stderr_of_call"·>&2 | ||
| 337 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 338 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 339 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 340 | » false··#·end·with·an·error·code | ||
| 341 | elif·test·"$rc"·!=·0;·then | ||
| 342 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 343 | » false··#·end·with·an·error·code | ||
| 344 | fi | ||
| 331 | Remediation_Ansible_snippet_⇲ | 345 | Remediation_Ansible_snippet_⇲ |
| 332 | Complexity:·low | 346 | Complexity:·low |
| 333 | Disruption:·low | 347 | Disruption:·low |
| 334 | Strategy:···restrict | 348 | Strategy:···restrict |
| 335 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable | 349 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable |
| 336 | ··set_fact: | 350 | ··set_fact: |
| 337 | ····var_system_crypto_policy:·!!str·DEFAULT | 351 | ····var_system_crypto_policy:·!!str·DEFAULT |
| Offset 371, 33 lines modified | Offset 390, 14 lines modified | ||
| 371 | ··-·NIST-800-53-SC-13 | 390 | ··-·NIST-800-53-SC-13 |
| 372 | ··-·configure_crypto_policy | 391 | ··-·configure_crypto_policy |
| 373 | ··-·high_severity | 392 | ··-·high_severity |
| 374 | ··-·low_complexity | 393 | ··-·low_complexity |
| 375 | ··-·low_disruption | 394 | ··-·low_disruption |
| 376 | ··-·no_reboot_needed | 395 | ··-·no_reboot_needed |
| 377 | ··-·restrict_strategy | 396 | ··-·restrict_strategy |
| 378 | Remediation_Shell_script_⇲ | ||
| 379 | var_system_crypto_policy='DEFAULT' | ||
| 380 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 381 | rc=$? | ||
| 382 | if·test·"$rc"·=·127;·then | ||
| 383 | » echo·"$stderr_of_call"·>&2 | ||
| 384 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 385 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 386 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 387 | » false··#·end·with·an·error·code | ||
| 388 | elif·test·"$rc"·!=·0;·then | ||
| 389 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 390 | » false··#·end·with·an·error·code | ||
| 391 | fi | ||
| 392 | Group ·Disk·Partitioning· Group·contains·1·rule | 397 | Group ·Disk·Partitioning· Group·contains·1·rule |
| 393 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which | 398 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which |
| 394 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default | 399 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default |
| 395 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 400 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 396 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify | 401 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify |
| 397 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the | 402 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the |
| 398 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to | 403 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to |
| Offset 431, 14 lines modified | Offset 431, 51 lines modified | ||
| 431 | ***·Rule ·Ensure·Sudo·Logfile·Exists·-·sudo·logfile· [ref]·*** | 431 | ***·Rule ·Ensure·Sudo·Logfile·Exists·-·sudo·logfile· [ref]·*** |
| 432 | A·custom·log·sudo·file·can·be·configured·with·the·'logfile'·tag.·This·rule·configures·a·sudo·custom | 432 | A·custom·log·sudo·file·can·be·configured·with·the·'logfile'·tag.·This·rule·configures·a·sudo·custom |
| 433 | logfile·at·the·default·location·suggested·by·CIS,·which·uses·/var/log/sudo.log. | 433 | logfile·at·the·default·location·suggested·by·CIS,·which·uses·/var/log/sudo.log. |
| 434 | Rationale:·················A·sudo·log·file·simplifies·auditing·of·sudo·commands. | 434 | Rationale:·················A·sudo·log·file·simplifies·auditing·of·sudo·commands. |
| 435 | Severity: ················low | 435 | Severity: ················low |
| 436 | Rule·ID:···················xccdf_org.ssgproject.content_rule_sudo_custom_logfile | 436 | Rule·ID:···················xccdf_org.ssgproject.content_rule_sudo_custom_logfile |
| 437 | Identifiers·and·References·References: ·Req-10.2.1.5,·5.3.3 | 437 | Identifiers·and·References·References: ·Req-10.2.1.5,·5.3.3 |
| 438 | Remediation_Shell_script_⇲ | ||
| 439 | Complexity:·low | ||
| 440 | Disruption:·low | ||
| 441 | Strategy:···restrict | ||
| 442 | var_sudo_logfile='/var/log/sudo.log' | ||
| 443 | if·/usr/sbin/visudo·-qcf·/etc/sudoers;·then | ||
| 444 | ····cp·/etc/sudoers·/etc/sudoers.bak | ||
| 445 | ····if·!·grep·-P·'^[\s]*Defaults[\s]*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ | ||
| 446 | |\\\\|[^",·\\\n])*)\b)\b.*$'·/etc/sudoers;·then | ||
| 447 | ········#·sudoers·file·doesn't·define·Option·logfile | ||
| 448 | ········echo·"Defaults·logfile=${var_sudo_logfile}"·>>·/etc/sudoers | ||
| 449 | ····else | ||
| 450 | ········#·sudoers·file·defines·Option·logfile,·remediate·if·appropriate·value·is·not·set | ||
| 451 | ········if·!·grep·-P·"^[\s]*Defaults.*\blogfile=${var_sudo_logfile}\b.*$"·/etc/sudoers;·then | ||
| 452 | ············escaped_variable=${var_sudo_logfile//$'/'/$'\/'} | ||
| 453 | ············sed·-Ei·"s/(^[\s]*Defaults.*\blogfile=)[-]?.+(\b.*$)/\1$escaped_variable\2/"·/etc/ | ||
| 454 | sudoers | ||
| 455 | ········fi | ||
| 456 | ····fi | ||
| 457 | ····#·Check·validity·of·sudoers·and·cleanup·bak | ||
| 458 | ····if·/usr/sbin/visudo·-qcf·/etc/sudoers;·then | ||
| 459 | ········rm·-f·/etc/sudoers.bak | ||
| 460 | ····else | ||
| 461 | ········echo·"Fail·to·validate·remediated·/etc/sudoers,·reverting·to·original·file." | ||
| 462 | ········mv·/etc/sudoers.bak·/etc/sudoers | ||
| 463 | ········false | ||
| 464 | ····fi | ||
| 465 | else | ||
| 466 | ····echo·"Skipping·remediation,·/etc/sudoers·failed·to·validate" | ||
| 467 | ····false | ||
| Max diff block lines reached; 266311/271530 bytes (98.08%) of diff not shown. | |||
| Offset 14290, 15 lines modified | Offset 14290, 15 lines modified | ||
| 00037d10:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037d10:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037d20:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037d20:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037d30:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037d30:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037d40:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037d40:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037d50:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037d50:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037d60:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037d60:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037d70:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037d70:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037d80:·3 | 00037d80:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037d90:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037d90:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037da0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037da0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037db0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037db0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037dc0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037dc0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037dd0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037dd0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037de0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037de0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037df0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037df0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 16673, 168 lines modified | Offset 16673, 168 lines modified | ||
| 00041200:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 00041200:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 00041210:·2369·646d·3230·3539·2220·7461·6269·6e64··#idm2059"·tabind | 00041210:·2369·646d·3230·3539·2220·7461·6269·6e64··#idm2059"·tabind | ||
| 00041220:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 00041220:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 00041230:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 00041230:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 00041240:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 00041240:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 00041250:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 00041250:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 00041260:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 00041260:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 00041270:·5265·6d65·6469·6174·696f·6e20· | 00041270:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 00041280:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | |||
| 00041290:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 000412a0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 000412b0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 000412c0:·3230·3539·223e·3c70·7265·3e3c·636f·6465··2059"><pre><code | |||
| 000412d0:·3e0a·7661·725f·7379·7374·656d·5f63·7279··>.var_system_cry | |||
| 000412e0:·7074·6f5f·706f·6c69·6379·3d27·3c61·6262··pto_policy='<abb | |||
| 000412f0:·7220·7469·746c·653d·2266·726f·6d20·4265··r·title="from·Be | |||
| 00041300:·6e63·686d·6172·6b2f·5661·6c75·653a·2078··nchmark/Value:·x | |||
| 00041310:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | |||
| 00041320:·6563·742e·636f·6e74·656e·745f·7661·6c75··ect.content_valu | |||
| 00041280:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 00041290:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 000412a0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 000412b0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 000412c0:·6964·6d32·3035·3922·3e3c·7461·626c·6520··idm2059"><table· | |||
| 000412d0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 000412e0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 000412f0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 00041300:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 00041310:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 00041320:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 00041330:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 00041340:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 00041350:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 00041360:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 00041370:·7468·3e3c·7464·3e72·6573·7472·6963·743c··th><td>restrict< | |||
| 00041380:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 00041390:·3e3c·7072·653e·3c63·6f64·653e·2d20·6e61··><pre><code>-·na | |||
| 000413a0:·6d65·3a20·5843·4344·4620·5661·6c75·6520··me:·XCCDF·Value· | |||
| 000413 | 00041330:·655f·7661·725f·7379·7374·656d·5f63·7279··e_var_system_cry | ||
| 000413c0:·6f5f·706f·6c69·6379·2023·2070·726f·6d6f··o_policy·#·promo | |||
| 000413d0:·7465·2074·6f20·7661·7269·6162·6c65·0a20··te·to·variable.· | |||
| 000413 | 00041340:·7074·6f5f·706f·6c69·6379·223e·4445·4641··pto_policy">DEFA | ||
| 00041350:·554c·543c·2f61·6262·723e·270a·0a0a·7374··ULT</abbr>'...st | |||
| 00041360:·6465·7272·5f6f·665f·6361·6c6c·3d24·2875··derr_of_call=$(u | |||
| 00041370:·7064·6174·652d·6372·7970·746f·2d70·6f6c··pdate-crypto-pol | |||
| 00041380:·6963·6965·7320·2d2d·7365·7420·247b·7661··icies·--set·${va | |||
| 00041390:·725f·7379·7374·656d·5f63·7279·7074·6f5f··r_system_crypto_ | |||
| 000413a0:·706f·6c69·6379·7d20·3226·6774·3b26·616d··policy}·2>&am | |||
| 000413b0:·703b·3120·2667·743b·202f·6465·762f·6e75··p;1·>·/dev/nu | |||
| 000413c0:·6c6c·290a·7263·3d24·3f0a·0a69·6620·7465··ll).rc=$?..if·te | |||
| 000413d0:·7374·2022·2472·6322·203d·2031·3237·3b20··st·"$rc"·=·127;· | |||
| 000413e0:·7468·656e·0a09·6563·686f·2022·2473·7464··then..echo·"$std | |||
| 000413f0:·6572·725f·6f66·5f63·616c·6c22·2026·6774··err_of_call"·> | |||
| 00041400:·3b26·616d·703b·320a·0965·6368·6f20·224d··;&2..echo·"M | |||
| 00041410:·616b·6520·7375·7265·2074·6861·7420·7468··ake·sure·that·th | |||
| 00041420:·6520·7363·7269·7074·2069·7320·696e·7374··e·script·is·inst | |||
| 00041430:·616c·6c65·6420·6f6e·2074·6865·2072·656d··alled·on·the·rem | |||
| 00041440:·6564·6961·7465·6420·7379·7374·656d·2e22··ediated·system." | |||
| 00041450:·2026·6774·3b26·616d·703b·320a·0965·6368···>&2..ech | |||
| 00041460:·6f20·2253·6565·206f·7574·7075·7420·6f66··o·"See·output·of | |||
| 00041470:·2074·6865·2027·646e·6620·7072·6f76·6964···the·'dnf·provid | |||
| 00041480:·6573·2075·7064·6174·652d·6372·7970·746f··es·update-crypto | |||
| 00041490:·2d70·6f6c·6963·6965·7327·2063·6f6d·6d61··-policies'·comma | |||
| 000414a0:·6e64·2220·2667·743b·2661·6d70·3b32·0a09··nd"·>&2.. | |||
| 000414b0:·6563·686f·2022·746f·2073·6565·2077·6861··echo·"to·see·wha | |||
| 000414c0:·7420·7061·636b·6167·6520·746f·2028·7265··t·package·to·(re | |||
| 000414d0:·2969·6e73·7461·6c6c·2220·2667·743b·2661··)install"·>&a | |||
| 000414e0:·6d70·3b32·0a0a·0966·616c·7365·2020·2320··mp;2...false··#· | |||
| 000414f0:·656e·6420·7769·7468·2061·6e20·6572·726f··end·with·an·erro | |||
| 00041500:·7220·636f·6465·0a65·6c69·6620·7465·7374··r·code.elif·test | |||
| 00041510:·2022·2472·6322·2021·3d20·303b·2074·6865···"$rc"·!=·0;·the | |||
| 00041520:·6e0a·0965·6368·6f20·2245·7272·6f72·2069··n..echo·"Error·i | |||
| 00041530:·6e76·6f6b·696e·6720·7468·6520·7570·6461··nvoking·the·upda | |||
| 00041540:·7465·2d63·7279·7074·6f2d·706f·6c69·6369··te-crypto-polici | |||
| 00041550:·6573·2073·6372·6970·743a·2024·7374·6465··es·script:·$stde | |||
| 00041560:·7272·5f6f·665f·6361·6c6c·2220·2667·743b··rr_of_call"·> | |||
| 00041570:·2661·6d70·3b32·0a09·6661·6c73·6520·2023··&2..false··# | |||
| 00041580:·2065·6e64·2077·6974·6820·616e·2065·7272···end·with·an·err | |||
| 00041590:·6f72·2063·6f64·650a·6669·0a3c·2f63·6f64··or·code.fi.</cod | |||
| 000415a0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 000415b0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 000415c0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 000415d0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 000415e0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 000415f0:·6d32·3036·3122·2074·6162·696e·6465·783d··m2061"·tabindex= | |||
| 00041600:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 00041610:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 00041620:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 00041630:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 00041640:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 00041650:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 00041660:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 00041670:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 00041680:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 00041690:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 000416a0:·3230·3631·223e·3c74·6162·6c65·2063·6c61··2061"><table·cla | |||
| 000416b0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 000416c0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 000416d0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 000416e0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 000416f0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 00041700:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 00041710:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 00041720:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 00041730:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 00041740:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 00041750:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 00041760:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 00041770:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 00041780:·2058·4343·4446·2056·616c·7565·2076·6172···XCCDF·Value·var | |||
| 00041 | 00041790:·5f73·7973·7465·6d5f·6372·7970·746f·5f70··_system_crypto_p | ||
| Max diff block lines reached; 68142/91104 bytes (74.80%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | *****·Profile·Information·***** | 39 | *****·Profile·Information·***** |
| 40 | Profile·Title·Standard·System·Security·Profile·for·Alibaba·Cloud·Linux·3 | 40 | Profile·Title·Standard·System·Security·Profile·for·Alibaba·Cloud·Linux·3 |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:3 | 43 | ····*·cpe:/o:alinux:alibaba_cloud_linux:3 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·System_Accounting_with_auditd | 50 | ·········2.·System_Accounting_with_auditd |
| 51 | ·········3.·File_Permissions_and_Masks | 51 | ·········3.·File_Permissions_and_Masks |
| 52 | ···2.·Services | 52 | ···2.·Services |
| 53 | ·········1.·Base_Services | 53 | ·········1.·Base_Services |
| Offset 220, 14 lines modified | Offset 220, 33 lines modified | ||
| 220 | Severity: ·high | 220 | Severity: ·high |
| 221 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy | 221 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 222 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2) | 222 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2) |
| 223 | Identifiers·(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a), | 223 | Identifiers·(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a), |
| 224 | and·········MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1 | 224 | and·········MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1 |
| 225 | References··(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS- | 225 | References··(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS- |
| 226 | ············00173,·SRG-OS-000394-GPOS-00174,·1.10 | 226 | ············00173,·SRG-OS-000394-GPOS-00174,·1.10 |
| 227 | Remediation_Shell_script_⇲ | ||
| 228 | var_system_crypto_policy='DEFAULT' | ||
| 229 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 230 | rc=$? | ||
| 231 | if·test·"$rc"·=·127;·then | ||
| 232 | » echo·"$stderr_of_call"·>&2 | ||
| 233 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 234 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 235 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 236 | » false··#·end·with·an·error·code | ||
| 237 | elif·test·"$rc"·!=·0;·then | ||
| 238 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 239 | » false··#·end·with·an·error·code | ||
| 240 | fi | ||
| 227 | Remediation_Ansible_snippet_⇲ | 241 | Remediation_Ansible_snippet_⇲ |
| 228 | Complexity:·low | 242 | Complexity:·low |
| 229 | Disruption:·low | 243 | Disruption:·low |
| 230 | Strategy:···restrict | 244 | Strategy:···restrict |
| 231 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable | 245 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable |
| 232 | ··set_fact: | 246 | ··set_fact: |
| 233 | ····var_system_crypto_policy:·!!str·DEFAULT | 247 | ····var_system_crypto_policy:·!!str·DEFAULT |
| Offset 267, 46 lines modified | Offset 286, 35 lines modified | ||
| 267 | ··-·NIST-800-53-SC-13 | 286 | ··-·NIST-800-53-SC-13 |
| 268 | ··-·configure_crypto_policy | 287 | ··-·configure_crypto_policy |
| 269 | ··-·high_severity | 288 | ··-·high_severity |
| 270 | ··-·low_complexity | 289 | ··-·low_complexity |
| 271 | ··-·low_disruption | 290 | ··-·low_disruption |
| 272 | ··-·no_reboot_needed | 291 | ··-·no_reboot_needed |
| 273 | ··-·restrict_strategy | 292 | ··-·restrict_strategy |
| 274 | Remediation_Shell_script_⇲ | ||
| 275 | var_system_crypto_policy='DEFAULT' | ||
| 276 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 277 | rc=$? | ||
| 278 | if·test·"$rc"·=·127;·then | ||
| 279 | » echo·"$stderr_of_call"·>&2 | ||
| 280 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 281 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 282 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 283 | » false··#·end·with·an·error·code | ||
| 284 | elif·test·"$rc"·!=·0;·then | ||
| 285 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 286 | » false··#·end·with·an·error·code | ||
| 287 | fi | ||
| 288 | ***·Rule ·Configure·Kerberos·to·use·System·Crypto·Policy· [ref]·*** | 293 | ***·Rule ·Configure·Kerberos·to·use·System·Crypto·Policy· [ref]·*** |
| 289 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Kerberos | 294 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Kerberos |
| 290 | is·supported·by·crypto·policy,·but·it's·configuration·may·be·set·up·to·ignore·it.·To·check·that·Crypto | 295 | is·supported·by·crypto·policy,·but·it's·configuration·may·be·set·up·to·ignore·it.·To·check·that·Crypto |
| 291 | Policies·settings·for·Kerberos·are·configured·correctly,·examine·that·there·is·a·symlink·at·/etc/ | 296 | Policies·settings·for·Kerberos·are·configured·correctly,·examine·that·there·is·a·symlink·at·/etc/ |
| 292 | krb5.conf.d/crypto-policies·targeting·/etc/cypto-policies/back-ends/krb5.config.·If·the·symlink | 297 | krb5.conf.d/crypto-policies·targeting·/etc/cypto-policies/back-ends/krb5.config.·If·the·symlink |
| 293 | exists,·Kerberos·is·configured·to·use·the·system-wide·crypto·policy·settings. | 298 | exists,·Kerberos·is·configured·to·use·the·system-wide·crypto·policy·settings. |
| 294 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·Kerberos·violate·expectations, | 299 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·Kerberos·violate·expectations, |
| 295 | ············and·makes·system·configuration·more·fragmented. | 300 | ············and·makes·system·configuration·more·fragmented. |
| 296 | Severity: ·high | 301 | Severity: ·high |
| 297 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy | 302 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy |
| 298 | Identifiers·References: ·0418,·1055,·1402,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-13,·SC-12(2),·SC-12(3), | 303 | Identifiers·References: ·0418,·1055,·1402,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-13,·SC-12(2),·SC-12(3), |
| 299 | and·········SRG-OS-000120-GPOS-00061 | 304 | and·········SRG-OS-000120-GPOS-00061 |
| 300 | References | 305 | References |
| 306 | Remediation_Shell_script_⇲ | ||
| 307 | Complexity:·low | ||
| 308 | Disruption:·low | ||
| 309 | Reboot:·····true | ||
| 310 | Strategy:···configure | ||
| 311 | rm·-f·/etc/krb5.conf.d/crypto-policies | ||
| 312 | ln·-s·/etc/crypto-policies/back-ends/krb5.config·/etc/krb5.conf.d/crypto-policies | ||
| 301 | Remediation_Ansible_snippet_⇲ | 313 | Remediation_Ansible_snippet_⇲ |
| 302 | Complexity:·low | 314 | Complexity:·low |
| 303 | Disruption:·low | 315 | Disruption:·low |
| 304 | Reboot:·····true | 316 | Reboot:·····true |
| 305 | Strategy:···configure | 317 | Strategy:···configure |
| 306 | -·name:·Configure·Kerberos·to·use·System·Crypto·Policy | 318 | -·name:·Configure·Kerberos·to·use·System·Crypto·Policy |
| 307 | ··file: | 319 | ··file: |
| Offset 319, 35 lines modified | Offset 327, 40 lines modified | ||
| 319 | ··-·NIST-800-53-SC-13 | 327 | ··-·NIST-800-53-SC-13 |
| 320 | ··-·configure_kerberos_crypto_policy | 328 | ··-·configure_kerberos_crypto_policy |
| 321 | ··-·configure_strategy | 329 | ··-·configure_strategy |
| 322 | ··-·high_severity | 330 | ··-·high_severity |
| 323 | ··-·low_complexity | 331 | ··-·low_complexity |
| 324 | ··-·low_disruption | 332 | ··-·low_disruption |
| 325 | ··-·reboot_required | 333 | ··-·reboot_required |
| 326 | Remediation_Shell_script_⇲ | ||
| 327 | Complexity:·low | ||
| 328 | Disruption:·low | ||
| 329 | Reboot:·····true | ||
| 330 | Strategy:···configure | ||
| 331 | rm·-f·/etc/krb5.conf.d/crypto-policies | ||
| 332 | ln·-s·/etc/crypto-policies/back-ends/krb5.config·/etc/krb5.conf.d/crypto-policies | ||
| 333 | ***·Rule ·Configure·Libreswan·to·use·System·Crypto·Policy· [ref]·*** | 334 | ***·Rule ·Configure·Libreswan·to·use·System·Crypto·Policy· [ref]·*** |
| 334 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Libreswan | 335 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Libreswan |
| 335 | is·supported·by·system·crypto·policy,·but·the·Libreswan·configuration·may·be·set·up·to·ignore·it.·To | 336 | is·supported·by·system·crypto·policy,·but·the·Libreswan·configuration·may·be·set·up·to·ignore·it.·To |
| 336 | check·that·Crypto·Policies·settings·are·configured·correctly,·ensure·that·the·/etc/ipsec.conf·includes | 337 | check·that·Crypto·Policies·settings·are·configured·correctly,·ensure·that·the·/etc/ipsec.conf·includes |
| 337 | the·appropriate·configuration·file.·In·/etc/ipsec.conf,·make·sure·that·the·following·line·is·not | 338 | the·appropriate·configuration·file.·In·/etc/ipsec.conf,·make·sure·that·the·following·line·is·not |
| 338 | commented·out·or·superseded·by·later·includes:·include·/etc/crypto-policies/back-ends/libreswan.config | 339 | commented·out·or·superseded·by·later·includes:·include·/etc/crypto-policies/back-ends/libreswan.config |
| 339 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·the·Libreswan·service·violate | 340 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·the·Libreswan·service·violate |
| Max diff block lines reached; 7204/12530 bytes (57.49%) of diff not shown. | |||
| Offset 14280, 16 lines modified | Offset 14280, 16 lines modified | ||
| 00037c70:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037c70:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037c80:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037c80:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037c90:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037c90:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037ca0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037ca0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037cb0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037cb0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037cc0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037cc0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037cd0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037cd0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ce0:·2861·7320·6f66·2032·3032·3 | 00037ce0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037cf0:·3 | 00037cf0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037d00:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037d00:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037d10:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037d10:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037d20:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037d20:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037d30:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037d30:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037d40:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037d40:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037d50:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037d50:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037d60:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037d60:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 16574, 168 lines modified | Offset 16574, 168 lines modified | ||
| 00040bd0:·7267·6574·3d22·2369·646d·3132·3236·2220··rget="#idm1226"· | 00040bd0:·7267·6574·3d22·2369·646d·3132·3236·2220··rget="#idm1226"· | ||
| 00040be0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 00040be0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 00040bf0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 00040bf0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 00040c00:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 00040c00:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 00040c10:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 00040c10:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 00040c20:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 00040c20:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 00040c30:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 00040c30:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 00040c40:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 00040c50:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 00040c60:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 00040c70:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 00040c80:·643d·2269·646d·3132·3236·223e·3c70·7265··d="idm1226"><pre | |||
| 00040c90:·3e3c·636f·6465·3e0a·7661·725f·7379·7374··><code>.var_syst | |||
| 00040c40:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 00040c50:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 00040c60:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 00040c70:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 00040c80:·2220·6964·3d22·6964·6d31·3232·3622·3e3c··"·id="idm1226">< | |||
| 00040c90:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 00040ca0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 00040cb0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 00040cc0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 00040cd0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 00040ce0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 00040cf0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 00040d00:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 00040d10:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 00040d20:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 00040d30:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 00040d40:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 00040d50:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 00040d60:·653e·2d20·6e61·6d65·3a20·5843·4344·4620··e>-·name:·XCCDF· | |||
| 00040d70:·5661·6c75·6520·7661·725f·7379·7374·656d··Value·var_system | |||
| 00040 | 00040ca0:·656d·5f63·7279·7074·6f5f·706f·6c69·6379··em_crypto_policy | ||
| 00040cb0:·3d27·3c61·6262·7220·7469·746c·653d·2266··='<abbr·title="f | |||
| 00040cc0:·726f·6d20·5072·6f66·696c·652f·7265·6669··rom·Profile/refi | |||
| 00040cd0:·6e65·2d76·616c·7565·3a20·7863·6364·665f··ne-value:·xccdf_ | |||
| 00040ce0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | |||
| 00040cf0:·6f6e·7465·6e74·5f76·616c·7565·5f76·6172··ontent_value_var | |||
| 00040d90:·2070·726f·6d6f·7465·2074·6f20·7661·7269···promote·to·vari | |||
| 00040da0:·6162·6c65·0a20·2073·6574·5f66·6163·743a··able.··set_fact: | |||
| 00040db0:·0a20·2020·2076·6172·5f73·7973·7465·6d5f··.····var_system_ | |||
| 00040dc0:·6372·7970·746f·5f70·6f6c·6963·793a·2021··crypto_policy:·! | |||
| 00040dd0:·2173·7472·203c·6162·6272·2074·6974·6c65··!str·<abbr·title | |||
| 00040de0:·3d22·6672·6f6d·2050·726f·6669·6c65·2f72··="from·Profile/r | |||
| 00040df0:·6566·696e·652d·7661·6c75·653a·2078·6363··efine-value:·xcc | |||
| 00040e00:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | |||
| 00040e10:·742e·636f·6e74·656e·745f·7661·6c75·655f··t.content_value_ | |||
| 00040e20:·7661·725f·7379·7374·656d·5f63·7279·7074··var_system_crypt | |||
| 00040e30:·6f5f·706f·6c69·6379·223e·4445·4641·554c··o_policy">DEFAUL | |||
| 00040e40:·543c·2f61·6262·723e·0a20·2074·6167·733a··T</abbr>.··tags: | |||
| 00040e50:·0a20·2020·202d·2061·6c77·6179·730a·0a2d··.····-·always..- | |||
| 00040e60:·206e·616d·653a·2043·6f6e·6669·6775·7265···name:·Configure | |||
| 00040 | 00040d00:·5f73·7973·7465·6d5f·6372·7970·746f·5f70··_system_crypto_p | ||
| 00040d10:·6f6c·6963·7922·3e44·4546·4155·4c54·3c2f··olicy">DEFAULT</ | |||
| 00040d20:·6162·6272·3e27·0a0a·0a73·7464·6572·725f··abbr>'...stderr_ | |||
| 00040d30:·6f66·5f63·616c·6c3d·2428·7570·6461·7465··of_call=$(update | |||
| 00040d40:·2d63·7279·7074·6f2d·706f·6c69·6369·6573··-crypto-policies | |||
| 00040d50:·202d·2d73·6574·2024·7b76·6172·5f73·7973···--set·${var_sys | |||
| 00040e80:·6170·6879·2050·6f6c·6963·790a·2020·6c69··aphy·Policy.··li | |||
| 00040e90:·6e65·696e·6669·6c65·3a0a·2020·2020·7061··neinfile:.····pa | |||
| 00040ea0:·7468·3a20·2f65·7463·2f63·7279·7074·6f2d··th:·/etc/crypto- | |||
| 00040eb0:·706f·6c69·6369·6573·2f63·6f6e·6669·670a··policies/config. | |||
| 00040ec0:·2020·2020·7265·6765·7870·3a20·5e28·3f21······regexp:·^(?! | |||
| 00040ed0:·2329·285c·532b·2924·0a20·2020·206c·696e··#)(\S+)$.····lin | |||
| 00040ee0:·653a·2027·7b7b·2076·6172·5f73·7973·7465··e:·'{{·var_syste | |||
| 00040 | 00040d60:·7465·6d5f·6372·7970·746f·5f70·6f6c·6963··tem_crypto_polic | ||
| 00040d70:·797d·2032·2667·743b·2661·6d70·3b31·2026··y}·2>&1·& | |||
| 00040d80:·6774·3b20·2f64·6576·2f6e·756c·6c29·0a72··gt;·/dev/null).r | |||
| 00040d90:·633d·243f·0a0a·6966·2074·6573·7420·2224··c=$?..if·test·"$ | |||
| 00040da0:·7263·2220·3d20·3132·373b·2074·6865·6e0a··rc"·=·127;·then. | |||
| 00040db0:·0965·6368·6f20·2224·7374·6465·7272·5f6f··.echo·"$stderr_o | |||
| 00040dc0:·665f·6361·6c6c·2220·2667·743b·2661·6d70··f_call"·>& | |||
| 00040dd0:·3b32·0a09·6563·686f·2022·4d61·6b65·2073··;2..echo·"Make·s | |||
| 00040de0:·7572·6520·7468·6174·2074·6865·2073·6372··ure·that·the·scr | |||
| 00040df0:·6970·7420·6973·2069·6e73·7461·6c6c·6564··ipt·is·installed | |||
| 00040e00:·206f·6e20·7468·6520·7265·6d65·6469·6174···on·the·remediat | |||
| 00040e10:·6564·2073·7973·7465·6d2e·2220·2667·743b··ed·system."·> | |||
| 00040e20:·2661·6d70·3b32·0a09·6563·686f·2022·5365··&2..echo·"Se | |||
| 00040e30:·6520·6f75·7470·7574·206f·6620·7468·6520··e·output·of·the· | |||
| 00040e40:·2764·6e66·2070·726f·7669·6465·7320·7570··'dnf·provides·up | |||
| 00040f00:·7d7d·270a·2020·2020·6372·6561·7465·3a20··}}'.····create:· | |||
| 00040f10:·7472·7565·0a20·2074·6167·733a·0a20·202d··true.··tags:.··- | |||
| 00040f20:·204e·4953·542d·3830·302d·3533·2d41·432d···NIST-800-53-AC- | |||
| 00040f30:·3137·2832·290a·2020·2d20·4e49·5354·2d38··17(2).··-·NIST-8 | |||
| 00040f40:·3030·2d35·332d·4143·2d31·3728·6129·0a20··00-53-AC-17(a).· | |||
| 00040f50:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 00040f60:·4d2d·3628·6129·0a20·202d·204e·4953·542d··M-6(a).··-·NIST- | |||
| 00040f70:·3830·302d·3533·2d4d·412d·3428·3629·0a20··800-53-MA-4(6).· | |||
| 00040f80:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| 00040f90:·432d·3132·2832·290a·2020·2d20·4e49·5354··C-12(2).··-·NIST | |||
| 00040fa0:·2d38·3030·2d35·332d·5343·2d31·3228·3329··-800-53-SC-12(3) | |||
| 00040fb0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00040fc0:·2d53·432d·3133·0a20·202d·2063·6f6e·6669··-SC-13.··-·confi | |||
| 00040fd0:·6775·7265·5f63·7279·7074·6f5f·706f·6c69··gure_crypto_poli | |||
| 00040fe0:·6379·0a20·202d·2068·6967·685f·7365·7665··cy.··-·high_seve | |||
| 00040ff0:·7269·7479·0a20·202d·206c·6f77·5f63·6f6d··rity.··-·low_com | |||
| 00041000:·706c·6578·6974·790a·2020·2d20·6c6f·775f··plexity.··-·low_ | |||
| 00041010:·6469·7372·7570·7469·6f6e·0a20·202d·206e··disruption.··-·n | |||
| 00041020:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 00041030:·2020·2d20·7265·7374·7269·6374·5f73·7472····-·restrict_str | |||
| 00041040:·6174·6567·790a·0a2d·206e·616d·653a·2056··ategy..-·name:·V | |||
| 00041050:·6572·6966·7920·7468·6174·2043·7279·7074··erify·that·Crypt | |||
| 00041060:·6f20·506f·6c69·6379·2069·7320·5365·7420··o·Policy·is·Set· | |||
| 00041070:·2872·756e·7469·6d65·290a·2020·636f·6d6d··(runtime).··comm | |||
| 00041080:·616e·643a·202f·7573·722f·6269·6e2f·7570··and:·/usr/bin/up | |||
| 0004 | 00040e50:·6461·7465·2d63·7279·7074·6f2d·706f·6c69··date-crypto-poli | ||
| 00040e60:·6369·6573·2720·636f·6d6d·616e·6422·2026··cies'·command"·& | |||
| 00040e70:·6774·3b26·616d·703b·320a·0965·6368·6f20··gt;&2..echo· | |||
| 00040e80:·2274·6f20·7365·6520·7768·6174·2070·6163··"to·see·what·pac | |||
| Max diff block lines reached; 1640863/1663963 bytes (98.61%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·Standard·System·Security·Profile·for·Anolis·OS·8 | 38 | Profile·Title·Standard·System·Security·Profile·for·Anolis·OS·8 |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:anolis:anolis_os:8 | 41 | ····*·cpe:/o:anolis:anolis_os:8 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 316, 14 lines modified | Offset 316, 33 lines modified | ||
| 316 | Severity: ·high | 316 | Severity: ·high |
| 317 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy | 317 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 318 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii), | 318 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii), |
| 319 | Identifiers·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC- | 319 | Identifiers·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC- |
| 320 | and·········13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1, | 320 | and·········13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1, |
| 321 | References··FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394- | 321 | References··FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394- |
| 322 | ············GPOS-00174 | 322 | ············GPOS-00174 |
| 323 | Remediation_Shell_script_⇲ | ||
| 324 | var_system_crypto_policy='DEFAULT' | ||
| 325 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 326 | rc=$? | ||
| 327 | if·test·"$rc"·=·127;·then | ||
| 328 | » echo·"$stderr_of_call"·>&2 | ||
| 329 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 330 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 331 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 332 | » false··#·end·with·an·error·code | ||
| 333 | elif·test·"$rc"·!=·0;·then | ||
| 334 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 335 | » false··#·end·with·an·error·code | ||
| 336 | fi | ||
| 323 | Remediation_Ansible_snippet_⇲ | 337 | Remediation_Ansible_snippet_⇲ |
| 324 | Complexity:·low | 338 | Complexity:·low |
| 325 | Disruption:·low | 339 | Disruption:·low |
| 326 | Strategy:···restrict | 340 | Strategy:···restrict |
| 327 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable | 341 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable |
| 328 | ··set_fact: | 342 | ··set_fact: |
| 329 | ····var_system_crypto_policy:·!!str·DEFAULT | 343 | ····var_system_crypto_policy:·!!str·DEFAULT |
| Offset 363, 33 lines modified | Offset 382, 14 lines modified | ||
| 363 | ··-·NIST-800-53-SC-13 | 382 | ··-·NIST-800-53-SC-13 |
| 364 | ··-·configure_crypto_policy | 383 | ··-·configure_crypto_policy |
| 365 | ··-·high_severity | 384 | ··-·high_severity |
| 366 | ··-·low_complexity | 385 | ··-·low_complexity |
| 367 | ··-·low_disruption | 386 | ··-·low_disruption |
| 368 | ··-·no_reboot_needed | 387 | ··-·no_reboot_needed |
| 369 | ··-·restrict_strategy | 388 | ··-·restrict_strategy |
| 370 | Remediation_Shell_script_⇲ | ||
| 371 | var_system_crypto_policy='DEFAULT' | ||
| 372 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 373 | rc=$? | ||
| 374 | if·test·"$rc"·=·127;·then | ||
| 375 | » echo·"$stderr_of_call"·>&2 | ||
| 376 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 377 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 378 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 379 | » false··#·end·with·an·error·code | ||
| 380 | elif·test·"$rc"·!=·0;·then | ||
| 381 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 382 | » false··#·end·with·an·error·code | ||
| 383 | fi | ||
| 384 | Group ·Updating·Software· Group·contains·1·rule | 389 | Group ·Updating·Software· Group·contains·1·rule |
| 385 | [ref] ·The·yum·command·line·tool·is·used·to·install·and·update·software·packages.·The·system·also | 390 | [ref] ·The·yum·command·line·tool·is·used·to·install·and·update·software·packages.·The·system·also |
| 386 | provides·a·graphical·software·update·tool·in·the·System·menu,·in·the·Administration·submenu,·called | 391 | provides·a·graphical·software·update·tool·in·the·System·menu,·in·the·Administration·submenu,·called |
| 387 | Software·Update. | 392 | Software·Update. |
| 388 | Anolis·OS·8·systems·contain·an·installed·software·catalog·called·the·RPM·database,·which·records | 393 | Anolis·OS·8·systems·contain·an·installed·software·catalog·called·the·RPM·database,·which·records |
| 389 | metadata·of·installed·packages.·Consistently·using·yum·or·the·graphical·Software·Update·for·all | 394 | metadata·of·installed·packages.·Consistently·using·yum·or·the·graphical·Software·Update·for·all |
| Offset 574, 14 lines modified | Offset 574, 22 lines modified | ||
| 574 | Rationale:·················verbiage·used·is·consistent·with·applicable·federal·laws,·Executive | 574 | Rationale:·················verbiage·used·is·consistent·with·applicable·federal·laws,·Executive |
| 575 | ···························Orders,·directives,·policies,·regulations,·standards,·and·guidance. | 575 | ···························Orders,·directives,·policies,·regulations,·standards,·and·guidance. |
| 576 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the | 576 | ···························Proper·group·ownership·will·ensure·that·only·root·user·can·modify·the |
| 577 | ···························banner. | 577 | ···························banner. |
| 578 | Severity: ················medium | 578 | Severity: ················medium |
| 579 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue | 579 | Rule·ID:···················xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue |
| 580 | Identifiers·and·References | 580 | Identifiers·and·References |
| 581 | Remediation_Shell_script_⇲ | ||
| 582 | Complexity:·low | ||
| 583 | Disruption:·low | ||
| 584 | Strategy:···configure | ||
| 585 | chgrp·0·/etc/issue | ||
| 581 | Remediation_Ansible_snippet_⇲ | 586 | Remediation_Ansible_snippet_⇲ |
| 582 | Complexity:·low | 587 | Complexity:·low |
| 583 | Disruption:·low | 588 | Disruption:·low |
| 584 | Strategy:···configure | 589 | Strategy:···configure |
| 585 | -·name:·Test·for·existence·/etc/issue | 590 | -·name:·Test·for·existence·/etc/issue |
| 586 | ··stat: | 591 | ··stat: |
| 587 | ····path:·/etc/issue | 592 | ····path:·/etc/issue |
| Offset 602, 34 lines modified | Offset 610, 34 lines modified | ||
| 602 | ··tags: | 610 | ··tags: |
| 603 | ··-·configure_strategy | 611 | ··-·configure_strategy |
| 604 | ··-·file_groupowner_etc_issue | 612 | ··-·file_groupowner_etc_issue |
| 605 | ··-·low_complexity | 613 | ··-·low_complexity |
| 606 | ··-·low_disruption | 614 | ··-·low_disruption |
| 607 | ··-·medium_severity | 615 | ··-·medium_severity |
| 608 | ··-·no_reboot_needed | 616 | ··-·no_reboot_needed |
| 609 | Remediation_Shell_script_⇲ | ||
| 610 | Complexity:·low | ||
| 611 | Disruption:·low | ||
| 612 | Strategy:···configure | ||
| 613 | chgrp·0·/etc/issue | ||
| 614 | ***·Rule ·Verify·Group·Ownership·of·Message·of·the·Day·Banner· [ref]·*** | 617 | ***·Rule ·Verify·Group·Ownership·of·Message·of·the·Day·Banner· [ref]·*** |
| 615 | To·properly·set·the·group·owner·of·/etc/motd,·run·the·command: | 618 | To·properly·set·the·group·owner·of·/etc/motd,·run·the·command: |
| 616 | $·sudo·chgrp·root·/etc/motd | 619 | $·sudo·chgrp·root·/etc/motd |
| 617 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting | 620 | ···························Display·of·a·standardized·and·approved·use·notification·before·granting |
| 618 | ···························access·to·the·operating·system·ensures·privacy·and·security·notification | 621 | ···························access·to·the·operating·system·ensures·privacy·and·security·notification |
| Max diff block lines reached; 203260/208030 bytes (97.71%) of diff not shown. | |||
| Offset 14450, 16 lines modified | Offset 14450, 16 lines modified | ||
| 00038710:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00038710:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00038720:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00038720:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00038730:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00038730:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00038740:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00038740:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00038750:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00038750:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00038760:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00038760:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00038770:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038770:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038780:·2020·2020·2861·7320·6f66·2032·3032·3 | 00038780:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00038790:·303 | 00038790:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 000387a0:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 000387a0:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 000387b0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 000387b0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 000387c0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 000387c0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 000387d0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 000387d0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 000387e0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 000387e0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 000387f0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 000387f0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00038800:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00038800:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15382, 334 lines modified | Offset 15382, 334 lines modified | ||
| 0003c150:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003c150:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003c160:·646d·3131·3539·2220·7461·6269·6e64·6578··dm1159"·tabindex | 0003c160:·646d·3131·3539·2220·7461·6269·6e64·6578··dm1159"·tabindex | ||
| 0003c170:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003c170:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003c180:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003c180:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003c190:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003c190:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003c1a0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003c1a0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003c1b0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003c1b0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003c1c0:·6d65·6469·6174·696f·6e20· | 0003c1c0:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | ||
| 0003c1d0:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003c1e0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c1f0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c200:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c210:·6d31·3135·3922·3e3c·7461·626c·6520·636c··m1159"><table·cl | |||
| 0003c220:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c230:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c240:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c250:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c260:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c270:·3e3c·7464·3e68·6967·683c·2f74·643e·3c2f··><td>high</td></ | |||
| 0003c280:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c290:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6d··ption:</th><td>m | |||
| 0003c2a0:·6564·6975·6d3c·2f74·643e·3c2f·7472·3e3c··edium</td></tr>< | |||
| 0003c2b0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c2c0:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003c2d0:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003c2e0:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003c | 0003c1d0:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | ||
| 0003c1e0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c1f0:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c200:·6c61·7073·6522·2069·643d·2269·646d·3131··lapse"·id="idm11 | |||
| 0003c210:·3539·223e·3c70·7265·3e3c·636f·6465·3e0a··59"><pre><code>. | |||
| 0003c220:·2320·4669·6e64·2077·6869·6368·2066·696c··#·Find·which·fil | |||
| 0003c230:·6573·2068·6176·6520·696e·636f·7272·6563··es·have·incorrec | |||
| 0003c240:·7420·6861·7368·2028·6e6f·7420·696e·202f··t·hash·(not·in·/ | |||
| 0003c250:·6574·632c·2062·6563·6175·7365·206f·6620··etc,·because·of· | |||
| 0003c260:·7468·6520·7379·7374·656d·2072·656c·6174··the·system·relat | |||
| 0003c270:·6564·2063·6f6e·6669·6720·6669·6c65·7329··ed·config·files) | |||
| 0003c280:·2061·6e64·2074·6865·6e20·6765·7420·6669···and·then·get·fi | |||
| 0003c290:·6c65·7320·6e61·6d65·730a·6669·6c65·735f··les·names.files_ | |||
| 0003c2a0:·7769·7468·5f69·6e63·6f72·7265·6374·5f68··with_incorrect_h | |||
| 0003c2b0:·6173·683d·2224·2872·706d·202d·5661·202d··ash="$(rpm·-Va·- | |||
| 0003c2c0:·2d6e·6f63·6f6e·6669·6720·7c20·6772·6570··-noconfig·|·grep | |||
| 0003c2d0:·202d·4520·275e·2e2e·3527·207c·2061·776b···-E·'^..5'·|·awk | |||
| 0003c2e0:·2027·7b70·7269·6e74·2024·4e46·7d27·2029···'{print·$NF}'·) | |||
| 0003c2f0:·220a·0a23·2046·726f·6d20·6669·6c65·7320··"..#·From·files· | |||
| 0003c300:·6e61·6d65·7320·6765·7420·7061·636b·6167··names·get·packag | |||
| 0003c310:·6520·6e61·6d65·7320·616e·6420·6368·616e··e·names·and·chan | |||
| 0003c320:·6765·206e·6577·6c69·6e65·2074·6f20·7370··ge·newline·to·sp | |||
| 0003c330:·6163·652c·2062·6563·6175·7365·2072·706d··ace,·because·rpm | |||
| 0003c340:·2077·7269·7465·7320·6561·6368·2070·6163···writes·each·pac | |||
| 0003c350:·6b61·6765·2074·6f20·6e65·7720·6c69·6e65··kage·to·new·line | |||
| 0003c360:·0a70·6163·6b61·6765·735f·746f·5f72·6569··.packages_to_rei | |||
| 0003c370:·6e73·7461·6c6c·3d22·2428·7270·6d20·2d71··nstall="$(rpm·-q | |||
| 0003c380:·6620·2466·696c·6573·5f77·6974·685f·696e··f·$files_with_in | |||
| 0003c390:·636f·7272·6563·745f·6861·7368·207c·2074··correct_hash·|·t | |||
| 0003c3a0:·7220·275c·6e27·2027·2027·2922·0a0a·0a79··r·'\n'·'·')"...y | |||
| 0003c3b0:·756d·2072·6569·6e73·7461·6c6c·202d·7920··um·reinstall·-y· | |||
| 0003c3c0:·2470·6163·6b61·6765·735f·746f·5f72·6569··$packages_to_rei | |||
| 0003c3d0:·6e73·7461·6c6c·0a3c·2f63·6f64·653e·3c2f··nstall.</code></ | |||
| 0003c3e0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c3f0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c400:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c410:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c420:·2d74·6172·6765·743d·2223·6964·6d31·3136··-target="#idm116 | |||
| 0003c430:·3022·2074·6162·696e·6465·783d·2230·2220··0"·tabindex="0"· | |||
| 0003c440:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c450:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c460:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c470:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c480:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c490:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003c4a0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c4b0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c4c0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c4d0:·7073·6522·2069·643d·2269·646d·3131·3630··pse"·id="idm1160 | |||
| 0003c4e0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c4f0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c500:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c510:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c520:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c530:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c540:·6869·6768·3c2f·7464·3e3c·2f74·723e·3c74··high</td></tr><t | |||
| 0003c550:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003c560:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003c570:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c580:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c590:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003c5a0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003c5b0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003c5c0:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003c5d0:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003c5e0:·7374·616c·6c20·636f·6d6d·616e·6420·2864··stall·command·(d | |||
| 0003c5f0:·6e66·2927·0a20·2073·6574·5f66·6163·743a··nf)'.··set_fact: | |||
| 0003c600:·0a20·2020·2070·6163·6b61·6765·5f6d·616e··.····package_man | |||
| 0003c610:·6167·6572·5f72·6569·6e73·7461·6c6c·5f63··ager_reinstall_c | |||
| 0003c620:·6d64·3a20·646e·6620·7265·696e·7374·616c··md:·dnf·reinstal | |||
| 0003c630:·6c20·2d79·0a20·2077·6865·6e3a·2061·6e73··l·-y.··when:·ans | |||
| 0003c640:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003c650:·6e20·3d3d·2022·4665·646f·7261·220a·2020··n·==·"Fedora".·· | |||
| 0003c660:·7461·6773·3a0a·2020·2d20·434a·4953·2d35··tags:.··-·CJIS-5 | |||
| 0003c670:·2e31·302e·342e·310a·2020·2d20·4449·5341··.10.4.1.··-·DISA | |||
| 0003c680:·2d53·5449·472d·5248·454c·2d30·372d·3031··-STIG-RHEL-07-01 | |||
| 0003c690:·3030·3230·0a20·202d·204e·4953·542d·3830··0020.··-·NIST-80 | |||
| 0003c6a0:·302d·3137·312d·332e·332e·380a·2020·2d20··0-171-3.3.8.··-· | |||
| 0003c6b0:·4e49·5354·2d38·3030·2d31·3731·2d33·2e34··NIST-800-171-3.4 | |||
| 0003c6c0:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003c6d0:·3533·2d41·552d·3928·3329·0a20·202d·204e··53-AU-9(3).··-·N | |||
| 0003c6e0:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003c6f0:·6329·0a20·202d·204e·4953·542d·3830·302d··c).··-·NIST-800- | |||
| 0003c700:·3533·2d43·4d2d·3628·6429·0a20·202d·204e··53-CM-6(d).··-·N | |||
| Max diff block lines reached; 8716452/8740242 bytes (99.73%) of diff not shown. | |||
| Offset 59, 15 lines modified | Offset 59, 15 lines modified | ||
| 59 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 59 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 60 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 60 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 61 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 61 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 62 | ····*·cpe:/o:redhat:enterprise_linux:7 | 62 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 63 | ····*·cpe:/o:centos:centos:7 | 63 | ····*·cpe:/o:centos:centos:7 |
| 64 | *****·Revision·History·***** | 64 | *****·Revision·History·***** |
| 65 | Current·version:·0.1.65 | 65 | Current·version:·0.1.65 |
| 66 | ····*·draft·(as·of·202 | 66 | ····*·draft·(as·of·2025-02-23) |
| 67 | *****·Table·of·Contents·***** | 67 | *****·Table·of·Contents·***** |
| 68 | ···1.·System_Settings | 68 | ···1.·System_Settings |
| 69 | ·········1.·Installing_and_Maintaining_Software | 69 | ·········1.·Installing_and_Maintaining_Software |
| 70 | ·········2.·Account_and_Access_Control | 70 | ·········2.·Account_and_Access_Control |
| 71 | ·········3.·System_Accounting_with_auditd | 71 | ·········3.·System_Accounting_with_auditd |
| 72 | ·········4.·GRUB2_bootloader_configuration | 72 | ·········4.·GRUB2_bootloader_configuration |
| 73 | ·········5.·Configure_Syslog | 73 | ·········5.·Configure_Syslog |
| Offset 101, 14 lines modified | Offset 101, 24 lines modified | ||
| 101 | $·sudo·yum·reinstall·PACKAGENAME | 101 | $·sudo·yum·reinstall·PACKAGENAME |
| 102 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 102 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 103 | $·sudo·rpm·-Uvh·PACKAGENAME | 103 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 104 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 104 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 105 | Severity: ················high | 105 | Severity: ················high |
| 106 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 106 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 107 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule | 107 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule |
| 108 | Remediation_Shell_script_⇲ | ||
| 109 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 110 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 111 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 112 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 113 | yum·reinstall·-y·$packages_to_reinstall | ||
| 108 | Remediation_Ansible_snippet_⇲ | 114 | Remediation_Ansible_snippet_⇲ |
| 109 | Complexity:·high | 115 | Complexity:·high |
| 110 | Disruption:·medium | 116 | Disruption:·medium |
| 111 | Strategy:···restrict | 117 | Strategy:···restrict |
| 112 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 118 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 113 | ··set_fact: | 119 | ··set_fact: |
| 114 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 120 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 258, 37 lines modified | Offset 268, 56 lines modified | ||
| 258 | ··-·PCI-DSS-Req-11.5 | 268 | ··-·PCI-DSS-Req-11.5 |
| 259 | ··-·high_complexity | 269 | ··-·high_complexity |
| 260 | ··-·high_severity | 270 | ··-·high_severity |
| 261 | ··-·medium_disruption | 271 | ··-·medium_disruption |
| 262 | ··-·no_reboot_needed | 272 | ··-·no_reboot_needed |
| 263 | ··-·restrict_strategy | 273 | ··-·restrict_strategy |
| 264 | ··-·rpm_verify_hashes | 274 | ··-·rpm_verify_hashes |
| 265 | Remediation_Shell_script_⇲ | ||
| 266 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 267 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 268 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 269 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 270 | yum·reinstall·-y·$packages_to_reinstall | ||
| 271 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 275 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 272 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 276 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 273 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 277 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 274 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 278 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 275 | $·rpm·-qf·FILENAME | 279 | $·rpm·-qf·FILENAME |
| 276 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 280 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 277 | $·sudo·rpm·--setperms·PACKAGENAME | 281 | $·sudo·rpm·--setperms·PACKAGENAME |
| 278 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 282 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 279 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 283 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 280 | Severity: ················high | 284 | Severity: ················high |
| 281 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 285 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 282 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 286 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 287 | Remediation_Shell_script_⇲ | ||
| 288 | Complexity:·high | ||
| 289 | Disruption:·medium | ||
| 290 | Strategy:···restrict | ||
| 291 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 292 | declare·-A·SETPERMS_RPM_DICT | ||
| 293 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 294 | #·is·expected·by·the·RPM·database | ||
| 295 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 296 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 297 | do | ||
| 298 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 299 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 300 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 301 | ········do | ||
| 302 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 303 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 304 | ········done | ||
| 305 | done | ||
| 306 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 307 | #·correct·values | ||
| 308 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 309 | do | ||
| 310 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 311 | done | ||
| 283 | Remediation_Ansible_snippet_⇲ | 312 | Remediation_Ansible_snippet_⇲ |
| 284 | Complexity:·high | 313 | Complexity:·high |
| 285 | Disruption:·medium | 314 | Disruption:·medium |
| 286 | Strategy:···restrict | 315 | Strategy:···restrict |
| 287 | -·name:·Read·list·of·files·with·incorrect·permissions | 316 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 288 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 317 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 289 | ····--nocaps·--nolinkto·--nouser·--nogroup | 318 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 365, 69 lines modified | Offset 394, 48 lines modified | ||
| 365 | ··-·PCI-DSS-Req-11.5 | 394 | ··-·PCI-DSS-Req-11.5 |
| 366 | ··-·high_complexity | 395 | ··-·high_complexity |
| 367 | ··-·high_severity | 396 | ··-·high_severity |
| 368 | ··-·medium_disruption | 397 | ··-·medium_disruption |
| 369 | ··-·no_reboot_needed | 398 | ··-·no_reboot_needed |
| 370 | ··-·restrict_strategy | 399 | ··-·restrict_strategy |
| 371 | ··-·rpm_verify_permissions | 400 | ··-·rpm_verify_permissions |
| 372 | Remediation_Shell_script_⇲ | ||
| 373 | Complexity:·high | ||
| 374 | Disruption:·medium | ||
| 375 | Strategy:···restrict | ||
| 376 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 377 | declare·-A·SETPERMS_RPM_DICT | ||
| 378 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 379 | #·is·expected·by·the·RPM·database | ||
| 380 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 865721/874032 bytes (99.05%) of diff not shown. | |||
| Offset 14457, 16 lines modified | Offset 14457, 16 lines modified | ||
| 00038780:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038780:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038790:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038790:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 000387a0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 000387a0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 000387b0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 000387b0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 000387c0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 000387c0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 000387d0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 000387d0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 000387e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000387e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000387f0:·2020·2861·7320·6f66·2032·3032·3 | 000387f0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00038800:·2d32·3 | 00038800:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038810:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038810:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038820:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038820:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00038830:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00038830:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00038840:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00038840:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00038850:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00038850:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00038860:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00038860:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00038870:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00038870:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15377, 334 lines modified | Offset 15377, 334 lines modified | ||
| 0003c100:·6574·3d22·2369·646d·3131·3539·2220·7461··et="#idm1159"·ta | 0003c100:·6574·3d22·2369·646d·3131·3539·2220·7461··et="#idm1159"·ta | ||
| 0003c110:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003c110:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003c120:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003c120:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003c130:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003c130:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003c140:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003c140:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003c150:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003c150:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003c160:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003c160:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003c170:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | |||
| 0003c180:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c190:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c1a0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c1b0:·2269·646d·3131·3539·223e·3c70·7265·3e3c··"idm1159"><pre>< | |||
| 0003c1c0:·636f·6465·3e0a·2320·4669·6e64·2077·6869··code>.#·Find·whi | |||
| 0003c1d0:·6368·2066·696c·6573·2068·6176·6520·696e··ch·files·have·in | |||
| 0003c1e0:·636f·7272·6563·7420·6861·7368·2028·6e6f··correct·hash·(no | |||
| 0003c1f0:·7420·696e·202f·6574·632c·2062·6563·6175··t·in·/etc,·becau | |||
| 0003c200:·7365·206f·6620·7468·6520·7379·7374·656d··se·of·the·system | |||
| 0003c210:·2072·656c·6174·6564·2063·6f6e·6669·6720···related·config· | |||
| 0003c220:·6669·6c65·7329·2061·6e64·2074·6865·6e20··files)·and·then· | |||
| 0003c230:·6765·7420·6669·6c65·7320·6e61·6d65·730a··get·files·names. | |||
| 0003c170:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003c180:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c190:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c1a0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c1b0:·6964·3d22·6964·6d31·3135·3922·3e3c·7461··id="idm1159"><ta | |||
| 0003c1c0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c1d0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c1e0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c1f0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c200:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c210:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003c220:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c230:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003c240:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003c250:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c260:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003c270:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003c280:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003c290:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003c2a0:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003c2b0:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | |||
| 0003c2c0:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003c2d0:·2020·7365·745f·6661·6374·3a0a·2020·2020····set_fact:.···· | |||
| 0003c2e0:·7061·636b·6167·655f·6d61·6e61·6765·725f··package_manager_ | |||
| 0003c2f0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003c300:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003c310:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003c320:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003c330:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003c340:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003c350:·2e31·0a20·202d·2044·4953·412d·5354·4947··.1.··-·DISA-STIG | |||
| 0003c360:·2d52·4845·4c2d·3037·2d30·3130·3032·300a··-RHEL-07-010020. | |||
| 0003c370:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003c380:·2d33·2e33·2e38·0a20·202d·204e·4953·542d··-3.3.8.··-·NIST- | |||
| 0003c390:·3830·302d·3137·312d·332e·342e·310a·2020··800-171-3.4.1.·· | |||
| 0003c3a0:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003c3b0:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003c3c0:·3030·2d35·332d·434d·2d36·2863·290a·2020··00-53-CM-6(c).·· | |||
| 0003c3d0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003c3e0:·2d36·2864·290a·2020·2d20·4e49·5354·2d38··-6(d).··-·NIST-8 | |||
| 0003c3f0:·3030·2d35·332d·5349·2d37·0a20·202d·204e··00-53-SI-7.··-·N | |||
| 0003c400:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003c410:·3129·0a20·202d·204e·4953·542d·3830·302d··1).··-·NIST-800- | |||
| 0003c420:·3533·2d53·492d·3728·3629·0a20·202d·2050··53-SI-7(6).··-·P | |||
| 0003c430:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003c440:·2020·2d20·6869·6768·5f63·6f6d·706c·6578····-·high_complex | |||
| 0003c450:·6974·790a·2020·2d20·6869·6768·5f73·6576··ity.··-·high_sev | |||
| 0003c460:·6572·6974·790a·2020·2d20·6d65·6469·756d··erity.··-·medium | |||
| 0003c470:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | |||
| 0003c480:·6e6f·5f72·6562·6f6f·745f·6e65·6564·6564··no_reboot_needed | |||
| 0003c490:·0a20·202d·2072·6573·7472·6963·745f·7374··.··-·restrict_st | |||
| 0003c4a0:·7261·7465·6779·0a20·202d·2072·706d·5f76··rategy.··-·rpm_v | |||
| 0003c4b0:·6572·6966·795f·6861·7368·6573·0a0a·2d20··erify_hashes..-· | |||
| 0003c4c0:·6e61·6d65·3a20·2753·6574·2066·6163·743a··name:·'Set·fact: | |||
| 0003c4d0:·2050·6163·6b61·6765·206d·616e·6167·6572···Package·manager | |||
| 0003c4e0:·2072·6569·6e73·7461·6c6c·2063·6f6d·6d61···reinstall·comma | |||
| 0003c4f0:·6e64·2028·7975·6d29·270a·2020·7365·745f··nd·(yum)'.··set_ | |||
| 0003c500:·6661·6374·3a0a·2020·2020·7061·636b·6167··fact:.····packag | |||
| 0003c510:·655f·6d61·6e61·6765·725f·7265·696e·7374··e_manager_reinst | |||
| 0003c520:·616c·6c5f·636d·643a·2079·756d·2072·6569··all_cmd:·yum·rei | |||
| 0003c530:·6e73·7461·6c6c·202d·790a·2020·7768·656e··nstall·-y.··when | |||
| 0003c540:·3a20·2861·6e73·6962·6c65·5f64·6973·7472··:·(ansible_distr | |||
| 0003c550:·6962·7574·696f·6e20·3d3d·2022·5265·6448··ibution·==·"RedH | |||
| 0003c560:·6174·2220·6f72·2061·6e73·6962·6c65·5f64··at"·or·ansible_d | |||
| 0003c570:·6973·7472·6962·7574·696f·6e20·3d3d·2022··istribution·==·" | |||
| 0003c580:·4365·6e74·4f53·2220·6f72·2061·6e73·6962··CentOS"·or·ansib | |||
| 0003c590:·6c65·5f64·6973·7472·6962·7574·696f·6e0a··le_distribution. | |||
| 0003c5a0:·2020·2020·3d3d·2022·4f72·6163·6c65·4c69······==·"OracleLi | |||
| 0003c5b0:·6e75·7822·290a·2020·7461·6773·3a0a·2020··nux").··tags:.·· | |||
| 0003c5c0:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| 0003c5d0:·2020·2d20·4449·5341·2d53·5449·472d·5248····-·DISA-STIG-RH | |||
| 0003c5e0:·454c·2d30·372d·3031·3030·3230·0a20·202d··EL-07-010020.··- | |||
| 0003c5f0:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003c600:·332e·380a·2020·2d20·4e49·5354·2d38·3030··3.8.··-·NIST-800 | |||
| 0003c610:·2d31·3731·2d33·2e34·2e31·0a20·202d·204e··-171-3.4.1.··-·N | |||
| 0003c620:·4953·542d·3830·302d·3533·2d41·552d·3928··IST-800-53-AU-9( | |||
| 0003c630:·3329·0a20·202d·204e·4953·542d·3830·302d··3).··-·NIST-800- | |||
| 0003c640:·3533·2d43·4d2d·3628·6329·0a20·202d·204e··53-CM-6(c).··-·N | |||
| 0003c650:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003c660:·6429·0a20·202d·204e·4953·542d·3830·302d··d).··-·NIST-800- | |||
| 0003c670:·3533·2d53·492d·370a·2020·2d20·4e49·5354··53-SI-7.··-·NIST | |||
| 0003c680:·2d38·3030·2d35·332d·5349·2d37·2831·290a··-800-53-SI-7(1). | |||
| 0003c690:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c6a0:·5349·2d37·2836·290a·2020·2d20·5043·492d··SI-7(6).··-·PCI- | |||
| 0003c6b0:·4453·532d·5265·712d·3131·2e35·0a20·202d··DSS-Req-11.5.··- | |||
| 0003c6c0:·2068·6967·685f·636f·6d70·6c65·7869·7479···high_complexity | |||
| 0003c6d0:·0a20·202d·2068·6967·685f·7365·7665·7269··.··-·high_severi | |||
| 0003c6e0:·7479·0a20·202d·206d·6564·6975·6d5f·6469··ty.··-·medium_di | |||
| 0003c6f0:·7372·7570·7469·6f6e·0a20·202d·206e·6f5f··sruption.··-·no_ | |||
| 0003c700:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| Max diff block lines reached; 6199322/6222836 bytes (99.62%) of diff not shown. | |||
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 61 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 62 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 62 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 63 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 63 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:7 | 64 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 65 | ····*·cpe:/o:centos:centos:7 | 65 | ····*·cpe:/o:centos:centos:7 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·System_Settings | 70 | ···1.·System_Settings |
| 71 | ·········1.·Installing_and_Maintaining_Software | 71 | ·········1.·Installing_and_Maintaining_Software |
| 72 | ·········2.·Account_and_Access_Control | 72 | ·········2.·Account_and_Access_Control |
| 73 | ·········3.·System_Accounting_with_auditd | 73 | ·········3.·System_Accounting_with_auditd |
| 74 | ·········4.·Configure_Syslog | 74 | ·········4.·Configure_Syslog |
| 75 | ·········5.·File_Permissions_and_Masks | 75 | ·········5.·File_Permissions_and_Masks |
| Offset 101, 14 lines modified | Offset 101, 24 lines modified | ||
| 101 | $·sudo·yum·reinstall·PACKAGENAME | 101 | $·sudo·yum·reinstall·PACKAGENAME |
| 102 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 102 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 103 | $·sudo·rpm·-Uvh·PACKAGENAME | 103 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 104 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 104 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 105 | Severity: ················high | 105 | Severity: ················high |
| 106 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 106 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 107 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule | 107 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule |
| 108 | Remediation_Shell_script_⇲ | ||
| 109 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 110 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 111 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 112 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 113 | yum·reinstall·-y·$packages_to_reinstall | ||
| 108 | Remediation_Ansible_snippet_⇲ | 114 | Remediation_Ansible_snippet_⇲ |
| 109 | Complexity:·high | 115 | Complexity:·high |
| 110 | Disruption:·medium | 116 | Disruption:·medium |
| 111 | Strategy:···restrict | 117 | Strategy:···restrict |
| 112 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 118 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 113 | ··set_fact: | 119 | ··set_fact: |
| 114 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 120 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 258, 37 lines modified | Offset 268, 56 lines modified | ||
| 258 | ··-·PCI-DSS-Req-11.5 | 268 | ··-·PCI-DSS-Req-11.5 |
| 259 | ··-·high_complexity | 269 | ··-·high_complexity |
| 260 | ··-·high_severity | 270 | ··-·high_severity |
| 261 | ··-·medium_disruption | 271 | ··-·medium_disruption |
| 262 | ··-·no_reboot_needed | 272 | ··-·no_reboot_needed |
| 263 | ··-·restrict_strategy | 273 | ··-·restrict_strategy |
| 264 | ··-·rpm_verify_hashes | 274 | ··-·rpm_verify_hashes |
| 265 | Remediation_Shell_script_⇲ | ||
| 266 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 267 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 268 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 269 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 270 | yum·reinstall·-y·$packages_to_reinstall | ||
| 271 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 275 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 272 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 276 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 273 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 277 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 274 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 278 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 275 | $·rpm·-qf·FILENAME | 279 | $·rpm·-qf·FILENAME |
| 276 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 280 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 277 | $·sudo·rpm·--setperms·PACKAGENAME | 281 | $·sudo·rpm·--setperms·PACKAGENAME |
| 278 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 282 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 279 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 283 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 280 | Severity: ················high | 284 | Severity: ················high |
| 281 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 285 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 282 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 286 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 287 | Remediation_Shell_script_⇲ | ||
| 288 | Complexity:·high | ||
| 289 | Disruption:·medium | ||
| 290 | Strategy:···restrict | ||
| 291 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 292 | declare·-A·SETPERMS_RPM_DICT | ||
| 293 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 294 | #·is·expected·by·the·RPM·database | ||
| 295 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 296 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 297 | do | ||
| 298 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 299 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 300 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 301 | ········do | ||
| 302 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 303 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 304 | ········done | ||
| 305 | done | ||
| 306 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 307 | #·correct·values | ||
| 308 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 309 | do | ||
| 310 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 311 | done | ||
| 283 | Remediation_Ansible_snippet_⇲ | 312 | Remediation_Ansible_snippet_⇲ |
| 284 | Complexity:·high | 313 | Complexity:·high |
| 285 | Disruption:·medium | 314 | Disruption:·medium |
| 286 | Strategy:···restrict | 315 | Strategy:···restrict |
| 287 | -·name:·Read·list·of·files·with·incorrect·permissions | 316 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 288 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 317 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 289 | ····--nocaps·--nolinkto·--nouser·--nogroup | 318 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 365, 96 lines modified | Offset 394, 101 lines modified | ||
| 365 | ··-·PCI-DSS-Req-11.5 | 394 | ··-·PCI-DSS-Req-11.5 |
| 366 | ··-·high_complexity | 395 | ··-·high_complexity |
| 367 | ··-·high_severity | 396 | ··-·high_severity |
| 368 | ··-·medium_disruption | 397 | ··-·medium_disruption |
| 369 | ··-·no_reboot_needed | 398 | ··-·no_reboot_needed |
| 370 | ··-·restrict_strategy | 399 | ··-·restrict_strategy |
| 371 | ··-·rpm_verify_permissions | 400 | ··-·rpm_verify_permissions |
| 372 | Remediation_Shell_script_⇲ | ||
| 373 | Complexity:·high | ||
| 374 | Disruption:·medium | ||
| 375 | Strategy:···restrict | ||
| 376 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 377 | declare·-A·SETPERMS_RPM_DICT | ||
| 378 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 379 | #·is·expected·by·the·RPM·database | ||
| 380 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 576293/584592 bytes (98.58%) of diff not shown. | |||
| Offset 14554, 15 lines modified | Offset 14554, 15 lines modified | ||
| 00038d90:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038d90:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038da0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038da0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038db0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038db0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038dc0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038dc0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038dd0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038dd0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038de0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038de0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038df0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038df0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038e00:·3 | 00038e00:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038e10:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038e10:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038e20:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038e20:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038e30:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038e30:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038e40:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038e40:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00038e50:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00038e50:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00038e60:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00038e60:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00038e70:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00038e70:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15473, 192 lines modified | Offset 15473, 192 lines modified | ||
| 0003c700:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003c700:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003c710:·2223·6964·6d38·3534·3022·2074·6162·696e··"#idm8540"·tabin | 0003c710:·2223·6964·6d38·3534·3022·2074·6162·696e··"#idm8540"·tabin | ||
| 0003c720:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003c720:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c730:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c730:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c740:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c740:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c750:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c750:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c760:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c760:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c770:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c770:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003c780:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003c790:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c7a0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c7b0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c7c0:·3d22·6964·6d38·3534·3022·3e3c·7461·626c··="idm8540"><tabl | |||
| 0003c7d0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c7e0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c7f0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003c800:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003c810:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003c820:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c830:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c840:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c850:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c860:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c870:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003c880:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c890:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003c8a0:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003c8b0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c8c0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c8d0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c8e0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c8f0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c900:·3d22·2369·646d·3835·3431·2220·7461·6269··="#idm8541"·tabi | |||
| 0003c910:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c920:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c930:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c940:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c950:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c960:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003c970:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003c980:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c990:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c9a0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c9b0:·2269·646d·3835·3431·223e·3c74·6162·6c65··"idm8541"><table | |||
| 0003c9c0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c9d0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c9e0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c9f0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003ca00:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003ca10:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003ca20:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003ca30:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003ca40:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003ca50:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003ca60:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003ca70:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003ca80:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003ca90:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003caa0:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003cab0:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003cac0:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003cad0:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003cae0:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003caf0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003cb00:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003cb10:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003cb20:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003cb30:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003cb40:·2369·646d·3835·3432·2220·7461·6269·6e64··#idm8542"·tabind | |||
| 0003cb50:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003cb60:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003cb70:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003cb80:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003cb90:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003cba0:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003c | 0003c780:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003c | 0003c790:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003c | 0003c7a0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003c | 0003c7b0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003c | 0003c7c0:·6964·6d38·3534·3022·3e3c·7461·626c·6520··idm8540"><table· | ||
| 0003c | 0003c7d0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003c | 0003c7e0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003c | 0003c7f0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003c | 0003c800:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003c | 0003c810:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003c | 0003c820:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003c830:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003c | 0003c840:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003c | 0003c850:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003c860:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003c | 0003c870:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003c | 0003c880:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003c890:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003c8a0:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003c8b0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003c8c0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003c8d0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003c8e0:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003c8f0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003c900:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c910:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c920:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c930:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c940:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c950:·6964·6d38·3534·3122·2074·6162·696e·6465··idm8541"·tabinde | |||
| 0003c960:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c970:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c980:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c990:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c9a0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c9b0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| Max diff block lines reached; 6783301/6809575 bytes (99.61%) of diff not shown. | |||
| Offset 72, 15 lines modified | Offset 72, 15 lines modified | ||
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 75 | ····*·cpe:/o:redhat:enterprise_linux:8 | 75 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 76 | ····*·cpe:/o:centos:centos:8 | 76 | ····*·cpe:/o:centos:centos:8 |
| 77 | *****·Revision·History·***** | 77 | *****·Revision·History·***** |
| 78 | Current·version:·0.1.65 | 78 | Current·version:·0.1.65 |
| 79 | ····*·draft·(as·of·202 | 79 | ····*·draft·(as·of·2025-02-23) |
| 80 | *****·Table·of·Contents·***** | 80 | *****·Table·of·Contents·***** |
| 81 | ···1.·System_Settings | 81 | ···1.·System_Settings |
| 82 | ·········1.·Installing_and_Maintaining_Software | 82 | ·········1.·Installing_and_Maintaining_Software |
| 83 | ·········2.·Account_and_Access_Control | 83 | ·········2.·Account_and_Access_Control |
| 84 | ·········3.·System_Accounting_with_auditd | 84 | ·········3.·System_Accounting_with_auditd |
| 85 | ·········4.·GRUB2_bootloader_configuration | 85 | ·········4.·GRUB2_bootloader_configuration |
| 86 | ·········5.·Configure_Syslog | 86 | ·········5.·Configure_Syslog |
| Offset 113, 31 lines modified | Offset 113, 39 lines modified | ||
| 113 | $·sudo·yum·install·aide | 113 | $·sudo·yum·install·aide |
| 114 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 114 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 115 | Severity: ·medium | 115 | Severity: ·medium |
| 116 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 116 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 117 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 117 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 118 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 118 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 119 | References | 119 | References |
| 120 | Remediation_Anaconda_snippet_⇲ | ||
| 121 | Complexity:·low | ||
| 122 | Disruption:·low | ||
| 123 | Strategy:···enable | ||
| 124 | package·--add=aide | ||
| 125 | Remediation_Puppet_snippet_⇲ | 120 | Remediation_Puppet_snippet_⇲ |
| 126 | Complexity:·low | 121 | Complexity:·low |
| 127 | Disruption:·low | 122 | Disruption:·low |
| 128 | Strategy:···enable | 123 | Strategy:···enable |
| 129 | include·install_aide | 124 | include·install_aide |
| 130 | class·install_aide·{ | 125 | class·install_aide·{ |
| 131 | ··package·{·'aide': | 126 | ··package·{·'aide': |
| 132 | ····ensure·=>·'installed', | 127 | ····ensure·=>·'installed', |
| 133 | ··} | 128 | ··} |
| 134 | } | 129 | } |
| 130 | Remediation_Shell_script_⇲ | ||
| 131 | Complexity:·low | ||
| 132 | Disruption:·low | ||
| 133 | Strategy:···enable | ||
| 134 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 135 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 136 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 137 | ····yum·install·-y·"aide" | ||
| 138 | fi | ||
| 139 | else | ||
| 140 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 141 | fi | ||
| 135 | Remediation_Ansible_snippet_⇲ | 142 | Remediation_Ansible_snippet_⇲ |
| 136 | Complexity:·low | 143 | Complexity:·low |
| 137 | Disruption:·low | 144 | Disruption:·low |
| 138 | Strategy:···enable | 145 | Strategy:···enable |
| 139 | -·name:·Ensure·aide·is·installed | 146 | -·name:·Ensure·aide·is·installed |
| 140 | ··package: | 147 | ··package: |
| 141 | ····name:·aide | 148 | ····name:·aide |
| Offset 155, 42 lines modified | Offset 163, 48 lines modified | ||
| 155 | ··-·no_reboot_needed | 163 | ··-·no_reboot_needed |
| 156 | ··-·package_aide_installed | 164 | ··-·package_aide_installed |
| 157 | Remediation_OSBuild_Blueprint_snippet_⇲ | 165 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 158 | [[packages]] | 166 | [[packages]] |
| 159 | name·=·"aide" | 167 | name·=·"aide" |
| 160 | version·=·"*" | 168 | version·=·"*" |
| 161 | Remediation_ | 169 | Remediation_Anaconda_snippet_⇲ |
| 162 | Complexity:·low | 170 | Complexity:·low |
| 163 | Disruption:·low | 171 | Disruption:·low |
| 164 | Strategy:···enable | 172 | Strategy:···enable |
| 165 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 166 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 173 | package·--add=aide | ||
| 167 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 168 | ····yum·install·-y·"aide" | ||
| 169 | fi | ||
| 170 | else | ||
| 171 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 172 | fi | ||
| 173 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 174 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 174 | Run·the·following·command·to·generate·a·new·database: | 175 | Run·the·following·command·to·generate·a·new·database: |
| 175 | $·sudo·/usr/sbin/aide·--init | 176 | $·sudo·/usr/sbin/aide·--init |
| 176 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 177 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 177 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 178 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 178 | To·initiate·a·manual·check,·run·the·following·command: | 179 | To·initiate·a·manual·check,·run·the·following·command: |
| 179 | $·sudo·/usr/sbin/aide·--check | 180 | $·sudo·/usr/sbin/aide·--check |
| 180 | If·this·check·produces·any·unexpected·output,·investigate. | 181 | If·this·check·produces·any·unexpected·output,·investigate. |
| 181 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 182 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 182 | Severity: ·medium | 183 | Severity: ·medium |
| 183 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 184 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 184 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 185 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 185 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 186 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 186 | References | 187 | References |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 192 | ····yum·install·-y·"aide" | ||
| 193 | fi | ||
| 194 | /usr/sbin/aide·--init | ||
| 195 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 196 | else | ||
| 197 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 198 | fi | ||
| 187 | Remediation_Ansible_snippet_⇲ | 199 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 200 | Complexity:·low |
| 189 | Disruption:·low | 201 | Disruption:·low |
| 190 | Strategy:···restrict | 202 | Strategy:···restrict |
| 191 | -·name:·Ensure·AIDE·is·installed | 203 | -·name:·Ensure·AIDE·is·installed |
| 192 | ··package: | 204 | ··package: |
| 193 | ····name:·'{{·item·}}' | 205 | ····name:·'{{·item·}}' |
| Offset 255, 234 lines modified | Offset 269, 228 lines modified | ||
| 255 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 256 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 257 | ··-·low_complexity | 271 | ··-·low_complexity |
| 258 | ··-·low_disruption | 272 | ··-·low_disruption |
| 259 | ··-·medium_severity | 273 | ··-·medium_severity |
| 260 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 261 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| Max diff block lines reached; 774003/779660 bytes (99.27%) of diff not shown. | |||
| Offset 14553, 15 lines modified | Offset 14553, 15 lines modified | ||
| 00038d80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038d80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038d90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038d90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038da0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038da0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038db0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038db0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038dc0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038dc0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038dd0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038dd0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038de0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038de0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038df0:·3 | 00038df0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038e00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038e00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038e10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038e10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038e20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038e20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038e30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038e30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00038e40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00038e40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00038e50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00038e50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00038e60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00038e60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15472, 192 lines modified | Offset 15472, 192 lines modified | ||
| 0003c6f0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003c6f0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003c700:·2223·6964·6d38·3534·3022·2074·6162·696e··"#idm8540"·tabin | 0003c700:·2223·6964·6d38·3534·3022·2074·6162·696e··"#idm8540"·tabin | ||
| 0003c710:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003c710:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c720:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c720:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c730:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c730:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c740:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c740:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c750:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c750:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c760:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c760:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003c770:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003c780:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c790:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c7a0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c7b0:·3d22·6964·6d38·3534·3022·3e3c·7461·626c··="idm8540"><tabl | |||
| 0003c7c0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c7d0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c7e0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003c7f0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003c800:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003c810:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c820:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c830:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c840:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c850:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c860:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003c870:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c880:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003c890:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003c8a0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c8b0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c8c0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c8d0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c8e0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c8f0:·3d22·2369·646d·3835·3431·2220·7461·6269··="#idm8541"·tabi | |||
| 0003c900:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c910:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c920:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c930:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c940:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c950:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003c960:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003c970:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c980:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c990:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c9a0:·2269·646d·3835·3431·223e·3c74·6162·6c65··"idm8541"><table | |||
| 0003c9b0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c9c0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c9d0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c9e0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c9f0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003ca00:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003ca10:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003ca20:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003ca30:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003ca40:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003ca50:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003ca60:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003ca70:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003ca80:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003ca90:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003caa0:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003cab0:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003cac0:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003cad0:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003cae0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003caf0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003cb00:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003cb10:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003cb20:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003cb30:·2369·646d·3835·3432·2220·7461·6269·6e64··#idm8542"·tabind | |||
| 0003cb40:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003cb50:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003cb60:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003cb70:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003cb80:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003cb90:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003c | 0003c770:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003c | 0003c780:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003c | 0003c790:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003c | 0003c7a0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003c | 0003c7b0:·6964·6d38·3534·3022·3e3c·7461·626c·6520··idm8540"><table· | ||
| 0003c | 0003c7c0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003c | 0003c7d0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003c | 0003c7e0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003c | 0003c7f0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003c | 0003c800:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003c | 0003c810:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003c820:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003c | 0003c830:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003c | 0003c840:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003c850:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003c | 0003c860:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003c | 0003c870:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003c880:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003c890:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003c8a0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003c8b0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003c8c0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003c8d0:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003c8e0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003c8f0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c900:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c910:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c920:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c930:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c940:·6964·6d38·3534·3122·2074·6162·696e·6465··idm8541"·tabinde | |||
| 0003c950:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c960:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c970:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c980:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c990:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c9a0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| Max diff block lines reached; 7009576/7035850 bytes (99.63%) of diff not shown. | |||
| Offset 72, 15 lines modified | Offset 72, 15 lines modified | ||
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 75 | ····*·cpe:/o:redhat:enterprise_linux:8 | 75 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 76 | ····*·cpe:/o:centos:centos:8 | 76 | ····*·cpe:/o:centos:centos:8 |
| 77 | *****·Revision·History·***** | 77 | *****·Revision·History·***** |
| 78 | Current·version:·0.1.65 | 78 | Current·version:·0.1.65 |
| 79 | ····*·draft·(as·of·202 | 79 | ····*·draft·(as·of·2025-02-23) |
| 80 | *****·Table·of·Contents·***** | 80 | *****·Table·of·Contents·***** |
| 81 | ···1.·System_Settings | 81 | ···1.·System_Settings |
| 82 | ·········1.·Installing_and_Maintaining_Software | 82 | ·········1.·Installing_and_Maintaining_Software |
| 83 | ·········2.·Account_and_Access_Control | 83 | ·········2.·Account_and_Access_Control |
| 84 | ·········3.·System_Accounting_with_auditd | 84 | ·········3.·System_Accounting_with_auditd |
| 85 | ·········4.·GRUB2_bootloader_configuration | 85 | ·········4.·GRUB2_bootloader_configuration |
| 86 | ·········5.·Configure_Syslog | 86 | ·········5.·Configure_Syslog |
| Offset 113, 31 lines modified | Offset 113, 39 lines modified | ||
| 113 | $·sudo·yum·install·aide | 113 | $·sudo·yum·install·aide |
| 114 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 114 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 115 | Severity: ·medium | 115 | Severity: ·medium |
| 116 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 116 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 117 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 117 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 118 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 118 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 119 | References | 119 | References |
| 120 | Remediation_Anaconda_snippet_⇲ | ||
| 121 | Complexity:·low | ||
| 122 | Disruption:·low | ||
| 123 | Strategy:···enable | ||
| 124 | package·--add=aide | ||
| 125 | Remediation_Puppet_snippet_⇲ | 120 | Remediation_Puppet_snippet_⇲ |
| 126 | Complexity:·low | 121 | Complexity:·low |
| 127 | Disruption:·low | 122 | Disruption:·low |
| 128 | Strategy:···enable | 123 | Strategy:···enable |
| 129 | include·install_aide | 124 | include·install_aide |
| 130 | class·install_aide·{ | 125 | class·install_aide·{ |
| 131 | ··package·{·'aide': | 126 | ··package·{·'aide': |
| 132 | ····ensure·=>·'installed', | 127 | ····ensure·=>·'installed', |
| 133 | ··} | 128 | ··} |
| 134 | } | 129 | } |
| 130 | Remediation_Shell_script_⇲ | ||
| 131 | Complexity:·low | ||
| 132 | Disruption:·low | ||
| 133 | Strategy:···enable | ||
| 134 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 135 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 136 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 137 | ····yum·install·-y·"aide" | ||
| 138 | fi | ||
| 139 | else | ||
| 140 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 141 | fi | ||
| 135 | Remediation_Ansible_snippet_⇲ | 142 | Remediation_Ansible_snippet_⇲ |
| 136 | Complexity:·low | 143 | Complexity:·low |
| 137 | Disruption:·low | 144 | Disruption:·low |
| 138 | Strategy:···enable | 145 | Strategy:···enable |
| 139 | -·name:·Ensure·aide·is·installed | 146 | -·name:·Ensure·aide·is·installed |
| 140 | ··package: | 147 | ··package: |
| 141 | ····name:·aide | 148 | ····name:·aide |
| Offset 155, 42 lines modified | Offset 163, 48 lines modified | ||
| 155 | ··-·no_reboot_needed | 163 | ··-·no_reboot_needed |
| 156 | ··-·package_aide_installed | 164 | ··-·package_aide_installed |
| 157 | Remediation_OSBuild_Blueprint_snippet_⇲ | 165 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 158 | [[packages]] | 166 | [[packages]] |
| 159 | name·=·"aide" | 167 | name·=·"aide" |
| 160 | version·=·"*" | 168 | version·=·"*" |
| 161 | Remediation_ | 169 | Remediation_Anaconda_snippet_⇲ |
| 162 | Complexity:·low | 170 | Complexity:·low |
| 163 | Disruption:·low | 171 | Disruption:·low |
| 164 | Strategy:···enable | 172 | Strategy:···enable |
| 165 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 166 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 173 | package·--add=aide | ||
| 167 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 168 | ····yum·install·-y·"aide" | ||
| 169 | fi | ||
| 170 | else | ||
| 171 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 172 | fi | ||
| 173 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 174 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 174 | Run·the·following·command·to·generate·a·new·database: | 175 | Run·the·following·command·to·generate·a·new·database: |
| 175 | $·sudo·/usr/sbin/aide·--init | 176 | $·sudo·/usr/sbin/aide·--init |
| 176 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 177 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 177 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 178 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 178 | To·initiate·a·manual·check,·run·the·following·command: | 179 | To·initiate·a·manual·check,·run·the·following·command: |
| 179 | $·sudo·/usr/sbin/aide·--check | 180 | $·sudo·/usr/sbin/aide·--check |
| 180 | If·this·check·produces·any·unexpected·output,·investigate. | 181 | If·this·check·produces·any·unexpected·output,·investigate. |
| 181 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 182 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 182 | Severity: ·medium | 183 | Severity: ·medium |
| 183 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 184 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 184 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 185 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 185 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 186 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 186 | References | 187 | References |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 192 | ····yum·install·-y·"aide" | ||
| 193 | fi | ||
| 194 | /usr/sbin/aide·--init | ||
| 195 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 196 | else | ||
| 197 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 198 | fi | ||
| 187 | Remediation_Ansible_snippet_⇲ | 199 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 200 | Complexity:·low |
| 189 | Disruption:·low | 201 | Disruption:·low |
| 190 | Strategy:···restrict | 202 | Strategy:···restrict |
| 191 | -·name:·Ensure·AIDE·is·installed | 203 | -·name:·Ensure·AIDE·is·installed |
| 192 | ··package: | 204 | ··package: |
| 193 | ····name:·'{{·item·}}' | 205 | ····name:·'{{·item·}}' |
| Offset 255, 28 lines modified | Offset 269, 14 lines modified | ||
| 255 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 256 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 257 | ··-·low_complexity | 271 | ··-·low_complexity |
| 258 | ··-·low_disruption | 272 | ··-·low_disruption |
| 259 | ··-·medium_severity | 273 | ··-·medium_severity |
| 260 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 261 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| Max diff block lines reached; 803622/809285 bytes (99.30%) of diff not shown. | |||
| Offset 14555, 15 lines modified | Offset 14555, 15 lines modified | ||
| 00038da0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038da0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038db0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038db0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038dc0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038dc0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038dd0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038dd0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038de0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038de0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038df0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038df0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038e00:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038e00:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038e10:·3 | 00038e10:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038e20:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038e20:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038e30:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038e30:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038e40:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038e40:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038e50:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038e50:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00038e60:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00038e60:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00038e70:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00038e70:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00038e80:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00038e80:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15468, 191 lines modified | Offset 15468, 191 lines modified | ||
| 0003c6b0:·6172·6765·743d·2223·6964·6d38·3534·3022··arget="#idm8540" | 0003c6b0:·6172·6765·743d·2223·6964·6d38·3534·3022··arget="#idm8540" | ||
| 0003c6c0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003c6c0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003c6d0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003c6d0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003c6e0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003c6e0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003c6f0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003c6f0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003c700:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003c700:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003c710:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003c710:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003c720:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003c720:·6f6e·2041·6e61·636f·6e64·6120·736e·6970··on·Anaconda·snip | |||
| 0003c730:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c740:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c750:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c760:·7365·2220·6964·3d22·6964·6d38·3534·3022··se"·id="idm8540" | |||
| 0003c770:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c780:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c790:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c7a0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c7b0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c7c0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c7d0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c7e0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c7f0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c800:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c810:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c820:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003c830:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c840:·653e·0a70·6163·6b61·6765·202d·2d61·6464··e>.package·--add | |||
| 0003c850:·3d61·6964·650a·3c2f·636f·6465·3e3c·2f70··=aide.</code></p | |||
| 0003c860:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c870:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c880:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c890:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c8a0:·7461·7267·6574·3d22·2369·646d·3835·3431··target="#idm8541 | |||
| 0003c8b0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c8c0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c8d0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c8e0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c8f0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c900:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c910:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003c920:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c930:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c940:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c950:·6522·2069·643d·2269·646d·3835·3431·223e··e"·id="idm8541"> | |||
| 0003c960:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c970:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c980:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c990:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c9a0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c9b0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003c9c0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c9d0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c9e0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c9f0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003ca00:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003ca10:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003ca20:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003ca30:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003ca40:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003ca50:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003ca60:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003ca70:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003ca80:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003ca90:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003caa0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003cab0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003cac0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003cad0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003cae0:·7267·6574·3d22·2369·646d·3835·3432·2220··rget="#idm8542"· | |||
| 0003caf0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003cb00:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003cb10:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003cb20:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003cb30:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003cb40:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003cb50:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c | 0003c730:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 0003c | 0003c740:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 0003c | 0003c750:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 0003c | 0003c760:·2220·6964·3d22·6964·6d38·3534·3022·3e3c··"·id="idm8540">< | ||
| 0003c | 0003c770:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | ||
| 0003c | 0003c780:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | ||
| 0003c | 0003c790:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 0003c | 0003c7a0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | ||
| 0003c | 0003c7b0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | ||
| 0003c | 0003c7c0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | ||
| 0003c | 0003c7d0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003c | 0003c7e0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | ||
| 0003c | 0003c7f0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003c | 0003c800:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | ||
| 0003c | 0003c810:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | ||
| 0003c | 0003c820:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | ||
| 0003c | 0003c830:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | ||
| 0003c840:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003c850:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003c860:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003c870:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003c880:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003c890:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003c8a0:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003c8b0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c8c0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003cc70:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003cc80:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003cc90:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003cca0:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003ccb0:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003ccc0:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003ccd0:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003cce0:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003ccf0:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| Max diff block lines reached; 6534383/6560519 bytes (99.60%) of diff not shown. | |||
| Offset 72, 15 lines modified | Offset 72, 15 lines modified | ||
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 75 | ····*·cpe:/o:redhat:enterprise_linux:8 | 75 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 76 | ····*·cpe:/o:centos:centos:8 | 76 | ····*·cpe:/o:centos:centos:8 |
| 77 | *****·Revision·History·***** | 77 | *****·Revision·History·***** |
| 78 | Current·version:·0.1.65 | 78 | Current·version:·0.1.65 |
| 79 | ····*·draft·(as·of·202 | 79 | ····*·draft·(as·of·2025-02-23) |
| 80 | *****·Table·of·Contents·***** | 80 | *****·Table·of·Contents·***** |
| 81 | ···1.·System_Settings | 81 | ···1.·System_Settings |
| 82 | ·········1.·Installing_and_Maintaining_Software | 82 | ·········1.·Installing_and_Maintaining_Software |
| 83 | ·········2.·Account_and_Access_Control | 83 | ·········2.·Account_and_Access_Control |
| 84 | ·········3.·System_Accounting_with_auditd | 84 | ·········3.·System_Accounting_with_auditd |
| 85 | ·········4.·Configure_Syslog | 85 | ·········4.·Configure_Syslog |
| 86 | ·········5.·Network_Configuration_and_Firewalls | 86 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 112, 31 lines modified | Offset 112, 39 lines modified | ||
| 112 | $·sudo·yum·install·aide | 112 | $·sudo·yum·install·aide |
| 113 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 113 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 114 | Severity: ·medium | 114 | Severity: ·medium |
| 115 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 115 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 116 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 116 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 117 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 117 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 118 | References | 118 | References |
| 119 | Remediation_Anaconda_snippet_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | package·--add=aide | ||
| 124 | Remediation_Puppet_snippet_⇲ | 119 | Remediation_Puppet_snippet_⇲ |
| 125 | Complexity:·low | 120 | Complexity:·low |
| 126 | Disruption:·low | 121 | Disruption:·low |
| 127 | Strategy:···enable | 122 | Strategy:···enable |
| 128 | include·install_aide | 123 | include·install_aide |
| 129 | class·install_aide·{ | 124 | class·install_aide·{ |
| 130 | ··package·{·'aide': | 125 | ··package·{·'aide': |
| 131 | ····ensure·=>·'installed', | 126 | ····ensure·=>·'installed', |
| 132 | ··} | 127 | ··} |
| 133 | } | 128 | } |
| 129 | Remediation_Shell_script_⇲ | ||
| 130 | Complexity:·low | ||
| 131 | Disruption:·low | ||
| 132 | Strategy:···enable | ||
| 133 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 134 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 135 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 136 | ····yum·install·-y·"aide" | ||
| 137 | fi | ||
| 138 | else | ||
| 139 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 140 | fi | ||
| 134 | Remediation_Ansible_snippet_⇲ | 141 | Remediation_Ansible_snippet_⇲ |
| 135 | Complexity:·low | 142 | Complexity:·low |
| 136 | Disruption:·low | 143 | Disruption:·low |
| 137 | Strategy:···enable | 144 | Strategy:···enable |
| 138 | -·name:·Ensure·aide·is·installed | 145 | -·name:·Ensure·aide·is·installed |
| 139 | ··package: | 146 | ··package: |
| 140 | ····name:·aide | 147 | ····name:·aide |
| Offset 154, 42 lines modified | Offset 162, 48 lines modified | ||
| 154 | ··-·no_reboot_needed | 162 | ··-·no_reboot_needed |
| 155 | ··-·package_aide_installed | 163 | ··-·package_aide_installed |
| 156 | Remediation_OSBuild_Blueprint_snippet_⇲ | 164 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 157 | [[packages]] | 165 | [[packages]] |
| 158 | name·=·"aide" | 166 | name·=·"aide" |
| 159 | version·=·"*" | 167 | version·=·"*" |
| 160 | Remediation_ | 168 | Remediation_Anaconda_snippet_⇲ |
| 161 | Complexity:·low | 169 | Complexity:·low |
| 162 | Disruption:·low | 170 | Disruption:·low |
| 163 | Strategy:···enable | 171 | Strategy:···enable |
| 164 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 165 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 172 | package·--add=aide | ||
| 166 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 167 | ····yum·install·-y·"aide" | ||
| 168 | fi | ||
| 169 | else | ||
| 170 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 171 | fi | ||
| 172 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 173 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 173 | Run·the·following·command·to·generate·a·new·database: | 174 | Run·the·following·command·to·generate·a·new·database: |
| 174 | $·sudo·/usr/sbin/aide·--init | 175 | $·sudo·/usr/sbin/aide·--init |
| 175 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 176 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 176 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 177 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 177 | To·initiate·a·manual·check,·run·the·following·command: | 178 | To·initiate·a·manual·check,·run·the·following·command: |
| 178 | $·sudo·/usr/sbin/aide·--check | 179 | $·sudo·/usr/sbin/aide·--check |
| 179 | If·this·check·produces·any·unexpected·output,·investigate. | 180 | If·this·check·produces·any·unexpected·output,·investigate. |
| 180 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 181 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 181 | Severity: ·medium | 182 | Severity: ·medium |
| 182 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 183 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 183 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 184 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 184 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 185 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 185 | References | 186 | References |
| 187 | Remediation_Shell_script_⇲ | ||
| 188 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 189 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 190 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 191 | ····yum·install·-y·"aide" | ||
| 192 | fi | ||
| 193 | /usr/sbin/aide·--init | ||
| 194 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 195 | else | ||
| 196 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 197 | fi | ||
| 186 | Remediation_Ansible_snippet_⇲ | 198 | Remediation_Ansible_snippet_⇲ |
| 187 | Complexity:·low | 199 | Complexity:·low |
| 188 | Disruption:·low | 200 | Disruption:·low |
| 189 | Strategy:···restrict | 201 | Strategy:···restrict |
| 190 | -·name:·Ensure·AIDE·is·installed | 202 | -·name:·Ensure·AIDE·is·installed |
| 191 | ··package: | 203 | ··package: |
| 192 | ····name:·'{{·item·}}' | 204 | ····name:·'{{·item·}}' |
| Offset 254, 234 lines modified | Offset 268, 228 lines modified | ||
| 254 | ··-·PCI-DSS-Req-11.5 | 268 | ··-·PCI-DSS-Req-11.5 |
| 255 | ··-·aide_build_database | 269 | ··-·aide_build_database |
| 256 | ··-·low_complexity | 270 | ··-·low_complexity |
| 257 | ··-·low_disruption | 271 | ··-·low_disruption |
| 258 | ··-·medium_severity | 272 | ··-·medium_severity |
| 259 | ··-·no_reboot_needed | 273 | ··-·no_reboot_needed |
| 260 | ··-·restrict_strategy | 274 | ··-·restrict_strategy |
| Max diff block lines reached; 734929/740591 bytes (99.24%) of diff not shown. | |||
| Offset 14553, 16 lines modified | Offset 14553, 16 lines modified | ||
| 00038d80:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038d80:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038d90:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038d90:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00038da0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00038da0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00038db0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00038db0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00038dc0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00038dc0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00038dd0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00038dd0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00038de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038df0:·2020·2861·7320·6f66·2032·3032·3 | 00038df0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00038e00:·2d32·3 | 00038e00:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038e10:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038e10:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038e20:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038e20:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00038e30:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00038e30:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00038e40:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00038e40:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00038e50:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00038e50:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00038e60:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00038e60:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00038e70:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00038e70:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15236, 143 lines modified | Offset 15236, 143 lines modified | ||
| 0003b830:·6574·3d22·2369·646d·3132·3732·3622·2074··et="#idm12726"·t | 0003b830:·6574·3d22·2369·646d·3132·3732·3622·2074··et="#idm12726"·t | ||
| 0003b840:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003b840:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003b850:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003b850:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003b860:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003b860:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003b870:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003b870:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003b880:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003b880:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003b890:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003b890:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003b8a0:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 0003b8b0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b8c0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003b8d0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003b8e0:·3d22·6964·6d31·3237·3236·223e·3c74·6162··="idm12726"><tab | |||
| 0003b8f0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003b900:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003b910:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003b920:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003b930:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003b8a0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003b8b0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003b8c0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003b8d0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003b8e0:·2069·643d·2269·646d·3132·3732·3622·3e3c···id="idm12726">< | |||
| 0003b8f0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003b900:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003b910:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003b920:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003b930:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003b940:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003b950:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003b960:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003b9 | 0003b940:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | ||
| 0003b9 | 0003b950:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | ||
| 0003b960:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b970:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003b980:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003b990:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003b9a0:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003b9b0:·626c·653e·3c70·7265·3e3c·636f·6465·3e0a··ble><pre><code>. | |||
| 0003b9c0:·666f·7220·6620·696e·202f·6574·632f·7375··for·f·in·/etc/su | |||
| 0003b9d0:·646f·6572·7320·2f65·7463·2f73·7564·6f65··doers·/etc/sudoe | |||
| 0003b9e0:·7273·2e64·2f2a·203b·2064·6f0a·2020·6966··rs.d/*·;·do.··if | |||
| 0003b9f0:·205b·2021·202d·6520·2224·6622·205d·203b···[·!·-e·"$f"·]·; | |||
| 0003ba00:·2074·6865·6e0a·2020·2020·636f·6e74·696e···then.····contin | |||
| 0003ba10:·7565·0a20·2066·690a·2020·6d61·7463·6869··ue.··fi.··matchi | |||
| 0003ba20:·6e67·5f6c·6973·743d·2428·6772·6570·202d··ng_list=$(grep·- | |||
| 0003ba30:·5020·275e·283f·2123·292e·2a5b·5c73·5d2b··P·'^(?!#).*[\s]+ | |||
| 0003ba40:·5c21·6175·7468·656e·7469·6361·7465·2e2a··\!authenticate.* | |||
| 0003ba50:·2427·2024·6620·7c20·756e·6971·2029·0a20··$'·$f·|·uniq·).· | |||
| 0003ba60:·2069·6620·2120·7465·7374·202d·7a20·2224···if·!·test·-z·"$ | |||
| 0003ba70:·6d61·7463·6869·6e67·5f6c·6973·7422·3b20··matching_list";· | |||
| 0003ba80:·7468·656e·0a20·2020·2077·6869·6c65·2049··then.····while·I | |||
| 0003ba90:·4653·3d20·7265·6164·202d·7220·656e·7472··FS=·read·-r·entr | |||
| 0003baa0:·793b·2064·6f0a·2020·2020·2020·2320·636f··y;·do.······#·co | |||
| 0003bab0:·6d6d·656e·7420·6f75·7420·2221·6175·7468··mment·out·"!auth | |||
| 0003bac0:·656e·7469·6361·7465·2220·6d61·7463·6865··enticate"·matche | |||
| 0003bad0:·7320·746f·2070·7265·7365·7276·6520·7573··s·to·preserve·us | |||
| 0003bae0:·6572·2064·6174·610a·2020·2020·2020·7365··er·data.······se | |||
| 0003baf0:·6420·2d69·2022·732f·5e24·7b65·6e74·7279··d·-i·"s/^${entry | |||
| 0003bb00:·7d24·2f23·2026·616d·703b·2f67·2220·2466··}$/#·&/g"·$f | |||
| 0003bb10:·0a20·2020·2064·6f6e·6520·266c·743b·266c··.····done·<&l | |||
| 0003bb20:·743b·266c·743b·2022·246d·6174·6368·696e··t;<·"$matchin | |||
| 0003bb30:·675f·6c69·7374·220a·0a20·2020·202f·7573··g_list"..····/us | |||
| 0003b990:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 0003b9a0:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 0003b9b0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003b9c0:·653e·2d20·6e61·6d65·3a20·4669·6e64·202f··e>-·name:·Find·/ | |||
| 0003b9d0:·6574·632f·7375·646f·6572·732e·642f·2066··etc/sudoers.d/·f | |||
| 0003b9e0:·696c·6573·0a20·2066·696e·643a·0a20·2020··iles.··find:.··· | |||
| 0003b9f0:·2070·6174·6873·3a0a·2020·2020·2d20·2f65···paths:.····-·/e | |||
| 0003ba00:·7463·2f73·7564·6f65·7273·2e64·2f0a·2020··tc/sudoers.d/.·· | |||
| 0003ba10:·7265·6769·7374·6572·3a20·7375·646f·6572··register:·sudoer | |||
| 0003ba20:·730a·2020·7461·6773·3a0a·2020·2d20·4449··s.··tags:.··-·DI | |||
| 0003ba30:·5341·2d53·5449·472d·5248·454c·2d30·382d··SA-STIG-RHEL-08- | |||
| 0003ba40:·3031·3033·3831·0a20·202d·204e·4953·542d··010381.··-·NIST- | |||
| 0003ba50:·3830·302d·3533·2d43·4d2d·3628·6129·0a20··800-53-CM-6(a).· | |||
| 0003ba60:·202d·204e·4953·542d·3830·302d·3533·2d49···-·NIST-800-53-I | |||
| 0003ba70:·412d·3131·0a20·202d·206c·6f77·5f63·6f6d··A-11.··-·low_com | |||
| 0003ba80:·706c·6578·6974·790a·2020·2d20·6c6f·775f··plexity.··-·low_ | |||
| 0003ba90:·6469·7372·7570·7469·6f6e·0a20·202d·206d··disruption.··-·m | |||
| 0003baa0:·6564·6975·6d5f·7365·7665·7269·7479·0a20··edium_severity.· | |||
| 0003bab0:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 0003bac0:·6465·640a·2020·2d20·7265·7374·7269·6374··ded.··-·restrict | |||
| 0003bad0:·5f73·7472·6174·6567·790a·2020·2d20·7375··_strategy.··-·su | |||
| 0003bae0:·646f·5f72·656d·6f76·655f·6e6f·5f61·7574··do_remove_no_aut | |||
| 0003baf0:·6865·6e74·6963·6174·650a·0a2d·206e·616d··henticate..-·nam | |||
| 0003bb00:·653a·2052·656d·6f76·6520·6c69·6e65·7320··e:·Remove·lines· | |||
| 0003bb10:·636f·6e74·6169·6e69·6e67·2021·6175·7468··containing·!auth | |||
| 0003bb20:·656e·7469·6361·7465·2066·726f·6d20·7375··enticate·from·su | |||
| 0003bb30:·646f·6572·7320·6669·6c65·730a·2020·7265··doers·files.··re | |||
| 0003bb40:·706c·6163·653a·0a20·2020·2072·6567·6578··place:.····regex | |||
| 0003bb50:·703a·2028·5e28·3f21·2329·2e2a·5b5c·735d··p:·(^(?!#).*[\s] | |||
| 0003bb60:·2b5c·2161·7574·6865·6e74·6963·6174·652e··+\!authenticate. | |||
| 0003bb70:·2a24·290a·2020·2020·7265·706c·6163·653a··*$).····replace: | |||
| 0003bb80:·2027·2320·5c67·266c·743b·3126·6774·3b27···'#·\g<1>' | |||
| 0003bb90:·0a20·2020·2070·6174·683a·2027·7b7b·2069··.····path:·'{{·i | |||
| 0003bba0:·7465·6d2e·7061·7468·207d·7d27·0a20·2020··tem.path·}}'.··· | |||
| 0003bbb0:·2076·616c·6964·6174·653a·202f·7573·722f···validate:·/usr/ | |||
| 0003bb | 0003bb40:·722f·7362·696e·2f76·6973·7564·6f20·2d63··r/sbin/visudo·-c | ||
| 0003bbd0:·2573·0a20·2077·6974·685f·6974·656d·733a··%s.··with_items: | |||
| 0003bbe0:·0a20·202d·2070·6174·683a·202f·6574·632f··.··-·path:·/etc/ | |||
| 0003bbf0:·7375·646f·6572·730a·2020·2d20·277b·7b20··sudoers.··-·'{{· | |||
| 0003bc00:·7375·646f·6572·732e·6669·6c65·7320·7d7d··sudoers.files·}} | |||
| 0003bc10:·270a·2020·7461·6773·3a0a·2020·2d20·4449··'.··tags:.··-·DI | |||
| 0003bc20:·5341·2d53·5449·472d·5248·454c·2d30·382d··SA-STIG-RHEL-08- | |||
| 0003bc30:·3031·3033·3831·0a20·202d·204e·4953·542d··010381.··-·NIST- | |||
| 0003bc40:·3830·302d·3533·2d43·4d2d·3628·6129·0a20··800-53-CM-6(a).· | |||
| 0003bc50:·202d·204e·4953·542d·3830·302d·3533·2d49···-·NIST-800-53-I | |||
| 0003bc60:·412d·3131·0a20·202d·206c·6f77·5f63·6f6d··A-11.··-·low_com | |||
| 0003bc70:·706c·6578·6974·790a·2020·2d20·6c6f·775f··plexity.··-·low_ | |||
| 0003bc80:·6469·7372·7570·7469·6f6e·0a20·202d·206d··disruption.··-·m | |||
| Max diff block lines reached; 2472087/2491737 bytes (99.21%) of diff not shown. | |||
| Offset 72, 15 lines modified | Offset 72, 15 lines modified | ||
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 75 | ····*·cpe:/o:redhat:enterprise_linux:8 | 75 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 76 | ····*·cpe:/o:centos:centos:8 | 76 | ····*·cpe:/o:centos:centos:8 |
| 77 | *****·Revision·History·***** | 77 | *****·Revision·History·***** |
| 78 | Current·version:·0.1.65 | 78 | Current·version:·0.1.65 |
| 79 | ····*·draft·(as·of·202 | 79 | ····*·draft·(as·of·2025-02-23) |
| 80 | *****·Table·of·Contents·***** | 80 | *****·Table·of·Contents·***** |
| 81 | ···1.·System_Settings | 81 | ···1.·System_Settings |
| 82 | ·········1.·Installing_and_Maintaining_Software | 82 | ·········1.·Installing_and_Maintaining_Software |
| 83 | ·········2.·Account_and_Access_Control | 83 | ·········2.·Account_and_Access_Control |
| 84 | ·········3.·Configure_Syslog | 84 | ·········3.·Configure_Syslog |
| 85 | ·········4.·File_Permissions_and_Masks | 85 | ·········4.·File_Permissions_and_Masks |
| 86 | ···2.·Services | 86 | ···2.·Services |
| Offset 117, 14 lines modified | Offset 117, 33 lines modified | ||
| 117 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 117 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 118 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 118 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 119 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 119 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 120 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 120 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 121 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 121 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 122 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 122 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 123 | ············000373-VMM-001490,·SV-230272r854027_rule | 123 | ············000373-VMM-001490,·SV-230272r854027_rule |
| 124 | Remediation_Shell_script_⇲ | ||
| 125 | Complexity:·low | ||
| 126 | Disruption:·low | ||
| 127 | Strategy:···restrict | ||
| 128 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 129 | ··if·[·!·-e·"$f"·]·;·then | ||
| 130 | ····continue | ||
| 131 | ··fi | ||
| 132 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 133 | ··if·!·test·-z·"$matching_list";·then | ||
| 134 | ····while·IFS=·read·-r·entry;·do | ||
| 135 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 136 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 137 | ····done·<<<·"$matching_list" | ||
| 138 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 139 | ··fi | ||
| 140 | done | ||
| 124 | Remediation_Ansible_snippet_⇲ | 141 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 142 | Complexity:·low |
| 126 | Disruption:·low | 143 | Disruption:·low |
| 127 | Strategy:···restrict | 144 | Strategy:···restrict |
| 128 | -·name:·Find·/etc/sudoers.d/·files | 145 | -·name:·Find·/etc/sudoers.d/·files |
| 129 | ··find: | 146 | ··find: |
| 130 | ····paths: | 147 | ····paths: |
| Offset 156, 33 lines modified | Offset 175, 14 lines modified | ||
| 156 | ··-·NIST-800-53-IA-11 | 175 | ··-·NIST-800-53-IA-11 |
| 157 | ··-·low_complexity | 176 | ··-·low_complexity |
| 158 | ··-·low_disruption | 177 | ··-·low_disruption |
| 159 | ··-·medium_severity | 178 | ··-·medium_severity |
| 160 | ··-·no_reboot_needed | 179 | ··-·no_reboot_needed |
| 161 | ··-·restrict_strategy | 180 | ··-·restrict_strategy |
| 162 | ··-·sudo_remove_no_authenticate | 181 | ··-·sudo_remove_no_authenticate |
| 163 | Remediation_Shell_script_⇲ | ||
| 164 | Complexity:·low | ||
| 165 | Disruption:·low | ||
| 166 | Strategy:···restrict | ||
| 167 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 168 | ··if·[·!·-e·"$f"·]·;·then | ||
| 169 | ····continue | ||
| 170 | ··fi | ||
| 171 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 172 | ··if·!·test·-z·"$matching_list";·then | ||
| 173 | ····while·IFS=·read·-r·entry;·do | ||
| 174 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 175 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 176 | ····done·<<<·"$matching_list" | ||
| 177 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 178 | ··fi | ||
| 179 | done | ||
| 180 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 182 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 181 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 183 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 182 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 184 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 183 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 185 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 184 | Warning: ·This·rule·is·disabled·on·Red·Hat·Virtualization·Hosts·and·Managers,·it·will·report·not | 186 | Warning: ·This·rule·is·disabled·on·Red·Hat·Virtualization·Hosts·and·Managers,·it·will·report·not |
| 185 | applicable.·RHV·requires·to·perform·operations·as·root·without·being·asked·for·password. | 187 | applicable.·RHV·requires·to·perform·operations·as·root·without·being·asked·for·password. |
| 186 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 188 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| Offset 195, 14 lines modified | Offset 195, 33 lines modified | ||
| 195 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 195 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 196 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 196 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 197 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 197 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 198 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 198 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 199 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 199 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 200 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 200 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 201 | ············000373-VMM-001490,·SV-230271r854026_rule | 201 | ············000373-VMM-001490,·SV-230271r854026_rule |
| 202 | Remediation_Shell_script_⇲ | ||
| 203 | Complexity:·low | ||
| 204 | Disruption:·low | ||
| 205 | Strategy:···restrict | ||
| 206 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 207 | ··if·[·!·-e·"$f"·]·;·then | ||
| 208 | ····continue | ||
| 209 | ··fi | ||
| 210 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 211 | ··if·!·test·-z·"$matching_list";·then | ||
| 212 | ····while·IFS=·read·-r·entry;·do | ||
| 213 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 214 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 215 | ····done·<<<·"$matching_list" | ||
| 216 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 217 | ··fi | ||
| 218 | done | ||
| 202 | Remediation_Ansible_snippet_⇲ | 219 | Remediation_Ansible_snippet_⇲ |
| 203 | Complexity:·low | 220 | Complexity:·low |
| 204 | Disruption:·low | 221 | Disruption:·low |
| 205 | Strategy:···restrict | 222 | Strategy:···restrict |
| 206 | -·name:·Find·/etc/sudoers.d/·files | 223 | -·name:·Find·/etc/sudoers.d/·files |
| 207 | ··find: | 224 | ··find: |
| 208 | ····paths: | 225 | ····paths: |
| Offset 234, 33 lines modified | Offset 253, 14 lines modified | ||
| 234 | ··-·NIST-800-53-IA-11 | 253 | ··-·NIST-800-53-IA-11 |
| 235 | ··-·low_complexity | 254 | ··-·low_complexity |
| 236 | ··-·low_disruption | 255 | ··-·low_disruption |
| 237 | ··-·medium_severity | 256 | ··-·medium_severity |
| 238 | ··-·no_reboot_needed | 257 | ··-·no_reboot_needed |
| 239 | ··-·restrict_strategy | 258 | ··-·restrict_strategy |
| 240 | ··-·sudo_remove_nopasswd | 259 | ··-·sudo_remove_nopasswd |
| 241 | Remediation_Shell_script_⇲ | ||
| 242 | Complexity:·low | ||
| Max diff block lines reached; 175467/181018 bytes (96.93%) of diff not shown. | |||
| Offset 14546, 16 lines modified | Offset 14546, 16 lines modified | ||
| 00038d10:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038d10:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038d20:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038d20:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00038d30:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00038d30:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00038d40:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00038d40:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00038d50:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00038d50:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00038d60:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00038d60:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00038d70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038d70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038d80:·2020·2861·7320·6f66·2032·3032·3 | 00038d80:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00038d90:·2d32·3 | 00038d90:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038da0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038da0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038db0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038db0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00038dc0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00038dc0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00038dd0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00038dd0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00038de0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00038de0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00038df0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00038df0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00038e00:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00038e00:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15513, 191 lines modified | Offset 15513, 191 lines modified | ||
| 0003c980:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003c980:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003c990:·3835·3430·2220·7461·6269·6e64·6578·3d22··8540"·tabindex=" | 0003c990:·3835·3430·2220·7461·6269·6e64·6578·3d22··8540"·tabindex=" | ||
| 0003c9a0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003c9a0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003c9b0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003c9b0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003c9c0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003c9c0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003c9d0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003c9d0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003c9e0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003c9e0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003c9f0:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003c9f0:·6469·6174·696f·6e20·416e·6163·6f6e·6461··diation·Anaconda | |||
| 0003ca00:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003ca10:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003ca20:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003ca30:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003ca40:·3835·3430·223e·3c74·6162·6c65·2063·6c61··8540"><table·cla | |||
| 0003ca50:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003ca60:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003ca70:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003ca80:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003ca90:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003caa0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003cab0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003cac0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003cad0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003cae0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003caf0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003cb00:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003cb10:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003cb20:·2d2d·6164·643d·6169·6465·0a3c·2f63·6f64··--add=aide.</cod | |||
| 0003cb30:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003cb40:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003cb50:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003cb60:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003cb70:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003cb80:·6d38·3534·3122·2074·6162·696e·6465·783d··m8541"·tabindex= | |||
| 0003cb90:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003cba0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003cbb0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003cbc0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003cbd0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003cbe0:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003cbf0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003cc00:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003cc10:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003cc20:·6c6c·6170·7365·2220·6964·3d22·6964·6d38··llapse"·id="idm8 | |||
| 0003cc30:·3534·3122·3e3c·7461·626c·6520·636c·6173··541"><table·clas | |||
| 0003cc40:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003cc50:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003cc60:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003cc70:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003cc80:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003cc90:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003cca0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003ccb0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003ccc0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003ccd0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003cce0:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003ccf0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003cd00:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003cd10:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003cd20:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003cd30:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003cd40:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003cd50:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003cd60:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003cd70:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003cd80:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003cd90:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003cda0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003cdb0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | |||
| 0003cdc0:·3534·3222·2074·6162·696e·6465·783d·2230··542"·tabindex="0 | |||
| 0003cdd0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003cde0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003cdf0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003ce00:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003ce10:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003ce20:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003c | 0003ca00:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | ||
| 0003c | 0003ca10:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | ||
| 0003c | 0003ca20:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | ||
| 0003c | 0003ca30:·6c61·7073·6522·2069·643d·2269·646d·3835··lapse"·id="idm85 | ||
| 0003c | 0003ca40:·3430·223e·3c74·6162·6c65·2063·6c61·7373··40"><table·class | ||
| 0003c | 0003ca50:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | ||
| 0003c | 0003ca60:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003c | 0003ca70:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003c | 0003ca80:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | ||
| 0003c | 0003ca90:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | ||
| 0003c | 0003caa0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003c | 0003cab0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | ||
| 0003c | 0003cac0:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | ||
| 0003c | 0003cad0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003c | 0003cae0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | ||
| 0003c | 0003caf0:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | ||
| 0003c | 0003cb00:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | ||
| 0003cb10:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003cb20:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003cb30:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003cb40:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003cb50:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003cb60:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003cb70:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003cb80:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003cb90:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003cba0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003cbb0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003cbc0:·612d·7461·7267·6574·3d22·2369·646d·3835··a-target="#idm85 | |||
| 0003cbd0:·3431·2220·7461·6269·6e64·6578·3d22·3022··41"·tabindex="0" | |||
| 0003cbe0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003cbf0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003cc00:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003cc10:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| Max diff block lines reached; 18833024/18859298 bytes (99.86%) of diff not shown. | |||
| Offset 14547, 15 lines modified | Offset 14547, 15 lines modified | ||
| 00038d20:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038d20:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038d30:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038d30:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038d40:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038d40:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00038d50:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00038d50:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00038d60:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00038d60:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 00038d70:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 00038d70:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 00038d80:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 00038d80:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 00038d90:·6f66·2032·3032·3 | 00038d90:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 00038da0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 00038da0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 00038db0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 00038db0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00038dc0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00038dc0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00038dd0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00038dd0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038de0:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038de0:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038df0:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038df0:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038e00:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038e00:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15503, 191 lines modified | Offset 15503, 191 lines modified | ||
| 0003c8e0:·612d·7461·7267·6574·3d22·2369·646d·3835··a-target="#idm85 | 0003c8e0:·612d·7461·7267·6574·3d22·2369·646d·3835··a-target="#idm85 | ||
| 0003c8f0:·3430·2220·7461·6269·6e64·6578·3d22·3022··40"·tabindex="0" | 0003c8f0:·3430·2220·7461·6269·6e64·6578·3d22·3022··40"·tabindex="0" | ||
| 0003c900:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003c900:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003c910:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003c910:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003c920:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003c920:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003c930:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003c930:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003c940:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003c940:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003c950:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003c950:·6174·696f·6e20·416e·6163·6f6e·6461·2073··ation·Anaconda·s | |||
| 0003c960:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c970:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c980:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c990:·6c61·7073·6522·2069·643d·2269·646d·3835··lapse"·id="idm85 | |||
| 0003c9a0:·3430·223e·3c74·6162·6c65·2063·6c61·7373··40"><table·class | |||
| 0003c9b0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c9c0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c9d0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003c9e0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c9f0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003ca00:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003ca10:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003ca20:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003ca30:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003ca40:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003ca50:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003ca60:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003ca70:·636f·6465·3e0a·7061·636b·6167·6520·2d2d··code>.package·-- | |||
| 0003ca80:·6164·643d·6169·6465·0a3c·2f63·6f64·653e··add=aide.</code> | |||
| 0003ca90:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003caa0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003cab0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003cac0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003cad0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | |||
| 0003cae0:·3534·3122·2074·6162·696e·6465·783d·2230··541"·tabindex="0 | |||
| 0003caf0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003cb00:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003cb10:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003cb20:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003cb30:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003cb40:·6961·7469·6f6e·2050·7570·7065·7420·736e··iation·Puppet·sn | |||
| 0003cb50:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003cb60:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003cb70:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003cb80:·6170·7365·2220·6964·3d22·6964·6d38·3534··apse"·id="idm854 | |||
| 0003cb90:·3122·3e3c·7461·626c·6520·636c·6173·733d··1"><table·class= | |||
| 0003cba0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003cbb0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003cbc0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003cbd0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003cbe0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003cbf0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003cc00:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003cc10:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003cc20:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003cc30:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003cc40:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003cc50:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003cc60:·6f64·653e·696e·636c·7564·6520·696e·7374··ode>include·inst | |||
| 0003cc70:·616c·6c5f·6169·6465·0a0a·636c·6173·7320··all_aide..class· | |||
| 0003cc80:·696e·7374·616c·6c5f·6169·6465·207b·0a20··install_aide·{.· | |||
| 0003cc90:·2070·6163·6b61·6765·207b·2027·6169·6465···package·{·'aide | |||
| 0003cca0:·273a·0a20·2020·2065·6e73·7572·6520·3d26··':.····ensure·=& | |||
| 0003ccb0:·6774·3b20·2769·6e73·7461·6c6c·6564·272c··gt;·'installed', | |||
| 0003ccc0:·0a20·207d·0a7d·0a3c·2f63·6f64·653e·3c2f··.··}.}.</code></ | |||
| 0003ccd0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003cce0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003ccf0:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003cd00:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003cd10:·2d74·6172·6765·743d·2223·6964·6d38·3534··-target="#idm854 | |||
| 0003cd20:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | |||
| 0003cd30:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003cd40:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003cd50:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003cd60:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003cd70:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003cd80:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003c | 0003c960:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | ||
| 0003c | 0003c970:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | ||
| 0003c | 0003c980:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | ||
| 0003c | 0003c990:·7073·6522·2069·643d·2269·646d·3835·3430··pse"·id="idm8540 | ||
| 0003c | 0003c9a0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | ||
| 0003c | 0003c9b0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | ||
| 0003c | 0003c9c0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | ||
| 0003c | 0003c9d0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | ||
| 0003c | 0003c9e0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | ||
| 0003c | 0003c9f0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | ||
| 0003c | 0003ca00:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003ca10:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | ||
| 0003c | 0003ca20:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003c | 0003ca30:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | ||
| 0003c | 0003ca40:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | ||
| 0003c | 0003ca50:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | ||
| 0003c | 0003ca60:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | ||
| 0003ca70:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003ca80:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003ca90:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003caa0:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003cab0:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003cac0:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003cad0:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003cae0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003caf0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003cea0:·6465·3e2d·206e·616d·653a·2045·6e73·7572··de>-·name:·Ensur | |||
| 0003ceb0:·6520·6169·6465·2069·7320·696e·7374·616c··e·aide·is·instal | |||
| 0003cec0:·6c65·640a·2020·7061·636b·6167·653a·0a20··led.··package:.· | |||
| 0003ced0:·2020·206e·616d·653a·2061·6964·650a·2020·····name:·aide.·· | |||
| 0003cee0:·2020·7374·6174·653a·2070·7265·7365·6e74····state:·present | |||
| 0003cef0:·0a20·2077·6865·6e3a·2061·6e73·6962·6c65··.··when:·ansible | |||
| 0003cf00:·5f76·6972·7475·616c·697a·6174·696f·6e5f··_virtualization_ | |||
| 0003cf10:·7479·7065·206e·6f74·2069·6e20·5b22·646f··type·not·in·["do | |||
| 0003cf20:·636b·6572·222c·2022·6c78·6322·2c20·226f··cker",·"lxc",·"o | |||
| Max diff block lines reached; 7547922/7574058 bytes (99.65%) of diff not shown. | |||
| Offset 70, 15 lines modified | Offset 70, 15 lines modified | ||
| 70 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 70 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 74 | ····*·cpe:/o:centos:centos:8 | 74 | ····*·cpe:/o:centos:centos:8 |
| 75 | *****·Revision·History·***** | 75 | *****·Revision·History·***** |
| 76 | Current·version:·0.1.65 | 76 | Current·version:·0.1.65 |
| 77 | ····*·draft·(as·of·202 | 77 | ····*·draft·(as·of·2025-02-23) |
| 78 | *****·Table·of·Contents·***** | 78 | *****·Table·of·Contents·***** |
| 79 | ···1.·System_Settings | 79 | ···1.·System_Settings |
| 80 | ·········1.·Installing_and_Maintaining_Software | 80 | ·········1.·Installing_and_Maintaining_Software |
| 81 | ·········2.·Account_and_Access_Control | 81 | ·········2.·Account_and_Access_Control |
| 82 | ·········3.·GRUB2_bootloader_configuration | 82 | ·········3.·GRUB2_bootloader_configuration |
| 83 | ·········4.·Configure_Syslog | 83 | ·········4.·Configure_Syslog |
| 84 | ·········5.·Network_Configuration_and_Firewalls | 84 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 115, 31 lines modified | Offset 115, 39 lines modified | ||
| 115 | ***·Rule ·Install·AIDE· [ref]·*** | 115 | ***·Rule ·Install·AIDE· [ref]·*** |
| 116 | The·aide·package·can·be·installed·with·the·following·command: | 116 | The·aide·package·can·be·installed·with·the·following·command: |
| 117 | $·sudo·yum·install·aide | 117 | $·sudo·yum·install·aide |
| 118 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 118 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 119 | Severity: ················medium | 119 | Severity: ················medium |
| 120 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 120 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 121 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 121 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 122 | Remediation_Anaconda_snippet_⇲ | ||
| 123 | Complexity:·low | ||
| 124 | Disruption:·low | ||
| 125 | Strategy:···enable | ||
| 126 | package·--add=aide | ||
| 127 | Remediation_Puppet_snippet_⇲ | 122 | Remediation_Puppet_snippet_⇲ |
| 128 | Complexity:·low | 123 | Complexity:·low |
| 129 | Disruption:·low | 124 | Disruption:·low |
| 130 | Strategy:···enable | 125 | Strategy:···enable |
| 131 | include·install_aide | 126 | include·install_aide |
| 132 | class·install_aide·{ | 127 | class·install_aide·{ |
| 133 | ··package·{·'aide': | 128 | ··package·{·'aide': |
| 134 | ····ensure·=>·'installed', | 129 | ····ensure·=>·'installed', |
| 135 | ··} | 130 | ··} |
| 136 | } | 131 | } |
| 132 | Remediation_Shell_script_⇲ | ||
| 133 | Complexity:·low | ||
| 134 | Disruption:·low | ||
| 135 | Strategy:···enable | ||
| 136 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 137 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 138 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 139 | ····yum·install·-y·"aide" | ||
| 140 | fi | ||
| 141 | else | ||
| 142 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 143 | fi | ||
| 137 | Remediation_Ansible_snippet_⇲ | 144 | Remediation_Ansible_snippet_⇲ |
| 138 | Complexity:·low | 145 | Complexity:·low |
| 139 | Disruption:·low | 146 | Disruption:·low |
| 140 | Strategy:···enable | 147 | Strategy:···enable |
| 141 | -·name:·Ensure·aide·is·installed | 148 | -·name:·Ensure·aide·is·installed |
| 142 | ··package: | 149 | ··package: |
| 143 | ····name:·aide | 150 | ····name:·aide |
| Offset 157, 40 lines modified | Offset 165, 46 lines modified | ||
| 157 | ··-·no_reboot_needed | 165 | ··-·no_reboot_needed |
| 158 | ··-·package_aide_installed | 166 | ··-·package_aide_installed |
| 159 | Remediation_OSBuild_Blueprint_snippet_⇲ | 167 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 160 | [[packages]] | 168 | [[packages]] |
| 161 | name·=·"aide" | 169 | name·=·"aide" |
| 162 | version·=·"*" | 170 | version·=·"*" |
| 163 | Remediation_ | 171 | Remediation_Anaconda_snippet_⇲ |
| 164 | Complexity:·low | 172 | Complexity:·low |
| 165 | Disruption:·low | 173 | Disruption:·low |
| 166 | Strategy:···enable | 174 | Strategy:···enable |
| 167 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 168 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 175 | package·--add=aide | ||
| 169 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 170 | ····yum·install·-y·"aide" | ||
| 171 | fi | ||
| 172 | else | ||
| 173 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 174 | fi | ||
| 175 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 176 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 176 | Run·the·following·command·to·generate·a·new·database: | 177 | Run·the·following·command·to·generate·a·new·database: |
| 177 | $·sudo·/usr/sbin/aide·--init | 178 | $·sudo·/usr/sbin/aide·--init |
| 178 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 179 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 179 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 180 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 180 | To·initiate·a·manual·check,·run·the·following·command: | 181 | To·initiate·a·manual·check,·run·the·following·command: |
| 181 | $·sudo·/usr/sbin/aide·--check | 182 | $·sudo·/usr/sbin/aide·--check |
| 182 | If·this·check·produces·any·unexpected·output,·investigate. | 183 | If·this·check·produces·any·unexpected·output,·investigate. |
| 183 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 184 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 184 | Severity: ················medium | 185 | Severity: ················medium |
| 185 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 186 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 186 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 187 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 192 | ····yum·install·-y·"aide" | ||
| 193 | fi | ||
| 194 | /usr/sbin/aide·--init | ||
| 195 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 196 | else | ||
| 197 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 198 | fi | ||
| 187 | Remediation_Ansible_snippet_⇲ | 199 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 200 | Complexity:·low |
| 189 | Disruption:·low | 201 | Disruption:·low |
| 190 | Strategy:···restrict | 202 | Strategy:···restrict |
| 191 | -·name:·Ensure·AIDE·is·installed | 203 | -·name:·Ensure·AIDE·is·installed |
| 192 | ··package: | 204 | ··package: |
| 193 | ····name:·'{{·item·}}' | 205 | ····name:·'{{·item·}}' |
| Offset 255, 42 lines modified | Offset 269, 46 lines modified | ||
| 255 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 256 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 257 | ··-·low_complexity | 271 | ··-·low_complexity |
| 258 | ··-·low_disruption | 272 | ··-·low_disruption |
| 259 | ··-·medium_severity | 273 | ··-·medium_severity |
| 260 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 261 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 262 | Remediation_Shell_script_⇲ | ||
| 263 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| Max diff block lines reached; 966302/972141 bytes (99.40%) of diff not shown. | |||
| Offset 14548, 16 lines modified | Offset 14548, 16 lines modified | ||
| 00038d30:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00038d30:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00038d40:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00038d40:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00038d50:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00038d50:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00038d60:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00038d60:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00038d70:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00038d70:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00038d80:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00038d80:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00038d90:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038d90:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038da0:·2861·7320·6f66·2032·3032·3 | 00038da0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038db0:·3 | 00038db0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038dc0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038dc0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038dd0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038dd0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038de0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038de0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038df0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038df0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038e00:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038e00:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038e10:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038e10:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038e20:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038e20:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15499, 191 lines modified | Offset 15499, 191 lines modified | ||
| 0003c8a0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | 0003c8a0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | ||
| 0003c8b0:·3534·3022·2074·6162·696e·6465·783d·2230··540"·tabindex="0 | 0003c8b0:·3534·3022·2074·6162·696e·6465·783d·2230··540"·tabindex="0 | ||
| 0003c8c0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 0003c8c0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 0003c8d0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 0003c8d0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 0003c8e0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 0003c8e0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 0003c8f0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 0003c8f0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 0003c900:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 0003c900:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 0003c910:·6961·7469·6f6e·2050·7570·7065·7420·736e··iation·Puppet·sn | |||
| 0003c910:·6961·7469·6f6e·2041·6e61·636f·6e64·6120··iation·Anaconda· | |||
| 0003c920:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003c930:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c940:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c950:·6c6c·6170·7365·2220·6964·3d22·6964·6d38··llapse"·id="idm8 | |||
| 0003c960:·3534·3022·3e3c·7461·626c·6520·636c·6173··540"><table·clas | |||
| 0003c970:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c980:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c990:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c9a0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c9b0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c9c0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c9d0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c9e0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c9f0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003ca00:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003ca10:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003ca20:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003ca30:·3c63·6f64·653e·0a70·6163·6b61·6765·202d··<code>.package·- | |||
| 0003ca40:·2d61·6464·3d61·6964·650a·3c2f·636f·6465··-add=aide.</code | |||
| 0003ca50:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003ca60:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003ca70:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003ca80:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003ca90:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003caa0:·3835·3431·2220·7461·6269·6e64·6578·3d22··8541"·tabindex=" | |||
| 0003cab0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003cac0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003cad0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003cae0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003caf0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003cb00:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003cb10:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003cb20:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003cb30:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003cb40:·6c61·7073·6522·2069·643d·2269·646d·3835··lapse"·id="idm85 | |||
| 0003cb50:·3431·223e·3c74·6162·6c65·2063·6c61·7373··41"><table·class | |||
| 0003cb60:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003cb70:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003cb80:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003cb90:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003cba0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003cbb0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003cbc0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003cbd0:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003cbe0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003cbf0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003cc00:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003cc10:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003cc20:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003cc30:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003cc40:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003cc50:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003cc60:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003cc70:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003cc80:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003cc90:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003cca0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003ccb0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003ccc0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003ccd0:·612d·7461·7267·6574·3d22·2369·646d·3835··a-target="#idm85 | |||
| 0003cce0:·3432·2220·7461·6269·6e64·6578·3d22·3022··42"·tabindex="0" | |||
| 0003ccf0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003cd00:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003cd10:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003cd20:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003cd30:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003cd40:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003c | 0003c920:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | ||
| 0003c | 0003c930:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | ||
| 0003c | 0003c940:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | ||
| 0003c | 0003c950:·6170·7365·2220·6964·3d22·6964·6d38·3534··apse"·id="idm854 | ||
| 0003c | 0003c960:·3022·3e3c·7461·626c·6520·636c·6173·733d··0"><table·class= | ||
| 0003c | 0003c970:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | ||
| 0003c | 0003c980:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | ||
| 0003c | 0003c990:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | ||
| 0003c | 0003c9a0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | ||
| 0003c | 0003c9b0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | ||
| 0003c | 0003c9c0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003c | 0003c9d0:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | ||
| 0003c | 0003c9e0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | ||
| 0003c | 0003c9f0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | ||
| 0003c | 0003ca00:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | ||
| 0003c | 0003ca10:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | ||
| 0003c | 0003ca20:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | ||
| 0003ca30:·6f64·653e·696e·636c·7564·6520·696e·7374··ode>include·inst | |||
| 0003ca40:·616c·6c5f·6169·6465·0a0a·636c·6173·7320··all_aide..class· | |||
| 0003ca50:·696e·7374·616c·6c5f·6169·6465·207b·0a20··install_aide·{.· | |||
| 0003ca60:·2070·6163·6b61·6765·207b·2027·6169·6465···package·{·'aide | |||
| 0003ca70:·273a·0a20·2020·2065·6e73·7572·6520·3d26··':.····ensure·=& | |||
| 0003ca80:·6774·3b20·2769·6e73·7461·6c6c·6564·272c··gt;·'installed', | |||
| 0003ca90:·0a20·207d·0a7d·0a3c·2f63·6f64·653e·3c2f··.··}.}.</code></ | |||
| 0003caa0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003cab0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003cac0:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003cad0:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003cae0:·2d74·6172·6765·743d·2223·6964·6d38·3534··-target="#idm854 | |||
| 0003caf0:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | |||
| 0003cb00:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003cb10:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003cb20:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003cb30:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| Max diff block lines reached; 7453852/7480126 bytes (99.65%) of diff not shown. | |||
| Offset 71, 15 lines modified | Offset 71, 15 lines modified | ||
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 75 | ····*·cpe:/o:centos:centos:8 | 75 | ····*·cpe:/o:centos:centos:8 |
| 76 | *****·Revision·History·***** | 76 | *****·Revision·History·***** |
| 77 | Current·version:·0.1.65 | 77 | Current·version:·0.1.65 |
| 78 | ····*·draft·(as·of·202 | 78 | ····*·draft·(as·of·2025-02-23) |
| 79 | *****·Table·of·Contents·***** | 79 | *****·Table·of·Contents·***** |
| 80 | ···1.·System_Settings | 80 | ···1.·System_Settings |
| 81 | ·········1.·Installing_and_Maintaining_Software | 81 | ·········1.·Installing_and_Maintaining_Software |
| 82 | ·········2.·Account_and_Access_Control | 82 | ·········2.·Account_and_Access_Control |
| 83 | ·········3.·GRUB2_bootloader_configuration | 83 | ·········3.·GRUB2_bootloader_configuration |
| 84 | ·········4.·Configure_Syslog | 84 | ·········4.·Configure_Syslog |
| 85 | ·········5.·Network_Configuration_and_Firewalls | 85 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 115, 31 lines modified | Offset 115, 39 lines modified | ||
| 115 | ***·Rule ·Install·AIDE· [ref]·*** | 115 | ***·Rule ·Install·AIDE· [ref]·*** |
| 116 | The·aide·package·can·be·installed·with·the·following·command: | 116 | The·aide·package·can·be·installed·with·the·following·command: |
| 117 | $·sudo·yum·install·aide | 117 | $·sudo·yum·install·aide |
| 118 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 118 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 119 | Severity: ················medium | 119 | Severity: ················medium |
| 120 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 120 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 121 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 121 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 122 | Remediation_Anaconda_snippet_⇲ | ||
| 123 | Complexity:·low | ||
| 124 | Disruption:·low | ||
| 125 | Strategy:···enable | ||
| 126 | package·--add=aide | ||
| 127 | Remediation_Puppet_snippet_⇲ | 122 | Remediation_Puppet_snippet_⇲ |
| 128 | Complexity:·low | 123 | Complexity:·low |
| 129 | Disruption:·low | 124 | Disruption:·low |
| 130 | Strategy:···enable | 125 | Strategy:···enable |
| 131 | include·install_aide | 126 | include·install_aide |
| 132 | class·install_aide·{ | 127 | class·install_aide·{ |
| 133 | ··package·{·'aide': | 128 | ··package·{·'aide': |
| 134 | ····ensure·=>·'installed', | 129 | ····ensure·=>·'installed', |
| 135 | ··} | 130 | ··} |
| 136 | } | 131 | } |
| 132 | Remediation_Shell_script_⇲ | ||
| 133 | Complexity:·low | ||
| 134 | Disruption:·low | ||
| 135 | Strategy:···enable | ||
| 136 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 137 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 138 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 139 | ····yum·install·-y·"aide" | ||
| 140 | fi | ||
| 141 | else | ||
| 142 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 143 | fi | ||
| 137 | Remediation_Ansible_snippet_⇲ | 144 | Remediation_Ansible_snippet_⇲ |
| 138 | Complexity:·low | 145 | Complexity:·low |
| 139 | Disruption:·low | 146 | Disruption:·low |
| 140 | Strategy:···enable | 147 | Strategy:···enable |
| 141 | -·name:·Ensure·aide·is·installed | 148 | -·name:·Ensure·aide·is·installed |
| 142 | ··package: | 149 | ··package: |
| 143 | ····name:·aide | 150 | ····name:·aide |
| Offset 157, 40 lines modified | Offset 165, 46 lines modified | ||
| 157 | ··-·no_reboot_needed | 165 | ··-·no_reboot_needed |
| 158 | ··-·package_aide_installed | 166 | ··-·package_aide_installed |
| 159 | Remediation_OSBuild_Blueprint_snippet_⇲ | 167 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 160 | [[packages]] | 168 | [[packages]] |
| 161 | name·=·"aide" | 169 | name·=·"aide" |
| 162 | version·=·"*" | 170 | version·=·"*" |
| 163 | Remediation_ | 171 | Remediation_Anaconda_snippet_⇲ |
| 164 | Complexity:·low | 172 | Complexity:·low |
| 165 | Disruption:·low | 173 | Disruption:·low |
| 166 | Strategy:···enable | 174 | Strategy:···enable |
| 167 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 168 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 175 | package·--add=aide | ||
| 169 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 170 | ····yum·install·-y·"aide" | ||
| 171 | fi | ||
| 172 | else | ||
| 173 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 174 | fi | ||
| 175 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 176 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 176 | Run·the·following·command·to·generate·a·new·database: | 177 | Run·the·following·command·to·generate·a·new·database: |
| 177 | $·sudo·/usr/sbin/aide·--init | 178 | $·sudo·/usr/sbin/aide·--init |
| 178 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 179 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 179 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 180 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 180 | To·initiate·a·manual·check,·run·the·following·command: | 181 | To·initiate·a·manual·check,·run·the·following·command: |
| 181 | $·sudo·/usr/sbin/aide·--check | 182 | $·sudo·/usr/sbin/aide·--check |
| 182 | If·this·check·produces·any·unexpected·output,·investigate. | 183 | If·this·check·produces·any·unexpected·output,·investigate. |
| 183 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 184 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 184 | Severity: ················medium | 185 | Severity: ················medium |
| 185 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 186 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 186 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 187 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 192 | ····yum·install·-y·"aide" | ||
| 193 | fi | ||
| 194 | /usr/sbin/aide·--init | ||
| 195 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 196 | else | ||
| 197 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 198 | fi | ||
| 187 | Remediation_Ansible_snippet_⇲ | 199 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 200 | Complexity:·low |
| 189 | Disruption:·low | 201 | Disruption:·low |
| 190 | Strategy:···restrict | 202 | Strategy:···restrict |
| 191 | -·name:·Ensure·AIDE·is·installed | 203 | -·name:·Ensure·AIDE·is·installed |
| 192 | ··package: | 204 | ··package: |
| 193 | ····name:·'{{·item·}}' | 205 | ····name:·'{{·item·}}' |
| Offset 255, 42 lines modified | Offset 269, 46 lines modified | ||
| 255 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 256 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 257 | ··-·low_complexity | 271 | ··-·low_complexity |
| 258 | ··-·low_disruption | 272 | ··-·low_disruption |
| 259 | ··-·medium_severity | 273 | ··-·medium_severity |
| 260 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 261 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 262 | Remediation_Shell_script_⇲ | ||
| 263 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| Max diff block lines reached; 953318/959157 bytes (99.39%) of diff not shown. | |||
| Offset 14548, 16 lines modified | Offset 14548, 16 lines modified | ||
| 00038d30:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00038d30:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00038d40:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00038d40:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00038d50:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00038d50:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00038d60:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00038d60:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00038d70:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00038d70:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00038d80:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00038d80:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00038d90:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038d90:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038da0:·2861·7320·6f66·2032·3032·3 | 00038da0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038db0:·3 | 00038db0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038dc0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038dc0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038dd0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038dd0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038de0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038de0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038df0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038df0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038e00:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038e00:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038e10:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038e10:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038e20:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038e20:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15510, 191 lines modified | Offset 15510, 191 lines modified | ||
| 0003c950:·7267·6574·3d22·2369·646d·3835·3430·2220··rget="#idm8540"· | 0003c950:·7267·6574·3d22·2369·646d·3835·3430·2220··rget="#idm8540"· | ||
| 0003c960:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003c960:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003c970:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003c970:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003c980:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003c980:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003c990:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003c990:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003c9a0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003c9a0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003c9b0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003c9b0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003c9c0:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003c9c0:·6e20·416e·6163·6f6e·6461·2073·6e69·7070··n·Anaconda·snipp | |||
| 0003c9d0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c9e0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c9f0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003ca00:·6522·2069·643d·2269·646d·3835·3430·223e··e"·id="idm8540"> | |||
| 0003ca10:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003ca20:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003ca30:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003ca40:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003ca50:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003ca60:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003ca70:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003ca80:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003ca90:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003caa0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003cab0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003cac0:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003cad0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003cae0:·3e0a·7061·636b·6167·6520·2d2d·6164·643d··>.package·--add= | |||
| 0003caf0:·6169·6465·0a3c·2f63·6f64·653e·3c2f·7072··aide.</code></pr | |||
| 0003cb00:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003cb10:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003cb20:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003cb30:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003cb40:·6172·6765·743d·2223·6964·6d38·3534·3122··arget="#idm8541" | |||
| 0003cb50:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003cb60:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003cb70:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003cb80:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003cb90:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003cba0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003cbb0:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003cbc0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003cbd0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003cbe0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003cbf0:·2220·6964·3d22·6964·6d38·3534·3122·3e3c··"·id="idm8541">< | |||
| 0003cc00:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003cc10:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003cc20:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003cc30:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003cc40:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003cc50:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003cc60:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003cc70:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003cc80:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003cc90:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003cca0:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003ccb0:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003ccc0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003ccd0:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003cce0:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003ccf0:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003cd00:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003cd10:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003cd20:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003cd30:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003cd40:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003cd50:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003cd60:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003cd70:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003cd80:·6765·743d·2223·6964·6d38·3534·3222·2074··get="#idm8542"·t | |||
| 0003cd90:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003cda0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003cdb0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003cdc0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003cdd0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003cde0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003cdf0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003c | 0003c9d0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | ||
| 0003c | 0003c9e0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | ||
| 0003c | 0003c9f0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | ||
| 0003c | 0003ca00:·2069·643d·2269·646d·3835·3430·223e·3c74···id="idm8540"><t | ||
| 0003c | 0003ca10:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | ||
| 0003c | 0003ca20:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | ||
| 0003c | 0003ca30:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | ||
| 0003c | 0003ca40:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | ||
| 0003c | 0003ca50:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | ||
| 0003c | 0003ca60:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | ||
| 0003c | 0003ca70:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | ||
| 0003c | 0003ca80:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | ||
| 0003c | 0003ca90:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003c | 0003caa0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | ||
| 0003c | 0003cab0:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | ||
| 0003c | 0003cac0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | ||
| 0003c | 0003cad0:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | ||
| 0003cae0:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003caf0:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003cb00:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003cb10:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003cb20:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003cb30:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003cb40:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003cb50:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003cb60:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003cb70:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003cb80:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003cb90:·6574·3d22·2369·646d·3835·3431·2220·7461··et="#idm8541"·ta | |||
| 0003cba0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003cbb0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003cbc0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003cbd0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003cbe0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| Max diff block lines reached; 18761174/18787448 bytes (99.86%) of diff not shown. | |||
| Offset 14541, 15 lines modified | Offset 14541, 15 lines modified | ||
| 00038cc0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00038cc0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00038cd0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00038cd0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00038ce0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00038ce0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00038cf0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00038cf0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00038d00:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00038d00:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00038d10:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00038d10:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00038d20:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00038d20:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00038d30:·3230·323 | 00038d30:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00038d40:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00038d40:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00038d50:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00038d50:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00038d60:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00038d60:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00038d70:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00038d70:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00038d80:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00038d80:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00038d90:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00038d90:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00038da0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00038da0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15457, 323 lines modified | Offset 15457, 323 lines modified | ||
| 0003c600:·2d74·6172·6765·743d·2223·6964·6d38·3138··-target="#idm818 | 0003c600:·2d74·6172·6765·743d·2223·6964·6d38·3138··-target="#idm818 | ||
| 0003c610:·3322·2074·6162·696e·6465·783d·2230·2220··3"·tabindex="0"· | 0003c610:·3322·2074·6162·696e·6465·783d·2230·2220··3"·tabindex="0"· | ||
| 0003c620:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003c620:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003c630:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003c630:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003c640:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003c640:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003c650:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003c650:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003c660:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003c660:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003c670:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003c680:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c690:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c6a0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c6b0:·7073·6522·2069·643d·2269·646d·3831·3833··pse"·id="idm8183 | |||
| 0003c6c0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c6d0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c6e0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c6f0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c700:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c710:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c720:·6869·6768·3c2f·7464·3e3c·2f74·723e·3c74··high</td></tr><t | |||
| 0003c730:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003c740:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003c750:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c760:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c770:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003c780:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003c790:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003c7a0:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003c7b0:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003c7c0:·7374·616c·6c20·636f·6d6d·616e·6420·2864··stall·command·(d | |||
| 0003c7d0:·6e66·2927·0a20·2073·6574·5f66·6163·743a··nf)'.··set_fact: | |||
| 0003c | 0003c670:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003c680:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c690:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c6a0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c6b0:·2220·6964·3d22·6964·6d38·3138·3322·3e3c··"·id="idm8183">< | |||
| 0003c6c0:·7072·653e·3c63·6f64·653e·0a23·2046·696e··pre><code>.#·Fin | |||
| 0003c6d0:·6420·7768·6963·6820·6669·6c65·7320·6861··d·which·files·ha | |||
| 0003c6e0:·7665·2069·6e63·6f72·7265·6374·2068·6173··ve·incorrect·has | |||
| 0003c6f0:·6820·286e·6f74·2069·6e20·2f65·7463·2c20··h·(not·in·/etc,· | |||
| 0003c700:·6265·6361·7573·6520·6f66·2074·6865·2073··because·of·the·s | |||
| 0003c710:·7973·7465·6d20·7265·6c61·7465·6420·636f··ystem·related·co | |||
| 0003c720:·6e66·6967·2066·696c·6573·2920·616e·6420··nfig·files)·and· | |||
| 0003c730:·7468·656e·2067·6574·2066·696c·6573·206e··then·get·files·n | |||
| 0003c740:·616d·6573·0a66·696c·6573·5f77·6974·685f··ames.files_with_ | |||
| 0003c750:·696e·636f·7272·6563·745f·6861·7368·3d22··incorrect_hash=" | |||
| 0003c760:·2428·7270·6d20·2d56·6120·2d2d·6e6f·636f··$(rpm·-Va·--noco | |||
| 0003c770:·6e66·6967·207c·2067·7265·7020·2d45·2027··nfig·|·grep·-E·' | |||
| 0003c780:·5e2e·2e35·2720·7c20·6177·6b20·277b·7072··^..5'·|·awk·'{pr | |||
| 0003c790:·696e·7420·244e·467d·2720·2922·0a0a·2320··int·$NF}'·)"..#· | |||
| 0003c7a0:·4672·6f6d·2066·696c·6573·206e·616d·6573··From·files·names | |||
| 0003c7b0:·2067·6574·2070·6163·6b61·6765·206e·616d···get·package·nam | |||
| 0003c7c0:·6573·2061·6e64·2063·6861·6e67·6520·6e65··es·and·change·ne | |||
| 0003c7d0:·776c·696e·6520·746f·2073·7061·6365·2c20··wline·to·space,· | |||
| 0003c7e0:·6265·6361·7573·6520·7270·6d20·7772·6974··because·rpm·writ | |||
| 0003c7f0:·6573·2065·6163·6820·7061·636b·6167·6520··es·each·package· | |||
| 0003c800:·746f·206e·6577·206c·696e·650a·7061·636b··to·new·line.pack | |||
| 0003c810:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003c820:·6c3d·2224·2872·706d·202d·7166·2024·6669··l="$(rpm·-qf·$fi | |||
| 0003c830:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003c840:·6374·5f68·6173·6820·7c20·7472·2027·5c6e··ct_hash·|·tr·'\n | |||
| 0003c850:·2720·2720·2729·220a·0a0a·7975·6d20·7265··'·'·')"...yum·re | |||
| 0003c860:·696e·7374·616c·6c20·2d79·2024·7061·636b··install·-y·$pack | |||
| 0003c870:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003c880:·6c0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··l.</code></pre>< | |||
| 0003c890:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c8a0:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c8b0:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c8c0:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c8d0:·6574·3d22·2369·646d·3831·3834·2220·7461··et="#idm8184"·ta | |||
| 0003c8e0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c8f0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c900:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c910:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c920:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c930:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003c940:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003c950:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c960:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c970:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c980:·6964·3d22·6964·6d38·3138·3422·3e3c·7461··id="idm8184"><ta | |||
| 0003c990:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c9a0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c9b0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c9c0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c9d0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c9e0:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003c9f0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003ca00:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003ca10:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003ca20:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003ca30:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003ca40:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003ca50:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003ca60:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003ca70:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003c | 0003ca80:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | ||
| 0003ca90:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003caa0:·2020·7365·745f·6661·6374·3a0a·2020·2020····set_fact:.···· | |||
| 0003cab0:·7061·636b·6167·655f·6d61·6e61·6765·725f··package_manager_ | |||
| 0003cac0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003cad0:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003cae0:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003caf0:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003cb00:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003cb10:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003c800:·6d64·3a20·646e·6620·7265·696e·7374·616c··md:·dnf·reinstal | |||
| 0003c810:·6c20·2d79·0a20·2077·6865·6e3a·2061·6e73··l·-y.··when:·ans | |||
| 0003c820:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003c830:·6e20·3d3d·2022·4665·646f·7261·220a·2020··n·==·"Fedora".·· | |||
| 0003c840:·7461·6773·3a0a·2020·2d20·434a·4953·2d35··tags:.··-·CJIS-5 | |||
| 0003c850:·2e31·302e·342e·310a·2020·2d20·4e49·5354··.10.4.1.··-·NIST | |||
| Max diff block lines reached; 9666056/9695228 bytes (99.70%) of diff not shown. | |||
| Offset 69, 15 lines modified | Offset 69, 15 lines modified | ||
| 69 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 69 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 70 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 70 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 73 | ····*·cpe:/o:centos:centos:8 | 73 | ····*·cpe:/o:centos:centos:8 |
| 74 | *****·Revision·History·***** | 74 | *****·Revision·History·***** |
| 75 | Current·version:·0.1.65 | 75 | Current·version:·0.1.65 |
| 76 | ····*·draft·(as·of·202 | 76 | ····*·draft·(as·of·2025-02-23) |
| 77 | *****·Table·of·Contents·***** | 77 | *****·Table·of·Contents·***** |
| 78 | ···1.·System_Settings | 78 | ···1.·System_Settings |
| 79 | ·········1.·Installing_and_Maintaining_Software | 79 | ·········1.·Installing_and_Maintaining_Software |
| 80 | ·········2.·Account_and_Access_Control | 80 | ·········2.·Account_and_Access_Control |
| 81 | ·········3.·System_Accounting_with_auditd | 81 | ·········3.·System_Accounting_with_auditd |
| 82 | ·········4.·GRUB2_bootloader_configuration | 82 | ·········4.·GRUB2_bootloader_configuration |
| 83 | ·········5.·Network_Configuration_and_Firewalls | 83 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 109, 14 lines modified | Offset 109, 24 lines modified | ||
| 109 | $·sudo·yum·reinstall·PACKAGENAME | 109 | $·sudo·yum·reinstall·PACKAGENAME |
| 110 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 110 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 111 | $·sudo·rpm·-Uvh·PACKAGENAME | 111 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 112 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 112 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 113 | Severity: ················high | 113 | Severity: ················high |
| 114 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 114 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 115 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 115 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 116 | Remediation_Shell_script_⇲ | ||
| 117 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 118 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 119 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 120 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 121 | yum·reinstall·-y·$packages_to_reinstall | ||
| 116 | Remediation_Ansible_snippet_⇲ | 122 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·high | 123 | Complexity:·high |
| 118 | Disruption:·medium | 124 | Disruption:·medium |
| 119 | Strategy:···restrict | 125 | Strategy:···restrict |
| 120 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 126 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 121 | ··set_fact: | 127 | ··set_fact: |
| 122 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 128 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 260, 37 lines modified | Offset 270, 56 lines modified | ||
| 260 | ··-·PCI-DSS-Req-11.5 | 270 | ··-·PCI-DSS-Req-11.5 |
| 261 | ··-·high_complexity | 271 | ··-·high_complexity |
| 262 | ··-·high_severity | 272 | ··-·high_severity |
| 263 | ··-·medium_disruption | 273 | ··-·medium_disruption |
| 264 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 265 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 266 | ··-·rpm_verify_hashes | 276 | ··-·rpm_verify_hashes |
| 267 | Remediation_Shell_script_⇲ | ||
| 268 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 269 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 270 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 271 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 272 | yum·reinstall·-y·$packages_to_reinstall | ||
| 273 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 277 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 274 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 278 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 275 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 279 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 276 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 280 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 277 | $·rpm·-qf·FILENAME | 281 | $·rpm·-qf·FILENAME |
| 278 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 282 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 279 | $·sudo·rpm·--setperms·PACKAGENAME | 283 | $·sudo·rpm·--setperms·PACKAGENAME |
| 280 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 284 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 281 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 285 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 282 | Severity: ················high | 286 | Severity: ················high |
| 283 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 287 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 284 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 288 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 289 | Remediation_Shell_script_⇲ | ||
| 290 | Complexity:·high | ||
| 291 | Disruption:·medium | ||
| 292 | Strategy:···restrict | ||
| 293 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 294 | declare·-A·SETPERMS_RPM_DICT | ||
| 295 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 296 | #·is·expected·by·the·RPM·database | ||
| 297 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 298 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 299 | do | ||
| 300 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 301 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 302 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 303 | ········do | ||
| 304 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 305 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 306 | ········done | ||
| 307 | done | ||
| 308 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 309 | #·correct·values | ||
| 310 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 311 | do | ||
| 312 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 313 | done | ||
| 285 | Remediation_Ansible_snippet_⇲ | 314 | Remediation_Ansible_snippet_⇲ |
| 286 | Complexity:·high | 315 | Complexity:·high |
| 287 | Disruption:·medium | 316 | Disruption:·medium |
| 288 | Strategy:···restrict | 317 | Strategy:···restrict |
| 289 | -·name:·Read·list·of·files·with·incorrect·permissions | 318 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 290 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 319 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 291 | ····--nocaps·--nolinkto·--nouser·--nogroup | 320 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 364, 69 lines modified | Offset 393, 48 lines modified | ||
| 364 | ··-·PCI-DSS-Req-11.5 | 393 | ··-·PCI-DSS-Req-11.5 |
| 365 | ··-·high_complexity | 394 | ··-·high_complexity |
| 366 | ··-·high_severity | 395 | ··-·high_severity |
| 367 | ··-·medium_disruption | 396 | ··-·medium_disruption |
| 368 | ··-·no_reboot_needed | 397 | ··-·no_reboot_needed |
| 369 | ··-·restrict_strategy | 398 | ··-·restrict_strategy |
| 370 | ··-·rpm_verify_permissions | 399 | ··-·rpm_verify_permissions |
| 371 | Remediation_Shell_script_⇲ | ||
| 372 | Complexity:·high | ||
| 373 | Disruption:·medium | ||
| 374 | Strategy:···restrict | ||
| 375 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 376 | declare·-A·SETPERMS_RPM_DICT | ||
| 377 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 378 | #·is·expected·by·the·RPM·database | ||
| 379 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 890031/898287 bytes (99.08%) of diff not shown. | |||
| Offset 14581, 16 lines modified | Offset 14581, 16 lines modified | ||
| 00038f40:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00038f40:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00038f50:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00038f50:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00038f60:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00038f60:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00038f70:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00038f70:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00038f80:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00038f80:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00038f90:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00038f90:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00038fa0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038fa0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038fb0:·2020·2020·2861·7320·6f66·2032·3032·3 | 00038fb0:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00038fc0:·303 | 00038fc0:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00038fd0:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00038fd0:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00038fe0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00038fe0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00038ff0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00038ff0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00039000:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00039000:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00039010:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00039010:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00039020:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00039020:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00039030:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00039030:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15524, 192 lines modified | Offset 15524, 192 lines modified | ||
| 0003ca30:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003ca30:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003ca40:·2223·6964·6d38·3534·3022·2074·6162·696e··"#idm8540"·tabin | 0003ca40:·2223·6964·6d38·3534·3022·2074·6162·696e··"#idm8540"·tabin | ||
| 0003ca50:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003ca50:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003ca60:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003ca60:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003ca70:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003ca70:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003ca80:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003ca80:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003ca90:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003ca90:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003caa0:·3e52·656d·6564·6961·7469·6f6e·20 | 0003caa0:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003cab0:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003cac0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003cad0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003cae0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003caf0:·3d22·6964·6d38·3534·3022·3e3c·7461·626c··="idm8540"><tabl | |||
| 0003cb00:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003cb10:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003cb20:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003cb30:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003cb40:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003cb50:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003cb60:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003cb70:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003cb80:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003cb90:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003cba0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003cbb0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003cbc0:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003cbd0:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003cbe0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003cbf0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003cc00:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003cc10:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003cc20:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003cc30:·3d22·2369·646d·3835·3431·2220·7461·6269··="#idm8541"·tabi | |||
| 0003cc40:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003cc50:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003cc60:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003cc70:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003cc80:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003cc90:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003cca0:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003ccb0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003ccc0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003ccd0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003cce0:·2269·646d·3835·3431·223e·3c74·6162·6c65··"idm8541"><table | |||
| 0003ccf0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003cd00:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003cd10:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003cd20:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003cd30:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003cd40:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003cd50:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003cd60:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003cd70:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003cd80:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003cd90:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003cda0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003cdb0:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003cdc0:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003cdd0:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003cde0:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003cdf0:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003ce00:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003ce10:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003ce20:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003ce30:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003ce40:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003ce50:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003ce60:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003ce70:·2369·646d·3835·3432·2220·7461·6269·6e64··#idm8542"·tabind | |||
| 0003ce80:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003ce90:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003cea0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003ceb0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003cec0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003ced0:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003c | 0003cab0:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003c | 0003cac0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003c | 0003cad0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003c | 0003cae0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003c | 0003caf0:·6964·6d38·3534·3022·3e3c·7461·626c·6520··idm8540"><table· | ||
| 0003c | 0003cb00:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003c | 0003cb10:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003c | 0003cb20:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003c | 0003cb30:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003c | 0003cb40:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003c | 0003cb50:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003cb60:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003c | 0003cb70:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003c | 0003cb80:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003cb90:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003c | 0003cba0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003c | 0003cbb0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003cbc0:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003cbd0:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003cbe0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003cbf0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003cc00:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003cc10:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003cc20:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003cc30:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003cc40:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003cc50:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003cc60:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003cc70:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003cc80:·6964·6d38·3534·3122·2074·6162·696e·6465··idm8541"·tabinde | |||
| 0003cc90:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003cca0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003ccb0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003ccc0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003ccd0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| Max diff block lines reached; 8372698/8399110 bytes (99.69%) of diff not shown. | |||
| Offset 79, 15 lines modified | Offset 79, 15 lines modified | ||
| 79 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 79 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 80 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 80 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 81 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 81 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 82 | ····*·cpe:/o:redhat:enterprise_linux:8 | 82 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 83 | ····*·cpe:/o:centos:centos:8 | 83 | ····*·cpe:/o:centos:centos:8 |
| 84 | *****·Revision·History·***** | 84 | *****·Revision·History·***** |
| 85 | Current·version:·0.1.65 | 85 | Current·version:·0.1.65 |
| 86 | ····*·draft·(as·of·202 | 86 | ····*·draft·(as·of·2025-02-23) |
| 87 | *****·Table·of·Contents·***** | 87 | *****·Table·of·Contents·***** |
| 88 | ···1.·System_Settings | 88 | ···1.·System_Settings |
| 89 | ·········1.·Installing_and_Maintaining_Software | 89 | ·········1.·Installing_and_Maintaining_Software |
| 90 | ·········2.·Account_and_Access_Control | 90 | ·········2.·Account_and_Access_Control |
| 91 | ·········3.·System_Accounting_with_auditd | 91 | ·········3.·System_Accounting_with_auditd |
| 92 | ·········4.·GRUB2_bootloader_configuration | 92 | ·········4.·GRUB2_bootloader_configuration |
| 93 | ·········5.·zIPL_bootloader_configuration | 93 | ·········5.·zIPL_bootloader_configuration |
| Offset 121, 31 lines modified | Offset 121, 39 lines modified | ||
| 121 | ***·Rule ·Install·AIDE· [ref]·*** | 121 | ***·Rule ·Install·AIDE· [ref]·*** |
| 122 | The·aide·package·can·be·installed·with·the·following·command: | 122 | The·aide·package·can·be·installed·with·the·following·command: |
| 123 | $·sudo·yum·install·aide | 123 | $·sudo·yum·install·aide |
| 124 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 124 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 125 | Severity: ················medium | 125 | Severity: ················medium |
| 126 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 126 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 127 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 127 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 128 | Remediation_Anaconda_snippet_⇲ | ||
| 129 | Complexity:·low | ||
| 130 | Disruption:·low | ||
| 131 | Strategy:···enable | ||
| 132 | package·--add=aide | ||
| 133 | Remediation_Puppet_snippet_⇲ | 128 | Remediation_Puppet_snippet_⇲ |
| 134 | Complexity:·low | 129 | Complexity:·low |
| 135 | Disruption:·low | 130 | Disruption:·low |
| 136 | Strategy:···enable | 131 | Strategy:···enable |
| 137 | include·install_aide | 132 | include·install_aide |
| 138 | class·install_aide·{ | 133 | class·install_aide·{ |
| 139 | ··package·{·'aide': | 134 | ··package·{·'aide': |
| 140 | ····ensure·=>·'installed', | 135 | ····ensure·=>·'installed', |
| 141 | ··} | 136 | ··} |
| 142 | } | 137 | } |
| 138 | Remediation_Shell_script_⇲ | ||
| 139 | Complexity:·low | ||
| 140 | Disruption:·low | ||
| 141 | Strategy:···enable | ||
| 142 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 143 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 144 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 145 | ····yum·install·-y·"aide" | ||
| 146 | fi | ||
| 147 | else | ||
| 148 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 149 | fi | ||
| 143 | Remediation_Ansible_snippet_⇲ | 150 | Remediation_Ansible_snippet_⇲ |
| 144 | Complexity:·low | 151 | Complexity:·low |
| 145 | Disruption:·low | 152 | Disruption:·low |
| 146 | Strategy:···enable | 153 | Strategy:···enable |
| 147 | -·name:·Ensure·aide·is·installed | 154 | -·name:·Ensure·aide·is·installed |
| 148 | ··package: | 155 | ··package: |
| 149 | ····name:·aide | 156 | ····name:·aide |
| Offset 163, 28 lines modified | Offset 171, 20 lines modified | ||
| 163 | ··-·no_reboot_needed | 171 | ··-·no_reboot_needed |
| 164 | ··-·package_aide_installed | 172 | ··-·package_aide_installed |
| 165 | Remediation_OSBuild_Blueprint_snippet_⇲ | 173 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 166 | [[packages]] | 174 | [[packages]] |
| 167 | name·=·"aide" | 175 | name·=·"aide" |
| 168 | version·=·"*" | 176 | version·=·"*" |
| 169 | Remediation_ | 177 | Remediation_Anaconda_snippet_⇲ |
| 170 | Complexity:·low | 178 | Complexity:·low |
| 171 | Disruption:·low | 179 | Disruption:·low |
| 172 | Strategy:···enable | 180 | Strategy:···enable |
| 173 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 174 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 181 | package·--add=aide | ||
| 175 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 176 | ····yum·install·-y·"aide" | ||
| 177 | fi | ||
| 178 | else | ||
| 179 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 180 | fi | ||
| 181 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 182 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 182 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 183 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 183 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. | 184 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. |
| 184 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 185 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 185 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 186 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 193, 14 lines modified | Offset 193, 27 lines modified | ||
| 193 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 193 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 194 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 194 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 195 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 195 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 196 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 196 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 197 | Severity: ················high | 197 | Severity: ················high |
| 198 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 198 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 199 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·SV-230223r792855_rule | 199 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·SV-230223r792855_rule |
| 200 | Remediation_Shell_script_⇲ | ||
| 201 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 202 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 203 | fips-mode-setup·--enable | ||
| 204 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 205 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 206 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 207 | fi | ||
| 208 | else | ||
| 209 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 210 | fi | ||
| 200 | Remediation_Ansible_snippet_⇲ | 211 | Remediation_Ansible_snippet_⇲ |
| 201 | Complexity:·medium | 212 | Complexity:·medium |
| 202 | Disruption:·medium | 213 | Disruption:·medium |
| 203 | Reboot:·····true | 214 | Reboot:·····true |
| 204 | Strategy:···restrict | 215 | Strategy:···restrict |
| 205 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 216 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 206 | ··command:·/usr/bin/fips-mode-setup·--check | 217 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 258, 27 lines modified | Offset 271, 14 lines modified | ||
| 258 | ··-·NIST-800-53-SC-13 | 271 | ··-·NIST-800-53-SC-13 |
| 259 | ··-·enable_dracut_fips_module | 272 | ··-·enable_dracut_fips_module |
| 260 | ··-·high_severity | 273 | ··-·high_severity |
| 261 | ··-·medium_complexity | 274 | ··-·medium_complexity |
| 262 | ··-·medium_disruption | 275 | ··-·medium_disruption |
| 263 | ··-·reboot_required | 276 | ··-·reboot_required |
| 264 | ··-·restrict_strategy | 277 | ··-·restrict_strategy |
| Max diff block lines reached; 1100680/1107927 bytes (99.35%) of diff not shown. | |||
| Offset 14548, 15 lines modified | Offset 14548, 15 lines modified | ||
| 00038d30:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00038d30:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00038d40:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00038d40:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00038d50:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00038d50:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00038d60:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00038d60:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00038d70:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00038d70:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00038d80:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00038d80:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00038d90:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00038d90:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038da0:·6173·206f·6620·3230·323 | 00038da0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00038db0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00038db0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00038dc0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00038dc0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00038dd0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00038dd0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00038de0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00038de0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00038df0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00038df0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00038e00:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00038e00:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038e10:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038e10:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15494, 323 lines modified | Offset 15494, 323 lines modified | ||
| 0003c850:·6765·743d·2223·6964·6d38·3138·3322·2074··get="#idm8183"·t | 0003c850:·6765·743d·2223·6964·6d38·3138·3322·2074··get="#idm8183"·t | ||
| 0003c860:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003c860:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003c870:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003c870:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003c880:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003c880:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003c890:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003c890:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003c8a0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003c8a0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003c8b0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003c8b0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003c8c0:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 0003c8d0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c8e0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c8f0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c900:·3d22·6964·6d38·3138·3322·3e3c·7072·653e··="idm8183"><pre> | |||
| 0003c910:·3c63·6f64·653e·0a23·2046·696e·6420·7768··<code>.#·Find·wh | |||
| 0003c920:·6963·6820·6669·6c65·7320·6861·7665·2069··ich·files·have·i | |||
| 0003c930:·6e63·6f72·7265·6374·2068·6173·6820·286e··ncorrect·hash·(n | |||
| 0003c940:·6f74·2069·6e20·2f65·7463·2c20·6265·6361··ot·in·/etc,·beca | |||
| 0003c950:·7573·6520·6f66·2074·6865·2073·7973·7465··use·of·the·syste | |||
| 0003c960:·6d20·7265·6c61·7465·6420·636f·6e66·6967··m·related·config | |||
| 0003c970:·2066·696c·6573·2920·616e·6420·7468·656e···files)·and·then | |||
| 0003c980:·2067·6574·2066·696c·6573·206e·616d·6573···get·files·names | |||
| 0003c990:·0a66·696c·6573·5f77·6974·685f·696e·636f··.files_with_inco | |||
| 0003c9a0:·7272·6563·745f·6861·7368·3d22·2428·7270··rrect_hash="$(rp | |||
| 0003c9b0:·6d20·2d56·6120·2d2d·6e6f·636f·6e66·6967··m·-Va·--noconfig | |||
| 0003c9c0:·207c·2067·7265·7020·2d45·2027·5e2e·2e35···|·grep·-E·'^..5 | |||
| 0003c9d0:·2720·7c20·6177·6b20·277b·7072·696e·7420··'·|·awk·'{print· | |||
| 0003c9e0:·244e·467d·2720·2922·0a0a·2320·4672·6f6d··$NF}'·)"..#·From | |||
| 0003c9f0:·2066·696c·6573·206e·616d·6573·2067·6574···files·names·get | |||
| 0003c8c0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003c8d0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003c8e0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003c8f0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003c900:·2069·643d·2269·646d·3831·3833·223e·3c74···id="idm8183"><t | |||
| 0003c910:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003c920:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003c930:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003c940:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c950:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c960:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003c970:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c980:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c990:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003c9a0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c9b0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c9c0:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003c9d0:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c9e0:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003c9f0:·7420·6661·6374·3a20·5061·636b·6167·6520··t·fact:·Package· | |||
| 0003ca00:·6d61·6e61·6765·7220·7265·696e·7374·616c··manager·reinstal | |||
| 0003ca10:·6c20·636f·6d6d·616e·6420·2864·6e66·2927··l·command·(dnf)' | |||
| 0003ca20:·0a20·2073·6574·5f66·6163·743a·0a20·2020··.··set_fact:.··· | |||
| 0003ca | 0003ca00:·2070·6163·6b61·6765·206e·616d·6573·2061···package·names·a | ||
| 0003ca40:·5f72·6569·6e73·7461·6c6c·5f63·6d64·3a20··_reinstall_cmd:· | |||
| 0003ca50:·646e·6620·7265·696e·7374·616c·6c20·2d79··dnf·reinstall·-y | |||
| 0003ca60:·0a20·2077·6865·6e3a·2061·6e73·6962·6c65··.··when:·ansible | |||
| 0003ca70:·5f64·6973·7472·6962·7574·696f·6e20·3d3d··_distribution·== | |||
| 0003ca80:·2022·4665·646f·7261·220a·2020·7461·6773···"Fedora".··tags | |||
| 0003ca90:·3a0a·2020·2d20·434a·4953·2d35·2e31·302e··:.··-·CJIS-5.10. | |||
| 0003caa0:·342e·310a·2020·2d20·4e49·5354·2d38·3030··4.1.··-·NIST-800 | |||
| 0003cab0:·2d31·3731·2d33·2e33·2e38·0a20·202d·204e··-171-3.3.8.··-·N | |||
| 0003cac0:·4953·542d·3830·302d·3137·312d·332e·342e··IST-800-171-3.4. | |||
| 0003cad0:·310a·2020·2d20·4e49·5354·2d38·3030·2d35··1.··-·NIST-800-5 | |||
| 0003cae0:·332d·4155·2d39·2833·290a·2020·2d20·4e49··3-AU-9(3).··-·NI | |||
| 0003caf0:·5354·2d38·3030·2d35·332d·434d·2d36·2863··ST-800-53-CM-6(c | |||
| 0003cb00:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003cb10:·332d·434d·2d36·2864·290a·2020·2d20·4e49··3-CM-6(d).··-·NI | |||
| 0003cb20:·5354·2d38·3030·2d35·332d·5349·2d37·0a20··ST-800-53-SI-7.· | |||
| 0003cb30:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| 0003cb40:·492d·3728·3129·0a20·202d·204e·4953·542d··I-7(1).··-·NIST- | |||
| 0003cb50:·3830·302d·3533·2d53·492d·3728·3629·0a20··800-53-SI-7(6).· | |||
| 0003cb60:·202d·2050·4349·2d44·5353·2d52·6571·2d31···-·PCI-DSS-Req-1 | |||
| 0003cb70:·312e·350a·2020·2d20·6869·6768·5f63·6f6d··1.5.··-·high_com | |||
| 0003cb80:·706c·6578·6974·790a·2020·2d20·6869·6768··plexity.··-·high | |||
| 0003cb90:·5f73·6576·6572·6974·790a·2020·2d20·6d65··_severity.··-·me | |||
| 0003cba0:·6469·756d·5f64·6973·7275·7074·696f·6e0a··dium_disruption. | |||
| 0003cbb0:·2020·2d20·6e6f·5f72·6562·6f6f·745f·6e65····-·no_reboot_ne | |||
| 0003cbc0:·6564·6564·0a20·202d·2072·6573·7472·6963··eded.··-·restric | |||
| 0003cbd0:·745f·7374·7261·7465·6779·0a20·202d·2072··t_strategy.··-·r | |||
| 0003c | 0003ca10:·6e64·2063·6861·6e67·6520·6e65·776c·696e··nd·change·newlin | ||
| 0003ca20:·6520·746f·2073·7061·6365·2c20·6265·6361··e·to·space,·beca | |||
| 0003ca30:·7573·6520·7270·6d20·7772·6974·6573·2065··use·rpm·writes·e | |||
| 0003ca40:·6163·6820·7061·636b·6167·6520·746f·206e··ach·package·to·n | |||
| 0003ca50:·6577·206c·696e·650a·7061·636b·6167·6573··ew·line.packages | |||
| 0003ca60:·5f74·6f5f·7265·696e·7374·616c·6c3d·2224··_to_reinstall="$ | |||
| 0003ca70:·2872·706d·202d·7166·2024·6669·6c65·735f··(rpm·-qf·$files_ | |||
| 0003ca80:·7769·7468·5f69·6e63·6f72·7265·6374·5f68··with_incorrect_h | |||
| 0003ca90:·6173·6820·7c20·7472·2027·5c6e·2720·2720··ash·|·tr·'\n'·'· | |||
| 0003caa0:·2729·220a·0a0a·7975·6d20·7265·696e·7374··')"...yum·reinst | |||
| 0003cab0:·616c·6c20·2d79·2024·7061·636b·6167·6573··all·-y·$packages | |||
| 0003cac0:·5f74·6f5f·7265·696e·7374·616c·6c0a·3c2f··_to_reinstall.</ | |||
| 0003cad0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003cae0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003caf0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003cb00:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003cb10:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003cb20:·2369·646d·3831·3834·2220·7461·6269·6e64··#idm8184"·tabind | |||
| 0003cb30:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003cb40:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003cb50:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003cb60:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003cb70:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003cb80:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003cb90:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003cba0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003cbb0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003cbc0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003cbd0:·6964·6d38·3138·3422·3e3c·7461·626c·6520··idm8184"><table· | |||
| 0003cbe0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003cbf0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003cc00:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003cc10:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003cc20:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| Max diff block lines reached; 6194796/6239148 bytes (99.29%) of diff not shown. | |||
| Offset 70, 15 lines modified | Offset 70, 15 lines modified | ||
| 70 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 70 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 74 | ····*·cpe:/o:centos:centos:8 | 74 | ····*·cpe:/o:centos:centos:8 |
| 75 | *****·Revision·History·***** | 75 | *****·Revision·History·***** |
| 76 | Current·version:·0.1.65 | 76 | Current·version:·0.1.65 |
| 77 | ····*·draft·(as·of·202 | 77 | ····*·draft·(as·of·2025-02-23) |
| 78 | *****·Table·of·Contents·***** | 78 | *****·Table·of·Contents·***** |
| 79 | ···1.·System_Settings | 79 | ···1.·System_Settings |
| 80 | ·········1.·Installing_and_Maintaining_Software | 80 | ·········1.·Installing_and_Maintaining_Software |
| 81 | ·········2.·Account_and_Access_Control | 81 | ·········2.·Account_and_Access_Control |
| 82 | ·········3.·System_Accounting_with_auditd | 82 | ·········3.·System_Accounting_with_auditd |
| 83 | ·········4.·Configure_Syslog | 83 | ·········4.·Configure_Syslog |
| 84 | ·········5.·Network_Configuration_and_Firewalls | 84 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 116, 14 lines modified | Offset 116, 24 lines modified | ||
| 116 | $·sudo·yum·reinstall·PACKAGENAME | 116 | $·sudo·yum·reinstall·PACKAGENAME |
| 117 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 117 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 118 | $·sudo·rpm·-Uvh·PACKAGENAME | 118 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 119 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 119 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 120 | Severity: ················high | 120 | Severity: ················high |
| 121 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 121 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 122 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 122 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 123 | Remediation_Shell_script_⇲ | ||
| 124 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 125 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 126 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 127 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 128 | yum·reinstall·-y·$packages_to_reinstall | ||
| 123 | Remediation_Ansible_snippet_⇲ | 129 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·high | 130 | Complexity:·high |
| 125 | Disruption:·medium | 131 | Disruption:·medium |
| 126 | Strategy:···restrict | 132 | Strategy:···restrict |
| 127 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 133 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 128 | ··set_fact: | 134 | ··set_fact: |
| 129 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 135 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 267, 36 lines modified | Offset 277, 51 lines modified | ||
| 267 | ··-·PCI-DSS-Req-11.5 | 277 | ··-·PCI-DSS-Req-11.5 |
| 268 | ··-·high_complexity | 278 | ··-·high_complexity |
| 269 | ··-·high_severity | 279 | ··-·high_severity |
| 270 | ··-·medium_disruption | 280 | ··-·medium_disruption |
| 271 | ··-·no_reboot_needed | 281 | ··-·no_reboot_needed |
| 272 | ··-·restrict_strategy | 282 | ··-·restrict_strategy |
| 273 | ··-·rpm_verify_hashes | 283 | ··-·rpm_verify_hashes |
| 274 | Remediation_Shell_script_⇲ | ||
| 275 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 276 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 277 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 278 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 279 | yum·reinstall·-y·$packages_to_reinstall | ||
| 280 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 284 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 281 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 285 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 282 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 286 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 283 | run·the·following·command·to·determine·which·package·owns·it: | 287 | run·the·following·command·to·determine·which·package·owns·it: |
| 284 | $·rpm·-qf·FILENAME | 288 | $·rpm·-qf·FILENAME |
| 285 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 289 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 286 | $·sudo·rpm·--setugids·PACKAGENAME | 290 | $·sudo·rpm·--setugids·PACKAGENAME |
| 287 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 291 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 288 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 292 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 289 | Severity: ················high | 293 | Severity: ················high |
| 290 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 294 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 291 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 295 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 296 | Remediation_Shell_script_⇲ | ||
| 297 | Complexity:·high | ||
| 298 | Disruption:·medium | ||
| 299 | Strategy:···restrict | ||
| 300 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 301 | declare·-A·SETPERMS_RPM_DICT | ||
| 302 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 303 | #·is·expected·by·the·RPM·database | ||
| 304 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 305 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 306 | do | ||
| 307 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 308 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 309 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 310 | done | ||
| 311 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 312 | #·correct·values | ||
| 313 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 314 | do | ||
| 315 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 316 | done | ||
| 292 | Remediation_Ansible_snippet_⇲ | 317 | Remediation_Ansible_snippet_⇲ |
| 293 | Complexity:·high | 318 | Complexity:·high |
| 294 | Disruption:·medium | 319 | Disruption:·medium |
| 295 | Strategy:···restrict | 320 | Strategy:···restrict |
| 296 | -·name:·Read·list·of·files·with·incorrect·ownership | 321 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 297 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 322 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 298 | ····--nocaps·--nolinkto·--nomode | 323 | ····--nocaps·--nolinkto·--nomode |
| Offset 367, 52 lines modified | Offset 392, 56 lines modified | ||
| 367 | ··-·PCI-DSS-Req-11.5 | 392 | ··-·PCI-DSS-Req-11.5 |
| 368 | ··-·high_complexity | 393 | ··-·high_complexity |
| 369 | ··-·high_severity | 394 | ··-·high_severity |
| 370 | ··-·medium_disruption | 395 | ··-·medium_disruption |
| 371 | ··-·no_reboot_needed | 396 | ··-·no_reboot_needed |
| 372 | ··-·restrict_strategy | 397 | ··-·restrict_strategy |
| 373 | ··-·rpm_verify_ownership | 398 | ··-·rpm_verify_ownership |
| 399 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 400 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 401 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 402 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 403 | $·rpm·-qf·FILENAME | ||
| 404 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 405 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 406 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 407 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 408 | Severity: ················high | ||
| 409 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 410 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | ||
| 374 | Remediation_Shell_script_⇲ | 411 | Remediation_Shell_script_⇲ |
| 375 | Complexity:·high | 412 | Complexity:·high |
| 376 | Disruption:·medium | 413 | Disruption:·medium |
| 377 | Strategy:···restrict | 414 | Strategy:···restrict |
| Max diff block lines reached; 651320/660641 bytes (98.59%) of diff not shown. | |||
| Offset 14568, 15 lines modified | Offset 14568, 15 lines modified | ||
| 00038e70:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00038e70:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00038e80:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00038e80:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00038e90:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00038e90:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00038ea0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00038ea0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00038eb0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00038eb0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00038ec0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00038ec0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00038ed0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00038ed0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00038ee0:·6620·3230·323 | 00038ee0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00038ef0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00038ef0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00038f00:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00038f00:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00038f10:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00038f10:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00038f20:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00038f20:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00038f30:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00038f30:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00038f40:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00038f40:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00038f50:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00038f50:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15520, 323 lines modified | Offset 15520, 323 lines modified | ||
| 0003c9f0:·7461·7267·6574·3d22·2369·646d·3831·3833··target="#idm8183 | 0003c9f0:·7461·7267·6574·3d22·2369·646d·3831·3833··target="#idm8183 | ||
| 0003ca00:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003ca00:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003ca10:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003ca10:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003ca20:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003ca20:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003ca30:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003ca30:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003ca40:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003ca40:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003ca50:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003ca50:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003ca60:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003ca70:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003ca80:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003ca90:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003caa0:·7365·2220·6964·3d22·6964·6d38·3138·3322··se"·id="idm8183" | |||
| 0003cab0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003cac0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003cad0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003cae0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003caf0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003cb00:·6578·6974·793a·3c2f·7468·3e3c·7464·3e68··exity:</th><td>h | |||
| 0003cb10:·6967·683c·2f74·643e·3c2f·7472·3e3c·7472··igh</td></tr><tr | |||
| 0003cb20:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003cb30:·3c2f·7468·3e3c·7464·3e6d·6564·6975·6d3c··</th><td>medium< | |||
| 0003cb40:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003cb50:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003cb60:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 0003cb70:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003cb80:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003cb90:·2753·6574·2066·6163·743a·2050·6163·6b61··'Set·fact:·Packa | |||
| 0003cba0:·6765·206d·616e·6167·6572·2072·6569·6e73··ge·manager·reins | |||
| 0003cbb0:·7461·6c6c·2063·6f6d·6d61·6e64·2028·646e··tall·command·(dn | |||
| 0003cbc0:·6629·270a·2020·7365·745f·6661·6374·3a0a··f)'.··set_fact:. | |||
| 0003c | 0003ca60:·696f·6e20·5368·656c·6c20·7363·7269·7074··ion·Shell·script | ||
| 0003ca70:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003ca80:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003ca90:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003caa0:·2069·643d·2269·646d·3831·3833·223e·3c70···id="idm8183"><p | |||
| 0003cab0:·7265·3e3c·636f·6465·3e0a·2320·4669·6e64··re><code>.#·Find | |||
| 0003cac0:·2077·6869·6368·2066·696c·6573·2068·6176···which·files·hav | |||
| 0003cad0:·6520·696e·636f·7272·6563·7420·6861·7368··e·incorrect·hash | |||
| 0003cae0:·2028·6e6f·7420·696e·202f·6574·632c·2062···(not·in·/etc,·b | |||
| 0003caf0:·6563·6175·7365·206f·6620·7468·6520·7379··ecause·of·the·sy | |||
| 0003cb00:·7374·656d·2072·656c·6174·6564·2063·6f6e··stem·related·con | |||
| 0003cb10:·6669·6720·6669·6c65·7329·2061·6e64·2074··fig·files)·and·t | |||
| 0003cb20:·6865·6e20·6765·7420·6669·6c65·7320·6e61··hen·get·files·na | |||
| 0003cb30:·6d65·730a·6669·6c65·735f·7769·7468·5f69··mes.files_with_i | |||
| 0003cb40:·6e63·6f72·7265·6374·5f68·6173·683d·2224··ncorrect_hash="$ | |||
| 0003cb50:·2872·706d·202d·5661·202d·2d6e·6f63·6f6e··(rpm·-Va·--nocon | |||
| 0003cb60:·6669·6720·7c20·6772·6570·202d·4520·275e··fig·|·grep·-E·'^ | |||
| 0003cb70:·2e2e·3527·207c·2061·776b·2027·7b70·7269··..5'·|·awk·'{pri | |||
| 0003cb80:·6e74·2024·4e46·7d27·2029·220a·0a23·2046··nt·$NF}'·)"..#·F | |||
| 0003cb90:·726f·6d20·6669·6c65·7320·6e61·6d65·7320··rom·files·names· | |||
| 0003cba0:·6765·7420·7061·636b·6167·6520·6e61·6d65··get·package·name | |||
| 0003cbb0:·7320·616e·6420·6368·616e·6765·206e·6577··s·and·change·new | |||
| 0003cbc0:·6c69·6e65·2074·6f20·7370·6163·652c·2062··line·to·space,·b | |||
| 0003cbd0:·6563·6175·7365·2072·706d·2077·7269·7465··ecause·rpm·write | |||
| 0003cbe0:·7320·6561·6368·2070·6163·6b61·6765·2074··s·each·package·t | |||
| 0003cbf0:·6f20·6e65·7720·6c69·6e65·0a70·6163·6b61··o·new·line.packa | |||
| 0003cc00:·6765·735f·746f·5f72·6569·6e73·7461·6c6c··ges_to_reinstall | |||
| 0003cc10:·3d22·2428·7270·6d20·2d71·6620·2466·696c··="$(rpm·-qf·$fil | |||
| 0003cc20:·6573·5f77·6974·685f·696e·636f·7272·6563··es_with_incorrec | |||
| 0003cc30:·745f·6861·7368·207c·2074·7220·275c·6e27··t_hash·|·tr·'\n' | |||
| 0003cc40:·2027·2027·2922·0a0a·0a79·756d·2072·6569···'·')"...yum·rei | |||
| 0003cc50:·6e73·7461·6c6c·202d·7920·2470·6163·6b61··nstall·-y·$packa | |||
| 0003cc60:·6765·735f·746f·5f72·6569·6e73·7461·6c6c··ges_to_reinstall | |||
| 0003cc70:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003cc80:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003cc90:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003cca0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003ccb0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003ccc0:·743d·2223·6964·6d38·3138·3422·2074·6162··t="#idm8184"·tab | |||
| 0003ccd0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003cce0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003ccf0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003cd00:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003cd10:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003cd20:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003cd30:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003cd40:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003cd50:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003cd60:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003cd70:·643d·2269·646d·3831·3834·223e·3c74·6162··d="idm8184"><tab | |||
| 0003cd80:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003cd90:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003cda0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003cdb0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003cdc0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003cdd0:·3a3c·2f74·683e·3c74·643e·6869·6768·3c2f··:</th><td>high</ | |||
| 0003cde0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003cdf0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003ce00:·3c74·643e·6d65·6469·756d·3c2f·7464·3e3c··<td>medium</td>< | |||
| 0003ce10:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003ce20:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003ce30:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003ce40:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003ce50:·6465·3e2d·206e·616d·653a·2027·5365·7420··de>-·name:·'Set· | |||
| 0003ce60:·6661·6374·3a20·5061·636b·6167·6520·6d61··fact:·Package·ma | |||
| 0003c | 0003ce70:·6e61·6765·7220·7265·696e·7374·616c·6c20··nager·reinstall· | ||
| 0003ce80:·636f·6d6d·616e·6420·2864·6e66·2927·0a20··command·(dnf)'.· | |||
| 0003ce90:·2073·6574·5f66·6163·743a·0a20·2020·2070···set_fact:.····p | |||
| 0003cea0:·6163·6b61·6765·5f6d·616e·6167·6572·5f72··ackage_manager_r | |||
| 0003ceb0:·6569·6e73·7461·6c6c·5f63·6d64·3a20·646e··einstall_cmd:·dn | |||
| 0003cec0:·6620·7265·696e·7374·616c·6c20·2d79·0a20··f·reinstall·-y.· | |||
| 0003ced0:·2077·6865·6e3a·2061·6e73·6962·6c65·5f64···when:·ansible_d | |||
| 0003cee0:·6973·7472·6962·7574·696f·6e20·3d3d·2022··istribution·==·" | |||
| 0003cef0:·4665·646f·7261·220a·2020·7461·6773·3a0a··Fedora".··tags:. | |||
| 0003cf00:·2020·2d20·434a·4953·2d35·2e31·302e·342e····-·CJIS-5.10.4. | |||
| 0003cbf0:·643a·2064·6e66·2072·6569·6e73·7461·6c6c··d:·dnf·reinstall | |||
| 0003cc00:·202d·790a·2020·7768·656e·3a20·616e·7369···-y.··when:·ansi | |||
| 0003cc10:·626c·655f·6469·7374·7269·6275·7469·6f6e··ble_distribution | |||
| 0003cc20:·203d·3d20·2246·6564·6f72·6122·0a20·2074···==·"Fedora".··t | |||
| 0003cc30:·6167·733a·0a20·202d·2043·4a49·532d·352e··ags:.··-·CJIS-5. | |||
| 0003cc40:·3130·2e34·2e31·0a20·202d·204e·4953·542d··10.4.1.··-·NIST- | |||
| Max diff block lines reached; 16980952/17010124 bytes (99.83%) of diff not shown. | |||
| Offset 75, 15 lines modified | Offset 75, 15 lines modified | ||
| 75 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 75 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 76 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 76 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 77 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 77 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 78 | ····*·cpe:/o:redhat:enterprise_linux:8 | 78 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 79 | ····*·cpe:/o:centos:centos:8 | 79 | ····*·cpe:/o:centos:centos:8 |
| 80 | *****·Revision·History·***** | 80 | *****·Revision·History·***** |
| 81 | Current·version:·0.1.65 | 81 | Current·version:·0.1.65 |
| 82 | ····*·draft·(as·of·202 | 82 | ····*·draft·(as·of·2025-02-23) |
| 83 | *****·Table·of·Contents·***** | 83 | *****·Table·of·Contents·***** |
| 84 | ···1.·System_Settings | 84 | ···1.·System_Settings |
| 85 | ·········1.·Installing_and_Maintaining_Software | 85 | ·········1.·Installing_and_Maintaining_Software |
| 86 | ·········2.·Account_and_Access_Control | 86 | ·········2.·Account_and_Access_Control |
| 87 | ·········3.·System_Accounting_with_auditd | 87 | ·········3.·System_Accounting_with_auditd |
| 88 | ·········4.·GRUB2_bootloader_configuration | 88 | ·········4.·GRUB2_bootloader_configuration |
| 89 | ·········5.·Configure_Syslog | 89 | ·········5.·Configure_Syslog |
| Offset 122, 14 lines modified | Offset 122, 24 lines modified | ||
| 122 | $·sudo·yum·reinstall·PACKAGENAME | 122 | $·sudo·yum·reinstall·PACKAGENAME |
| 123 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 123 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 124 | $·sudo·rpm·-Uvh·PACKAGENAME | 124 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 125 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 125 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 126 | Severity: ················high | 126 | Severity: ················high |
| 127 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 127 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 128 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 128 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 129 | Remediation_Shell_script_⇲ | ||
| 130 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 131 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 132 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 133 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 134 | yum·reinstall·-y·$packages_to_reinstall | ||
| 129 | Remediation_Ansible_snippet_⇲ | 135 | Remediation_Ansible_snippet_⇲ |
| 130 | Complexity:·high | 136 | Complexity:·high |
| 131 | Disruption:·medium | 137 | Disruption:·medium |
| 132 | Strategy:···restrict | 138 | Strategy:···restrict |
| 133 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 139 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 134 | ··set_fact: | 140 | ··set_fact: |
| 135 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 141 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 273, 37 lines modified | Offset 283, 56 lines modified | ||
| 273 | ··-·PCI-DSS-Req-11.5 | 283 | ··-·PCI-DSS-Req-11.5 |
| 274 | ··-·high_complexity | 284 | ··-·high_complexity |
| 275 | ··-·high_severity | 285 | ··-·high_severity |
| 276 | ··-·medium_disruption | 286 | ··-·medium_disruption |
| 277 | ··-·no_reboot_needed | 287 | ··-·no_reboot_needed |
| 278 | ··-·restrict_strategy | 288 | ··-·restrict_strategy |
| 279 | ··-·rpm_verify_hashes | 289 | ··-·rpm_verify_hashes |
| 280 | Remediation_Shell_script_⇲ | ||
| 281 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 282 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 283 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 284 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 285 | yum·reinstall·-y·$packages_to_reinstall | ||
| 286 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 290 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 287 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 291 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 288 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 292 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 289 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 293 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 290 | $·rpm·-qf·FILENAME | 294 | $·rpm·-qf·FILENAME |
| 291 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 295 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 292 | $·sudo·rpm·--setperms·PACKAGENAME | 296 | $·sudo·rpm·--setperms·PACKAGENAME |
| 293 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 297 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 294 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 298 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 295 | Severity: ················high | 299 | Severity: ················high |
| 296 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 300 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 297 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 301 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 302 | Remediation_Shell_script_⇲ | ||
| 303 | Complexity:·high | ||
| 304 | Disruption:·medium | ||
| 305 | Strategy:···restrict | ||
| 306 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 307 | declare·-A·SETPERMS_RPM_DICT | ||
| 308 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 309 | #·is·expected·by·the·RPM·database | ||
| 310 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 311 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 312 | do | ||
| 313 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 314 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 315 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 316 | ········do | ||
| 317 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 318 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 319 | ········done | ||
| 320 | done | ||
| 321 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 322 | #·correct·values | ||
| 323 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 324 | do | ||
| 325 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 326 | done | ||
| 298 | Remediation_Ansible_snippet_⇲ | 327 | Remediation_Ansible_snippet_⇲ |
| 299 | Complexity:·high | 328 | Complexity:·high |
| 300 | Disruption:·medium | 329 | Disruption:·medium |
| 301 | Strategy:···restrict | 330 | Strategy:···restrict |
| 302 | -·name:·Read·list·of·files·with·incorrect·permissions | 331 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 303 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 332 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 304 | ····--nocaps·--nolinkto·--nouser·--nogroup | 333 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 377, 43 lines modified | Offset 406, 14 lines modified | ||
| 377 | ··-·PCI-DSS-Req-11.5 | 406 | ··-·PCI-DSS-Req-11.5 |
| 378 | ··-·high_complexity | 407 | ··-·high_complexity |
| 379 | ··-·high_severity | 408 | ··-·high_severity |
| 380 | ··-·medium_disruption | 409 | ··-·medium_disruption |
| 381 | ··-·no_reboot_needed | 410 | ··-·no_reboot_needed |
| 382 | ··-·restrict_strategy | 411 | ··-·restrict_strategy |
| 383 | ··-·rpm_verify_permissions | 412 | ··-·rpm_verify_permissions |
| 384 | Remediation_Shell_script_⇲ | ||
| 385 | Complexity:·high | ||
| 386 | Disruption:·medium | ||
| 387 | Strategy:···restrict | ||
| 388 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 389 | declare·-A·SETPERMS_RPM_DICT | ||
| 390 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 391 | #·is·expected·by·the·RPM·database | ||
| 392 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1253614/1261854 bytes (99.35%) of diff not shown. | |||
| Offset 14561, 15 lines modified | Offset 14561, 15 lines modified | ||
| 00038e00:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00038e00:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00038e10:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00038e10:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00038e20:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00038e20:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00038e30:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00038e30:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00038e40:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00038e40:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00038e50:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00038e50:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00038e60:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00038e60:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00038e70:·6620·3230·323 | 00038e70:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00038e80:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00038e80:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00038e90:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00038e90:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00038ea0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00038ea0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00038eb0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00038eb0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00038ec0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00038ec0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00038ed0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00038ed0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00038ee0:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00038ee0:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15522, 323 lines modified | Offset 15522, 323 lines modified | ||
| 0003ca10:·7267·6574·3d22·2369·646d·3831·3833·2220··rget="#idm8183"· | 0003ca10:·7267·6574·3d22·2369·646d·3831·3833·2220··rget="#idm8183"· | ||
| 0003ca20:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003ca20:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003ca30:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003ca30:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003ca40:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003ca40:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003ca50:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003ca50:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003ca60:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003ca60:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003ca70:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003ca70:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003ca80:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003ca90:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003caa0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003cab0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003cac0:·643d·2269·646d·3831·3833·223e·3c70·7265··d="idm8183"><pre | |||
| 0003cad0:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003cae0:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003caf0:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003cb00:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003cb10:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003cb20:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003cb30:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003cb40:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003cb50:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003cb60:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003cb70:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003cb80:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003cb90:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003cba0:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003cbb0:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003ca80:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003ca90:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003caa0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003cab0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003cac0:·2220·6964·3d22·6964·6d38·3138·3322·3e3c··"·id="idm8183">< | |||
| 0003cad0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003cae0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003caf0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003cb00:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003cb10:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003cb20:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003cb30:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003cb40:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003cb50:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003cb60:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003cb70:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003cb80:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003cb90:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003cba0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003cbb0:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003cbc0:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003cbd0:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003cbe0:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003cb | 0003cbc0:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003cc00:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003cc10:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003cc20:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003cc30:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003cc40:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003cc50:·733a·0a20·202d·2043·4a49·532d·352e·3130··s:.··-·CJIS-5.10 | |||
| 0003cc60:·2e34·2e31·0a20·202d·204e·4953·542d·3830··.4.1.··-·NIST-80 | |||
| 0003cc70:·302d·3137·312d·332e·332e·380a·2020·2d20··0-171-3.3.8.··-· | |||
| 0003cc80:·4e49·5354·2d38·3030·2d31·3731·2d33·2e34··NIST-800-171-3.4 | |||
| 0003cc90:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003cca0:·3533·2d41·552d·3928·3329·0a20·202d·204e··53-AU-9(3).··-·N | |||
| 0003ccb0:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003ccc0:·6329·0a20·202d·204e·4953·542d·3830·302d··c).··-·NIST-800- | |||
| 0003ccd0:·3533·2d43·4d2d·3628·6429·0a20·202d·204e··53-CM-6(d).··-·N | |||
| 0003cce0:·4953·542d·3830·302d·3533·2d53·492d·370a··IST-800-53-SI-7. | |||
| 0003ccf0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003cd00:·5349·2d37·2831·290a·2020·2d20·4e49·5354··SI-7(1).··-·NIST | |||
| 0003cd10:·2d38·3030·2d35·332d·5349·2d37·2836·290a··-800-53-SI-7(6). | |||
| 0003cd20:·2020·2d20·5043·492d·4453·532d·5265·712d····-·PCI-DSS-Req- | |||
| 0003cd30:·3131·2e35·0a20·202d·2068·6967·685f·636f··11.5.··-·high_co | |||
| 0003cd40:·6d70·6c65·7869·7479·0a20·202d·2068·6967··mplexity.··-·hig | |||
| 0003cd50:·685f·7365·7665·7269·7479·0a20·202d·206d··h_severity.··-·m | |||
| 0003cd60:·6564·6975·6d5f·6469·7372·7570·7469·6f6e··edium_disruption | |||
| 0003cd70:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 0003cd80:·6565·6465·640a·2020·2d20·7265·7374·7269··eeded.··-·restri | |||
| 0003cd90:·6374·5f73·7472·6174·6567·790a·2020·2d20··ct_strategy.··-· | |||
| 0003c | 0003cbd0:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | ||
| 0003cbe0:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003cbf0:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003cc00:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003cc10:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003cc20:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003cc30:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003cc40:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003cc50:·6861·7368·207c·2074·7220·275c·6e27·2027··hash·|·tr·'\n'·' | |||
| 0003cc60:·2027·2922·0a0a·0a79·756d·2072·6569·6e73···')"...yum·reins | |||
| 0003cc70:·7461·6c6c·202d·7920·2470·6163·6b61·6765··tall·-y·$package | |||
| 0003cc80:·735f·746f·5f72·6569·6e73·7461·6c6c·0a3c··s_to_reinstall.< | |||
| 0003cc90:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003cca0:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003ccb0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003ccc0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003ccd0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003cce0:·2223·6964·6d38·3138·3422·2074·6162·696e··"#idm8184"·tabin | |||
| 0003ccf0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003cd00:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003cd10:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003cd20:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003cd30:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003cd40:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003cd50:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003cd60:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003cd70:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003cd80:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003cd90:·2269·646d·3831·3834·223e·3c74·6162·6c65··"idm8184"><table | |||
| 0003cda0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003cdb0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003cdc0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003cdd0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003cde0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| Max diff block lines reached; 9095405/9139757 bytes (99.51%) of diff not shown. | |||
| Offset 73, 15 lines modified | Offset 73, 15 lines modified | ||
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 75 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 75 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 76 | ····*·cpe:/o:redhat:enterprise_linux:8 | 76 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 77 | ····*·cpe:/o:centos:centos:8 | 77 | ····*·cpe:/o:centos:centos:8 |
| 78 | *****·Revision·History·***** | 78 | *****·Revision·History·***** |
| 79 | Current·version:·0.1.65 | 79 | Current·version:·0.1.65 |
| 80 | ····*·draft·(as·of·202 | 80 | ····*·draft·(as·of·2025-02-23) |
| 81 | *****·Table·of·Contents·***** | 81 | *****·Table·of·Contents·***** |
| 82 | ···1.·System_Settings | 82 | ···1.·System_Settings |
| 83 | ·········1.·Installing_and_Maintaining_Software | 83 | ·········1.·Installing_and_Maintaining_Software |
| 84 | ·········2.·Account_and_Access_Control | 84 | ·········2.·Account_and_Access_Control |
| 85 | ·········3.·System_Accounting_with_auditd | 85 | ·········3.·System_Accounting_with_auditd |
| 86 | ·········4.·Configure_Syslog | 86 | ·········4.·Configure_Syslog |
| 87 | ·········5.·Network_Configuration_and_Firewalls | 87 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 122, 14 lines modified | Offset 122, 24 lines modified | ||
| 122 | $·sudo·yum·reinstall·PACKAGENAME | 122 | $·sudo·yum·reinstall·PACKAGENAME |
| 123 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 123 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 124 | $·sudo·rpm·-Uvh·PACKAGENAME | 124 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 125 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 125 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 126 | Severity: ················high | 126 | Severity: ················high |
| 127 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 127 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 128 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 128 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 129 | Remediation_Shell_script_⇲ | ||
| 130 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 131 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 132 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 133 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 134 | yum·reinstall·-y·$packages_to_reinstall | ||
| 129 | Remediation_Ansible_snippet_⇲ | 135 | Remediation_Ansible_snippet_⇲ |
| 130 | Complexity:·high | 136 | Complexity:·high |
| 131 | Disruption:·medium | 137 | Disruption:·medium |
| 132 | Strategy:···restrict | 138 | Strategy:···restrict |
| 133 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 139 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 134 | ··set_fact: | 140 | ··set_fact: |
| 135 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 141 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 273, 36 lines modified | Offset 283, 51 lines modified | ||
| 273 | ··-·PCI-DSS-Req-11.5 | 283 | ··-·PCI-DSS-Req-11.5 |
| 274 | ··-·high_complexity | 284 | ··-·high_complexity |
| 275 | ··-·high_severity | 285 | ··-·high_severity |
| 276 | ··-·medium_disruption | 286 | ··-·medium_disruption |
| 277 | ··-·no_reboot_needed | 287 | ··-·no_reboot_needed |
| 278 | ··-·restrict_strategy | 288 | ··-·restrict_strategy |
| 279 | ··-·rpm_verify_hashes | 289 | ··-·rpm_verify_hashes |
| 280 | Remediation_Shell_script_⇲ | ||
| 281 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 282 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 283 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 284 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 285 | yum·reinstall·-y·$packages_to_reinstall | ||
| 286 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 290 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 287 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 291 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 288 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 292 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 289 | run·the·following·command·to·determine·which·package·owns·it: | 293 | run·the·following·command·to·determine·which·package·owns·it: |
| 290 | $·rpm·-qf·FILENAME | 294 | $·rpm·-qf·FILENAME |
| 291 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 295 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 292 | $·sudo·rpm·--setugids·PACKAGENAME | 296 | $·sudo·rpm·--setugids·PACKAGENAME |
| 293 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 297 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 294 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 298 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 295 | Severity: ················high | 299 | Severity: ················high |
| 296 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 300 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 297 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 301 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 302 | Remediation_Shell_script_⇲ | ||
| 303 | Complexity:·high | ||
| 304 | Disruption:·medium | ||
| 305 | Strategy:···restrict | ||
| 306 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 307 | declare·-A·SETPERMS_RPM_DICT | ||
| 308 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 309 | #·is·expected·by·the·RPM·database | ||
| 310 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 311 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 312 | do | ||
| 313 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 314 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 315 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 316 | done | ||
| 317 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 318 | #·correct·values | ||
| 319 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 320 | do | ||
| 321 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 322 | done | ||
| 298 | Remediation_Ansible_snippet_⇲ | 323 | Remediation_Ansible_snippet_⇲ |
| 299 | Complexity:·high | 324 | Complexity:·high |
| 300 | Disruption:·medium | 325 | Disruption:·medium |
| 301 | Strategy:···restrict | 326 | Strategy:···restrict |
| 302 | -·name:·Read·list·of·files·with·incorrect·ownership | 327 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 303 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 328 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 304 | ····--nocaps·--nolinkto·--nomode | 329 | ····--nocaps·--nolinkto·--nomode |
| Offset 373, 52 lines modified | Offset 398, 56 lines modified | ||
| 373 | ··-·PCI-DSS-Req-11.5 | 398 | ··-·PCI-DSS-Req-11.5 |
| 374 | ··-·high_complexity | 399 | ··-·high_complexity |
| 375 | ··-·high_severity | 400 | ··-·high_severity |
| 376 | ··-·medium_disruption | 401 | ··-·medium_disruption |
| 377 | ··-·no_reboot_needed | 402 | ··-·no_reboot_needed |
| 378 | ··-·restrict_strategy | 403 | ··-·restrict_strategy |
| 379 | ··-·rpm_verify_ownership | 404 | ··-·rpm_verify_ownership |
| 405 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 406 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 407 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 408 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 409 | $·rpm·-qf·FILENAME | ||
| 410 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 411 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 412 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 413 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 414 | Severity: ················high | ||
| 415 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 416 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | ||
| 380 | Remediation_Shell_script_⇲ | 417 | Remediation_Shell_script_⇲ |
| 381 | Complexity:·high | 418 | Complexity:·high |
| 382 | Disruption:·medium | 419 | Disruption:·medium |
| 383 | Strategy:···restrict | 420 | Strategy:···restrict |
| Max diff block lines reached; 949741/959062 bytes (99.03%) of diff not shown. | |||
| Offset 14555, 15 lines modified | Offset 14555, 15 lines modified | ||
| 00038da0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00038da0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00038db0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00038db0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00038dc0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00038dc0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00038dd0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00038dd0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00038de0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00038de0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00038df0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00038df0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00038e00:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00038e00:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00038e10:·3032·3 | 00038e10:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00038e20:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00038e20:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00038e30:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00038e30:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038e40:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038e40:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00038e50:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00038e50:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00038e60:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00038e60:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00038e70:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00038e70:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00038e80:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00038e80:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15498, 191 lines modified | Offset 15498, 191 lines modified | ||
| 0003c890:·6765·743d·2223·6964·6d38·3534·3022·2074··get="#idm8540"·t | 0003c890:·6765·743d·2223·6964·6d38·3534·3022·2074··get="#idm8540"·t | ||
| 0003c8a0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003c8a0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003c8b0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003c8b0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003c8c0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003c8c0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003c8d0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003c8d0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003c8e0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003c8e0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003c8f0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003c8f0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003c900:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003c900:·2041·6e61·636f·6e64·6120·736e·6970·7065···Anaconda·snippe | |||
| 0003c910:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c920:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c930:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c940:·2220·6964·3d22·6964·6d38·3534·3022·3e3c··"·id="idm8540">< | |||
| 0003c950:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c960:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c970:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c980:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c990:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c9a0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003c9b0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c9c0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c9d0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c9e0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003c9f0:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003ca00:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003ca10:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003ca20:·0a70·6163·6b61·6765·202d·2d61·6464·3d61··.package·--add=a | |||
| 0003ca30:·6964·650a·3c2f·636f·6465·3e3c·2f70·7265··ide.</code></pre | |||
| 0003ca40:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003ca50:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003ca60:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003ca70:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003ca80:·7267·6574·3d22·2369·646d·3835·3431·2220··rget="#idm8541"· | |||
| 0003ca90:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003caa0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003cab0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003cac0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003cad0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003cae0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003caf0:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003cb00:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003cb10:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003cb20:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003cb30:·2069·643d·2269·646d·3835·3431·223e·3c74···id="idm8541"><t | |||
| 0003cb40:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003cb50:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003cb60:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003cb70:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003cb80:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003cb90:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003cba0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003cbb0:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003cbc0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003cbd0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003cbe0:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003cbf0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003cc00:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | |||
| 0003cc10:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003cc20:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003cc30:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003cc40:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003cc50:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003cc60:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003cc70:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003cc80:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003cc90:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003cca0:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003ccb0:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003ccc0:·6574·3d22·2369·646d·3835·3432·2220·7461··et="#idm8542"·ta | |||
| 0003ccd0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003cce0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003ccf0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003cd00:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003cd10:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003cd20:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003cd30:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003c | 0003c910:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | ||
| 0003c | 0003c920:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | ||
| 0003c | 0003c930:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | ||
| 0003c | 0003c940:·6964·3d22·6964·6d38·3534·3022·3e3c·7461··id="idm8540"><ta | ||
| 0003c | 0003c950:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | ||
| 0003c | 0003c960:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | ||
| 0003c | 0003c970:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | ||
| 0003c | 0003c980:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | ||
| 0003c | 0003c990:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | ||
| 0003c | 0003c9a0:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | ||
| 0003c | 0003c9b0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003c | 0003c9c0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | ||
| 0003c | 0003c9d0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003c | 0003c9e0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | ||
| 0003c | 0003c9f0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | ||
| 0003c | 0003ca00:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | ||
| 0003c | 0003ca10:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | ||
| 0003ca20:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003ca30:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003ca40:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003ca50:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003ca60:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003ca70:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003ca80:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003ca90:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003caa0:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003cab0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003cac0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003cad0:·743d·2223·6964·6d38·3534·3122·2074·6162··t="#idm8541"·tab | |||
| 0003cae0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003caf0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003cb00:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003cb10:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003cb20:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003cb30:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | |||
| Max diff block lines reached; 8371594/8397730 bytes (99.69%) of diff not shown. | |||
| Offset 71, 15 lines modified | Offset 71, 15 lines modified | ||
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 72 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 72 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 73 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 73 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 74 | ····*·cpe:/o:redhat:enterprise_linux:8 | 74 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 75 | ····*·cpe:/o:centos:centos:8 | 75 | ····*·cpe:/o:centos:centos:8 |
| 76 | *****·Revision·History·***** | 76 | *****·Revision·History·***** |
| 77 | Current·version:·0.1.65 | 77 | Current·version:·0.1.65 |
| 78 | ····*·draft·(as·of·202 | 78 | ····*·draft·(as·of·2025-02-23) |
| 79 | *****·Table·of·Contents·***** | 79 | *****·Table·of·Contents·***** |
| 80 | ···1.·System_Settings | 80 | ···1.·System_Settings |
| 81 | ·········1.·Installing_and_Maintaining_Software | 81 | ·········1.·Installing_and_Maintaining_Software |
| 82 | ·········2.·Account_and_Access_Control | 82 | ·········2.·Account_and_Access_Control |
| 83 | ·········3.·System_Accounting_with_auditd | 83 | ·········3.·System_Accounting_with_auditd |
| 84 | ·········4.·GRUB2_bootloader_configuration | 84 | ·········4.·GRUB2_bootloader_configuration |
| 85 | ·········5.·zIPL_bootloader_configuration | 85 | ·········5.·zIPL_bootloader_configuration |
| Offset 113, 31 lines modified | Offset 113, 39 lines modified | ||
| 113 | ***·Rule ·Install·AIDE· [ref]·*** | 113 | ***·Rule ·Install·AIDE· [ref]·*** |
| 114 | The·aide·package·can·be·installed·with·the·following·command: | 114 | The·aide·package·can·be·installed·with·the·following·command: |
| 115 | $·sudo·yum·install·aide | 115 | $·sudo·yum·install·aide |
| 116 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 116 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 117 | Severity: ················medium | 117 | Severity: ················medium |
| 118 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 118 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 119 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 119 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 120 | Remediation_Anaconda_snippet_⇲ | ||
| 121 | Complexity:·low | ||
| 122 | Disruption:·low | ||
| 123 | Strategy:···enable | ||
| 124 | package·--add=aide | ||
| 125 | Remediation_Puppet_snippet_⇲ | 120 | Remediation_Puppet_snippet_⇲ |
| 126 | Complexity:·low | 121 | Complexity:·low |
| 127 | Disruption:·low | 122 | Disruption:·low |
| 128 | Strategy:···enable | 123 | Strategy:···enable |
| 129 | include·install_aide | 124 | include·install_aide |
| 130 | class·install_aide·{ | 125 | class·install_aide·{ |
| 131 | ··package·{·'aide': | 126 | ··package·{·'aide': |
| 132 | ····ensure·=>·'installed', | 127 | ····ensure·=>·'installed', |
| 133 | ··} | 128 | ··} |
| 134 | } | 129 | } |
| 130 | Remediation_Shell_script_⇲ | ||
| 131 | Complexity:·low | ||
| 132 | Disruption:·low | ||
| 133 | Strategy:···enable | ||
| 134 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 135 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 136 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 137 | ····yum·install·-y·"aide" | ||
| 138 | fi | ||
| 139 | else | ||
| 140 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 141 | fi | ||
| 135 | Remediation_Ansible_snippet_⇲ | 142 | Remediation_Ansible_snippet_⇲ |
| 136 | Complexity:·low | 143 | Complexity:·low |
| 137 | Disruption:·low | 144 | Disruption:·low |
| 138 | Strategy:···enable | 145 | Strategy:···enable |
| 139 | -·name:·Ensure·aide·is·installed | 146 | -·name:·Ensure·aide·is·installed |
| 140 | ··package: | 147 | ··package: |
| 141 | ····name:·aide | 148 | ····name:·aide |
| Offset 155, 28 lines modified | Offset 163, 20 lines modified | ||
| 155 | ··-·no_reboot_needed | 163 | ··-·no_reboot_needed |
| 156 | ··-·package_aide_installed | 164 | ··-·package_aide_installed |
| 157 | Remediation_OSBuild_Blueprint_snippet_⇲ | 165 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 158 | [[packages]] | 166 | [[packages]] |
| 159 | name·=·"aide" | 167 | name·=·"aide" |
| 160 | version·=·"*" | 168 | version·=·"*" |
| 161 | Remediation_ | 169 | Remediation_Anaconda_snippet_⇲ |
| 162 | Complexity:·low | 170 | Complexity:·low |
| 163 | Disruption:·low | 171 | Disruption:·low |
| 164 | Strategy:···enable | 172 | Strategy:···enable |
| 165 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 166 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 173 | package·--add=aide | ||
| 167 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 168 | ····yum·install·-y·"aide" | ||
| 169 | fi | ||
| 170 | else | ||
| 171 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 172 | fi | ||
| 173 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 174 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 174 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 175 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 175 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. | 176 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. |
| 176 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 177 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 177 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 178 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 185, 14 lines modified | Offset 185, 27 lines modified | ||
| 185 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 185 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 186 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 186 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 187 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 187 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 188 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 188 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 189 | Severity: ················high | 189 | Severity: ················high |
| 190 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 190 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 191 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·SV-230223r792855_rule | 191 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·SV-230223r792855_rule |
| 192 | Remediation_Shell_script_⇲ | ||
| 193 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 194 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 195 | fips-mode-setup·--enable | ||
| 196 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 197 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 198 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 199 | fi | ||
| 200 | else | ||
| 201 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 202 | fi | ||
| 192 | Remediation_Ansible_snippet_⇲ | 203 | Remediation_Ansible_snippet_⇲ |
| 193 | Complexity:·medium | 204 | Complexity:·medium |
| 194 | Disruption:·medium | 205 | Disruption:·medium |
| 195 | Reboot:·····true | 206 | Reboot:·····true |
| 196 | Strategy:···restrict | 207 | Strategy:···restrict |
| 197 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 208 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 198 | ··command:·/usr/bin/fips-mode-setup·--check | 209 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 250, 27 lines modified | Offset 263, 14 lines modified | ||
| 250 | ··-·NIST-800-53-SC-13 | 263 | ··-·NIST-800-53-SC-13 |
| 251 | ··-·enable_dracut_fips_module | 264 | ··-·enable_dracut_fips_module |
| 252 | ··-·high_severity | 265 | ··-·high_severity |
| 253 | ··-·medium_complexity | 266 | ··-·medium_complexity |
| 254 | ··-·medium_disruption | 267 | ··-·medium_disruption |
| 255 | ··-·reboot_required | 268 | ··-·reboot_required |
| 256 | ··-·restrict_strategy | 269 | ··-·restrict_strategy |
| Max diff block lines reached; 1100679/1107926 bytes (99.35%) of diff not shown. | |||
| Offset 14532, 15 lines modified | Offset 14532, 15 lines modified | ||
| 00038c30:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00038c30:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00038c40:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00038c40:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00038c50:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00038c50:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00038c60:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00038c60:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00038c70:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00038c70:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00038c80:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00038c80:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00038c90:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00038c90:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00038ca0:·7320·6f66·2032·3032·3 | 00038ca0:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00038cb0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038cb0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038cc0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00038cc0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00038cd0:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00038cd0:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00038ce0:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00038ce0:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00038cf0:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00038cf0:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00038d00:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00038d00:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00038d10:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00038d10:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15465, 323 lines modified | Offset 15465, 323 lines modified | ||
| 0003c680:·7267·6574·3d22·2369·646d·3831·3833·2220··rget="#idm8183"· | 0003c680:·7267·6574·3d22·2369·646d·3831·3833·2220··rget="#idm8183"· | ||
| 0003c690:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003c690:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003c6a0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003c6a0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003c6b0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003c6b0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003c6c0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003c6c0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003c6d0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003c6d0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003c6e0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003c6e0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003c6f0:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003c700:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c710:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c720:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c730:·643d·2269·646d·3831·3833·223e·3c70·7265··d="idm8183"><pre | |||
| 0003c740:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003c750:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003c760:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003c770:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003c780:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003c790:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003c7a0:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003c7b0:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003c7c0:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003c7d0:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003c7e0:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003c7f0:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003c800:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003c810:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003c820:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003c6f0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c700:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c710:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c720:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c730:·2220·6964·3d22·6964·6d38·3138·3322·3e3c··"·id="idm8183">< | |||
| 0003c740:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c750:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c760:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c770:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c780:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c790:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003c7a0:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003c7b0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c7c0:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003c7d0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003c7e0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003c7f0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003c800:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c810:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003c820:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003c830:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003c840:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003c850:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003c8 | 0003c830:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003c870:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003c880:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003c890:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003c8a0:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003c8b0:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003c8c0:·733a·0a20·202d·2043·4a49·532d·352e·3130··s:.··-·CJIS-5.10 | |||
| 0003c8d0:·2e34·2e31·0a20·202d·204e·4953·542d·3830··.4.1.··-·NIST-80 | |||
| 0003c8e0:·302d·3137·312d·332e·332e·380a·2020·2d20··0-171-3.3.8.··-· | |||
| 0003c8f0:·4e49·5354·2d38·3030·2d31·3731·2d33·2e34··NIST-800-171-3.4 | |||
| 0003c900:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003c910:·3533·2d41·552d·3928·3329·0a20·202d·204e··53-AU-9(3).··-·N | |||
| 0003c920:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003c930:·6329·0a20·202d·204e·4953·542d·3830·302d··c).··-·NIST-800- | |||
| 0003c940:·3533·2d43·4d2d·3628·6429·0a20·202d·204e··53-CM-6(d).··-·N | |||
| 0003c950:·4953·542d·3830·302d·3533·2d53·492d·370a··IST-800-53-SI-7. | |||
| 0003c960:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c970:·5349·2d37·2831·290a·2020·2d20·4e49·5354··SI-7(1).··-·NIST | |||
| 0003c980:·2d38·3030·2d35·332d·5349·2d37·2836·290a··-800-53-SI-7(6). | |||
| 0003c990:·2020·2d20·5043·492d·4453·532d·5265·712d····-·PCI-DSS-Req- | |||
| 0003c9a0:·3131·2e35·0a20·202d·2068·6967·685f·636f··11.5.··-·high_co | |||
| 0003c9b0:·6d70·6c65·7869·7479·0a20·202d·2068·6967··mplexity.··-·hig | |||
| 0003c9c0:·685f·7365·7665·7269·7479·0a20·202d·206d··h_severity.··-·m | |||
| 0003c9d0:·6564·6975·6d5f·6469·7372·7570·7469·6f6e··edium_disruption | |||
| 0003c9e0:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 0003c9f0:·6565·6465·640a·2020·2d20·7265·7374·7269··eeded.··-·restri | |||
| 0003ca00:·6374·5f73·7472·6174·6567·790a·2020·2d20··ct_strategy.··-· | |||
| 0003c | 0003c840:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | ||
| 0003c850:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003c860:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003c870:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003c880:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003c890:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003c8a0:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003c8b0:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003c8c0:·6861·7368·207c·2074·7220·275c·6e27·2027··hash·|·tr·'\n'·' | |||
| 0003c8d0:·2027·2922·0a0a·0a79·756d·2072·6569·6e73···')"...yum·reins | |||
| 0003c8e0:·7461·6c6c·202d·7920·2470·6163·6b61·6765··tall·-y·$package | |||
| 0003c8f0:·735f·746f·5f72·6569·6e73·7461·6c6c·0a3c··s_to_reinstall.< | |||
| 0003c900:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003c910:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003c920:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003c930:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003c940:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003c950:·2223·6964·6d38·3138·3422·2074·6162·696e··"#idm8184"·tabin | |||
| 0003c960:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003c970:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003c980:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003c990:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003c9a0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003c9b0:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003c9c0:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003c9d0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c9e0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c9f0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003ca00:·2269·646d·3831·3834·223e·3c74·6162·6c65··"idm8184"><table | |||
| 0003ca10:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003ca20:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003ca30:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003ca40:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003ca50:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| Max diff block lines reached; 14990988/15035340 bytes (99.71%) of diff not shown. | |||
| Offset 66, 15 lines modified | Offset 66, 15 lines modified | ||
| 66 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 66 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 67 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 67 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 68 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 68 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 69 | ····*·cpe:/o:redhat:enterprise_linux:8 | 69 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 70 | ····*·cpe:/o:centos:centos:8 | 70 | ····*·cpe:/o:centos:centos:8 |
| 71 | *****·Revision·History·***** | 71 | *****·Revision·History·***** |
| 72 | Current·version:·0.1.65 | 72 | Current·version:·0.1.65 |
| 73 | ····*·draft·(as·of·202 | 73 | ····*·draft·(as·of·2025-02-23) |
| 74 | *****·Table·of·Contents·***** | 74 | *****·Table·of·Contents·***** |
| 75 | ···1.·System_Settings | 75 | ···1.·System_Settings |
| 76 | ·········1.·Installing_and_Maintaining_Software | 76 | ·········1.·Installing_and_Maintaining_Software |
| 77 | ·········2.·Account_and_Access_Control | 77 | ·········2.·Account_and_Access_Control |
| 78 | ·········3.·System_Accounting_with_auditd | 78 | ·········3.·System_Accounting_with_auditd |
| 79 | ·········4.·GRUB2_bootloader_configuration | 79 | ·········4.·GRUB2_bootloader_configuration |
| 80 | ·········5.·Configure_Syslog | 80 | ·········5.·Configure_Syslog |
| Offset 109, 14 lines modified | Offset 109, 24 lines modified | ||
| 109 | $·sudo·yum·reinstall·PACKAGENAME | 109 | $·sudo·yum·reinstall·PACKAGENAME |
| 110 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 110 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 111 | $·sudo·rpm·-Uvh·PACKAGENAME | 111 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 112 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 112 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 113 | Severity: ················high | 113 | Severity: ················high |
| 114 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 114 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 115 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 115 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 116 | Remediation_Shell_script_⇲ | ||
| 117 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 118 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 119 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 120 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 121 | yum·reinstall·-y·$packages_to_reinstall | ||
| 116 | Remediation_Ansible_snippet_⇲ | 122 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·high | 123 | Complexity:·high |
| 118 | Disruption:·medium | 124 | Disruption:·medium |
| 119 | Strategy:···restrict | 125 | Strategy:···restrict |
| 120 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 126 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 121 | ··set_fact: | 127 | ··set_fact: |
| 122 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 128 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 260, 37 lines modified | Offset 270, 56 lines modified | ||
| 260 | ··-·PCI-DSS-Req-11.5 | 270 | ··-·PCI-DSS-Req-11.5 |
| 261 | ··-·high_complexity | 271 | ··-·high_complexity |
| 262 | ··-·high_severity | 272 | ··-·high_severity |
| 263 | ··-·medium_disruption | 273 | ··-·medium_disruption |
| 264 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 265 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 266 | ··-·rpm_verify_hashes | 276 | ··-·rpm_verify_hashes |
| 267 | Remediation_Shell_script_⇲ | ||
| 268 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 269 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 270 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 271 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 272 | yum·reinstall·-y·$packages_to_reinstall | ||
| 273 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 277 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 274 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 278 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 275 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 279 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 276 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 280 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 277 | $·rpm·-qf·FILENAME | 281 | $·rpm·-qf·FILENAME |
| 278 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 282 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 279 | $·sudo·rpm·--setperms·PACKAGENAME | 283 | $·sudo·rpm·--setperms·PACKAGENAME |
| 280 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 284 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 281 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 285 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 282 | Severity: ················high | 286 | Severity: ················high |
| 283 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 287 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 284 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 288 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 289 | Remediation_Shell_script_⇲ | ||
| 290 | Complexity:·high | ||
| 291 | Disruption:·medium | ||
| 292 | Strategy:···restrict | ||
| 293 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 294 | declare·-A·SETPERMS_RPM_DICT | ||
| 295 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 296 | #·is·expected·by·the·RPM·database | ||
| 297 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 298 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 299 | do | ||
| 300 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 301 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 302 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 303 | ········do | ||
| 304 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 305 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 306 | ········done | ||
| 307 | done | ||
| 308 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 309 | #·correct·values | ||
| 310 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 311 | do | ||
| 312 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 313 | done | ||
| 285 | Remediation_Ansible_snippet_⇲ | 314 | Remediation_Ansible_snippet_⇲ |
| 286 | Complexity:·high | 315 | Complexity:·high |
| 287 | Disruption:·medium | 316 | Disruption:·medium |
| 288 | Strategy:···restrict | 317 | Strategy:···restrict |
| 289 | -·name:·Read·list·of·files·with·incorrect·permissions | 318 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 290 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 319 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 291 | ····--nocaps·--nolinkto·--nouser·--nogroup | 320 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 364, 69 lines modified | Offset 393, 48 lines modified | ||
| 364 | ··-·PCI-DSS-Req-11.5 | 393 | ··-·PCI-DSS-Req-11.5 |
| 365 | ··-·high_complexity | 394 | ··-·high_complexity |
| 366 | ··-·high_severity | 395 | ··-·high_severity |
| 367 | ··-·medium_disruption | 396 | ··-·medium_disruption |
| 368 | ··-·no_reboot_needed | 397 | ··-·no_reboot_needed |
| 369 | ··-·restrict_strategy | 398 | ··-·restrict_strategy |
| 370 | ··-·rpm_verify_permissions | 399 | ··-·rpm_verify_permissions |
| 371 | Remediation_Shell_script_⇲ | ||
| 372 | Complexity:·high | ||
| 373 | Disruption:·medium | ||
| 374 | Strategy:···restrict | ||
| 375 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 376 | declare·-A·SETPERMS_RPM_DICT | ||
| 377 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 378 | #·is·expected·by·the·RPM·database | ||
| 379 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1060795/1069032 bytes (99.23%) of diff not shown. | |||
| Offset 14540, 15 lines modified | Offset 14540, 15 lines modified | ||
| 00038cb0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00038cb0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00038cc0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00038cc0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00038cd0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00038cd0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00038ce0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00038ce0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00038cf0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00038cf0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00038d00:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00038d00:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00038d10:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00038d10:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00038d20:·206f·6620·3230·323 | 00038d20:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00038d30:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038d30:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038d40:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00038d40:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00038d50:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00038d50:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00038d60:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00038d60:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00038d70:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00038d70:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00038d80:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00038d80:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00038d90:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00038d90:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15445, 191 lines modified | Offset 15445, 191 lines modified | ||
| 0003c540:·6574·3d22·2369·646d·3835·3430·2220·7461··et="#idm8540"·ta | 0003c540:·6574·3d22·2369·646d·3835·3430·2220·7461··et="#idm8540"·ta | ||
| 0003c550:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003c550:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003c560:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003c560:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003c570:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003c570:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003c580:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003c580:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003c590:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003c590:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003c5a0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003c5a0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003c5b0:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003c5b0:·416e·6163·6f6e·6461·2073·6e69·7070·6574··Anaconda·snippet | |||
| 0003c5c0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003c5d0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003c5e0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003c5f0:·2069·643d·2269·646d·3835·3430·223e·3c74···id="idm8540"><t | |||
| 0003c600:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003c610:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003c620:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003c630:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c640:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c650:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003c660:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c670:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003c680:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c690:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c6a0:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003c6b0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003c6c0:·626c·653e·3c70·7265·3e3c·636f·6465·3e0a··ble><pre><code>. | |||
| 0003c6d0:·7061·636b·6167·6520·2d2d·6164·643d·6169··package·--add=ai | |||
| 0003c6e0:·6465·0a3c·2f63·6f64·653e·3c2f·7072·653e··de.</code></pre> | |||
| 0003c6f0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c700:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003c710:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003c720:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003c730:·6765·743d·2223·6964·6d38·3534·3122·2074··get="#idm8541"·t | |||
| 0003c740:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c750:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c760:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c770:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c780:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003c790:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003c7a0:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003c7b0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c7c0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c7d0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c7e0:·6964·3d22·6964·6d38·3534·3122·3e3c·7461··id="idm8541"><ta | |||
| 0003c7f0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c800:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c810:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c820:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c830:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c840:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003c850:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c860:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003c870:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c880:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003c890:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003c8a0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003c8b0:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | |||
| 0003c8c0:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003c8d0:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003c8e0:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003c8f0:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003c900:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003c910:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003c920:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c930:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c940:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c950:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c960:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003c970:·743d·2223·6964·6d38·3534·3222·2074·6162··t="#idm8542"·tab | |||
| 0003c980:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003c990:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003c9a0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003c9b0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003c9c0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003c9d0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003c9e0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003c | 0003c5c0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | ||
| 0003c | 0003c5d0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | ||
| 0003c | 0003c5e0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | ||
| 0003c | 0003c5f0:·643d·2269·646d·3835·3430·223e·3c74·6162··d="idm8540"><tab | ||
| 0003c | 0003c600:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | ||
| 0003c | 0003c610:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | ||
| 0003c | 0003c620:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | ||
| 0003c | 0003c630:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | ||
| 0003c | 0003c640:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | ||
| 0003c | 0003c650:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | ||
| 0003c | 0003c660:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | ||
| 0003c | 0003c670:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | ||
| 0003c | 0003c680:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003c | 0003c690:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | ||
| 0003c | 0003c6a0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | ||
| 0003c | 0003c6b0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003c | 0003c6c0:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | ||
| 0003c6d0:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003c6e0:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003c6f0:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003c700:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003c710:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003c720:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003c730:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c740:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c750:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c760:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c770:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c780:·3d22·2369·646d·3835·3431·2220·7461·6269··="#idm8541"·tabi | |||
| 0003c790:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c7a0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c7b0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c7c0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c7d0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c7e0:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | |||
| Max diff block lines reached; 2553268/2579404 bytes (98.99%) of diff not shown. | |||
| Offset 68, 15 lines modified | Offset 68, 15 lines modified | ||
| 68 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 68 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 69 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 69 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 70 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 70 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 72 | ····*·cpe:/o:centos:centos:8 | 72 | ····*·cpe:/o:centos:centos:8 |
| 73 | *****·Revision·History·***** | 73 | *****·Revision·History·***** |
| 74 | Current·version:·0.1.65 | 74 | Current·version:·0.1.65 |
| 75 | ····*·draft·(as·of·202 | 75 | ····*·draft·(as·of·2025-02-23) |
| 76 | *****·Table·of·Contents·***** | 76 | *****·Table·of·Contents·***** |
| 77 | ···1.·System_Settings | 77 | ···1.·System_Settings |
| 78 | ·········1.·Installing_and_Maintaining_Software | 78 | ·········1.·Installing_and_Maintaining_Software |
| 79 | ·········2.·Account_and_Access_Control | 79 | ·········2.·Account_and_Access_Control |
| 80 | ·········3.·System_Accounting_with_auditd | 80 | ·········3.·System_Accounting_with_auditd |
| 81 | ·········4.·GRUB2_bootloader_configuration | 81 | ·········4.·GRUB2_bootloader_configuration |
| 82 | ·········5.·Network_Configuration_and_Firewalls | 82 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 103, 31 lines modified | Offset 103, 39 lines modified | ||
| 103 | ***·Rule ·Install·AIDE· [ref]·*** | 103 | ***·Rule ·Install·AIDE· [ref]·*** |
| 104 | The·aide·package·can·be·installed·with·the·following·command: | 104 | The·aide·package·can·be·installed·with·the·following·command: |
| 105 | $·sudo·yum·install·aide | 105 | $·sudo·yum·install·aide |
| 106 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 106 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 107 | Severity: ················medium | 107 | Severity: ················medium |
| 108 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 108 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 109 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule | 109 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·1.3.1,·SV-251710r854081_rule |
| 110 | Remediation_Anaconda_snippet_⇲ | ||
| 111 | Complexity:·low | ||
| 112 | Disruption:·low | ||
| 113 | Strategy:···enable | ||
| 114 | package·--add=aide | ||
| 115 | Remediation_Puppet_snippet_⇲ | 110 | Remediation_Puppet_snippet_⇲ |
| 116 | Complexity:·low | 111 | Complexity:·low |
| 117 | Disruption:·low | 112 | Disruption:·low |
| 118 | Strategy:···enable | 113 | Strategy:···enable |
| 119 | include·install_aide | 114 | include·install_aide |
| 120 | class·install_aide·{ | 115 | class·install_aide·{ |
| 121 | ··package·{·'aide': | 116 | ··package·{·'aide': |
| 122 | ····ensure·=>·'installed', | 117 | ····ensure·=>·'installed', |
| 123 | ··} | 118 | ··} |
| 124 | } | 119 | } |
| 120 | Remediation_Shell_script_⇲ | ||
| 121 | Complexity:·low | ||
| 122 | Disruption:·low | ||
| 123 | Strategy:···enable | ||
| 124 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 125 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 126 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 127 | ····yum·install·-y·"aide" | ||
| 128 | fi | ||
| 129 | else | ||
| 130 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 131 | fi | ||
| 125 | Remediation_Ansible_snippet_⇲ | 132 | Remediation_Ansible_snippet_⇲ |
| 126 | Complexity:·low | 133 | Complexity:·low |
| 127 | Disruption:·low | 134 | Disruption:·low |
| 128 | Strategy:···enable | 135 | Strategy:···enable |
| 129 | -·name:·Ensure·aide·is·installed | 136 | -·name:·Ensure·aide·is·installed |
| 130 | ··package: | 137 | ··package: |
| 131 | ····name:·aide | 138 | ····name:·aide |
| Offset 145, 28 lines modified | Offset 153, 20 lines modified | ||
| 145 | ··-·no_reboot_needed | 153 | ··-·no_reboot_needed |
| 146 | ··-·package_aide_installed | 154 | ··-·package_aide_installed |
| 147 | Remediation_OSBuild_Blueprint_snippet_⇲ | 155 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 148 | [[packages]] | 156 | [[packages]] |
| 149 | name·=·"aide" | 157 | name·=·"aide" |
| 150 | version·=·"*" | 158 | version·=·"*" |
| 151 | Remediation_ | 159 | Remediation_Anaconda_snippet_⇲ |
| 152 | Complexity:·low | 160 | Complexity:·low |
| 153 | Disruption:·low | 161 | Disruption:·low |
| 154 | Strategy:···enable | 162 | Strategy:···enable |
| 155 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 156 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 157 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 158 | ····yum·install·-y·"aide" | ||
| 159 | fi | ||
| 163 | package·--add=aide | ||
| 160 | else | ||
| 161 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 162 | fi | ||
| 163 | Group ·System·Cryptographic·Policies· Group·contains·2·rules | 164 | Group ·System·Cryptographic·Policies· Group·contains·2·rules |
| 164 | [ref] ·Linux·has·the·capability·to·centrally·configure·cryptographic·polices.·The·command·update-crypto-policies·is·used·to·set·the·policy·applicable·for·the·various·cryptographic·back-ends,·such·as·SSL/TLS·libraries.·The·configured·cryptographic·policies·will·be·the·default·policy·used·by·these·backends·unless·the·application·user·configures·them·otherwise.·When·the·system·has·been·configured·to·use·the·centralized·cryptographic·policies,·the·administrator·is·assured·that·any·application·that·utilizes·the·supported·backends·will·follow·a·policy·that·adheres·to·the·configured·profile.·Currently·the·supported·backends·are: | 165 | [ref] ·Linux·has·the·capability·to·centrally·configure·cryptographic·polices.·The·command·update-crypto-policies·is·used·to·set·the·policy·applicable·for·the·various·cryptographic·back-ends,·such·as·SSL/TLS·libraries.·The·configured·cryptographic·policies·will·be·the·default·policy·used·by·these·backends·unless·the·application·user·configures·them·otherwise.·When·the·system·has·been·configured·to·use·the·centralized·cryptographic·policies,·the·administrator·is·assured·that·any·application·that·utilizes·the·supported·backends·will·follow·a·policy·that·adheres·to·the·configured·profile.·Currently·the·supported·backends·are: |
| 165 | ····*·GnuTLS·library | 166 | ····*·GnuTLS·library |
| 166 | ····*·OpenSSL·library | 167 | ····*·OpenSSL·library |
| 167 | ····*·NSS·library | 168 | ····*·NSS·library |
| 168 | ····*·OpenJDK | 169 | ····*·OpenJDK |
| 169 | ····*·Libkrb5 | 170 | ····*·Libkrb5 |
| Offset 179, 39 lines modified | Offset 179, 33 lines modified | ||
| 179 | The·rule·checks·if·settings·for·selected·crypto·policy·are·configured·as·expected.·Configuration·files·in·the·/etc/crypto-policies/back-ends·are·either·symlinks·to·correct·files·provided·by·Crypto-policies·package·or·they·are·regular·files·in·case·crypto·policy·customizations·are·applied.·Crypto·policies·may·be·customized·by·crypto·policy·modules,·in·which·case·it·is·delimited·from·the·base·policy·using·a·colon. | 179 | The·rule·checks·if·settings·for·selected·crypto·policy·are·configured·as·expected.·Configuration·files·in·the·/etc/crypto-policies/back-ends·are·either·symlinks·to·correct·files·provided·by·Crypto-policies·package·or·they·are·regular·files·in·case·crypto·policy·customizations·are·applied.·Crypto·policies·may·be·customized·by·crypto·policy·modules,·in·which·case·it·is·delimited·from·the·base·policy·using·a·colon. |
| 180 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 180 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 181 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 181 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 182 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. | 182 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. |
| 183 | Severity: ················high | 183 | Severity: ················high |
| 184 | Rule·ID:···················xccdf_org.ssgproject.content_rule_configure_crypto_policy | 184 | Rule·ID:···················xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 185 | Identifiers·and·References·References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174,·1.10,·1.11,·SV-230223r792855_rule | 185 | Identifiers·and·References·References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174,·1.10,·1.11,·SV-230223r792855_rule |
| 186 | Remediation_Shell_script_⇲ | ||
| 187 | var_system_crypto_policy='FIPS' | ||
| 188 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 189 | rc=$? | ||
| 190 | if·test·"$rc"·=·127;·then | ||
| 191 | » echo·"$stderr_of_call"·>&2 | ||
| 192 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 193 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 194 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 195 | » false··#·end·with·an·error·code | ||
| 196 | elif·test·"$rc"·!=·0;·then | ||
| 197 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 198 | » false··#·end·with·an·error·code | ||
| 199 | fi | ||
| 186 | Remediation_Kubernetes_snippet_⇲ | ||
| 187 | Complexity:·low | ||
| 188 | Disruption:·low | ||
| 189 | Reboot:·····true | ||
| 190 | Strategy:···restrict | ||
| 191 | --- | ||
| 192 | apiVersion:·machineconfiguration.openshift.io/v1 | ||
| 193 | kind:·MachineConfig | ||
| 194 | spec: | ||
| Max diff block lines reached; 329867/337390 bytes (97.77%) of diff not shown. | |||
| Offset 14539, 15 lines modified | Offset 14539, 15 lines modified | ||
| 00038ca0:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038ca0:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038cb0:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038cb0:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038cc0:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038cc0:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00038cd0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00038cd0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00038ce0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00038ce0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 00038cf0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 00038cf0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 00038d00:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 00038d00:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 00038d10:·6f66·2032·3032·3 | 00038d10:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 00038d20:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 00038d20:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 00038d30:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 00038d30:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00038d40:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00038d40:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00038d50:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00038d50:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038d60:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038d60:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038d70:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038d70:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038d80:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038d80:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15453, 323 lines modified | Offset 15453, 323 lines modified | ||
| 0003c5c0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | 0003c5c0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | ||
| 0003c5d0:·3138·3322·2074·6162·696e·6465·783d·2230··183"·tabindex="0 | 0003c5d0:·3138·3322·2074·6162·696e·6465·783d·2230··183"·tabindex="0 | ||
| 0003c5e0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 0003c5e0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 0003c5f0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 0003c5f0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 0003c600:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 0003c600:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 0003c610:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 0003c610:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 0003c620:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 0003c620:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 0003c630:·6961·7469·6f6e·20 | 0003c630:·6961·7469·6f6e·2053·6865·6c6c·2073·6372··iation·Shell·scr | ||
| 0003c640:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c650:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c660:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c670:·6c61·7073·6522·2069·643d·2269·646d·3831··lapse"·id="idm81 | |||
| 0003c680:·3833·223e·3c74·6162·6c65·2063·6c61·7373··83"><table·class | |||
| 0003c690:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c6a0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c6b0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003c6c0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c6d0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003c6e0:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003c6f0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c700:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003c710:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003c720:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c730:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003c740:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003c750:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003c760:·653a·2027·5365·7420·6661·6374·3a20·5061··e:·'Set·fact:·Pa | |||
| 0003c770:·636b·6167·6520·6d61·6e61·6765·7220·7265··ckage·manager·re | |||
| 0003c780:·696e·7374·616c·6c20·636f·6d6d·616e·6420··install·command· | |||
| 0003c790:·2864·6e66·2927·0a20·2073·6574·5f66·6163··(dnf)'.··set_fac | |||
| 0003c7a0:·743a·0a20·2020·2070·6163·6b61·6765·5f6d··t:.····package_m | |||
| 0003c7b0:·616e·6167·6572·5f72·6569·6e73·7461·6c6c··anager_reinstall | |||
| 0003c7c0:·5f63·6d64·3a20·646e·6620·7265·696e·7374··_cmd:·dnf·reinst | |||
| 0003c7d0:·616c·6c20·2d79·0a20·2077·6865·6e3a·2061··all·-y.··when:·a | |||
| 0003c7e0:·6e73·6962·6c65·5f64·6973·7472·6962·7574··nsible_distribut | |||
| 0003c7f0:·696f·6e20·3d3d·2022·4665·646f·7261·220a··ion·==·"Fedora". | |||
| 0003c800:·2020·7461·6773·3a0a·2020·2d20·434a·4953····tags:.··-·CJIS | |||
| 0003c810:·2d35·2e31·302e·342e·310a·2020·2d20·4e49··-5.10.4.1.··-·NI | |||
| 0003c820:·5354·2d38·3030·2d31·3731·2d33·2e33·2e38··ST-800-171-3.3.8 | |||
| 0003c830:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | |||
| 0003c840:·312d·332e·342e·310a·2020·2d20·4e49·5354··1-3.4.1.··-·NIST | |||
| 0003c850:·2d38·3030·2d35·332d·4155·2d39·2833·290a··-800-53-AU-9(3). | |||
| 0003c860:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c870:·434d·2d36·2863·290a·2020·2d20·4e49·5354··CM-6(c).··-·NIST | |||
| 0003c880:·2d38·3030·2d35·332d·434d·2d36·2864·290a··-800-53-CM-6(d). | |||
| 0003c890:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c8a0:·5349·2d37·0a20·202d·204e·4953·542d·3830··SI-7.··-·NIST-80 | |||
| 0003c8b0:·302d·3533·2d53·492d·3728·3129·0a20·202d··0-53-SI-7(1).··- | |||
| 0003c8c0:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003c8d0:·3728·3629·0a20·202d·2050·4349·2d44·5353··7(6).··-·PCI-DSS | |||
| 0003c8e0:·2d52·6571·2d31·312e·350a·2020·2d20·6869··-Req-11.5.··-·hi | |||
| 0003c8f0:·6768·5f63·6f6d·706c·6578·6974·790a·2020··gh_complexity.·· | |||
| 0003c900:·2d20·6869·6768·5f73·6576·6572·6974·790a··-·high_severity. | |||
| 0003c910:·2020·2d20·6d65·6469·756d·5f64·6973·7275····-·medium_disru | |||
| 0003c920:·7074·696f·6e0a·2020·2d20·6e6f·5f72·6562··ption.··-·no_reb | |||
| 0003c930:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 0003c940:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 0003c950:·0a20·202d·2072·706d·5f76·6572·6966·795f··.··-·rpm_verify_ | |||
| 0003c | 0003c640:·6970·7420·e287·b23c·2f61·3e3c·6272·3e3c··ipt·...</a><br>< | ||
| 0003c650:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c660:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c670:·7365·2220·6964·3d22·6964·6d38·3138·3322··se"·id="idm8183" | |||
| 0003c680:·3e3c·7072·653e·3c63·6f64·653e·0a23·2046··><pre><code>.#·F | |||
| 0003c690:·696e·6420·7768·6963·6820·6669·6c65·7320··ind·which·files· | |||
| 0003c6a0:·6861·7665·2069·6e63·6f72·7265·6374·2068··have·incorrect·h | |||
| 0003c6b0:·6173·6820·286e·6f74·2069·6e20·2f65·7463··ash·(not·in·/etc | |||
| 0003c6c0:·2c20·6265·6361·7573·6520·6f66·2074·6865··,·because·of·the | |||
| 0003c6d0:·2073·7973·7465·6d20·7265·6c61·7465·6420···system·related· | |||
| 0003c6e0:·636f·6e66·6967·2066·696c·6573·2920·616e··config·files)·an | |||
| 0003c6f0:·6420·7468·656e·2067·6574·2066·696c·6573··d·then·get·files | |||
| 0003c700:·206e·616d·6573·0a66·696c·6573·5f77·6974···names.files_wit | |||
| 0003c710:·685f·696e·636f·7272·6563·745f·6861·7368··h_incorrect_hash | |||
| 0003c720:·3d22·2428·7270·6d20·2d56·6120·2d2d·6e6f··="$(rpm·-Va·--no | |||
| 0003c730:·636f·6e66·6967·207c·2067·7265·7020·2d45··config·|·grep·-E | |||
| 0003c740:·2027·5e2e·2e35·2720·7c20·6177·6b20·277b···'^..5'·|·awk·'{ | |||
| 0003c750:·7072·696e·7420·244e·467d·2720·2922·0a0a··print·$NF}'·)".. | |||
| 0003c760:·2320·4672·6f6d·2066·696c·6573·206e·616d··#·From·files·nam | |||
| 0003c770:·6573·2067·6574·2070·6163·6b61·6765·206e··es·get·package·n | |||
| 0003c780:·616d·6573·2061·6e64·2063·6861·6e67·6520··ames·and·change· | |||
| 0003c790:·6e65·776c·696e·6520·746f·2073·7061·6365··newline·to·space | |||
| 0003c7a0:·2c20·6265·6361·7573·6520·7270·6d20·7772··,·because·rpm·wr | |||
| 0003c7b0:·6974·6573·2065·6163·6820·7061·636b·6167··ites·each·packag | |||
| 0003c7c0:·6520·746f·206e·6577·206c·696e·650a·7061··e·to·new·line.pa | |||
| 0003c7d0:·636b·6167·6573·5f74·6f5f·7265·696e·7374··ckages_to_reinst | |||
| 0003c7e0:·616c·6c3d·2224·2872·706d·202d·7166·2024··all="$(rpm·-qf·$ | |||
| 0003c7f0:·6669·6c65·735f·7769·7468·5f69·6e63·6f72··files_with_incor | |||
| 0003c800:·7265·6374·5f68·6173·6820·7c20·7472·2027··rect_hash·|·tr·' | |||
| 0003c810:·5c6e·2720·2720·2729·220a·0a0a·7975·6d20··\n'·'·')"...yum· | |||
| 0003c820:·7265·696e·7374·616c·6c20·2d79·2024·7061··reinstall·-y·$pa | |||
| 0003c830:·636b·6167·6573·5f74·6f5f·7265·696e·7374··ckages_to_reinst | |||
| 0003c840:·616c·6c0a·3c2f·636f·6465·3e3c·2f70·7265··all.</code></pre | |||
| 0003c850:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c860:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c870:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c880:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c890:·7267·6574·3d22·2369·646d·3831·3834·2220··rget="#idm8184"· | |||
| 0003c8a0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c8b0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c8c0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c8d0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c8e0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c8f0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003c900:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c910:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c920:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c930:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c940:·2220·6964·3d22·6964·6d38·3138·3422·3e3c··"·id="idm8184">< | |||
| 0003c950:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c960:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c970:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c980:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| Max diff block lines reached; 7401447/7445799 bytes (99.40%) of diff not shown. | |||
| Offset 68, 15 lines modified | Offset 68, 15 lines modified | ||
| 68 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 68 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 69 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 69 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 70 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 70 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:8 | 71 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 72 | ····*·cpe:/o:centos:centos:8 | 72 | ····*·cpe:/o:centos:centos:8 |
| 73 | *****·Revision·History·***** | 73 | *****·Revision·History·***** |
| 74 | Current·version:·0.1.65 | 74 | Current·version:·0.1.65 |
| 75 | ····*·draft·(as·of·202 | 75 | ····*·draft·(as·of·2025-02-23) |
| 76 | *****·Table·of·Contents·***** | 76 | *****·Table·of·Contents·***** |
| 77 | ···1.·System_Settings | 77 | ···1.·System_Settings |
| 78 | ·········1.·Installing_and_Maintaining_Software | 78 | ·········1.·Installing_and_Maintaining_Software |
| 79 | ·········2.·Account_and_Access_Control | 79 | ·········2.·Account_and_Access_Control |
| 80 | ·········3.·System_Accounting_with_auditd | 80 | ·········3.·System_Accounting_with_auditd |
| 81 | ·········4.·Configure_Syslog | 81 | ·········4.·Configure_Syslog |
| 82 | ·········5.·File_Permissions_and_Masks | 82 | ·········5.·File_Permissions_and_Masks |
| Offset 108, 14 lines modified | Offset 108, 24 lines modified | ||
| 108 | $·sudo·yum·reinstall·PACKAGENAME | 108 | $·sudo·yum·reinstall·PACKAGENAME |
| 109 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 109 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 110 | $·sudo·rpm·-Uvh·PACKAGENAME | 110 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 111 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 111 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 112 | Severity: ················high | 112 | Severity: ················high |
| 113 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 113 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 114 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 114 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 115 | Remediation_Shell_script_⇲ | ||
| 116 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 117 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 118 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 119 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 120 | yum·reinstall·-y·$packages_to_reinstall | ||
| 115 | Remediation_Ansible_snippet_⇲ | 121 | Remediation_Ansible_snippet_⇲ |
| 116 | Complexity:·high | 122 | Complexity:·high |
| 117 | Disruption:·medium | 123 | Disruption:·medium |
| 118 | Strategy:···restrict | 124 | Strategy:···restrict |
| 119 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 125 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 120 | ··set_fact: | 126 | ··set_fact: |
| 121 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 127 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 259, 37 lines modified | Offset 269, 56 lines modified | ||
| 259 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 260 | ··-·high_complexity | 270 | ··-·high_complexity |
| 261 | ··-·high_severity | 271 | ··-·high_severity |
| 262 | ··-·medium_disruption | 272 | ··-·medium_disruption |
| 263 | ··-·no_reboot_needed | 273 | ··-·no_reboot_needed |
| 264 | ··-·restrict_strategy | 274 | ··-·restrict_strategy |
| 265 | ··-·rpm_verify_hashes | 275 | ··-·rpm_verify_hashes |
| 266 | Remediation_Shell_script_⇲ | ||
| 267 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 268 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 269 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 270 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 271 | yum·reinstall·-y·$packages_to_reinstall | ||
| 272 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 276 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 273 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 277 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 274 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 278 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 275 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 279 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 276 | $·rpm·-qf·FILENAME | 280 | $·rpm·-qf·FILENAME |
| 277 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 281 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 278 | $·sudo·rpm·--setperms·PACKAGENAME | 282 | $·sudo·rpm·--setperms·PACKAGENAME |
| 279 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 283 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 280 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 284 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 281 | Severity: ················high | 285 | Severity: ················high |
| 282 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 286 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 283 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 287 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 288 | Remediation_Shell_script_⇲ | ||
| 289 | Complexity:·high | ||
| 290 | Disruption:·medium | ||
| 291 | Strategy:···restrict | ||
| 292 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 293 | declare·-A·SETPERMS_RPM_DICT | ||
| 294 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 295 | #·is·expected·by·the·RPM·database | ||
| 296 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 297 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 298 | do | ||
| 299 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 300 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 301 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 302 | ········do | ||
| 303 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 304 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 305 | ········done | ||
| 306 | done | ||
| 307 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 308 | #·correct·values | ||
| 309 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 310 | do | ||
| 311 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 312 | done | ||
| 284 | Remediation_Ansible_snippet_⇲ | 313 | Remediation_Ansible_snippet_⇲ |
| 285 | Complexity:·high | 314 | Complexity:·high |
| 286 | Disruption:·medium | 315 | Disruption:·medium |
| 287 | Strategy:···restrict | 316 | Strategy:···restrict |
| 288 | -·name:·Read·list·of·files·with·incorrect·permissions | 317 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 289 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 318 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 290 | ····--nocaps·--nolinkto·--nouser·--nogroup | 319 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 363, 43 lines modified | Offset 392, 14 lines modified | ||
| 363 | ··-·PCI-DSS-Req-11.5 | 392 | ··-·PCI-DSS-Req-11.5 |
| 364 | ··-·high_complexity | 393 | ··-·high_complexity |
| 365 | ··-·high_severity | 394 | ··-·high_severity |
| 366 | ··-·medium_disruption | 395 | ··-·medium_disruption |
| 367 | ··-·no_reboot_needed | 396 | ··-·no_reboot_needed |
| 368 | ··-·restrict_strategy | 397 | ··-·restrict_strategy |
| 369 | ··-·rpm_verify_permissions | 398 | ··-·rpm_verify_permissions |
| 370 | Remediation_Shell_script_⇲ | ||
| 371 | Complexity:·high | ||
| 372 | Disruption:·medium | ||
| 373 | Strategy:···restrict | ||
| 374 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 375 | declare·-A·SETPERMS_RPM_DICT | ||
| 376 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 377 | #·is·expected·by·the·RPM·database | ||
| 378 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 573100/581336 bytes (98.58%) of diff not shown. | |||
| Offset 14558, 16 lines modified | Offset 14558, 16 lines modified | ||
| 00038dd0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00038dd0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00038de0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00038de0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00038df0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00038df0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00038e00:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00038e00:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00038e10:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00038e10:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00038e20:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00038e20:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00038e30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038e30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038e40:·2020·2020·2028·6173·206f·6620·3230·323 | 00038e40:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00038e50:·2d30·3 | 00038e50:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00038e60:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00038e60:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00038e70:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00038e70:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00038e80:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00038e80:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00038e90:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00038e90:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00038ea0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00038ea0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00038eb0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00038eb0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00038ec0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00038ec0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 15522, 192 lines modified | Offset 15522, 192 lines modified | ||
| 0003ca10:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003ca10:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003ca20:·6964·6d38·3534·3022·2074·6162·696e·6465··idm8540"·tabinde | 0003ca20:·6964·6d38·3534·3022·2074·6162·696e·6465··idm8540"·tabinde | ||
| 0003ca30:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003ca30:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003ca40:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003ca40:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003ca50:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003ca50:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003ca60:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003ca60:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003ca70:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003ca70:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003ca80:·656d·6564·6961·7469·6f6e·20 | 0003ca80:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | ||
| 0003ca90:·6e64·6120·736e·6970·7065·7420·e287·b23c··nda·snippet·...< | |||
| 0003caa0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003cab0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003cac0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003cad0:·6964·6d38·3534·3022·3e3c·7461·626c·6520··idm8540"><table· | |||
| 0003cae0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003caf0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003cb00:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003cb10:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003cb20:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003cb30:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003cb40:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003cb50:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003cb60:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003cb70:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003cb80:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003cb90:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003cba0:·7072·653e·3c63·6f64·653e·0a70·6163·6b61··pre><code>.packa | |||
| 0003cbb0:·6765·202d·2d61·6464·3d61·6964·650a·3c2f··ge·--add=aide.</ | |||
| 0003cbc0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003cbd0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003cbe0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003cbf0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003cc00:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003cc10:·2369·646d·3835·3431·2220·7461·6269·6e64··#idm8541"·tabind | |||
| 0003cc20:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003cc30:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003cc40:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003cc50:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003cc60:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003cc70:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | |||
| 0003cc80:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | |||
| 0003cc90:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003cca0:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003ccb0:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003ccc0:·646d·3835·3431·223e·3c74·6162·6c65·2063··dm8541"><table·c | |||
| 0003ccd0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003cce0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003ccf0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003cd00:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003cd10:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003cd20:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003cd30:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003cd40:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003cd50:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003cd60:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003cd70:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003cd80:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003cd90:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | |||
| 0003cda0:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003cdb0:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003cdc0:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003cdd0:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003cde0:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003cdf0:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003ce00:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003ce10:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003ce20:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003ce30:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003ce40:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003ce50:·646d·3835·3432·2220·7461·6269·6e64·6578··dm8542"·tabindex | |||
| 0003ce60:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003ce70:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003ce80:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003ce90:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003cea0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003ceb0:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003c | 0003ca90:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | ||
| 0003c | 0003caa0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | ||
| 0003c | 0003cab0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | ||
| 0003c | 0003cac0:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | ||
| 0003c | 0003cad0:·6d38·3534·3022·3e3c·7461·626c·6520·636c··m8540"><table·cl | ||
| 0003c | 0003cae0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | ||
| 0003c | 0003caf0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | ||
| 0003c | 0003cb00:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | ||
| 0003c | 0003cb10:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | ||
| 0003c | 0003cb20:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | ||
| 0003c | 0003cb30:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003c | 0003cb40:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | ||
| 0003c | 0003cb50:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | ||
| 0003c | 0003cb60:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003c | 0003cb70:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | ||
| 0003c | 0003cb80:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | ||
| 0003c | 0003cb90:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | ||
| 0003cba0:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003cbb0:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003cbc0:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003cbd0:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003cbe0:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003cbf0:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003cc00:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003cc10:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003cc20:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003cc30:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003cc40:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003cc50:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003cc60:·6d38·3534·3122·2074·6162·696e·6465·783d··m8541"·tabindex= | |||
| 0003cc70:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003cc80:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003cc90:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003cca0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003ccb0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| Max diff block lines reached; 25624559/25650971 bytes (99.90%) of diff not shown. | |||
| Offset 14583, 15 lines modified | Offset 14583, 15 lines modified | ||
| 00038f60:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00038f60:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00038f70:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00038f70:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00038f80:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00038f80:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00038f90:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00038f90:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00038fa0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00038fa0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00038fb0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00038fb0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00038fc0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00038fc0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00038fd0:·3230·323 | 00038fd0:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00038fe0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00038fe0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00038ff0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00038ff0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00039000:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00039000:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00039010:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00039010:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00039020:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00039020:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00039030:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00039030:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00039040:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00039040:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15541, 192 lines modified | Offset 15541, 192 lines modified | ||
| 0003cb40:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003cb40:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003cb50:·2369·646d·3835·3430·2220·7461·6269·6e64··#idm8540"·tabind | 0003cb50:·2369·646d·3835·3430·2220·7461·6269·6e64··#idm8540"·tabind | ||
| 0003cb60:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003cb60:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003cb70:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003cb70:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003cb80:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003cb80:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003cb90:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003cb90:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003cba0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003cba0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003cbb0:·5265·6d65·6469·6174·696f·6e20· | 0003cbb0:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | ||
| 0003cbc0:·6 | 0003cbc0:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | ||
| 0003cbd0:· | 0003cbd0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | ||
| 0003cbe0:· | 0003cbe0:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | ||
| 0003cbf0:· | 0003cbf0:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | ||
| 0003cc00:· | 0003cc00:·646d·3835·3430·223e·3c74·6162·6c65·2063··dm8540"><table·c | ||
| 0003cc10:· | 0003cc10:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | ||
| 0003cc20:·6 | 0003cc20:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | ||
| 0003cc30:·6 | 0003cc30:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | ||
| 0003cc40:· | 0003cc40:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | ||
| 0003cc50:· | 0003cc50:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | ||
| 0003cc60:· | 0003cc60:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003cc70:· | 0003cc70:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | ||
| 0003cc80:·7 | 0003cc80:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | ||
| 0003cc90:· | 0003cc90:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003cca0:· | 0003cca0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | ||
| 0003ccb0:· | 0003ccb0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | ||
| 0003ccc0:· | 0003ccc0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | ||
| 0003ccd0:·3c70·7265·3e3c·636f·6465·3e0a·7061·636b··<pre><code>.pack | |||
| 0003cc | 0003ccd0:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | ||
| 0003cce0:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003ccf0:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003cd00:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003cd10:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003cd20:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003cd30:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003cd40:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003cd50:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003cd60:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003cd70:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003cd80:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003cd90:·646d·3835·3431·2220·7461·6269·6e64·6578··dm8541"·tabindex | |||
| 0003cda0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003cdb0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003cdc0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003cdd0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003cde0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003cdf0:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | |||
| 0003ce00:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | |||
| 0003ce10:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003ce20:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003ce30:·6c61·7073·6522·2069·643d·2269·646d·3835··lapse"·id="idm85 | |||
| 0003ce40:·3431·223e·3c74·6162·6c65·2063·6c61·7373··41"><table·class | |||
| 0003ce50:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003ce60:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003ce70:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003ce80:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003ce90:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003cea0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003ceb0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003cec0:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003ced0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003cee0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003cef0:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003cf00:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003cf10:·636f·6465·3e23·2052·656d·6564·6961·7469··code>#·Remediati | |||
| 0003cf20:·6f6e·2069·7320·6170·706c·6963·6162·6c65··on·is·applicable | |||
| 0003cf30:·206f·6e6c·7920·696e·2063·6572·7461·696e···only·in·certain | |||
| 0003cf40:·2070·6c61·7466·6f72·6d73·0a69·6620·5b20···platforms.if·[· | |||
| 0003cf50:·2120·2d66·202f·2e64·6f63·6b65·7265·6e76··!·-f·/.dockerenv | |||
| 0003cf60:·205d·2026·616d·703b·2661·6d70·3b20·5b20···]·&&·[· | |||
| 0003cf70:·2120·2d66·202f·7275·6e2f·2e63·6f6e·7461··!·-f·/run/.conta | |||
| 0003cf80:·696e·6572·656e·7620·5d3b·2074·6865·6e0a··inerenv·];·then. | |||
| 0003cf90:·0a69·6620·2120·7270·6d20·2d71·202d·2d71··.if·!·rpm·-q·--q | |||
| 0003cfa0:·7569·6574·2022·6169·6465·2220·3b20·7468··uiet·"aide"·;·th | |||
| 0003cfb0:·656e·0a20·2020·2079·756d·2069·6e73·7461··en.····yum·insta | |||
| 0003cfc0:·6c6c·202d·7920·2261·6964·6522·0a66·690a··ll·-y·"aide".fi. | |||
| 0003cfd0:·0a65·6c73·650a·2020·2020·2667·743b·2661··.else.····>&a | |||
| 0003cfe0:·6d70·3b32·2065·6368·6f20·2752·656d·6564··mp;2·echo·'Remed | |||
| 0003cff0:·6961·7469·6f6e·2069·7320·6e6f·7420·6170··iation·is·not·ap | |||
| 0003d000:·706c·6963·6162·6c65·2c20·6e6f·7468·696e··plicable,·nothin | |||
| 0003d010:·6720·7761·7320·646f·6e65·270a·6669·0a3c··g·was·done'.fi.< | |||
| 0003 | 0003d020:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | ||
| 0003 | 0003d030:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | ||
| 0003 | 0003d040:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | ||
| 0003 | 0003d050:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | ||
| 0003 | 0003d060:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003 | 0003d070:·2223·6964·6d38·3534·3222·2074·6162·696e··"#idm8542"·tabin | ||
| 0003 | 0003d080:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003 | 0003d090:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003 | 0003d0a0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003 | 0003d0b0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003 | 0003d0c0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003 | 0003d0d0:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | ||
| 0003cdb0:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | |||
| 0003cdc0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003cdd0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003cde0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003cdf0:·6964·6d38·3534·3122·3e3c·7461·626c·6520··idm8541"><table· | |||
| 0003ce00:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003ce10:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003ce20:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003ce30:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003ce40:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003ce50:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003ce60:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003ce70:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003ce80:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003ce90:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003cea0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003ceb0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003cec0:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003ced0:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003cee0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| Max diff block lines reached; 25565060/25591334 bytes (99.90%) of diff not shown. | |||
| Offset 14418, 16 lines modified | Offset 14418, 16 lines modified | ||
| 00038510:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038510:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00038520:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00038520:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00038530:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00038530:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00038540:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00038540:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00038550:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00038550:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00038560:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00038560:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00038570:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038570:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038580:·2020·2028·6173·206f·6620·3230·323 | 00038580:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00038590:·3 | 00038590:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 000385a0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 000385a0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 000385b0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 000385b0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 000385c0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 000385c0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 000385d0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 000385d0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 000385e0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 000385e0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 000385f0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 000385f0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00038600:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00038600:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15328, 190 lines modified | Offset 15328, 190 lines modified | ||
| 0003bdf0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003bdf0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003be00:·2223·6964·6d37·3630·3422·2074·6162·696e··"#idm7604"·tabin | 0003be00:·2223·6964·6d37·3630·3422·2074·6162·696e··"#idm7604"·tabin | ||
| 0003be10:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003be10:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003be20:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003be20:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003be30:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003be30:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003be40:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003be40:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003be50:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003be50:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003be60:·3e52·656d·6564·6961·7469·6f6e·20 | 0003be60:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003be70:· | 0003be70:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003be80:· | 0003be80:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003be90:· | 0003be90:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003bea0:· | 0003bea0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003beb0:· | 0003beb0:·6964·6d37·3630·3422·3e3c·7461·626c·6520··idm7604"><table· | ||
| 0003bec0:·6 | 0003bec0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003bed0:·6 | 0003bed0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003bee0:· | 0003bee0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003bef0:·6 | 0003bef0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003bf00:· | 0003bf00:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003bf10:· | 0003bf10:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003bf20:· | 0003bf20:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003bf30:·7 | 0003bf30:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003bf40:·6 | 0003bf40:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003bf50:· | 0003bf50:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003bf60:· | 0003bf60:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003bf70:· | 0003bf70:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003bf80:· | 0003bf80:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | ||
| 0003bf90:·6 | 0003bf90:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | ||
| 0003bfa0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003bfb0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003bfc0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003bfd0:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003bfe0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003bff0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c000:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c010:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c020:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c030:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c040:·6964·6d37·3630·3522·2074·6162·696e·6465··idm7605"·tabinde | |||
| 0003c050:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c060:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c070:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c080:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c090:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c0a0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| 0003c0b0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003c0c0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c0d0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c0e0:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003c0f0:·3630·3522·3e3c·7461·626c·6520·636c·6173··605"><table·clas | |||
| 0003c100:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c110:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c120:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c130:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c140:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c150:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c160:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c170:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c180:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c190:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c1a0:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003c1b0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c1c0:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003c1d0:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003c1e0:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003c1f0:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003c200:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003c210:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003c220:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003c230:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003c240:·0a0a·6966·2021·2072·706d·202d·7120·2d2d··..if·!·rpm·-q·-- | |||
| 0003c250:·7175·6965·7420·2261·6964·6522·203b·2074··quiet·"aide"·;·t | |||
| 0003c260:·6865·6e0a·2020·2020·646e·6620·696e·7374··hen.····dnf·inst | |||
| 0003c270:·616c·6c20·2d79·2022·6169·6465·220a·6669··all·-y·"aide".fi | |||
| 0003c280:·0a0a·656c·7365·0a20·2020·2026·6774·3b26··..else.····>& | |||
| 0003c290:·616d·703b·3220·6563·686f·2027·5265·6d65··amp;2·echo·'Reme | |||
| 0003c2a0:·6469·6174·696f·6e20·6973·206e·6f74·2061··diation·is·not·a | |||
| 0003c2b0:·7070·6c69·6361·626c·652c·206e·6f74·6869··pplicable,·nothi | |||
| 0003c2c0:·6e67·2077·6173·2064·6f6e·6527·0a66·690a··ng·was·done'.fi. | |||
| 0003 | 0003c2d0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | ||
| 0003 | 0003c2e0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | ||
| 0003 | 0003c2f0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | ||
| 0003 | 0003c300:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | ||
| 0003 | 0003c310:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003 | 0003c320:·3d22·2369·646d·3736·3036·2220·7461·6269··="#idm7606"·tabi | ||
| 0003c | 0003c330:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003c | 0003c340:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003c | 0003c350:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003c | 0003c360:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003c | 0003c370:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003c | 0003c380:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | ||
| 0003c060:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003c070:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c080:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c090:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c0a0:·2269·646d·3736·3035·223e·3c74·6162·6c65··"idm7605"><table | |||
| 0003c0b0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c0c0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c0d0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c0e0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c0f0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c100:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c110:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003c | 0003c390:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | ||
| 0003c3a0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c3b0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c3c0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c3d0:·3d22·6964·6d37·3630·3622·3e3c·7461·626c··="idm7606"><tabl | |||
| 0003c3e0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c3f0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c400:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| Max diff block lines reached; 6530326/6556462 bytes (99.60%) of diff not shown. | |||
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | Profile·Title·ANSSI-BP-028·(enhanced) | 61 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 63 | ***·CPE·Platforms·*** | 63 | ***·CPE·Platforms·*** |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:9 | 64 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 65 | ····*·cpe:/o:centos:centos:9 | 65 | ····*·cpe:/o:centos:centos:9 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·System_Settings | 70 | ···1.·System_Settings |
| 71 | ·········1.·Installing_and_Maintaining_Software | 71 | ·········1.·Installing_and_Maintaining_Software |
| 72 | ·········2.·Account_and_Access_Control | 72 | ·········2.·Account_and_Access_Control |
| 73 | ·········3.·System_Accounting_with_auditd | 73 | ·········3.·System_Accounting_with_auditd |
| 74 | ·········4.·GRUB2_bootloader_configuration | 74 | ·········4.·GRUB2_bootloader_configuration |
| 75 | ·········5.·Configure_Syslog | 75 | ·········5.·Configure_Syslog |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | $·sudo·dnf·install·aide | 102 | $·sudo·dnf·install·aide |
| 103 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 103 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 104 | Severity: ·medium | 104 | Severity: ·medium |
| 105 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 105 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 106 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 106 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 107 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 107 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 108 | References | 108 | References |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····dnf·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 143, 42 lines modified | Offset 151, 48 lines modified | ||
| 143 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 144 | ··-·package_aide_installed | 152 | ··-·package_aide_installed |
| 145 | Remediation_OSBuild_Blueprint_snippet_⇲ | 153 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 146 | [[packages]] | 154 | [[packages]] |
| 147 | name·=·"aide" | 155 | name·=·"aide" |
| 148 | version·=·"*" | 156 | version·=·"*" |
| 149 | Remediation_ | 157 | Remediation_Anaconda_snippet_⇲ |
| 150 | Complexity:·low | 158 | Complexity:·low |
| 151 | Disruption:·low | 159 | Disruption:·low |
| 152 | Strategy:···enable | 160 | Strategy:···enable |
| 153 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 154 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | package·--add=aide | ||
| 155 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 156 | ····dnf·install·-y·"aide" | ||
| 157 | fi | ||
| 158 | else | ||
| 159 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 160 | fi | ||
| 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 162 | Run·the·following·command·to·generate·a·new·database: | 163 | Run·the·following·command·to·generate·a·new·database: |
| 163 | $·sudo·/usr/sbin/aide·--init | 164 | $·sudo·/usr/sbin/aide·--init |
| 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 165 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 166 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 166 | To·initiate·a·manual·check,·run·the·following·command: | 167 | To·initiate·a·manual·check,·run·the·following·command: |
| 167 | $·sudo·/usr/sbin/aide·--check | 168 | $·sudo·/usr/sbin/aide·--check |
| 168 | If·this·check·produces·any·unexpected·output,·investigate. | 169 | If·this·check·produces·any·unexpected·output,·investigate. |
| 169 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 170 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 170 | Severity: ·medium | 171 | Severity: ·medium |
| 171 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 172 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 172 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 173 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 173 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 174 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 174 | References | 175 | References |
| 176 | Remediation_Shell_script_⇲ | ||
| 177 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 178 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 179 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 180 | ····dnf·install·-y·"aide" | ||
| 181 | fi | ||
| 182 | /usr/sbin/aide·--init | ||
| 183 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 184 | else | ||
| 185 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 186 | fi | ||
| 175 | Remediation_Ansible_snippet_⇲ | 187 | Remediation_Ansible_snippet_⇲ |
| 176 | Complexity:·low | 188 | Complexity:·low |
| 177 | Disruption:·low | 189 | Disruption:·low |
| 178 | Strategy:···restrict | 190 | Strategy:···restrict |
| 179 | -·name:·Ensure·AIDE·is·installed | 191 | -·name:·Ensure·AIDE·is·installed |
| 180 | ··package: | 192 | ··package: |
| 181 | ····name:·'{{·item·}}' | 193 | ····name:·'{{·item·}}' |
| Offset 243, 182 lines modified | Offset 257, 176 lines modified | ||
| 243 | ··-·PCI-DSS-Req-11.5 | 257 | ··-·PCI-DSS-Req-11.5 |
| 244 | ··-·aide_build_database | 258 | ··-·aide_build_database |
| 245 | ··-·low_complexity | 259 | ··-·low_complexity |
| 246 | ··-·low_disruption | 260 | ··-·low_disruption |
| 247 | ··-·medium_severity | 261 | ··-·medium_severity |
| 248 | ··-·no_reboot_needed | 262 | ··-·no_reboot_needed |
| 249 | ··-·restrict_strategy | 263 | ··-·restrict_strategy |
| Max diff block lines reached; 730016/735643 bytes (99.24%) of diff not shown. | |||
| Offset 14417, 16 lines modified | Offset 14417, 16 lines modified | ||
| 00038500:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038500:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00038510:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00038510:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00038520:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00038520:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00038530:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00038530:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00038540:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00038540:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00038550:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00038550:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00038560:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038560:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038570:·2020·2028·6173·206f·6620·3230·323 | 00038570:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00038580:·3 | 00038580:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00038590:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00038590:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 000385a0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 000385a0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 000385b0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 000385b0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 000385c0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 000385c0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 000385d0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 000385d0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 000385e0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 000385e0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 000385f0:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 000385f0:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15327, 190 lines modified | Offset 15327, 190 lines modified | ||
| 0003bde0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003bde0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003bdf0:·2223·6964·6d37·3630·3422·2074·6162·696e··"#idm7604"·tabin | 0003bdf0:·2223·6964·6d37·3630·3422·2074·6162·696e··"#idm7604"·tabin | ||
| 0003be00:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003be00:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003be10:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003be10:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003be20:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003be20:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003be30:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003be30:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003be40:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003be40:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003be50:·3e52·656d·6564·6961·7469·6f6e·20 | 0003be50:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003be60:· | 0003be60:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003be70:· | 0003be70:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003be80:· | 0003be80:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003be90:· | 0003be90:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003bea0:· | 0003bea0:·6964·6d37·3630·3422·3e3c·7461·626c·6520··idm7604"><table· | ||
| 0003beb0:·6 | 0003beb0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003bec0:·6 | 0003bec0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003bed0:· | 0003bed0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003bee0:·6 | 0003bee0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003bef0:· | 0003bef0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003bf00:· | 0003bf00:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003bf10:· | 0003bf10:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003bf20:·7 | 0003bf20:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003bf30:·6 | 0003bf30:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003bf40:· | 0003bf40:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003bf50:· | 0003bf50:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003bf60:· | 0003bf60:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003bf70:· | 0003bf70:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | ||
| 0003bf80:·6 | 0003bf80:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | ||
| 0003bf90:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003bfa0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003bfb0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003bfc0:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003bfd0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003bfe0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003bff0:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c000:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c010:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c020:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c030:·6964·6d37·3630·3522·2074·6162·696e·6465··idm7605"·tabinde | |||
| 0003c040:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c050:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c060:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c070:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c080:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c090:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| 0003c0a0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003c0b0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c0c0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c0d0:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003c0e0:·3630·3522·3e3c·7461·626c·6520·636c·6173··605"><table·clas | |||
| 0003c0f0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c100:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c110:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c120:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c130:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c140:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c150:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c160:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c170:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c180:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c190:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003c1a0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c1b0:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003c1c0:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003c1d0:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003c1e0:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003c1f0:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003c200:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003c210:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003c220:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003c230:·0a0a·6966·2021·2072·706d·202d·7120·2d2d··..if·!·rpm·-q·-- | |||
| 0003c240:·7175·6965·7420·2261·6964·6522·203b·2074··quiet·"aide"·;·t | |||
| 0003c250:·6865·6e0a·2020·2020·646e·6620·696e·7374··hen.····dnf·inst | |||
| 0003c260:·616c·6c20·2d79·2022·6169·6465·220a·6669··all·-y·"aide".fi | |||
| 0003c270:·0a0a·656c·7365·0a20·2020·2026·6774·3b26··..else.····>& | |||
| 0003c280:·616d·703b·3220·6563·686f·2027·5265·6d65··amp;2·echo·'Reme | |||
| 0003c290:·6469·6174·696f·6e20·6973·206e·6f74·2061··diation·is·not·a | |||
| 0003c2a0:·7070·6c69·6361·626c·652c·206e·6f74·6869··pplicable,·nothi | |||
| 0003c2b0:·6e67·2077·6173·2064·6f6e·6527·0a66·690a··ng·was·done'.fi. | |||
| 0003 | 0003c2c0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | ||
| 0003 | 0003c2d0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | ||
| 0003 | 0003c2e0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | ||
| 0003 | 0003c2f0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | ||
| 0003 | 0003c300:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003 | 0003c310:·3d22·2369·646d·3736·3036·2220·7461·6269··="#idm7606"·tabi | ||
| 0003 | 0003c320:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003c | 0003c330:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003c | 0003c340:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003c | 0003c350:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003c | 0003c360:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003c | 0003c370:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | ||
| 0003c050:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003c060:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c070:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c080:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c090:·2269·646d·3736·3035·223e·3c74·6162·6c65··"idm7605"><table | |||
| 0003c0a0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c0b0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c0c0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c0d0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c0e0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c0f0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c100:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003c | 0003c380:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | ||
| 0003c390:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c3a0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c3b0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c3c0:·3d22·6964·6d37·3630·3622·3e3c·7461·626c··="idm7606"><tabl | |||
| 0003c3d0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c3e0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c3f0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| Max diff block lines reached; 6732973/6759109 bytes (99.61%) of diff not shown. | |||
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | Profile·Title·ANSSI-BP-028·(high) | 61 | Profile·Title·ANSSI-BP-028·(high) |
| 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 63 | ***·CPE·Platforms·*** | 63 | ***·CPE·Platforms·*** |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:9 | 64 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 65 | ····*·cpe:/o:centos:centos:9 | 65 | ····*·cpe:/o:centos:centos:9 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·System_Settings | 70 | ···1.·System_Settings |
| 71 | ·········1.·Installing_and_Maintaining_Software | 71 | ·········1.·Installing_and_Maintaining_Software |
| 72 | ·········2.·Account_and_Access_Control | 72 | ·········2.·Account_and_Access_Control |
| 73 | ·········3.·System_Accounting_with_auditd | 73 | ·········3.·System_Accounting_with_auditd |
| 74 | ·········4.·GRUB2_bootloader_configuration | 74 | ·········4.·GRUB2_bootloader_configuration |
| 75 | ·········5.·Configure_Syslog | 75 | ·········5.·Configure_Syslog |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | $·sudo·dnf·install·aide | 102 | $·sudo·dnf·install·aide |
| 103 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 103 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 104 | Severity: ·medium | 104 | Severity: ·medium |
| 105 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 105 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 106 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 106 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 107 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 107 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 108 | References | 108 | References |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····dnf·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 143, 42 lines modified | Offset 151, 48 lines modified | ||
| 143 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 144 | ··-·package_aide_installed | 152 | ··-·package_aide_installed |
| 145 | Remediation_OSBuild_Blueprint_snippet_⇲ | 153 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 146 | [[packages]] | 154 | [[packages]] |
| 147 | name·=·"aide" | 155 | name·=·"aide" |
| 148 | version·=·"*" | 156 | version·=·"*" |
| 149 | Remediation_ | 157 | Remediation_Anaconda_snippet_⇲ |
| 150 | Complexity:·low | 158 | Complexity:·low |
| 151 | Disruption:·low | 159 | Disruption:·low |
| 152 | Strategy:···enable | 160 | Strategy:···enable |
| 153 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 154 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | package·--add=aide | ||
| 155 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 156 | ····dnf·install·-y·"aide" | ||
| 157 | fi | ||
| 158 | else | ||
| 159 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 160 | fi | ||
| 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 162 | Run·the·following·command·to·generate·a·new·database: | 163 | Run·the·following·command·to·generate·a·new·database: |
| 163 | $·sudo·/usr/sbin/aide·--init | 164 | $·sudo·/usr/sbin/aide·--init |
| 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 165 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 166 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 166 | To·initiate·a·manual·check,·run·the·following·command: | 167 | To·initiate·a·manual·check,·run·the·following·command: |
| 167 | $·sudo·/usr/sbin/aide·--check | 168 | $·sudo·/usr/sbin/aide·--check |
| 168 | If·this·check·produces·any·unexpected·output,·investigate. | 169 | If·this·check·produces·any·unexpected·output,·investigate. |
| 169 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 170 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 170 | Severity: ·medium | 171 | Severity: ·medium |
| 171 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 172 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 172 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 173 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 173 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 174 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 174 | References | 175 | References |
| 176 | Remediation_Shell_script_⇲ | ||
| 177 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 178 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 179 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 180 | ····dnf·install·-y·"aide" | ||
| 181 | fi | ||
| 182 | /usr/sbin/aide·--init | ||
| 183 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 184 | else | ||
| 185 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 186 | fi | ||
| 175 | Remediation_Ansible_snippet_⇲ | 187 | Remediation_Ansible_snippet_⇲ |
| 176 | Complexity:·low | 188 | Complexity:·low |
| 177 | Disruption:·low | 189 | Disruption:·low |
| 178 | Strategy:···restrict | 190 | Strategy:···restrict |
| 179 | -·name:·Ensure·AIDE·is·installed | 191 | -·name:·Ensure·AIDE·is·installed |
| 180 | ··package: | 192 | ··package: |
| 181 | ····name:·'{{·item·}}' | 193 | ····name:·'{{·item·}}' |
| Offset 243, 28 lines modified | Offset 257, 14 lines modified | ||
| 243 | ··-·PCI-DSS-Req-11.5 | 257 | ··-·PCI-DSS-Req-11.5 |
| 244 | ··-·aide_build_database | 258 | ··-·aide_build_database |
| 245 | ··-·low_complexity | 259 | ··-·low_complexity |
| 246 | ··-·low_disruption | 260 | ··-·low_disruption |
| 247 | ··-·medium_severity | 261 | ··-·medium_severity |
| 248 | ··-·no_reboot_needed | 262 | ··-·no_reboot_needed |
| 249 | ··-·restrict_strategy | 263 | ··-·restrict_strategy |
| Max diff block lines reached; 753631/759257 bytes (99.26%) of diff not shown. | |||
| Offset 14419, 16 lines modified | Offset 14419, 16 lines modified | ||
| 00038520:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038520:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00038530:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00038530:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00038540:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00038540:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00038550:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00038550:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00038560:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00038560:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00038570:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00038570:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00038580:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038580:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038590:·2020·2028·6173·206f·6620·3230·323 | 00038590:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 000385a0:·3 | 000385a0:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 000385b0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 000385b0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 000385c0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 000385c0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 000385d0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 000385d0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 000385e0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 000385e0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 000385f0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 000385f0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00038600:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00038600:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00038610:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00038610:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15323, 189 lines modified | Offset 15323, 189 lines modified | ||
| 0003bda0:·6172·6765·743d·2223·6964·6d37·3630·3422··arget="#idm7604" | 0003bda0:·6172·6765·743d·2223·6964·6d37·3630·3422··arget="#idm7604" | ||
| 0003bdb0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003bdb0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003bdc0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003bdc0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003bdd0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003bdd0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003bde0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003bde0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003bdf0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003bdf0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003be00:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003be00:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003be10:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003be10:·6f6e·2041·6e61·636f·6e64·6120·736e·6970··on·Anaconda·snip | |||
| 0003be20:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003be30:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003be40:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003be50:·7365·2220·6964·3d22·6964·6d37·3630·3422··se"·id="idm7604" | |||
| 0003be60:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003be70:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003be80:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003be90:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003bea0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003beb0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003bec0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bed0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003bee0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bef0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bf00:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003bf10:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003bf20:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003bf30:·653e·0a70·6163·6b61·6765·202d·2d61·6464··e>.package·--add | |||
| 0003bf40:·3d61·6964·650a·3c2f·636f·6465·3e3c·2f70··=aide.</code></p | |||
| 0003bf50:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003bf60:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003bf70:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003bf80:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003bf90:·7461·7267·6574·3d22·2369·646d·3736·3035··target="#idm7605 | |||
| 0003bfa0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003bfb0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003bfc0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003bfd0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003bfe0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003bff0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c000:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003c010:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c020:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c030:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c040:·6522·2069·643d·2269·646d·3736·3035·223e··e"·id="idm7605"> | |||
| 0003c050:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c060:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c070:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c080:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c090:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c0a0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003c0b0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c0c0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c0d0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c0e0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003c0f0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003c100:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003c110:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c120:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003c130:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003c140:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003c150:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003c160:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003c170:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003c180:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003c190:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c1a0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c1b0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c1c0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c1d0:·7267·6574·3d22·2369·646d·3736·3036·2220··rget="#idm7606"· | |||
| 0003c1e0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c1f0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c200:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c210:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c220:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c230:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003c240:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003 | 0003be20:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 0003 | 0003be30:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 0003 | 0003be40:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 0003 | 0003be50:·2220·6964·3d22·6964·6d37·3630·3422·3e3c··"·id="idm7604">< | ||
| 0003 | 0003be60:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | ||
| 0003 | 0003be70:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | ||
| 0003 | 0003be80:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 0003 | 0003be90:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | ||
| 0003 | 0003bea0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | ||
| 0003 | 0003beb0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | ||
| 0003 | 0003bec0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003 | 0003bed0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | ||
| 0003 | 0003bee0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003 | 0003bef0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | ||
| 0003 | 0003bf00:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | ||
| 0003 | 0003bf10:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | ||
| 0003 | 0003bf20:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | ||
| 0003bf30:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003bf40:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003bf50:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003bf60:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003bf70:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003bf80:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003bf90:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003bfa0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003bfb0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003bfc0:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003bfd0:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003bfe0:·6765·743d·2223·6964·6d37·3630·3522·2074··get="#idm7605"·t | |||
| 0003bff0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c000:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c010:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c020:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c030:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| Max diff block lines reached; 6285475/6311473 bytes (99.59%) of diff not shown. | |||
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | Profile·Title·ANSSI-BP-028·(intermediary) | 61 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 63 | ***·CPE·Platforms·*** | 63 | ***·CPE·Platforms·*** |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:9 | 64 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 65 | ····*·cpe:/o:centos:centos:9 | 65 | ····*·cpe:/o:centos:centos:9 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·System_Settings | 70 | ···1.·System_Settings |
| 71 | ·········1.·Installing_and_Maintaining_Software | 71 | ·········1.·Installing_and_Maintaining_Software |
| 72 | ·········2.·Account_and_Access_Control | 72 | ·········2.·Account_and_Access_Control |
| 73 | ·········3.·System_Accounting_with_auditd | 73 | ·········3.·System_Accounting_with_auditd |
| 74 | ·········4.·Configure_Syslog | 74 | ·········4.·Configure_Syslog |
| 75 | ·········5.·Network_Configuration_and_Firewalls | 75 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 101, 31 lines modified | Offset 101, 39 lines modified | ||
| 101 | $·sudo·dnf·install·aide | 101 | $·sudo·dnf·install·aide |
| 102 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 102 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 103 | Severity: ·medium | 103 | Severity: ·medium |
| 104 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 104 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 105 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 105 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 106 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 106 | and·········A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 107 | References | 107 | References |
| 108 | Remediation_Anaconda_snippet_⇲ | ||
| 109 | Complexity:·low | ||
| 110 | Disruption:·low | ||
| 111 | Strategy:···enable | ||
| 112 | package·--add=aide | ||
| 113 | Remediation_Puppet_snippet_⇲ | 108 | Remediation_Puppet_snippet_⇲ |
| 114 | Complexity:·low | 109 | Complexity:·low |
| 115 | Disruption:·low | 110 | Disruption:·low |
| 116 | Strategy:···enable | 111 | Strategy:···enable |
| 117 | include·install_aide | 112 | include·install_aide |
| 118 | class·install_aide·{ | 113 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 114 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 115 | ····ensure·=>·'installed', |
| 121 | ··} | 116 | ··} |
| 122 | } | 117 | } |
| 118 | Remediation_Shell_script_⇲ | ||
| 119 | Complexity:·low | ||
| 120 | Disruption:·low | ||
| 121 | Strategy:···enable | ||
| 122 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 123 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 124 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 125 | ····dnf·install·-y·"aide" | ||
| 126 | fi | ||
| 127 | else | ||
| 128 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 129 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 130 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 131 | Complexity:·low |
| 125 | Disruption:·low | 132 | Disruption:·low |
| 126 | Strategy:···enable | 133 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 134 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 135 | ··package: |
| 129 | ····name:·aide | 136 | ····name:·aide |
| Offset 142, 42 lines modified | Offset 150, 48 lines modified | ||
| 142 | ··-·no_reboot_needed | 150 | ··-·no_reboot_needed |
| 143 | ··-·package_aide_installed | 151 | ··-·package_aide_installed |
| 144 | Remediation_OSBuild_Blueprint_snippet_⇲ | 152 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 145 | [[packages]] | 153 | [[packages]] |
| 146 | name·=·"aide" | 154 | name·=·"aide" |
| 147 | version·=·"*" | 155 | version·=·"*" |
| 148 | Remediation_ | 156 | Remediation_Anaconda_snippet_⇲ |
| 149 | Complexity:·low | 157 | Complexity:·low |
| 150 | Disruption:·low | 158 | Disruption:·low |
| 151 | Strategy:···enable | 159 | Strategy:···enable |
| 152 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 153 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 154 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 155 | ····dnf·install·-y·"aide" | ||
| 156 | fi | ||
| 160 | package·--add=aide | ||
| 157 | else | ||
| 158 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 159 | fi | ||
| 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 161 | Run·the·following·command·to·generate·a·new·database: | 162 | Run·the·following·command·to·generate·a·new·database: |
| 162 | $·sudo·/usr/sbin/aide·--init | 163 | $·sudo·/usr/sbin/aide·--init |
| 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 164 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 165 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 165 | To·initiate·a·manual·check,·run·the·following·command: | 166 | To·initiate·a·manual·check,·run·the·following·command: |
| 166 | $·sudo·/usr/sbin/aide·--check | 167 | $·sudo·/usr/sbin/aide·--check |
| 167 | If·this·check·produces·any·unexpected·output,·investigate. | 168 | If·this·check·produces·any·unexpected·output,·investigate. |
| 168 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 169 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 169 | Severity: ·medium | 170 | Severity: ·medium |
| 170 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 171 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 171 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 172 | Identifiers·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 172 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 173 | and·········PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 173 | References | 174 | References |
| 175 | Remediation_Shell_script_⇲ | ||
| 176 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 177 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 178 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 179 | ····dnf·install·-y·"aide" | ||
| 180 | fi | ||
| 181 | /usr/sbin/aide·--init | ||
| 182 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 183 | else | ||
| 184 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 185 | fi | ||
| 174 | Remediation_Ansible_snippet_⇲ | 186 | Remediation_Ansible_snippet_⇲ |
| 175 | Complexity:·low | 187 | Complexity:·low |
| 176 | Disruption:·low | 188 | Disruption:·low |
| 177 | Strategy:···restrict | 189 | Strategy:···restrict |
| 178 | -·name:·Ensure·AIDE·is·installed | 190 | -·name:·Ensure·AIDE·is·installed |
| 179 | ··package: | 191 | ··package: |
| 180 | ····name:·'{{·item·}}' | 192 | ····name:·'{{·item·}}' |
| Offset 242, 182 lines modified | Offset 256, 176 lines modified | ||
| 242 | ··-·PCI-DSS-Req-11.5 | 256 | ··-·PCI-DSS-Req-11.5 |
| 243 | ··-·aide_build_database | 257 | ··-·aide_build_database |
| 244 | ··-·low_complexity | 258 | ··-·low_complexity |
| 245 | ··-·low_disruption | 259 | ··-·low_disruption |
| 246 | ··-·medium_severity | 260 | ··-·medium_severity |
| 247 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 248 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| Max diff block lines reached; 698748/704388 bytes (99.20%) of diff not shown. | |||
| Offset 14418, 15 lines modified | Offset 14418, 15 lines modified | ||
| 00038510:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00038510:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00038520:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00038520:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00038530:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00038530:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00038540:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00038540:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00038550:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00038550:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00038560:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00038560:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00038570:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00038570:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038580:·6173·206f·6620·3230·323 | 00038580:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00038590:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00038590:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 000385a0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 000385a0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 000385b0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 000385b0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 000385c0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 000385c0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 000385d0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 000385d0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 000385e0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 000385e0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 000385f0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 000385f0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15095, 140 lines modified | Offset 15095, 140 lines modified | ||
| 0003af60:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003af60:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003af70:·6d31·3039·3438·2220·7461·6269·6e64·6578··m10948"·tabindex | 0003af70:·6d31·3039·3438·2220·7461·6269·6e64·6578··m10948"·tabindex | ||
| 0003af80:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003af80:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003af90:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003af90:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003afa0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003afa0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003afb0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003afb0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003afc0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003afc0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003afd0:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003afe0:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003aff0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003b000:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003b010:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003b020:·6d31·3039·3438·223e·3c74·6162·6c65·2063··m10948"><table·c | |||
| 0003b030:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003b040:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003b050:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003b060:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003b070:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003b080:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003b090:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003b0a0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003b0b0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003b0c0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003b0d0:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003b0e0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003b0f0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003b100:·653a·2046·696e·6420·2f65·7463·2f73·7564··e:·Find·/etc/sud | |||
| 0003b110:·6f65·7273·2e64·2f20·6669·6c65·730a·2020··oers.d/·files.·· | |||
| 0003b120:·6669·6e64·3a0a·2020·2020·7061·7468·733a··find:.····paths: | |||
| 0003b130:·0a20·2020·202d·202f·6574·632f·7375·646f··.····-·/etc/sudo | |||
| 0003b140:·6572·732e·642f·0a20·2072·6567·6973·7465··ers.d/.··registe | |||
| 0003b150:·723a·2073·7564·6f65·7273·0a20·2074·6167··r:·sudoers.··tag | |||
| 0003b160:·733a·0a20·202d·204e·4953·542d·3830·302d··s:.··-·NIST-800- | |||
| 0003b170:·3533·2d43·4d2d·3628·6129·0a20·202d·204e··53-CM-6(a).··-·N | |||
| 0003b180:·4953·542d·3830·302d·3533·2d49·412d·3131··IST-800-53-IA-11 | |||
| 0003b190:·0a20·202d·206c·6f77·5f63·6f6d·706c·6578··.··-·low_complex | |||
| 0003b1a0:·6974·790a·2020·2d20·6c6f·775f·6469·7372··ity.··-·low_disr | |||
| 0003b1b0:·7570·7469·6f6e·0a20·202d·206d·6564·6975··uption.··-·mediu | |||
| 0003b1c0:·6d5f·7365·7665·7269·7479·0a20·202d·206e··m_severity.··-·n | |||
| 0003b1d0:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 0003b1e0:·2020·2d20·7265·7374·7269·6374·5f73·7472····-·restrict_str | |||
| 0003b1f0:·6174·6567·790a·2020·2d20·7375·646f·5f72··ategy.··-·sudo_r | |||
| 0003b200:·656d·6f76·655f·6e6f·5f61·7574·6865·6e74··emove_no_authent | |||
| 0003b210:·6963·6174·650a·0a2d·206e·616d·653a·2052··icate..-·name:·R | |||
| 0003b220:·656d·6f76·6520·6c69·6e65·7320·636f·6e74··emove·lines·cont | |||
| 0003b230:·6169·6e69·6e67·2021·6175·7468·656e·7469··aining·!authenti | |||
| 0003b240:·6361·7465·2066·726f·6d20·7375·646f·6572··cate·from·sudoer | |||
| 0003b250:·7320·6669·6c65·730a·2020·7265·706c·6163··s·files.··replac | |||
| 0003b260:·653a·0a20·2020·2072·6567·6578·703a·2028··e:.····regexp:·( | |||
| 0003b270:·5e28·3f21·2329·2e2a·5b5c·735d·2b5c·2161··^(?!#).*[\s]+\!a | |||
| 0003b280:·7574·6865·6e74·6963·6174·652e·2a24·290a··uthenticate.*$). | |||
| 0003b290:·2020·2020·7265·706c·6163·653a·2027·2320······replace:·'#· | |||
| 0003b2a0:·5c67·266c·743b·3126·6774·3b27·0a20·2020··\g<1>'.··· | |||
| 0003b2b0:·2070·6174·683a·2027·7b7b·2069·7465·6d2e···path:·'{{·item. | |||
| 0003b2c0:·7061·7468·207d·7d27·0a20·2020·2076·616c··path·}}'.····val | |||
| 0003b2d0:·6964·6174·653a·202f·7573·722f·7362·696e··idate:·/usr/sbin | |||
| 0003b2e0:·2f76·6973·7564·6f20·2d63·6620·2573·0a20··/visudo·-cf·%s.· | |||
| 0003b2f0:·2077·6974·685f·6974·656d·733a·0a20·202d···with_items:.··- | |||
| 0003b300:·2070·6174·683a·202f·6574·632f·7375·646f···path:·/etc/sudo | |||
| 0003b310:·6572·730a·2020·2d20·277b·7b20·7375·646f··ers.··-·'{{·sudo | |||
| 0003b320:·6572·732e·6669·6c65·7320·7d7d·270a·2020··ers.files·}}'.·· | |||
| 0003b330:·7461·6773·3a0a·2020·2d20·4e49·5354·2d38··tags:.··-·NIST-8 | |||
| 0003b340:·3030·2d35·332d·434d·2d36·2861·290a·2020··00-53-CM-6(a).·· | |||
| 0003b350:·2d20·4e49·5354·2d38·3030·2d35·332d·4941··-·NIST-800-53-IA | |||
| 0003b360:·2d31·310a·2020·2d20·6c6f·775f·636f·6d70··-11.··-·low_comp | |||
| 0003b370:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003b380:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003b390:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003b3a0:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003b3b0:·6564·0a20·202d·2072·6573·7472·6963·745f··ed.··-·restrict_ | |||
| 0003b3c0:·7374·7261·7465·6779·0a20·202d·2073·7564··strategy.··-·sud | |||
| 0003b3d0:·6f5f·7265·6d6f·7665·5f6e·6f5f·6175·7468··o_remove_no_auth | |||
| 0003b3e0:·656e·7469·6361·7465·0a3c·2f63·6f64·653e··enticate.</code> | |||
| 0003b3f0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003b400:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003b410:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003b420:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003b430:·7461·2d74·6172·6765·743d·2223·6964·6d31··ta-target="#idm1 | |||
| 0003b440:·3039·3439·2220·7461·6269·6e64·6578·3d22··0949"·tabindex=" | |||
| 0003b450:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003b460:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003b470:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003b480:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003b490:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003 | 0003afd0:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | ||
| 0003afe0:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | |||
| 0003aff0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003b000:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003b010:·6c61·7073·6522·2069·643d·2269·646d·3130··lapse"·id="idm10 | |||
| 0003b020:·3934·3822·3e3c·7461·626c·6520·636c·6173··948"><table·clas | |||
| 0003b030:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003b040:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003b050:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003b060:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003b070:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003b080:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003b090:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003b0a0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003b0b0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003b0c0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003b0d0:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 0003b0e0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003b0f0:·653e·3c63·6f64·653e·0a66·6f72·2066·2069··e><code>.for·f·i | |||
| 0003b100:·6e20·2f65·7463·2f73·7564·6f65·7273·202f··n·/etc/sudoers·/ | |||
| 0003b110:·6574·632f·7375·646f·6572·732e·642f·2a20··etc/sudoers.d/*· | |||
| 0003b120:·3b20·646f·0a20·2069·6620·5b20·2120·2d65··;·do.··if·[·!·-e | |||
| 0003b130:·2022·2466·2220·5d20·3b20·7468·656e·0a20···"$f"·]·;·then.· | |||
| 0003b140:·2020·2063·6f6e·7469·6e75·650a·2020·6669·····continue.··fi | |||
| 0003b150:·0a20·206d·6174·6368·696e·675f·6c69·7374··.··matching_list | |||
| 0003b160:·3d24·2867·7265·7020·2d50·2027·5e28·3f21··=$(grep·-P·'^(?! | |||
| 0003b170:·2329·2e2a·5b5c·735d·2b5c·2161·7574·6865··#).*[\s]+\!authe | |||
| Max diff block lines reached; 2422696/2441794 bytes (99.22%) of diff not shown. | |||
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | Profile·Title·ANSSI-BP-028·(minimal) | 61 | Profile·Title·ANSSI-BP-028·(minimal) |
| 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 62 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 63 | ***·CPE·Platforms·*** | 63 | ***·CPE·Platforms·*** |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:9 | 64 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 65 | ····*·cpe:/o:centos:centos:9 | 65 | ····*·cpe:/o:centos:centos:9 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·System_Settings | 70 | ···1.·System_Settings |
| 71 | ·········1.·Installing_and_Maintaining_Software | 71 | ·········1.·Installing_and_Maintaining_Software |
| 72 | ·········2.·Account_and_Access_Control | 72 | ·········2.·Account_and_Access_Control |
| 73 | ·········3.·Configure_Syslog | 73 | ·········3.·Configure_Syslog |
| 74 | ·········4.·File_Permissions_and_Masks | 74 | ·········4.·File_Permissions_and_Masks |
| 75 | ···2.·Services | 75 | ···2.·Services |
| Offset 106, 14 lines modified | Offset 106, 33 lines modified | ||
| 106 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 106 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 107 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 107 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 108 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 108 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 109 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 109 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 110 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 110 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 111 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 111 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 112 | ············000373-VMM-001490 | 112 | ············000373-VMM-001490 |
| 113 | Remediation_Shell_script_⇲ | ||
| 114 | Complexity:·low | ||
| 115 | Disruption:·low | ||
| 116 | Strategy:···restrict | ||
| 117 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 118 | ··if·[·!·-e·"$f"·]·;·then | ||
| 119 | ····continue | ||
| 120 | ··fi | ||
| 121 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 122 | ··if·!·test·-z·"$matching_list";·then | ||
| 123 | ····while·IFS=·read·-r·entry;·do | ||
| 124 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 125 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 126 | ····done·<<<·"$matching_list" | ||
| 127 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 128 | ··fi | ||
| 129 | done | ||
| 113 | Remediation_Ansible_snippet_⇲ | 130 | Remediation_Ansible_snippet_⇲ |
| 114 | Complexity:·low | 131 | Complexity:·low |
| 115 | Disruption:·low | 132 | Disruption:·low |
| 116 | Strategy:···restrict | 133 | Strategy:···restrict |
| 117 | -·name:·Find·/etc/sudoers.d/·files | 134 | -·name:·Find·/etc/sudoers.d/·files |
| 118 | ··find: | 135 | ··find: |
| 119 | ····paths: | 136 | ····paths: |
| Offset 143, 33 lines modified | Offset 162, 14 lines modified | ||
| 143 | ··-·NIST-800-53-IA-11 | 162 | ··-·NIST-800-53-IA-11 |
| 144 | ··-·low_complexity | 163 | ··-·low_complexity |
| 145 | ··-·low_disruption | 164 | ··-·low_disruption |
| 146 | ··-·medium_severity | 165 | ··-·medium_severity |
| 147 | ··-·no_reboot_needed | 166 | ··-·no_reboot_needed |
| 148 | ··-·restrict_strategy | 167 | ··-·restrict_strategy |
| 149 | ··-·sudo_remove_no_authenticate | 168 | ··-·sudo_remove_no_authenticate |
| 150 | Remediation_Shell_script_⇲ | ||
| 151 | Complexity:·low | ||
| 152 | Disruption:·low | ||
| 153 | Strategy:···restrict | ||
| 154 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 155 | ··if·[·!·-e·"$f"·]·;·then | ||
| 156 | ····continue | ||
| 157 | ··fi | ||
| 158 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 159 | ··if·!·test·-z·"$matching_list";·then | ||
| 160 | ····while·IFS=·read·-r·entry;·do | ||
| 161 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 162 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 163 | ····done·<<<·"$matching_list" | ||
| 164 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 165 | ··fi | ||
| 166 | done | ||
| 167 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 169 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 168 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 170 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 169 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 171 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 170 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 172 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 171 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 173 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 172 | ············have·authorization. | 174 | ············have·authorization. |
| 173 | Rationale: | 175 | Rationale: |
| Offset 180, 14 lines modified | Offset 180, 33 lines modified | ||
| 180 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 180 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 181 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 181 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 182 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 182 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 183 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 183 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 184 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 184 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 185 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 185 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 186 | ············000373-VMM-001490 | 186 | ············000373-VMM-001490 |
| 187 | Remediation_Shell_script_⇲ | ||
| 188 | Complexity:·low | ||
| 189 | Disruption:·low | ||
| 190 | Strategy:···restrict | ||
| 191 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 192 | ··if·[·!·-e·"$f"·]·;·then | ||
| 193 | ····continue | ||
| 194 | ··fi | ||
| 195 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 196 | ··if·!·test·-z·"$matching_list";·then | ||
| 197 | ····while·IFS=·read·-r·entry;·do | ||
| 198 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 199 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 200 | ····done·<<<·"$matching_list" | ||
| 201 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 202 | ··fi | ||
| 203 | done | ||
| 187 | Remediation_Ansible_snippet_⇲ | 204 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 205 | Complexity:·low |
| 189 | Disruption:·low | 206 | Disruption:·low |
| 190 | Strategy:···restrict | 207 | Strategy:···restrict |
| 191 | -·name:·Find·/etc/sudoers.d/·files | 208 | -·name:·Find·/etc/sudoers.d/·files |
| 192 | ··find: | 209 | ··find: |
| 193 | ····paths: | 210 | ····paths: |
| Offset 217, 33 lines modified | Offset 236, 14 lines modified | ||
| 217 | ··-·NIST-800-53-IA-11 | 236 | ··-·NIST-800-53-IA-11 |
| 218 | ··-·low_complexity | 237 | ··-·low_complexity |
| 219 | ··-·low_disruption | 238 | ··-·low_disruption |
| 220 | ··-·medium_severity | 239 | ··-·medium_severity |
| 221 | ··-·no_reboot_needed | 240 | ··-·no_reboot_needed |
| 222 | ··-·restrict_strategy | 241 | ··-·restrict_strategy |
| 223 | ··-·sudo_remove_nopasswd | 242 | ··-·sudo_remove_nopasswd |
| 224 | Remediation_Shell_script_⇲ | ||
| 225 | Complexity:·low | ||
| Max diff block lines reached; 169891/175259 bytes (96.94%) of diff not shown. | |||
| Offset 14405, 15 lines modified | Offset 14405, 15 lines modified | ||
| 00038440:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00038440:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00038450:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00038450:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00038460:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00038460:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00038470:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00038470:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00038480:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00038480:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00038490:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00038490:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 000384a0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 000384a0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 000384b0:·6173·206f·6620·3230·323 | 000384b0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 000384c0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 000384c0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 000384d0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 000384d0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 000384e0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 000384e0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 000384f0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 000384f0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00038500:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00038500:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00038510:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00038510:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038520:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038520:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15362, 190 lines modified | Offset 15362, 190 lines modified | ||
| 0003c010:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003c010:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003c020:·3736·3034·2220·7461·6269·6e64·6578·3d22··7604"·tabindex=" | 0003c020:·3736·3034·2220·7461·6269·6e64·6578·3d22··7604"·tabindex=" | ||
| 0003c030:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003c030:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003c040:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003c040:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003c050:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003c050:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003c060:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003c060:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003c070:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003c070:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003c080:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003c080:·6469·6174·696f·6e20·416e·6163·6f6e·6461··diation·Anaconda | |||
| 0003c090:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003c0a0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c0b0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c0c0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c0d0:·3736·3034·223e·3c74·6162·6c65·2063·6c61··7604"><table·cla | |||
| 0003c0e0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003c0f0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003c100:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003c110:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003c120:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003c130:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c140:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c150:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003c160:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c170:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c180:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003c190:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c1a0:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003c1b0:·2d2d·6164·643d·6169·6465·0a3c·2f63·6f64··--add=aide.</cod | |||
| 0003c1c0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c1d0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c1e0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003c1f0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003c200:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003c210:·6d37·3630·3522·2074·6162·696e·6465·783d··m7605"·tabindex= | |||
| 0003c220:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003c230:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003c240:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003c250:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003c260:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003c270:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003c280:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003c290:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c2a0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c2b0:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003c2c0:·3630·3522·3e3c·7461·626c·6520·636c·6173··605"><table·clas | |||
| 0003c2d0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c2e0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c2f0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c300:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c310:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c320:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c330:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c340:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c350:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c360:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c370:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003c380:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c390:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003c3a0:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003c3b0:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003c3c0:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003c3d0:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003c3e0:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003c3f0:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003c400:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c410:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c420:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c430:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003c440:·7461·2d74·6172·6765·743d·2223·6964·6d37··ta-target="#idm7 | |||
| 0003c450:·3630·3622·2074·6162·696e·6465·783d·2230··606"·tabindex="0 | |||
| 0003c460:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c470:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c480:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c490:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003c4a0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003c4b0:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003c | 0003c090:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | ||
| 0003c | 0003c0a0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | ||
| 0003c | 0003c0b0:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | ||
| 0003c | 0003c0c0:·6c61·7073·6522·2069·643d·2269·646d·3736··lapse"·id="idm76 | ||
| 0003c | 0003c0d0:·3034·223e·3c74·6162·6c65·2063·6c61·7373··04"><table·class | ||
| 0003c | 0003c0e0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | ||
| 0003c | 0003c0f0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003c | 0003c100:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003c | 0003c110:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | ||
| 0003c | 0003c120:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | ||
| 0003c | 0003c130:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003c | 0003c140:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | ||
| 0003c | 0003c150:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | ||
| 0003c | 0003c160:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003c | 0003c170:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | ||
| 0003c | 0003c180:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | ||
| 0003c | 0003c190:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | ||
| 0003c1a0:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003c1b0:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003c1c0:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003c1d0:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003c1e0:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003c1f0:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003c200:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003c5d0:·636f·6465·3e2d·206e·616d·653a·2045·6e73··code>-·name:·Ens | |||
| 0003c5e0:·7572·6520·6169·6465·2069·7320·696e·7374··ure·aide·is·inst | |||
| 0003c5f0:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 0003c600:·0a20·2020·206e·616d·653a·2061·6964·650a··.····name:·aide. | |||
| 0003c610:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | |||
| 0003c620:·6e74·0a20·2077·6865·6e3a·2061·6e73·6962··nt.··when:·ansib | |||
| 0003c630:·6c65·5f76·6972·7475·616c·697a·6174·696f··le_virtualizatio | |||
| 0003c640:·6e5f·7479·7065·206e·6f74·2069·6e20·5b22··n_type·not·in·[" | |||
| 0003c650:·646f·636b·6572·222c·2022·6c78·6322·2c20··docker",·"lxc",· | |||
| 0003c660:·226f·7065·6e76·7a22·2c20·2270·6f64·6d61··"openvz",·"podma | |||
| 0003c670:·6e22·2c20·2263·6f6e·7461·696e·6572·225d··n",·"container"] | |||
| Max diff block lines reached; 18703908/18729906 bytes (99.86%) of diff not shown. | |||
| Offset 14406, 15 lines modified | Offset 14406, 15 lines modified | ||
| 00038450:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00038450:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00038460:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00038460:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00038470:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00038470:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00038480:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00038480:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00038490:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00038490:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 000384a0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 000384a0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 000384b0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 000384b0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 000384c0:·3230·323 | 000384c0:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 000384d0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 000384d0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 000384e0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 000384e0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 000384f0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 000384f0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00038500:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00038500:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00038510:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00038510:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00038520:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00038520:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00038530:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00038530:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15352, 189 lines modified | Offset 15352, 189 lines modified | ||
| 0003bf70:·612d·7461·7267·6574·3d22·2369·646d·3736··a-target="#idm76 | 0003bf70:·612d·7461·7267·6574·3d22·2369·646d·3736··a-target="#idm76 | ||
| 0003bf80:·3034·2220·7461·6269·6e64·6578·3d22·3022··04"·tabindex="0" | 0003bf80:·3034·2220·7461·6269·6e64·6578·3d22·3022··04"·tabindex="0" | ||
| 0003bf90:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003bf90:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003bfa0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003bfa0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003bfb0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003bfb0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003bfc0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003bfc0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003bfd0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003bfd0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003bfe0:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003bfe0:·6174·696f·6e20·416e·6163·6f6e·6461·2073··ation·Anaconda·s | |||
| 0003bff0:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c000:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c010:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c020:·6c61·7073·6522·2069·643d·2269·646d·3736··lapse"·id="idm76 | |||
| 0003c030:·3034·223e·3c74·6162·6c65·2063·6c61·7373··04"><table·class | |||
| 0003c040:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c050:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c060:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003c070:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c080:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003c090:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c0a0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003c0b0:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003c0c0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c0d0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003c0e0:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003c0f0:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c100:·636f·6465·3e0a·7061·636b·6167·6520·2d2d··code>.package·-- | |||
| 0003c110:·6164·643d·6169·6465·0a3c·2f63·6f64·653e··add=aide.</code> | |||
| 0003c120:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c130:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c140:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c150:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003c160:·7461·2d74·6172·6765·743d·2223·6964·6d37··ta-target="#idm7 | |||
| 0003c170:·3630·3522·2074·6162·696e·6465·783d·2230··605"·tabindex="0 | |||
| 0003c180:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c190:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c1a0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c1b0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003c1c0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003c1d0:·6961·7469·6f6e·2050·7570·7065·7420·736e··iation·Puppet·sn | |||
| 0003c1e0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c1f0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c200:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c210:·6170·7365·2220·6964·3d22·6964·6d37·3630··apse"·id="idm760 | |||
| 0003c220:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 0003c230:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003c240:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003c250:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003c260:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003c270:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003c280:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003c290:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003c2a0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c2b0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003c2c0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003c2d0:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003c2e0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003c2f0:·6f64·653e·696e·636c·7564·6520·696e·7374··ode>include·inst | |||
| 0003c300:·616c·6c5f·6169·6465·0a0a·636c·6173·7320··all_aide..class· | |||
| 0003c310:·696e·7374·616c·6c5f·6169·6465·207b·0a20··install_aide·{.· | |||
| 0003c320:·2070·6163·6b61·6765·207b·2027·6169·6465···package·{·'aide | |||
| 0003c330:·273a·0a20·2020·2065·6e73·7572·6520·3d26··':.····ensure·=& | |||
| 0003c340:·6774·3b20·2769·6e73·7461·6c6c·6564·272c··gt;·'installed', | |||
| 0003c350:·0a20·207d·0a7d·0a3c·2f63·6f64·653e·3c2f··.··}.}.</code></ | |||
| 0003c360:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c370:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c380:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c390:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c3a0:·2d74·6172·6765·743d·2223·6964·6d37·3630··-target="#idm760 | |||
| 0003c3b0:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | |||
| 0003c3c0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c3d0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c3e0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c3f0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c400:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c410:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003 | 0003bff0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | ||
| 0003c | 0003c000:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | ||
| 0003c | 0003c010:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | ||
| 0003c | 0003c020:·7073·6522·2069·643d·2269·646d·3736·3034··pse"·id="idm7604 | ||
| 0003c | 0003c030:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | ||
| 0003c | 0003c040:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | ||
| 0003c | 0003c050:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | ||
| 0003c | 0003c060:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | ||
| 0003c | 0003c070:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | ||
| 0003c | 0003c080:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | ||
| 0003c | 0003c090:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003c0a0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | ||
| 0003c | 0003c0b0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003c | 0003c0c0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | ||
| 0003c | 0003c0d0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | ||
| 0003c | 0003c0e0:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | ||
| 0003c | 0003c0f0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | ||
| 0003c100:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003c110:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003c120:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003c130:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003c140:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003c150:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003c160:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003c170:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c180:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c190:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c1a0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c1b0:·7461·7267·6574·3d22·2369·646d·3736·3035··target="#idm7605 | |||
| 0003c1c0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c1d0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c1e0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c1f0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c200:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c210:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| Max diff block lines reached; 7440324/7466184 bytes (99.65%) of diff not shown. | |||
| Offset 58, 15 lines modified | Offset 58, 15 lines modified | ||
| 58 | ··············Server | 58 | ··············Server |
| 59 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 | 59 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 |
| 60 | ***·CPE·Platforms·*** | 60 | ***·CPE·Platforms·*** |
| 61 | ····*·cpe:/o:redhat:enterprise_linux:9 | 61 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 62 | ····*·cpe:/o:centos:centos:9 | 62 | ····*·cpe:/o:centos:centos:9 |
| 63 | *****·Revision·History·***** | 63 | *****·Revision·History·***** |
| 64 | Current·version:·0.1.65 | 64 | Current·version:·0.1.65 |
| 65 | ····*·draft·(as·of·202 | 65 | ····*·draft·(as·of·2025-02-23) |
| 66 | *****·Table·of·Contents·***** | 66 | *****·Table·of·Contents·***** |
| 67 | ···1.·System_Settings | 67 | ···1.·System_Settings |
| 68 | ·········1.·Installing_and_Maintaining_Software | 68 | ·········1.·Installing_and_Maintaining_Software |
| 69 | ·········2.·Account_and_Access_Control | 69 | ·········2.·Account_and_Access_Control |
| 70 | ·········3.·GRUB2_bootloader_configuration | 70 | ·········3.·GRUB2_bootloader_configuration |
| 71 | ·········4.·Configure_Syslog | 71 | ·········4.·Configure_Syslog |
| 72 | ·········5.·Network_Configuration_and_Firewalls | 72 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 103, 31 lines modified | Offset 103, 39 lines modified | ||
| 103 | ***·Rule ·Install·AIDE· [ref]·*** | 103 | ***·Rule ·Install·AIDE· [ref]·*** |
| 104 | The·aide·package·can·be·installed·with·the·following·command: | 104 | The·aide·package·can·be·installed·with·the·following·command: |
| 105 | $·sudo·dnf·install·aide | 105 | $·sudo·dnf·install·aide |
| 106 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 106 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 107 | Severity: ················medium | 107 | Severity: ················medium |
| 108 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 108 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 109 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 109 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 110 | Remediation_Anaconda_snippet_⇲ | ||
| 111 | Complexity:·low | ||
| 112 | Disruption:·low | ||
| 113 | Strategy:···enable | ||
| 114 | package·--add=aide | ||
| 115 | Remediation_Puppet_snippet_⇲ | 110 | Remediation_Puppet_snippet_⇲ |
| 116 | Complexity:·low | 111 | Complexity:·low |
| 117 | Disruption:·low | 112 | Disruption:·low |
| 118 | Strategy:···enable | 113 | Strategy:···enable |
| 119 | include·install_aide | 114 | include·install_aide |
| 120 | class·install_aide·{ | 115 | class·install_aide·{ |
| 121 | ··package·{·'aide': | 116 | ··package·{·'aide': |
| 122 | ····ensure·=>·'installed', | 117 | ····ensure·=>·'installed', |
| 123 | ··} | 118 | ··} |
| 124 | } | 119 | } |
| 120 | Remediation_Shell_script_⇲ | ||
| 121 | Complexity:·low | ||
| 122 | Disruption:·low | ||
| 123 | Strategy:···enable | ||
| 124 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 125 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 126 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 127 | ····dnf·install·-y·"aide" | ||
| 128 | fi | ||
| 129 | else | ||
| 130 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 131 | fi | ||
| 125 | Remediation_Ansible_snippet_⇲ | 132 | Remediation_Ansible_snippet_⇲ |
| 126 | Complexity:·low | 133 | Complexity:·low |
| 127 | Disruption:·low | 134 | Disruption:·low |
| 128 | Strategy:···enable | 135 | Strategy:···enable |
| 129 | -·name:·Ensure·aide·is·installed | 136 | -·name:·Ensure·aide·is·installed |
| 130 | ··package: | 137 | ··package: |
| 131 | ····name:·aide | 138 | ····name:·aide |
| Offset 144, 40 lines modified | Offset 152, 46 lines modified | ||
| 144 | ··-·no_reboot_needed | 152 | ··-·no_reboot_needed |
| 145 | ··-·package_aide_installed | 153 | ··-·package_aide_installed |
| 146 | Remediation_OSBuild_Blueprint_snippet_⇲ | 154 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 147 | [[packages]] | 155 | [[packages]] |
| 148 | name·=·"aide" | 156 | name·=·"aide" |
| 149 | version·=·"*" | 157 | version·=·"*" |
| 150 | Remediation_ | 158 | Remediation_Anaconda_snippet_⇲ |
| 151 | Complexity:·low | 159 | Complexity:·low |
| 152 | Disruption:·low | 160 | Disruption:·low |
| 153 | Strategy:···enable | 161 | Strategy:···enable |
| 154 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 155 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | package·--add=aide | ||
| 156 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 157 | ····dnf·install·-y·"aide" | ||
| 158 | fi | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 164 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/sbin/aide·--init | 165 | $·sudo·/usr/sbin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 166 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 167 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 167 | To·initiate·a·manual·check,·run·the·following·command: | 168 | To·initiate·a·manual·check,·run·the·following·command: |
| 168 | $·sudo·/usr/sbin/aide·--check | 169 | $·sudo·/usr/sbin/aide·--check |
| 169 | If·this·check·produces·any·unexpected·output,·investigate. | 170 | If·this·check·produces·any·unexpected·output,·investigate. |
| 170 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 171 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 171 | Severity: ················medium | 172 | Severity: ················medium |
| 172 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 173 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 173 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 174 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 175 | Remediation_Shell_script_⇲ | ||
| 176 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 177 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 178 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 179 | ····dnf·install·-y·"aide" | ||
| 180 | fi | ||
| 181 | /usr/sbin/aide·--init | ||
| 182 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 183 | else | ||
| 184 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 185 | fi | ||
| 174 | Remediation_Ansible_snippet_⇲ | 186 | Remediation_Ansible_snippet_⇲ |
| 175 | Complexity:·low | 187 | Complexity:·low |
| 176 | Disruption:·low | 188 | Disruption:·low |
| 177 | Strategy:···restrict | 189 | Strategy:···restrict |
| 178 | -·name:·Ensure·AIDE·is·installed | 190 | -·name:·Ensure·AIDE·is·installed |
| 179 | ··package: | 191 | ··package: |
| 180 | ····name:·'{{·item·}}' | 192 | ····name:·'{{·item·}}' |
| Offset 242, 42 lines modified | Offset 256, 46 lines modified | ||
| 242 | ··-·PCI-DSS-Req-11.5 | 256 | ··-·PCI-DSS-Req-11.5 |
| 243 | ··-·aide_build_database | 257 | ··-·aide_build_database |
| 244 | ··-·low_complexity | 258 | ··-·low_complexity |
| 245 | ··-·low_disruption | 259 | ··-·low_disruption |
| 246 | ··-·medium_severity | 260 | ··-·medium_severity |
| 247 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 248 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| 249 | Remediation_Shell_script_⇲ | ||
| 250 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| Max diff block lines reached; 952725/958512 bytes (99.40%) of diff not shown. | |||
| Offset 14407, 15 lines modified | Offset 14407, 15 lines modified | ||
| 00038460:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00038460:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00038470:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00038470:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00038480:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00038480:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00038490:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00038490:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 000384a0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 000384a0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 000384b0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 000384b0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 000384c0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 000384c0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 000384d0:·3032·3 | 000384d0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 000384e0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 000384e0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 000384f0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 000384f0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038500:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038500:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00038510:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00038510:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00038520:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00038520:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00038530:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00038530:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00038540:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00038540:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15348, 189 lines modified | Offset 15348, 189 lines modified | ||
| 0003bf30:·7267·6574·3d22·2369·646d·3736·3034·2220··rget="#idm7604"· | 0003bf30:·7267·6574·3d22·2369·646d·3736·3034·2220··rget="#idm7604"· | ||
| 0003bf40:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003bf40:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003bf50:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003bf50:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003bf60:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003bf60:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003bf70:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003bf70:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003bf80:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003bf80:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003bf90:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003bf90:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003bfa0:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003bfa0:·6e20·416e·6163·6f6e·6461·2073·6e69·7070··n·Anaconda·snipp | |||
| 0003bfb0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003bfc0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003bfd0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003bfe0:·6522·2069·643d·2269·646d·3736·3034·223e··e"·id="idm7604"> | |||
| 0003bff0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c000:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c010:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c020:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c030:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c040:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003c050:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c060:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c070:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c080:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003c090:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003c0a0:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003c0b0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c0c0:·3e0a·7061·636b·6167·6520·2d2d·6164·643d··>.package·--add= | |||
| 0003c0d0:·6169·6465·0a3c·2f63·6f64·653e·3c2f·7072··aide.</code></pr | |||
| 0003c0e0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c0f0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c100:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c110:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c120:·6172·6765·743d·2223·6964·6d37·3630·3522··arget="#idm7605" | |||
| 0003c130:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c140:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c150:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c160:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c170:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c180:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c190:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003c1a0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c1b0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c1c0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c1d0:·2220·6964·3d22·6964·6d37·3630·3522·3e3c··"·id="idm7605">< | |||
| 0003c1e0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c1f0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c200:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c210:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c220:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c230:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003c240:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c250:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c260:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c270:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003c280:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003c290:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003c2a0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c2b0:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003c2c0:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003c2d0:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003c2e0:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003c2f0:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003c300:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003c310:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003c320:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c330:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003c340:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003c350:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003c360:·6765·743d·2223·6964·6d37·3630·3622·2074··get="#idm7606"·t | |||
| 0003c370:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c380:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c390:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c3a0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c3b0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003c3c0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003c3d0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003 | 0003bfb0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | ||
| 0003 | 0003bfc0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | ||
| 0003 | 0003bfd0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | ||
| 0003 | 0003bfe0:·2069·643d·2269·646d·3736·3034·223e·3c74···id="idm7604"><t | ||
| 0003 | 0003bff0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | ||
| 0003c | 0003c000:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | ||
| 0003c | 0003c010:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | ||
| 0003c | 0003c020:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | ||
| 0003c | 0003c030:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | ||
| 0003c | 0003c040:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | ||
| 0003c | 0003c050:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | ||
| 0003c | 0003c060:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | ||
| 0003c | 0003c070:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003c | 0003c080:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | ||
| 0003c | 0003c090:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | ||
| 0003c | 0003c0a0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | ||
| 0003c | 0003c0b0:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | ||
| 0003c0c0:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003c0d0:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003c0e0:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003c0f0:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003c100:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003c110:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003c4f0:·206e·616d·653a·2045·6e73·7572·6520·6169···name:·Ensure·ai | |||
| 0003c500:·6465·2069·7320·696e·7374·616c·6c65·640a··de·is·installed. | |||
| 0003c510:·2020·7061·636b·6167·653a·0a20·2020·206e····package:.····n | |||
| 0003c520:·616d·653a·2061·6964·650a·2020·2020·7374··ame:·aide.····st | |||
| 0003c530:·6174·653a·2070·7265·7365·6e74·0a20·2077··ate:·present.··w | |||
| 0003c540:·6865·6e3a·2061·6e73·6962·6c65·5f76·6972··hen:·ansible_vir | |||
| 0003c550:·7475·616c·697a·6174·696f·6e5f·7479·7065··tualization_type | |||
| 0003c560:·206e·6f74·2069·6e20·5b22·646f·636b·6572···not·in·["docker | |||
| 0003c570:·222c·2022·6c78·6322·2c20·226f·7065·6e76··",·"lxc",·"openv | |||
| 0003c580:·7a22·2c20·2270·6f64·6d61·6e22·2c20·2263··z",·"podman",·"c | |||
| 0003c590:·6f6e·7461·696e·6572·225d·0a20·2074·6167··ontainer"].··tag | |||
| 0003c5a0:·733a·0a20·202d·2043·4a49·532d·352e·3130··s:.··-·CJIS-5.10 | |||
| Max diff block lines reached; 7358532/7384392 bytes (99.65%) of diff not shown. | |||
| Offset 58, 15 lines modified | Offset 58, 15 lines modified | ||
| 58 | ··············Workstation | 58 | ··············Workstation |
| 59 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 | 59 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 |
| 60 | ***·CPE·Platforms·*** | 60 | ***·CPE·Platforms·*** |
| 61 | ····*·cpe:/o:redhat:enterprise_linux:9 | 61 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 62 | ····*·cpe:/o:centos:centos:9 | 62 | ····*·cpe:/o:centos:centos:9 |
| 63 | *****·Revision·History·***** | 63 | *****·Revision·History·***** |
| 64 | Current·version:·0.1.65 | 64 | Current·version:·0.1.65 |
| 65 | ····*·draft·(as·of·202 | 65 | ····*·draft·(as·of·2025-02-23) |
| 66 | *****·Table·of·Contents·***** | 66 | *****·Table·of·Contents·***** |
| 67 | ···1.·System_Settings | 67 | ···1.·System_Settings |
| 68 | ·········1.·Installing_and_Maintaining_Software | 68 | ·········1.·Installing_and_Maintaining_Software |
| 69 | ·········2.·Account_and_Access_Control | 69 | ·········2.·Account_and_Access_Control |
| 70 | ·········3.·GRUB2_bootloader_configuration | 70 | ·········3.·GRUB2_bootloader_configuration |
| 71 | ·········4.·Configure_Syslog | 71 | ·········4.·Configure_Syslog |
| 72 | ·········5.·Network_Configuration_and_Firewalls | 72 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | ***·Rule ·Install·AIDE· [ref]·*** | 102 | ***·Rule ·Install·AIDE· [ref]·*** |
| 103 | The·aide·package·can·be·installed·with·the·following·command: | 103 | The·aide·package·can·be·installed·with·the·following·command: |
| 104 | $·sudo·dnf·install·aide | 104 | $·sudo·dnf·install·aide |
| 105 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 105 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 106 | Severity: ················medium | 106 | Severity: ················medium |
| 107 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 107 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 108 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 108 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····dnf·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 143, 40 lines modified | Offset 151, 46 lines modified | ||
| 143 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 144 | ··-·package_aide_installed | 152 | ··-·package_aide_installed |
| 145 | Remediation_OSBuild_Blueprint_snippet_⇲ | 153 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 146 | [[packages]] | 154 | [[packages]] |
| 147 | name·=·"aide" | 155 | name·=·"aide" |
| 148 | version·=·"*" | 156 | version·=·"*" |
| 149 | Remediation_ | 157 | Remediation_Anaconda_snippet_⇲ |
| 150 | Complexity:·low | 158 | Complexity:·low |
| 151 | Disruption:·low | 159 | Disruption:·low |
| 152 | Strategy:···enable | 160 | Strategy:···enable |
| 153 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 154 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | package·--add=aide | ||
| 155 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 156 | ····dnf·install·-y·"aide" | ||
| 157 | fi | ||
| 158 | else | ||
| 159 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 160 | fi | ||
| 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 162 | Run·the·following·command·to·generate·a·new·database: | 163 | Run·the·following·command·to·generate·a·new·database: |
| 163 | $·sudo·/usr/sbin/aide·--init | 164 | $·sudo·/usr/sbin/aide·--init |
| 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 165 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 166 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 166 | To·initiate·a·manual·check,·run·the·following·command: | 167 | To·initiate·a·manual·check,·run·the·following·command: |
| 167 | $·sudo·/usr/sbin/aide·--check | 168 | $·sudo·/usr/sbin/aide·--check |
| 168 | If·this·check·produces·any·unexpected·output,·investigate. | 169 | If·this·check·produces·any·unexpected·output,·investigate. |
| 169 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 170 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 170 | Severity: ················medium | 171 | Severity: ················medium |
| 171 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 172 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 172 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 173 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 174 | Remediation_Shell_script_⇲ | ||
| 175 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 176 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 177 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 178 | ····dnf·install·-y·"aide" | ||
| 179 | fi | ||
| 180 | /usr/sbin/aide·--init | ||
| 181 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 182 | else | ||
| 183 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 184 | fi | ||
| 173 | Remediation_Ansible_snippet_⇲ | 185 | Remediation_Ansible_snippet_⇲ |
| 174 | Complexity:·low | 186 | Complexity:·low |
| 175 | Disruption:·low | 187 | Disruption:·low |
| 176 | Strategy:···restrict | 188 | Strategy:···restrict |
| 177 | -·name:·Ensure·AIDE·is·installed | 189 | -·name:·Ensure·AIDE·is·installed |
| 178 | ··package: | 190 | ··package: |
| 179 | ····name:·'{{·item·}}' | 191 | ····name:·'{{·item·}}' |
| Offset 241, 42 lines modified | Offset 255, 46 lines modified | ||
| 241 | ··-·PCI-DSS-Req-11.5 | 255 | ··-·PCI-DSS-Req-11.5 |
| 242 | ··-·aide_build_database | 256 | ··-·aide_build_database |
| 243 | ··-·low_complexity | 257 | ··-·low_complexity |
| 244 | ··-·low_disruption | 258 | ··-·low_disruption |
| 245 | ··-·medium_severity | 259 | ··-·medium_severity |
| 246 | ··-·no_reboot_needed | 260 | ··-·no_reboot_needed |
| 247 | ··-·restrict_strategy | 261 | ··-·restrict_strategy |
| 248 | Remediation_Shell_script_⇲ | ||
| 249 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| Max diff block lines reached; 939900/945697 bytes (99.39%) of diff not shown. | |||
| Offset 14407, 15 lines modified | Offset 14407, 15 lines modified | ||
| 00038460:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00038460:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00038470:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00038470:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00038480:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00038480:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00038490:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00038490:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 000384a0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 000384a0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 000384b0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 000384b0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 000384c0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 000384c0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 000384d0:·3032·3 | 000384d0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 000384e0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 000384e0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 000384f0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 000384f0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038500:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038500:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00038510:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00038510:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00038520:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00038520:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00038530:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00038530:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00038540:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00038540:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15358, 190 lines modified | Offset 15358, 190 lines modified | ||
| 0003bfd0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003bfd0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003bfe0:·2223·6964·6d37·3630·3422·2074·6162·696e··"#idm7604"·tabin | 0003bfe0:·2223·6964·6d37·3630·3422·2074·6162·696e··"#idm7604"·tabin | ||
| 0003bff0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003bff0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c000:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c000:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c010:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c010:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c020:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c020:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c030:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c030:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c040:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c040:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003c050:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003c060:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c070:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c080:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c090:·3d22·6964·6d37·3630·3422·3e3c·7461·626c··="idm7604"><tabl | |||
| 0003c0a0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c0b0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c0c0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003c0d0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003c0e0:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003c0f0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c100:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c110:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c120:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c130:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c140:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003c150:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c160:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003c170:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003c180:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c190:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c1a0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c1b0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c1c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c1d0:·3d22·2369·646d·3736·3035·2220·7461·6269··="#idm7605"·tabi | |||
| 0003c1e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c1f0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c200:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c210:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c220:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c230:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003c240:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003c250:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c260:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c270:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c280:·2269·646d·3736·3035·223e·3c74·6162·6c65··"idm7605"><table | |||
| 0003c290:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c2a0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c2b0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c2c0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c2d0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c2e0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c2f0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003c300:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003c310:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003c320:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003c330:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003c340:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003c350:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003c360:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003c370:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003c380:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003c390:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003c3a0:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003c3b0:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003c3c0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c3d0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c3e0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c3f0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c400:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c410:·2369·646d·3736·3036·2220·7461·6269·6e64··#idm7606"·tabind | |||
| 0003c420:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c430:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c440:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c450:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c460:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c470:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003c | 0003c050:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003c | 0003c060:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003c | 0003c070:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003c | 0003c080:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003c | 0003c090:·6964·6d37·3630·3422·3e3c·7461·626c·6520··idm7604"><table· | ||
| 0003c | 0003c0a0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003c | 0003c0b0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003c | 0003c0c0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003c | 0003c0d0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003c | 0003c0e0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003c | 0003c0f0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003c100:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003c | 0003c110:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003c | 0003c120:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003c130:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003c | 0003c140:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003c | 0003c150:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003c | 0003c160:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | ||
| 0003c170:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003c180:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003c190:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003c1a0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003c1b0:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003c1c0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003c5a0:·3a20·456e·7375·7265·2061·6964·6520·6973··:·Ensure·aide·is | |||
| 0003c5b0:·2069·6e73·7461·6c6c·6564·0a20·2070·6163···installed.··pac | |||
| 0003c5c0:·6b61·6765·3a0a·2020·2020·6e61·6d65·3a20··kage:.····name:· | |||
| 0003c5d0:·6169·6465·0a20·2020·2073·7461·7465·3a20··aide.····state:· | |||
| 0003c5e0:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 0003c5f0:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003c600:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003c610:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003c620:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003c630:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003c640:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0003c650:·2d20·434a·4953·2d35·2e31·302e·312e·330a··-·CJIS-5.10.1.3. | |||
| Max diff block lines reached; 18635441/18661439 bytes (99.86%) of diff not shown. | |||
| Offset 14448, 15 lines modified | Offset 14448, 15 lines modified | ||
| 000386f0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 000386f0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038700:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038700:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038710:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038710:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038720:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038720:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038730:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038730:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038740:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038740:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038750:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038750:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038760:·3 | 00038760:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038770:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038770:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038780:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038780:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038790:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038790:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 000387a0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 000387a0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 000387b0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 000387b0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 000387c0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 000387c0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 000387d0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 000387d0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15184, 175 lines modified | Offset 15184, 175 lines modified | ||
| 0003b4f0:·612d·7461·7267·6574·3d22·2369·646d·3830··a-target="#idm80 | 0003b4f0:·612d·7461·7267·6574·3d22·2369·646d·3830··a-target="#idm80 | ||
| 0003b500:·3837·2220·7461·6269·6e64·6578·3d22·3022··87"·tabindex="0" | 0003b500:·3837·2220·7461·6269·6e64·6578·3d22·3022··87"·tabindex="0" | ||
| 0003b510:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003b510:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003b520:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003b520:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003b530:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003b530:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003b540:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003b540:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003b550:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003b550:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003b560:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003b570:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003b580:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003b590:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003b5a0:·6170·7365·2220·6964·3d22·6964·6d38·3038··apse"·id="idm808 | |||
| 0003b5b0:·3722·3e3c·7461·626c·6520·636c·6173·733d··7"><table·class= | |||
| 0003b5c0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003b5 | 0003b560:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | ||
| 0003b570:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003b580:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003b590:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003b5a0:·6522·2069·643d·2269·646d·3830·3837·223e··e"·id="idm8087"> | |||
| 0003b5b0:·3c70·7265·3e3c·636f·6465·3e23·2052·656d··<pre><code>#·Rem | |||
| 0003b5c0:·6564·6961·7469·6f6e·2069·7320·6170·706c··ediation·is·appl | |||
| 0003b5d0:·6963·6162·6c65·206f·6e6c·7920·696e·2063··icable·only·in·c | |||
| 0003b5e0:·6572·7461·696e·2070·6c61·7466·6f72·6d73··ertain·platforms | |||
| 0003b5f0:·0a69·6620·5b20·2120·2d66·202f·2e64·6f63··.if·[·!·-f·/.doc | |||
| 0003b600:·6b65·7265·6e76·205d·2026·616d·703b·2661··kerenv·]·&&a | |||
| 0003b610:·6d70·3b20·5b20·2120·2d66·202f·7275·6e2f··mp;·[·!·-f·/run/ | |||
| 0003b620:·2e63·6f6e·7461·696e·6572·656e·7620·5d3b··.containerenv·]; | |||
| 0003b630:·2074·6865·6e0a·0a66·6970·732d·6d6f·6465···then..fips-mode | |||
| 0003b640:·2d73·6574·7570·202d·2d65·6e61·626c·650a··-setup·--enable. | |||
| 0003b650:·4649·5053·5f43·4f4e·463d·222f·6574·632f··FIPS_CONF="/etc/ | |||
| 0003b660:·6472·6163·7574·2e63·6f6e·662e·642f·3430··dracut.conf.d/40 | |||
| 0003b670:·2d66·6970·732e·636f·6e66·220a·6966·2021··-fips.conf".if·! | |||
| 0003b680:·2067·7265·7020·225e·6164·645f·6472·6163···grep·"^add_drac | |||
| 0003b690:·7574·6d6f·6475·6c65·732b·3d5c·2220·6669··utmodules+=\"·fi | |||
| 0003b6a0:·7073·205c·2222·2024·4649·5053·5f43·4f4e··ps·\""·$FIPS_CON | |||
| 0003b6b0:·463b·2074·6865·6e0a·2020·2020·6563·686f··F;·then.····echo | |||
| 0003b6c0:·2022·6164·645f·6472·6163·7574·6d6f·6475···"add_dracutmodu | |||
| 0003b6d0:·6c65·732b·3d5c·2220·6669·7073·205c·2222··les+=\"·fips·\"" | |||
| 0003b6e0:·2026·6774·3b26·6774·3b20·2446·4950·535f···>>·$FIPS_ | |||
| 0003b6f0:·434f·4e46·0a66·690a·0a65·6c73·650a·2020··CONF.fi..else.·· | |||
| 0003b700:·2020·2667·743b·2661·6d70·3b32·2065·6368····>&2·ech | |||
| 0003b710:·6f20·2752·656d·6564·6961·7469·6f6e·2069··o·'Remediation·i | |||
| 0003b720:·7320·6e6f·7420·6170·706c·6963·6162·6c65··s·not·applicable | |||
| 0003b730:·2c20·6e6f·7468·696e·6720·7761·7320·646f··,·nothing·was·do | |||
| 0003b740:·6e65·270a·6669·0a3c·2f63·6f64·653e·3c2f··ne'.fi.</code></ | |||
| 0003b750:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003b760:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003b770:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003b780:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003b790:·2d74·6172·6765·743d·2223·6964·6d38·3038··-target="#idm808 | |||
| 0003b7a0:·3822·2074·6162·696e·6465·783d·2230·2220··8"·tabindex="0"· | |||
| 0003b7b0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003b7c0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003b7d0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003b7e0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003b7f0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003b800:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003b810:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003b820:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003b830:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003b840:·7073·6522·2069·643d·2269·646d·3830·3838··pse"·id="idm8088 | |||
| 0003b850:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003b860:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003b | 0003b870:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | ||
| 0003b5f0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003b600:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003b610:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003b620:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003b630:·696f·6e3a·3c2f·7468·3e3c·7464·3e6d·6564··ion:</th><td>med | |||
| 0003b640:·6975·6d3c·2f74·643e·3c2f·7472·3e3c·7472··ium</td></tr><tr | |||
| 0003b650:·3e3c·7468·3e52·6562·6f6f·743a·3c2f·7468··><th>Reboot:</th | |||
| 0003b660:·3e3c·7464·3e74·7275·653c·2f74·643e·3c2f··><td>true</td></ | |||
| 0003b670:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003b680:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 0003b690:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 0003b6a0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003b6b0:·653e·2d20·6e61·6d65·3a20·4368·6563·6b20··e>-·name:·Check· | |||
| 0003b6c0:·746f·2073·6565·2074·6865·2063·7572·7265··to·see·the·curre | |||
| 0003b6d0:·6e74·2073·7461·7475·7320·6f66·2046·4950··nt·status·of·FIP | |||
| 0003b6e0:·5320·6d6f·6465·0a20·2063·6f6d·6d61·6e64··S·mode.··command | |||
| 0003b6f0:·3a20·2f75·7372·2f62·696e·2f66·6970·732d··:·/usr/bin/fips- | |||
| 0003b700:·6d6f·6465·2d73·6574·7570·202d·2d63·6865··mode-setup·--che | |||
| 0003b | 0003b880:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | ||
| 0003b890:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003b8a0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003b8b0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003b8c0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003b8d0:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003b8e0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003b8f0:·3c74·683e·5265·626f·6f74·3a3c·2f74·683e··<th>Reboot:</th> | |||
| 0003b900:·3c74·643e·7472·7565·3c2f·7464·3e3c·2f74··<td>true</td></t | |||
| 0003b910:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003b920:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003b930:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 0003b940:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003b950:·3e2d·206e·616d·653a·2043·6865·636b·2074··>-·name:·Check·t | |||
| 0003b960:·6f20·7365·6520·7468·6520·6375·7272·656e··o·see·the·curren | |||
| 0003b970:·7420·7374·6174·7573·206f·6620·4649·5053··t·status·of·FIPS | |||
| 0003b980:·206d·6f64·650a·2020·636f·6d6d·616e·643a···mode.··command: | |||
| 0003b990:·202f·7573·722f·6269·6e2f·6669·7073·2d6d···/usr/bin/fips-m | |||
| 0003b9a0:·6f64·652d·7365·7475·7020·2d2d·6368·6563··ode-setup·--chec | |||
| 0003b9b0:·6b0a·2020·7265·6769·7374·6572·3a20·6973··k.··register:·is | |||
| 0003b9c0:·5f66·6970·735f·656e·6162·6c65·640a·2020··_fips_enabled.·· | |||
| 0003b9d0:·6368·616e·6765·645f·7768·656e·3a20·6661··changed_when:·fa | |||
| 0003b9e0:·6c73·650a·2020·6661·696c·6564·5f77·6865··lse.··failed_whe | |||
| 0003b9f0:·6e3a·2066·616c·7365·0a20·2077·6865·6e3a··n:·false.··when: | |||
| 0003ba00:·2061·6e73·6962·6c65·5f76·6972·7475·616c···ansible_virtual | |||
| 0003ba10:·697a·6174·696f·6e5f·7479·7065·206e·6f74··ization_type·not | |||
| 0003ba20:·2069·6e20·5b22·646f·636b·6572·222c·2022···in·["docker",·" | |||
| 0003ba30:·6c78·6322·2c20·226f·7065·6e76·7a22·2c20··lxc",·"openvz",· | |||
| 0003ba40:·2270·6f64·6d61·6e22·2c20·2263·6f6e·7461··"podman",·"conta | |||
| Max diff block lines reached; 5853102/5877030 bytes (99.59%) of diff not shown. | |||
| Offset 68, 15 lines modified | Offset 68, 15 lines modified | ||
| 68 | ··············Systems·and·Organizations·(NIST·800-171) | 68 | ··············Systems·and·Organizations·(NIST·800-171) |
| 69 | Profile·ID····xccdf_org.ssgproject.content_profile_cui | 69 | Profile·ID····xccdf_org.ssgproject.content_profile_cui |
| 70 | ***·CPE·Platforms·*** | 70 | ***·CPE·Platforms·*** |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:9 | 71 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 72 | ····*·cpe:/o:centos:centos:9 | 72 | ····*·cpe:/o:centos:centos:9 |
| 73 | *****·Revision·History·***** | 73 | *****·Revision·History·***** |
| 74 | Current·version:·0.1.65 | 74 | Current·version:·0.1.65 |
| 75 | ····*·draft·(as·of·202 | 75 | ····*·draft·(as·of·2025-02-23) |
| 76 | *****·Table·of·Contents·***** | 76 | *****·Table·of·Contents·***** |
| 77 | ···1.·System_Settings | 77 | ···1.·System_Settings |
| 78 | ·········1.·Installing_and_Maintaining_Software | 78 | ·········1.·Installing_and_Maintaining_Software |
| 79 | ·········2.·Account_and_Access_Control | 79 | ·········2.·Account_and_Access_Control |
| 80 | ·········3.·System_Accounting_with_auditd | 80 | ·········3.·System_Accounting_with_auditd |
| 81 | ·········4.·GRUB2_bootloader_configuration | 81 | ·········4.·GRUB2_bootloader_configuration |
| 82 | ·········5.·zIPL_bootloader_configuration | 82 | ·········5.·zIPL_bootloader_configuration |
| Offset 109, 14 lines modified | Offset 109, 27 lines modified | ||
| 109 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 109 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 110 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 110 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 111 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 111 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 112 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 112 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 113 | Severity: ················high | 113 | Severity: ················high |
| 114 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 114 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 115 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 115 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 116 | Remediation_Shell_script_⇲ | ||
| 117 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 118 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 119 | fips-mode-setup·--enable | ||
| 120 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 121 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 122 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 123 | fi | ||
| 124 | else | ||
| 125 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 126 | fi | ||
| 116 | Remediation_Ansible_snippet_⇲ | 127 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·medium | 128 | Complexity:·medium |
| 118 | Disruption:·medium | 129 | Disruption:·medium |
| 119 | Reboot:·····true | 130 | Reboot:·····true |
| 120 | Strategy:···restrict | 131 | Strategy:···restrict |
| 121 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 132 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 122 | ··command:·/usr/bin/fips-mode-setup·--check | 133 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 171, 27 lines modified | Offset 184, 14 lines modified | ||
| 171 | ··-·NIST-800-53-SC-13 | 184 | ··-·NIST-800-53-SC-13 |
| 172 | ··-·enable_dracut_fips_module | 185 | ··-·enable_dracut_fips_module |
| 173 | ··-·high_severity | 186 | ··-·high_severity |
| 174 | ··-·medium_complexity | 187 | ··-·medium_complexity |
| 175 | ··-·medium_disruption | 188 | ··-·medium_disruption |
| 176 | ··-·reboot_required | 189 | ··-·reboot_required |
| 177 | ··-·restrict_strategy | 190 | ··-·restrict_strategy |
| 178 | Remediation_Shell_script_⇲ | ||
| 179 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 180 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 181 | fips-mode-setup·--enable | ||
| 182 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 183 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 184 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 185 | fi | ||
| 186 | else | ||
| 187 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 188 | fi | ||
| 189 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** | 191 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** |
| 190 | To·enable·FIPS·mode,·run·the·following·command: | 192 | To·enable·FIPS·mode,·run·the·following·command: |
| 191 | fips-mode-setup·--enable | 193 | fips-mode-setup·--enable |
| 192 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: | 194 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: |
| 193 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 | 195 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 |
| 194 | ····*·Creating·/etc/system-fips | 196 | ····*·Creating·/etc/system-fips |
| Offset 243, 31 lines modified | Offset 243, 33 lines modified | ||
| 243 | ***·Rule ·Install·crypto-policies·package· [ref]·*** | 243 | ***·Rule ·Install·crypto-policies·package· [ref]·*** |
| 244 | The·crypto-policies·package·can·be·installed·with·the·following·command: | 244 | The·crypto-policies·package·can·be·installed·with·the·following·command: |
| 245 | $·sudo·dnf·install·crypto-policies | 245 | $·sudo·dnf·install·crypto-policies |
| 246 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. | 246 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. |
| 247 | Severity: ················medium | 247 | Severity: ················medium |
| 248 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed | 248 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed |
| 249 | Identifiers·and·References·References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 | 249 | Identifiers·and·References·References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 |
| 250 | Remediation_Anaconda_snippet_⇲ | ||
| 251 | Complexity:·low | ||
| 252 | Disruption:·low | ||
| 253 | Strategy:···enable | ||
| 254 | package·--add=crypto-policies | ||
| 255 | Remediation_Puppet_snippet_⇲ | 250 | Remediation_Puppet_snippet_⇲ |
| 256 | Complexity:·low | 251 | Complexity:·low |
| 257 | Disruption:·low | 252 | Disruption:·low |
| 258 | Strategy:···enable | 253 | Strategy:···enable |
| 259 | include·install_crypto-policies | 254 | include·install_crypto-policies |
| 260 | class·install_crypto-policies·{ | 255 | class·install_crypto-policies·{ |
| 261 | ··package·{·'crypto-policies': | 256 | ··package·{·'crypto-policies': |
| 262 | ····ensure·=>·'installed', | 257 | ····ensure·=>·'installed', |
| 263 | ··} | 258 | ··} |
| 264 | } | 259 | } |
| 260 | Remediation_Shell_script_⇲ | ||
| 261 | Complexity:·low | ||
| 262 | Disruption:·low | ||
| 263 | Strategy:···enable | ||
| 264 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 265 | ····dnf·install·-y·"crypto-policies" | ||
| 266 | fi | ||
| 265 | Remediation_Ansible_snippet_⇲ | 267 | Remediation_Ansible_snippet_⇲ |
| 266 | Complexity:·low | 268 | Complexity:·low |
| 267 | Disruption:·low | 269 | Disruption:·low |
| 268 | Strategy:···enable | 270 | Strategy:···enable |
| 269 | -·name:·Ensure·crypto-policies·is·installed | 271 | -·name:·Ensure·crypto-policies·is·installed |
| 270 | ··package: | 272 | ··package: |
| 271 | ····name:·crypto-policies | 273 | ····name:·crypto-policies |
| Offset 280, 57 lines modified | Offset 282, 49 lines modified | ||
| 280 | ··-·no_reboot_needed | 282 | ··-·no_reboot_needed |
| 281 | ··-·package_crypto-policies_installed | 283 | ··-·package_crypto-policies_installed |
| 282 | Remediation_OSBuild_Blueprint_snippet_⇲ | 284 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 283 | [[packages]] | 285 | [[packages]] |
| 284 | name·=·"crypto-policies" | 286 | name·=·"crypto-policies" |
| 285 | version·=·"*" | 287 | version·=·"*" |
| 286 | Remediation_ | 288 | Remediation_Anaconda_snippet_⇲ |
| 287 | Complexity:·low | 289 | Complexity:·low |
| 288 | Disruption:·low | 290 | Disruption:·low |
| 289 | Strategy:···enable | 291 | Strategy:···enable |
| 292 | package·--add=crypto-policies | ||
| 290 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 291 | ····dnf·install·-y·"crypto-policies" | ||
| Max diff block lines reached; 804973/811140 bytes (99.24%) of diff not shown. | |||
| Offset 14413, 16 lines modified | Offset 14413, 16 lines modified | ||
| 000384c0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 000384c0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 000384d0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 000384d0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 000384e0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 000384e0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 000384f0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 000384f0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00038500:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00038500:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00038510:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00038510:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00038520:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038520:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038530:·2028·6173·206f·6620·3230·323 | 00038530:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00038540:·323 | 00038540:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00038550:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00038550:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00038560:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00038560:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00038570:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00038570:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00038580:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00038580:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00038590:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00038590:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 000385a0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 000385a0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 000385b0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 000385b0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | ||
| Offset 15354, 324 lines modified | Offset 15354, 324 lines modified | ||
| 0003bf90:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003bf90:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003bfa0:·646d·3732·3733·2220·7461·6269·6e64·6578··dm7273"·tabindex | 0003bfa0:·646d·3732·3733·2220·7461·6269·6e64·6578··dm7273"·tabindex | ||
| 0003bfb0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003bfb0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003bfc0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003bfc0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003bfd0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003bfd0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003bfe0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003bfe0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003bff0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003bff0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003c000:·6d65·6469·6174·696f·6e20· | 0003c000:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | ||
| 0003c010:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003c020:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c030:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c040:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c050:·6d37·3237·3322·3e3c·7461·626c·6520·636c··m7273"><table·cl | |||
| 0003c060:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c070:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c080:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c090:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c0a0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c0b0:·3e3c·7464·3e68·6967·683c·2f74·643e·3c2f··><td>high</td></ | |||
| 0003c0c0:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c0d0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6d··ption:</th><td>m | |||
| 0003c0e0:·6564·6975·6d3c·2f74·643e·3c2f·7472·3e3c··edium</td></tr>< | |||
| 0003c0f0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c100:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003c110:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003c120:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003c130:·6e61·6d65·3a20·2753·6574·2066·6163·743a··name:·'Set·fact: | |||
| 0003c | 0003c010:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | ||
| 0003c020:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c030:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c040:·6c61·7073·6522·2069·643d·2269·646d·3732··lapse"·id="idm72 | |||
| 0003c050:·3733·223e·3c70·7265·3e3c·636f·6465·3e0a··73"><pre><code>. | |||
| 0003c060:·2320·4669·6e64·2077·6869·6368·2066·696c··#·Find·which·fil | |||
| 0003c070:·6573·2068·6176·6520·696e·636f·7272·6563··es·have·incorrec | |||
| 0003c080:·7420·6861·7368·2028·6e6f·7420·696e·202f··t·hash·(not·in·/ | |||
| 0003c090:·6574·632c·2062·6563·6175·7365·206f·6620··etc,·because·of· | |||
| 0003c0a0:·7468·6520·7379·7374·656d·2072·656c·6174··the·system·relat | |||
| 0003c0b0:·6564·2063·6f6e·6669·6720·6669·6c65·7329··ed·config·files) | |||
| 0003c0c0:·2061·6e64·2074·6865·6e20·6765·7420·6669···and·then·get·fi | |||
| 0003c0d0:·6c65·7320·6e61·6d65·730a·6669·6c65·735f··les·names.files_ | |||
| 0003c0e0:·7769·7468·5f69·6e63·6f72·7265·6374·5f68··with_incorrect_h | |||
| 0003c0f0:·6173·683d·2224·2872·706d·202d·5661·202d··ash="$(rpm·-Va·- | |||
| 0003c100:·2d6e·6f63·6f6e·6669·6720·7c20·6772·6570··-noconfig·|·grep | |||
| 0003c110:·202d·4520·275e·2e2e·3527·207c·2061·776b···-E·'^..5'·|·awk | |||
| 0003c120:·2027·7b70·7269·6e74·2024·4e46·7d27·2029···'{print·$NF}'·) | |||
| 0003c130:·220a·0a23·2046·726f·6d20·6669·6c65·7320··"..#·From·files· | |||
| 0003c140:·6e61·6d65·7320·6765·7420·7061·636b·6167··names·get·packag | |||
| 0003c150:·6520·6e61·6d65·7320·616e·6420·6368·616e··e·names·and·chan | |||
| 0003c160:·6765·206e·6577·6c69·6e65·2074·6f20·7370··ge·newline·to·sp | |||
| 0003c170:·6163·652c·2062·6563·6175·7365·2072·706d··ace,·because·rpm | |||
| 0003c180:·2077·7269·7465·7320·6561·6368·2070·6163···writes·each·pac | |||
| 0003c190:·6b61·6765·2074·6f20·6e65·7720·6c69·6e65··kage·to·new·line | |||
| 0003c1a0:·0a70·6163·6b61·6765·735f·746f·5f72·6569··.packages_to_rei | |||
| 0003c1b0:·6e73·7461·6c6c·3d22·2428·7270·6d20·2d71··nstall="$(rpm·-q | |||
| 0003c1c0:·6620·2466·696c·6573·5f77·6974·685f·696e··f·$files_with_in | |||
| 0003c1d0:·636f·7272·6563·745f·6861·7368·207c·2074··correct_hash·|·t | |||
| 0003c1e0:·7220·275c·6e27·2027·2027·2922·0a0a·0a64··r·'\n'·'·')"...d | |||
| 0003c1 | 0003c1f0:·6e66·2072·6569·6e73·7461·6c6c·202d·7920··nf·reinstall·-y· | ||
| 0003c160:·6e64·2028·646e·6629·270a·2020·7365·745f··nd·(dnf)'.··set_ | |||
| 0003c170:·6661·6374·3a0a·2020·2020·7061·636b·6167··fact:.····packag | |||
| 0003c180:·655f·6d61·6e61·6765·725f·7265·696e·7374··e_manager_reinst | |||
| 0003c190:·616c·6c5f·636d·643a·2064·6e66·2072·6569··all_cmd:·dnf·rei | |||
| 0003c1a0:·6e73·7461·6c6c·202d·790a·2020·7768·656e··nstall·-y.··when | |||
| 0003c1b0:·3a20·616e·7369·626c·655f·6469·7374·7269··:·ansible_distri | |||
| 0003c1c0:·6275·7469·6f6e·203d·3d20·2246·6564·6f72··bution·==·"Fedor | |||
| 0003c1d0:·6122·0a20·2074·6167·733a·0a20·202d·2043··a".··tags:.··-·C | |||
| 0003c1e0:·4a49·532d·352e·3130·2e34·2e31·0a20·202d··JIS-5.10.4.1.··- | |||
| 0003c1f0:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003c200:·332e·380a·2020·2d20·4e49·5354·2d38·3030··3.8.··-·NIST-800 | |||
| 0003c210:·2d31·3731·2d33·2e34·2e31·0a20·202d·204e··-171-3.4.1.··-·N | |||
| 0003c220:·4953·542d·3830·302d·3533·2d41·552d·3928··IST-800-53-AU-9( | |||
| 0003c230:·3329·0a20·202d·204e·4953·542d·3830·302d··3).··-·NIST-800- | |||
| 0003c240:·3533·2d43·4d2d·3628·6329·0a20·202d·204e··53-CM-6(c).··-·N | |||
| 0003c250:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003c260:·6429·0a20·202d·204e·4953·542d·3830·302d··d).··-·NIST-800- | |||
| 0003c270:·3533·2d53·492d·370a·2020·2d20·4e49·5354··53-SI-7.··-·NIST | |||
| 0003c280:·2d38·3030·2d35·332d·5349·2d37·2831·290a··-800-53-SI-7(1). | |||
| 0003c290:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c2a0:·5349·2d37·2836·290a·2020·2d20·5043·492d··SI-7(6).··-·PCI- | |||
| 0003c2b0:·4453·532d·5265·712d·3131·2e35·0a20·202d··DSS-Req-11.5.··- | |||
| 0003c2c0:·2068·6967·685f·636f·6d70·6c65·7869·7479···high_complexity | |||
| 0003c2d0:·0a20·202d·2068·6967·685f·7365·7665·7269··.··-·high_severi | |||
| 0003c2e0:·7479·0a20·202d·206d·6564·6975·6d5f·6469··ty.··-·medium_di | |||
| 0003c2f0:·7372·7570·7469·6f6e·0a20·202d·206e·6f5f··sruption.··-·no_ | |||
| 0003c300:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 0003c310:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 0003c320:·6567·790a·2020·2d20·7270·6d5f·7665·7269··egy.··-·rpm_veri | |||
| 0003c | 0003c200:·2470·6163·6b61·6765·735f·746f·5f72·6569··$packages_to_rei | ||
| 0003c210:·6e73·7461·6c6c·0a3c·2f63·6f64·653e·3c2f··nstall.</code></ | |||
| 0003c220:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c230:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c240:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c250:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c260:·2d74·6172·6765·743d·2223·6964·6d37·3237··-target="#idm727 | |||
| 0003c270:·3422·2074·6162·696e·6465·783d·2230·2220··4"·tabindex="0"· | |||
| 0003c280:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c290:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c2a0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c2b0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c2c0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c2d0:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003c2e0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c2f0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c300:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c310:·7073·6522·2069·643d·2269·646d·3732·3734··pse"·id="idm7274 | |||
| 0003c320:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c330:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c340:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c350:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c360:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| Max diff block lines reached; 6234254/6278882 bytes (99.29%) of diff not shown. | |||
| Offset 59, 15 lines modified | Offset 59, 15 lines modified | ||
| 59 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight | 59 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight |
| 60 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 | 60 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 |
| 61 | ***·CPE·Platforms·*** | 61 | ***·CPE·Platforms·*** |
| 62 | ····*·cpe:/o:redhat:enterprise_linux:9 | 62 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 63 | ····*·cpe:/o:centos:centos:9 | 63 | ····*·cpe:/o:centos:centos:9 |
| 64 | *****·Revision·History·***** | 64 | *****·Revision·History·***** |
| 65 | Current·version:·0.1.65 | 65 | Current·version:·0.1.65 |
| 66 | ····*·draft·(as·of·202 | 66 | ····*·draft·(as·of·2025-02-23) |
| 67 | *****·Table·of·Contents·***** | 67 | *****·Table·of·Contents·***** |
| 68 | ···1.·System_Settings | 68 | ···1.·System_Settings |
| 69 | ·········1.·Installing_and_Maintaining_Software | 69 | ·········1.·Installing_and_Maintaining_Software |
| 70 | ·········2.·Account_and_Access_Control | 70 | ·········2.·Account_and_Access_Control |
| 71 | ·········3.·System_Accounting_with_auditd | 71 | ·········3.·System_Accounting_with_auditd |
| 72 | ·········4.·Configure_Syslog | 72 | ·········4.·Configure_Syslog |
| 73 | ·········5.·Network_Configuration_and_Firewalls | 73 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 105, 14 lines modified | Offset 105, 24 lines modified | ||
| 105 | $·sudo·dnf·reinstall·PACKAGENAME | 105 | $·sudo·dnf·reinstall·PACKAGENAME |
| 106 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 106 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 107 | $·sudo·rpm·-Uvh·PACKAGENAME | 107 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 108 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 108 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 109 | Severity: ················high | 109 | Severity: ················high |
| 110 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 110 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 111 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 111 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 112 | Remediation_Shell_script_⇲ | ||
| 113 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 114 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 115 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 116 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 117 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 112 | Remediation_Ansible_snippet_⇲ | 118 | Remediation_Ansible_snippet_⇲ |
| 113 | Complexity:·high | 119 | Complexity:·high |
| 114 | Disruption:·medium | 120 | Disruption:·medium |
| 115 | Strategy:···restrict | 121 | Strategy:···restrict |
| 116 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 122 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 117 | ··set_fact: | 123 | ··set_fact: |
| 118 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 124 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 256, 36 lines modified | Offset 266, 51 lines modified | ||
| 256 | ··-·PCI-DSS-Req-11.5 | 266 | ··-·PCI-DSS-Req-11.5 |
| 257 | ··-·high_complexity | 267 | ··-·high_complexity |
| 258 | ··-·high_severity | 268 | ··-·high_severity |
| 259 | ··-·medium_disruption | 269 | ··-·medium_disruption |
| 260 | ··-·no_reboot_needed | 270 | ··-·no_reboot_needed |
| 261 | ··-·restrict_strategy | 271 | ··-·restrict_strategy |
| 262 | ··-·rpm_verify_hashes | 272 | ··-·rpm_verify_hashes |
| 263 | Remediation_Shell_script_⇲ | ||
| 264 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 265 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 266 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 267 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 268 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 269 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 273 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 270 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 274 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 271 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 275 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 272 | run·the·following·command·to·determine·which·package·owns·it: | 276 | run·the·following·command·to·determine·which·package·owns·it: |
| 273 | $·rpm·-qf·FILENAME | 277 | $·rpm·-qf·FILENAME |
| 274 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 278 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 275 | $·sudo·rpm·--setugids·PACKAGENAME | 279 | $·sudo·rpm·--setugids·PACKAGENAME |
| 276 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 280 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 277 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 281 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 278 | Severity: ················high | 282 | Severity: ················high |
| 279 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 283 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 280 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 284 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 285 | Remediation_Shell_script_⇲ | ||
| 286 | Complexity:·high | ||
| 287 | Disruption:·medium | ||
| 288 | Strategy:···restrict | ||
| 289 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 290 | declare·-A·SETPERMS_RPM_DICT | ||
| 291 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 292 | #·is·expected·by·the·RPM·database | ||
| 293 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 294 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 295 | do | ||
| 296 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 297 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 298 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 299 | done | ||
| 300 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 301 | #·correct·values | ||
| 302 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 303 | do | ||
| 304 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 305 | done | ||
| 281 | Remediation_Ansible_snippet_⇲ | 306 | Remediation_Ansible_snippet_⇲ |
| 282 | Complexity:·high | 307 | Complexity:·high |
| 283 | Disruption:·medium | 308 | Disruption:·medium |
| 284 | Strategy:···restrict | 309 | Strategy:···restrict |
| 285 | -·name:·Read·list·of·files·with·incorrect·ownership | 310 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 286 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 311 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 287 | ····--nocaps·--nolinkto·--nomode | 312 | ····--nocaps·--nolinkto·--nomode |
| Offset 356, 52 lines modified | Offset 381, 56 lines modified | ||
| 356 | ··-·PCI-DSS-Req-11.5 | 381 | ··-·PCI-DSS-Req-11.5 |
| 357 | ··-·high_complexity | 382 | ··-·high_complexity |
| 358 | ··-·high_severity | 383 | ··-·high_severity |
| 359 | ··-·medium_disruption | 384 | ··-·medium_disruption |
| 360 | ··-·no_reboot_needed | 385 | ··-·no_reboot_needed |
| 361 | ··-·restrict_strategy | 386 | ··-·restrict_strategy |
| 362 | ··-·rpm_verify_ownership | 387 | ··-·rpm_verify_ownership |
| 388 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 389 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 390 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 391 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 392 | $·rpm·-qf·FILENAME | ||
| 393 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 394 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 395 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 396 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 397 | Severity: ················high | ||
| 398 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 399 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 363 | Remediation_Shell_script_⇲ | 400 | Remediation_Shell_script_⇲ |
| 364 | Complexity:·high | 401 | Complexity:·high |
| 365 | Disruption:·medium | 402 | Disruption:·medium |
| 366 | Strategy:···restrict | 403 | Strategy:···restrict |
| Max diff block lines reached; 722023/731180 bytes (98.75%) of diff not shown. | |||
| Offset 14433, 15 lines modified | Offset 14433, 15 lines modified | ||
| 00038600:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00038600:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00038610:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00038610:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00038620:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00038620:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00038630:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00038630:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00038640:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00038640:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00038650:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00038650:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00038660:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00038660:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00038670:·206f·6620·3230·323 | 00038670:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00038680:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038680:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038690:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00038690:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 000386a0:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 000386a0:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 000386b0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 000386b0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 000386c0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 000386c0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 000386d0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 000386d0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 000386e0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 000386e0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15375, 324 lines modified | Offset 15375, 324 lines modified | ||
| 0003c0e0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003c0e0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003c0f0:·6964·6d37·3237·3322·2074·6162·696e·6465··idm7273"·tabinde | 0003c0f0:·6964·6d37·3237·3322·2074·6162·696e·6465··idm7273"·tabinde | ||
| 0003c100:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003c100:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003c110:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003c110:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003c120:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003c120:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003c130:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003c130:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003c140:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003c140:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003c150:·656d·6564·6961·7469·6f6e·20 | 0003c150:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003c160:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003c170:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c180:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c190:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003c1a0:·3237·3322·3e3c·7072·653e·3c63·6f64·653e··273"><pre><code> | |||
| 0003c1b0:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003c1c0:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003c1d0:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003c1e0:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003c1f0:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003c200:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003c210:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003c220:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003c160:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003c170:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c180:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c190:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003c1a0:·646d·3732·3733·223e·3c74·6162·6c65·2063··dm7273"><table·c | |||
| 0003c1b0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003c1c0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003c1d0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003c1e0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003c1f0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003c200:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003c210:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003c220:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003c230:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003c240:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c250:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003c260:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003c270:·626c·653e·3c70·7265·3e3c·636f·6465·3e2d··ble><pre><code>- | |||
| 0003c280:·206e·616d·653a·2027·5365·7420·6661·6374···name:·'Set·fact | |||
| 0003c290:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003c2a0:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003c2b0:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003c2c0:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003c2d0:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003c2e0:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003c2f0:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003c300:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003c310:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003c320:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003c330:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003c340:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c350:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c360:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003c370:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003c380:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003c390:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003c3a0:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c3b0:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003c3c0:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003c3d0:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003c3e0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c3f0:·2d53·492d·3728·3629·0a20·202d·2050·4349··-SI-7(6).··-·PCI | |||
| 0003c400:·2d44·5353·2d52·6571·2d31·312e·350a·2020··-DSS-Req-11.5.·· | |||
| 0003c410:·2d20·6869·6768·5f63·6f6d·706c·6578·6974··-·high_complexit | |||
| 0003c420:·790a·2020·2d20·6869·6768·5f73·6576·6572··y.··-·high_sever | |||
| 0003c430:·6974·790a·2020·2d20·6d65·6469·756d·5f64··ity.··-·medium_d | |||
| 0003c440:·6973·7275·7074·696f·6e0a·2020·2d20·6e6f··isruption.··-·no | |||
| 0003c450:·5f72·6562·6f6f·745f·6e65·6564·6564·0a20··_reboot_needed.· | |||
| 0003c460:·202d·2072·6573·7472·6963·745f·7374·7261···-·restrict_stra | |||
| 0003c470:·7465·6779·0a20·202d·2072·706d·5f76·6572··tegy.··-·rpm_ver | |||
| 0003c480:·6966·795f·6861·7368·6573·0a0a·2d20·6e61··ify_hashes..-·na | |||
| 0003c490:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| 0003c4a0:·6163·6b61·6765·206d·616e·6167·6572·2072··ackage·manager·r | |||
| 0003c4b0:·6569·6e73·7461·6c6c·2063·6f6d·6d61·6e64··einstall·command | |||
| 0003c4c0:·2028·7975·6d29·270a·2020·7365·745f·6661···(yum)'.··set_fa | |||
| 0003c4d0:·6374·3a0a·2020·2020·7061·636b·6167·655f··ct:.····package_ | |||
| 0003c4e0:·6d61·6e61·6765·725f·7265·696e·7374·616c··manager_reinstal | |||
| 0003c4f0:·6c5f·636d·643a·2079·756d·2072·6569·6e73··l_cmd:·yum·reins | |||
| 0003c500:·7461·6c6c·202d·790a·2020·7768·656e·3a20··tall·-y.··when:· | |||
| 0003c510:·2861·6e73·6962·6c65·5f64·6973·7472·6962··(ansible_distrib | |||
| 0003c520:·7574·696f·6e20·3d3d·2022·5265·6448·6174··ution·==·"RedHat | |||
| 0003c530:·2220·6f72·2061·6e73·6962·6c65·5f64·6973··"·or·ansible_dis | |||
| 0003c540:·7472·6962·7574·696f·6e20·3d3d·2022·4365··tribution·==·"Ce | |||
| 0003c550:·6e74·4f53·2220·6f72·2061·6e73·6962·6c65··ntOS"·or·ansible | |||
| 0003c560:·5f64·6973·7472·6962·7574·696f·6e0a·2020··_distribution.·· | |||
| 0003c570:·2020·3d3d·2022·4f72·6163·6c65·4c69·6e75····==·"OracleLinu | |||
| 0003c580:·7822·290a·2020·7461·6773·3a0a·2020·2d20··x").··tags:.··-· | |||
| 0003c590:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003c5a0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c5b0:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c5c0:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003c5d0:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003c5e0:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003c5f0:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003c600:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c610:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003c620:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003c630:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003c640:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c650:·2d53·492d·3728·3629·0a20·202d·2050·4349··-SI-7(6).··-·PCI | |||
| 0003c660:·2d44·5353·2d52·6571·2d31·312e·350a·2020··-DSS-Req-11.5.·· | |||
| 0003c670:·2d20·6869·6768·5f63·6f6d·706c·6578·6974··-·high_complexit | |||
| 0003c680:·790a·2020·2d20·6869·6768·5f73·6576·6572··y.··-·high_sever | |||
| 0003c690:·6974·790a·2020·2d20·6d65·6469·756d·5f64··ity.··-·medium_d | |||
| 0003c6a0:·6973·7275·7074·696f·6e0a·2020·2d20·6e6f··isruption.··-·no | |||
| 0003c6b0:·5f72·6562·6f6f·745f·6e65·6564·6564·0a20··_reboot_needed.· | |||
| 0003c6c0:·202d·2072·6573·7472·6963·745f·7374·7261···-·restrict_stra | |||
| 0003c6d0:·7465·6779·0a20·202d·2072·706d·5f76·6572··tegy.··-·rpm_ver | |||
| 0003c6e0:·6966·795f·6861·7368·6573·0a0a·2d20·6e61··ify_hashes..-·na | |||
| 0003c6f0:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| Max diff block lines reached; 16877084/16921574 bytes (99.74%) of diff not shown. | |||
| Offset 14426, 15 lines modified | Offset 14426, 15 lines modified | ||
| 00038590:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00038590:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 000385a0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 000385a0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 000385b0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 000385b0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 000385c0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 000385c0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 000385d0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 000385d0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 000385e0:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 000385e0:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 000385f0:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 000385f0:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00038600:·206f·6620·3230·323 | 00038600:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00038610:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038610:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038620:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00038620:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00038630:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00038630:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00038640:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00038640:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00038650:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00038650:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00038660:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00038660:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00038670:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00038670:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15382, 324 lines modified | Offset 15382, 324 lines modified | ||
| 0003c150:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003c150:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003c160:·6964·6d37·3237·3322·2074·6162·696e·6465··idm7273"·tabinde | 0003c160:·6964·6d37·3237·3322·2074·6162·696e·6465··idm7273"·tabinde | ||
| 0003c170:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003c170:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003c180:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003c180:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003c190:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003c190:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003c1a0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003c1a0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003c1b0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003c1b0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003c1c0:·656d·6564·6961·7469·6f6e·20 | 0003c1c0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003c1d0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003c1e0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c1f0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c200:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003c210:·3237·3322·3e3c·7072·653e·3c63·6f64·653e··273"><pre><code> | |||
| 0003c220:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003c230:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003c240:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003c250:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003c260:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003c270:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003c280:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003c290:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003c1d0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003c1e0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c1f0:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c200:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003c210:·646d·3732·3733·223e·3c74·6162·6c65·2063··dm7273"><table·c | |||
| 0003c220:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003c230:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003c240:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003c250:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003c260:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003c270:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003c280:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003c290:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003c2a0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003c2b0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c2c0:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003c2d0:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003c2e0:·626c·653e·3c70·7265·3e3c·636f·6465·3e2d··ble><pre><code>- | |||
| 0003c2f0:·206e·616d·653a·2027·5365·7420·6661·6374···name:·'Set·fact | |||
| 0003c300:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003c310:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003c320:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003c330:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003c340:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003c350:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003c360:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003c370:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003c380:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003c390:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003c3a0:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003c3b0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c3c0:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c3d0:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003c3e0:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003c3f0:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003c400:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003c410:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c420:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003c430:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003c440:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003c450:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c460:·2d53·492d·3728·3629·0a20·202d·2050·4349··-SI-7(6).··-·PCI | |||
| 0003c470:·2d44·5353·2d52·6571·2d31·312e·350a·2020··-DSS-Req-11.5.·· | |||
| 0003c480:·2d20·6869·6768·5f63·6f6d·706c·6578·6974··-·high_complexit | |||
| 0003c490:·790a·2020·2d20·6869·6768·5f73·6576·6572··y.··-·high_sever | |||
| 0003c4a0:·6974·790a·2020·2d20·6d65·6469·756d·5f64··ity.··-·medium_d | |||
| 0003c4b0:·6973·7275·7074·696f·6e0a·2020·2d20·6e6f··isruption.··-·no | |||
| 0003c4c0:·5f72·6562·6f6f·745f·6e65·6564·6564·0a20··_reboot_needed.· | |||
| 0003c4d0:·202d·2072·6573·7472·6963·745f·7374·7261···-·restrict_stra | |||
| 0003c4e0:·7465·6779·0a20·202d·2072·706d·5f76·6572··tegy.··-·rpm_ver | |||
| 0003c4f0:·6966·795f·6861·7368·6573·0a0a·2d20·6e61··ify_hashes..-·na | |||
| 0003c500:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| 0003c510:·6163·6b61·6765·206d·616e·6167·6572·2072··ackage·manager·r | |||
| 0003c520:·6569·6e73·7461·6c6c·2063·6f6d·6d61·6e64··einstall·command | |||
| 0003c530:·2028·7975·6d29·270a·2020·7365·745f·6661···(yum)'.··set_fa | |||
| 0003c540:·6374·3a0a·2020·2020·7061·636b·6167·655f··ct:.····package_ | |||
| 0003c550:·6d61·6e61·6765·725f·7265·696e·7374·616c··manager_reinstal | |||
| 0003c560:·6c5f·636d·643a·2079·756d·2072·6569·6e73··l_cmd:·yum·reins | |||
| 0003c570:·7461·6c6c·202d·790a·2020·7768·656e·3a20··tall·-y.··when:· | |||
| 0003c580:·2861·6e73·6962·6c65·5f64·6973·7472·6962··(ansible_distrib | |||
| 0003c590:·7574·696f·6e20·3d3d·2022·5265·6448·6174··ution·==·"RedHat | |||
| 0003c5a0:·2220·6f72·2061·6e73·6962·6c65·5f64·6973··"·or·ansible_dis | |||
| 0003c5b0:·7472·6962·7574·696f·6e20·3d3d·2022·4365··tribution·==·"Ce | |||
| 0003c5c0:·6e74·4f53·2220·6f72·2061·6e73·6962·6c65··ntOS"·or·ansible | |||
| 0003c5d0:·5f64·6973·7472·6962·7574·696f·6e0a·2020··_distribution.·· | |||
| 0003c5e0:·2020·3d3d·2022·4f72·6163·6c65·4c69·6e75····==·"OracleLinu | |||
| 0003c5f0:·7822·290a·2020·7461·6773·3a0a·2020·2d20··x").··tags:.··-· | |||
| 0003c600:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003c610:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c620:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c630:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003c640:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003c650:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003c660:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003c670:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c680:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003c690:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003c6a0:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003c6b0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c6c0:·2d53·492d·3728·3629·0a20·202d·2050·4349··-SI-7(6).··-·PCI | |||
| 0003c6d0:·2d44·5353·2d52·6571·2d31·312e·350a·2020··-DSS-Req-11.5.·· | |||
| 0003c6e0:·2d20·6869·6768·5f63·6f6d·706c·6578·6974··-·high_complexit | |||
| 0003c6f0:·790a·2020·2d20·6869·6768·5f73·6576·6572··y.··-·high_sever | |||
| 0003c700:·6974·790a·2020·2d20·6d65·6469·756d·5f64··ity.··-·medium_d | |||
| 0003c710:·6973·7275·7074·696f·6e0a·2020·2d20·6e6f··isruption.··-·no | |||
| 0003c720:·5f72·6562·6f6f·745f·6e65·6564·6564·0a20··_reboot_needed.· | |||
| 0003c730:·202d·2072·6573·7472·6963·745f·7374·7261···-·restrict_stra | |||
| 0003c740:·7465·6779·0a20·202d·2072·706d·5f76·6572··tegy.··-·rpm_ver | |||
| 0003c750:·6966·795f·6861·7368·6573·0a0a·2d20·6e61··ify_hashes..-·na | |||
| 0003c760:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| Max diff block lines reached; 9007925/9052415 bytes (99.51%) of diff not shown. | |||
| Offset 62, 15 lines modified | Offset 62, 15 lines modified | ||
| 62 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·ISM·Official | 62 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·ISM·Official |
| 63 | Profile·ID····xccdf_org.ssgproject.content_profile_ism_o | 63 | Profile·ID····xccdf_org.ssgproject.content_profile_ism_o |
| 64 | ***·CPE·Platforms·*** | 64 | ***·CPE·Platforms·*** |
| 65 | ····*·cpe:/o:redhat:enterprise_linux:9 | 65 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 66 | ····*·cpe:/o:centos:centos:9 | 66 | ····*·cpe:/o:centos:centos:9 |
| 67 | *****·Revision·History·***** | 67 | *****·Revision·History·***** |
| 68 | Current·version:·0.1.65 | 68 | Current·version:·0.1.65 |
| 69 | ····*·draft·(as·of·202 | 69 | ····*·draft·(as·of·2025-02-23) |
| 70 | *****·Table·of·Contents·***** | 70 | *****·Table·of·Contents·***** |
| 71 | ···1.·System_Settings | 71 | ···1.·System_Settings |
| 72 | ·········1.·Installing_and_Maintaining_Software | 72 | ·········1.·Installing_and_Maintaining_Software |
| 73 | ·········2.·Account_and_Access_Control | 73 | ·········2.·Account_and_Access_Control |
| 74 | ·········3.·System_Accounting_with_auditd | 74 | ·········3.·System_Accounting_with_auditd |
| 75 | ·········4.·Configure_Syslog | 75 | ·········4.·Configure_Syslog |
| 76 | ·········5.·Network_Configuration_and_Firewalls | 76 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 111, 14 lines modified | Offset 111, 24 lines modified | ||
| 111 | $·sudo·dnf·reinstall·PACKAGENAME | 111 | $·sudo·dnf·reinstall·PACKAGENAME |
| 112 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 112 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 113 | $·sudo·rpm·-Uvh·PACKAGENAME | 113 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 114 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 114 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 115 | Severity: ················high | 115 | Severity: ················high |
| 116 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 116 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 117 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 117 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 118 | Remediation_Shell_script_⇲ | ||
| 119 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 120 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 121 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 122 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 123 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 118 | Remediation_Ansible_snippet_⇲ | 124 | Remediation_Ansible_snippet_⇲ |
| 119 | Complexity:·high | 125 | Complexity:·high |
| 120 | Disruption:·medium | 126 | Disruption:·medium |
| 121 | Strategy:···restrict | 127 | Strategy:···restrict |
| 122 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 128 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 123 | ··set_fact: | 129 | ··set_fact: |
| 124 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 130 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 262, 36 lines modified | Offset 272, 51 lines modified | ||
| 262 | ··-·PCI-DSS-Req-11.5 | 272 | ··-·PCI-DSS-Req-11.5 |
| 263 | ··-·high_complexity | 273 | ··-·high_complexity |
| 264 | ··-·high_severity | 274 | ··-·high_severity |
| 265 | ··-·medium_disruption | 275 | ··-·medium_disruption |
| 266 | ··-·no_reboot_needed | 276 | ··-·no_reboot_needed |
| 267 | ··-·restrict_strategy | 277 | ··-·restrict_strategy |
| 268 | ··-·rpm_verify_hashes | 278 | ··-·rpm_verify_hashes |
| 269 | Remediation_Shell_script_⇲ | ||
| 270 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 271 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 272 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 273 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 274 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 275 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 279 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 276 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 280 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 277 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 281 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 278 | run·the·following·command·to·determine·which·package·owns·it: | 282 | run·the·following·command·to·determine·which·package·owns·it: |
| 279 | $·rpm·-qf·FILENAME | 283 | $·rpm·-qf·FILENAME |
| 280 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 284 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 281 | $·sudo·rpm·--setugids·PACKAGENAME | 285 | $·sudo·rpm·--setugids·PACKAGENAME |
| 282 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 286 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 283 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 287 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 284 | Severity: ················high | 288 | Severity: ················high |
| 285 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 289 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 286 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 290 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 291 | Remediation_Shell_script_⇲ | ||
| 292 | Complexity:·high | ||
| 293 | Disruption:·medium | ||
| 294 | Strategy:···restrict | ||
| 295 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 296 | declare·-A·SETPERMS_RPM_DICT | ||
| 297 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 298 | #·is·expected·by·the·RPM·database | ||
| 299 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 300 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 301 | do | ||
| 302 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 303 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 304 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 305 | done | ||
| 306 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 307 | #·correct·values | ||
| 308 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 309 | do | ||
| 310 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 311 | done | ||
| 287 | Remediation_Ansible_snippet_⇲ | 312 | Remediation_Ansible_snippet_⇲ |
| 288 | Complexity:·high | 313 | Complexity:·high |
| 289 | Disruption:·medium | 314 | Disruption:·medium |
| 290 | Strategy:···restrict | 315 | Strategy:···restrict |
| 291 | -·name:·Read·list·of·files·with·incorrect·ownership | 316 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 292 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 317 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 293 | ····--nocaps·--nolinkto·--nomode | 318 | ····--nocaps·--nolinkto·--nomode |
| Offset 362, 52 lines modified | Offset 387, 56 lines modified | ||
| 362 | ··-·PCI-DSS-Req-11.5 | 387 | ··-·PCI-DSS-Req-11.5 |
| 363 | ··-·high_complexity | 388 | ··-·high_complexity |
| 364 | ··-·high_severity | 389 | ··-·high_severity |
| 365 | ··-·medium_disruption | 390 | ··-·medium_disruption |
| 366 | ··-·no_reboot_needed | 391 | ··-·no_reboot_needed |
| 367 | ··-·restrict_strategy | 392 | ··-·restrict_strategy |
| 368 | ··-·rpm_verify_ownership | 393 | ··-·rpm_verify_ownership |
| 394 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 395 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 396 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 397 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 398 | $·rpm·-qf·FILENAME | ||
| 399 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 400 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 401 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 402 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 403 | Severity: ················high | ||
| 404 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 405 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 369 | Remediation_Shell_script_⇲ | 406 | Remediation_Shell_script_⇲ |
| 370 | Complexity:·high | 407 | Complexity:·high |
| 371 | Disruption:·medium | 408 | Disruption:·medium |
| 372 | Strategy:···restrict | 409 | Strategy:···restrict |
| Max diff block lines reached; 992714/1001871 bytes (99.09%) of diff not shown. | |||
| Offset 14415, 15 lines modified | Offset 14415, 15 lines modified | ||
| 000384e0:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 000384e0:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 000384f0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 000384f0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00038500:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00038500:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00038510:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00038510:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00038520:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00038520:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00038530:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00038530:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00038540:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00038540:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038550:·6173·206f·6620·3230·323 | 00038550:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00038560:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00038560:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00038570:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00038570:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00038580:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00038580:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00038590:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00038590:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 000385a0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 000385a0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 000385b0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 000385b0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 000385c0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 000385c0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15151, 176 lines modified | Offset 15151, 176 lines modified | ||
| 0003b2e0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003b2e0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003b2f0:·743d·2223·6964·6d38·3038·3722·2074·6162··t="#idm8087"·tab | 0003b2f0:·743d·2223·6964·6d38·3038·3722·2074·6162··t="#idm8087"·tab | ||
| 0003b300:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003b300:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003b310:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003b310:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003b320:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003b320:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003b330:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003b330:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003b340:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003b340:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003b350:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003b350:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 0003b360:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | |||
| 0003b370:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003b380:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003b390:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003b3a0:·6964·6d38·3038·3722·3e3c·7072·653e·3c63··idm8087"><pre><c | |||
| 0003b3b0:·6f64·653e·2320·5265·6d65·6469·6174·696f··ode>#·Remediatio | |||
| 0003b3c0:·6e20·6973·2061·7070·6c69·6361·626c·6520··n·is·applicable· | |||
| 0003b3d0:·6f6e·6c79·2069·6e20·6365·7274·6169·6e20··only·in·certain· | |||
| 0003b3e0:·706c·6174·666f·726d·730a·6966·205b·2021··platforms.if·[·! | |||
| 0003b3f0:·202d·6620·2f2e·646f·636b·6572·656e·7620···-f·/.dockerenv· | |||
| 0003b400:·5d20·2661·6d70·3b26·616d·703b·205b·2021··]·&&·[·! | |||
| 0003b410:·202d·6620·2f72·756e·2f2e·636f·6e74·6169···-f·/run/.contai | |||
| 0003b420:·6e65·7265·6e76·205d·3b20·7468·656e·0a0a··nerenv·];·then.. | |||
| 0003b360:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003b370:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b380:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b390:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003b3a0:·643d·2269·646d·3830·3837·223e·3c74·6162··d="idm8087"><tab | |||
| 0003b3b0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003b3c0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003b3d0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003b3e0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003b3f0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003b400:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003b410:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003b420:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003b430:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003b440:·3e3c·2f74·723e·3c74·723e·3c74·683e·5265··></tr><tr><th>Re | |||
| 0003b450:·626f·6f74·3a3c·2f74·683e·3c74·643e·7472··boot:</th><td>tr | |||
| 0003b460:·7565·3c2f·7464·3e3c·2f74·723e·3c74·723e··ue</td></tr><tr> | |||
| 0003b470:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003b480:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003b490:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003b4a0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003b4b0:·653a·2043·6865·636b·2074·6f20·7365·6520··e:·Check·to·see· | |||
| 0003b4c0:·7468·6520·6375·7272·656e·7420·7374·6174··the·current·stat | |||
| 0003b4d0:·7573·206f·6620·4649·5053·206d·6f64·650a··us·of·FIPS·mode. | |||
| 0003b4e0:·2020·636f·6d6d·616e·643a·202f·7573·722f····command:·/usr/ | |||
| 0003b4 | 0003b430:·6669·7073·2d6d·6f64·652d·7365·7475·7020··fips-mode-setup· | ||
| 0003b500:·7475·7020·2d2d·6368·6563·6b0a·2020·7265··tup·--check.··re | |||
| 0003b510:·6769·7374·6572·3a20·6973·5f66·6970·735f··gister:·is_fips_ | |||
| 0003b | 0003b440:·2d2d·656e·6162·6c65·0a46·4950·535f·434f··--enable.FIPS_CO | ||
| 0003b450:·4e46·3d22·2f65·7463·2f64·7261·6375·742e··NF="/etc/dracut. | |||
| 0003b460:·636f·6e66·2e64·2f34·302d·6669·7073·2e63··conf.d/40-fips.c | |||
| 0003b470:·6f6e·6622·0a69·6620·2120·6772·6570·2022··onf".if·!·grep·" | |||
| 0003b480:·5e61·6464·5f64·7261·6375·746d·6f64·756c··^add_dracutmodul | |||
| 0003b490:·6573·2b3d·5c22·2066·6970·7320·5c22·2220··es+=\"·fips·\""· | |||
| 0003b4a0:·2446·4950·535f·434f·4e46·3b20·7468·656e··$FIPS_CONF;·then | |||
| 0003b4b0:·0a20·2020·2065·6368·6f20·2261·6464·5f64··.····echo·"add_d | |||
| 0003b4c0:·7261·6375·746d·6f64·756c·6573·2b3d·5c22··racutmodules+=\" | |||
| 0003b4d0:·2066·6970·7320·5c22·2220·2667·743b·2667···fips·\""·>&g | |||
| 0003b4e0:·743b·2024·4649·5053·5f43·4f4e·460a·6669··t;·$FIPS_CONF.fi | |||
| 0003b4f0:·0a0a·656c·7365·0a20·2020·2026·6774·3b26··..else.····>& | |||
| 0003b500:·616d·703b·3220·6563·686f·2027·5265·6d65··amp;2·echo·'Reme | |||
| 0003b510:·6469·6174·696f·6e20·6973·206e·6f74·2061··diation·is·not·a | |||
| 0003b520:·7070·6c69·6361·626c·652c·206e·6f74·6869··pplicable,·nothi | |||
| 0003b530:·6e67·2077·6173·2064·6f6e·6527·0a66·690a··ng·was·done'.fi. | |||
| 0003b540:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003b550:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003b560:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003b570:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003b580:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003b590:·3d22·2369·646d·3830·3838·2220·7461·6269··="#idm8088"·tabi | |||
| 0003b5a0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003b5b0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003b5c0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003b5d0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003b5e0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003b5f0:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003b600:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003b610:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b620:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003b630:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003b640:·3d22·6964·6d38·3038·3822·3e3c·7461·626c··="idm8088"><tabl | |||
| 0003b650:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003b660:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003b670:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003b680:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003b690:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003b6a0:·3c2f·7468·3e3c·7464·3e6d·6564·6975·6d3c··</th><td>medium< | |||
| 0003b6b0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003b6c0:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003b6d0:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003b6e0:·3c2f·7472·3e3c·7472·3e3c·7468·3e52·6562··</tr><tr><th>Reb | |||
| 0003b6f0:·6f6f·743a·3c2f·7468·3e3c·7464·3e74·7275··oot:</th><td>tru | |||
| 0003b700:·653c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··e</td></tr><tr>< | |||
| 0003b710:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003b720:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003b730:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003b740:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003b750:·3a20·4368·6563·6b20·746f·2073·6565·2074··:·Check·to·see·t | |||
| 0003b760:·6865·2063·7572·7265·6e74·2073·7461·7475··he·current·statu | |||
| 0003b770:·7320·6f66·2046·4950·5320·6d6f·6465·0a20··s·of·FIPS·mode.· | |||
| 0003b780:·2063·6f6d·6d61·6e64·3a20·2f75·7372·2f62···command:·/usr/b | |||
| 0003b790:·696e·2f66·6970·732d·6d6f·6465·2d73·6574··in/fips-mode-set | |||
| 0003b7a0:·7570·202d·2d63·6865·636b·0a20·2072·6567··up·--check.··reg | |||
| 0003b7b0:·6973·7465·723a·2069·735f·6669·7073·5f65··ister:·is_fips_e | |||
| 0003b7c0:·6e61·626c·6564·0a20·2063·6861·6e67·6564··nabled.··changed | |||
| 0003b7d0:·5f77·6865·6e3a·2066·616c·7365·0a20·2066··_when:·false.··f | |||
| 0003b | 0003b7e0:·6169·6c65·645f·7768·656e·3a20·6661·6c73··ailed_when:·fals | ||
| 0003b7f0:·650a·2020·7768·656e·3a20·616e·7369·626c··e.··when:·ansibl | |||
| 0003b800:·655f·7669·7274·7561·6c69·7a61·7469·6f6e··e_virtualization | |||
| 0003b810:·5f74·7970·6520·6e6f·7420·696e·205b·2264··_type·not·in·["d | |||
| Max diff block lines reached; 5853585/5877651 bytes (99.59%) of diff not shown. | |||
| Offset 59, 15 lines modified | Offset 59, 15 lines modified | ||
| 59 | Profile·Title·Protection·Profile·for·General·Purpose·Operating·Systems | 59 | Profile·Title·Protection·Profile·for·General·Purpose·Operating·Systems |
| 60 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp | 60 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp |
| 61 | ***·CPE·Platforms·*** | 61 | ***·CPE·Platforms·*** |
| 62 | ····*·cpe:/o:redhat:enterprise_linux:9 | 62 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 63 | ····*·cpe:/o:centos:centos:9 | 63 | ····*·cpe:/o:centos:centos:9 |
| 64 | *****·Revision·History·***** | 64 | *****·Revision·History·***** |
| 65 | Current·version:·0.1.65 | 65 | Current·version:·0.1.65 |
| 66 | ····*·draft·(as·of·202 | 66 | ····*·draft·(as·of·2025-02-23) |
| 67 | *****·Table·of·Contents·***** | 67 | *****·Table·of·Contents·***** |
| 68 | ···1.·System_Settings | 68 | ···1.·System_Settings |
| 69 | ·········1.·Installing_and_Maintaining_Software | 69 | ·········1.·Installing_and_Maintaining_Software |
| 70 | ·········2.·Account_and_Access_Control | 70 | ·········2.·Account_and_Access_Control |
| 71 | ·········3.·System_Accounting_with_auditd | 71 | ·········3.·System_Accounting_with_auditd |
| 72 | ·········4.·GRUB2_bootloader_configuration | 72 | ·········4.·GRUB2_bootloader_configuration |
| 73 | ·········5.·zIPL_bootloader_configuration | 73 | ·········5.·zIPL_bootloader_configuration |
| Offset 100, 14 lines modified | Offset 100, 27 lines modified | ||
| 100 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 100 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 101 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 101 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 102 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 102 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 103 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 103 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 104 | Severity: ················high | 104 | Severity: ················high |
| 105 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 105 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 106 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 106 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 107 | Remediation_Shell_script_⇲ | ||
| 108 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 109 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 110 | fips-mode-setup·--enable | ||
| 111 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 112 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 113 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 114 | fi | ||
| 115 | else | ||
| 116 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 117 | fi | ||
| 107 | Remediation_Ansible_snippet_⇲ | 118 | Remediation_Ansible_snippet_⇲ |
| 108 | Complexity:·medium | 119 | Complexity:·medium |
| 109 | Disruption:·medium | 120 | Disruption:·medium |
| 110 | Reboot:·····true | 121 | Reboot:·····true |
| 111 | Strategy:···restrict | 122 | Strategy:···restrict |
| 112 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 123 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 113 | ··command:·/usr/bin/fips-mode-setup·--check | 124 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 162, 27 lines modified | Offset 175, 14 lines modified | ||
| 162 | ··-·NIST-800-53-SC-13 | 175 | ··-·NIST-800-53-SC-13 |
| 163 | ··-·enable_dracut_fips_module | 176 | ··-·enable_dracut_fips_module |
| 164 | ··-·high_severity | 177 | ··-·high_severity |
| 165 | ··-·medium_complexity | 178 | ··-·medium_complexity |
| 166 | ··-·medium_disruption | 179 | ··-·medium_disruption |
| 167 | ··-·reboot_required | 180 | ··-·reboot_required |
| 168 | ··-·restrict_strategy | 181 | ··-·restrict_strategy |
| 169 | Remediation_Shell_script_⇲ | ||
| 170 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 171 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 172 | fips-mode-setup·--enable | ||
| 173 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 174 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 175 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 176 | fi | ||
| 177 | else | ||
| 178 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 179 | fi | ||
| 180 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** | 182 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** |
| 181 | To·enable·FIPS·mode,·run·the·following·command: | 183 | To·enable·FIPS·mode,·run·the·following·command: |
| 182 | fips-mode-setup·--enable | 184 | fips-mode-setup·--enable |
| 183 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: | 185 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: |
| 184 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 | 186 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 |
| 185 | ····*·Creating·/etc/system-fips | 187 | ····*·Creating·/etc/system-fips |
| Offset 234, 31 lines modified | Offset 234, 33 lines modified | ||
| 234 | ***·Rule ·Install·crypto-policies·package· [ref]·*** | 234 | ***·Rule ·Install·crypto-policies·package· [ref]·*** |
| 235 | The·crypto-policies·package·can·be·installed·with·the·following·command: | 235 | The·crypto-policies·package·can·be·installed·with·the·following·command: |
| 236 | $·sudo·dnf·install·crypto-policies | 236 | $·sudo·dnf·install·crypto-policies |
| 237 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. | 237 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. |
| 238 | Severity: ················medium | 238 | Severity: ················medium |
| 239 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed | 239 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed |
| 240 | Identifiers·and·References·References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 | 240 | Identifiers·and·References·References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 |
| 241 | Remediation_Anaconda_snippet_⇲ | ||
| 242 | Complexity:·low | ||
| 243 | Disruption:·low | ||
| 244 | Strategy:···enable | ||
| 245 | package·--add=crypto-policies | ||
| 246 | Remediation_Puppet_snippet_⇲ | 241 | Remediation_Puppet_snippet_⇲ |
| 247 | Complexity:·low | 242 | Complexity:·low |
| 248 | Disruption:·low | 243 | Disruption:·low |
| 249 | Strategy:···enable | 244 | Strategy:···enable |
| 250 | include·install_crypto-policies | 245 | include·install_crypto-policies |
| 251 | class·install_crypto-policies·{ | 246 | class·install_crypto-policies·{ |
| 252 | ··package·{·'crypto-policies': | 247 | ··package·{·'crypto-policies': |
| 253 | ····ensure·=>·'installed', | 248 | ····ensure·=>·'installed', |
| 254 | ··} | 249 | ··} |
| 255 | } | 250 | } |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | Complexity:·low | ||
| 253 | Disruption:·low | ||
| 254 | Strategy:···enable | ||
| 255 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 256 | ····dnf·install·-y·"crypto-policies" | ||
| 257 | fi | ||
| 256 | Remediation_Ansible_snippet_⇲ | 258 | Remediation_Ansible_snippet_⇲ |
| 257 | Complexity:·low | 259 | Complexity:·low |
| 258 | Disruption:·low | 260 | Disruption:·low |
| 259 | Strategy:···enable | 261 | Strategy:···enable |
| 260 | -·name:·Ensure·crypto-policies·is·installed | 262 | -·name:·Ensure·crypto-policies·is·installed |
| 261 | ··package: | 263 | ··package: |
| 262 | ····name:·crypto-policies | 264 | ····name:·crypto-policies |
| Offset 271, 57 lines modified | Offset 273, 49 lines modified | ||
| 271 | ··-·no_reboot_needed | 273 | ··-·no_reboot_needed |
| 272 | ··-·package_crypto-policies_installed | 274 | ··-·package_crypto-policies_installed |
| 273 | Remediation_OSBuild_Blueprint_snippet_⇲ | 275 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 274 | [[packages]] | 276 | [[packages]] |
| 275 | name·=·"crypto-policies" | 277 | name·=·"crypto-policies" |
| 276 | version·=·"*" | 278 | version·=·"*" |
| 277 | Remediation_ | 279 | Remediation_Anaconda_snippet_⇲ |
| 278 | Complexity:·low | 280 | Complexity:·low |
| 279 | Disruption:·low | 281 | Disruption:·low |
| 280 | Strategy:···enable | 282 | Strategy:···enable |
| 283 | package·--add=crypto-policies | ||
| 281 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 282 | ····dnf·install·-y·"crypto-policies" | ||
| Max diff block lines reached; 804973/811157 bytes (99.24%) of diff not shown. | |||
| Offset 14397, 16 lines modified | Offset 14397, 16 lines modified | ||
| 000383c0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 000383c0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 000383d0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 000383d0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 000383e0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 000383e0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 000383f0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 000383f0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00038400:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00038400:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00038410:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00038410:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00038420:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038420:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038430:·2861·7320·6f66·2032·3032·3 | 00038430:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038440:·3 | 00038440:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038450:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038450:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038460:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038460:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038470:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038470:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038480:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038480:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038490:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038490:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 000384a0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 000384a0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 000384b0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 000384b0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15325, 324 lines modified | Offset 15325, 324 lines modified | ||
| 0003bdc0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003bdc0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003bdd0:·6964·6d37·3237·3322·2074·6162·696e·6465··idm7273"·tabinde | 0003bdd0:·6964·6d37·3237·3322·2074·6162·696e·6465··idm7273"·tabinde | ||
| 0003bde0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003bde0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003bdf0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003bdf0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003be00:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003be00:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003be10:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003be10:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003be20:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003be20:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003be30:·656d·6564·6961·7469·6f6e·20 | 0003be30:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003be40:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003be50:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003be60:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003be70:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003be80:·646d·3732·3733·223e·3c74·6162·6c65·2063··dm7273"><table·c | |||
| 0003be90:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bea0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003beb0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bec0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bed0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bee0:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003bef0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bf00:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bf10:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003bf20:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bf30:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003bf40:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003b | 0003be40:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | ||
| 0003be50:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003be60:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003be70:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003be80:·3237·3322·3e3c·7072·653e·3c63·6f64·653e··273"><pre><code> | |||
| 0003be90:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003bea0:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003beb0:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003bec0:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003bed0:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003bee0:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003bef0:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003bf00:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003bf10:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003bf20:·6861·7368·3d22·2428·7270·6d20·2d56·6120··hash="$(rpm·-Va· | |||
| 0003bf30:·2d2d·6e6f·636f·6e66·6967·207c·2067·7265··--noconfig·|·gre | |||
| 0003bf40:·7020·2d45·2027·5e2e·2e35·2720·7c20·6177··p·-E·'^..5'·|·aw | |||
| 0003bf50:·6b20·277b·7072·696e·7420·244e·467d·2720··k·'{print·$NF}'· | |||
| 0003bf60:·2922·0a0a·2320·4672·6f6d·2066·696c·6573··)"..#·From·files | |||
| 0003bf | 0003bf70:·206e·616d·6573·2067·6574·2070·6163·6b61···names·get·packa | ||
| 0003bf80:·6765·206e·616d·6573·2061·6e64·2063·6861··ge·names·and·cha | |||
| 0003bf90:·6e67·6520·6e65·776c·696e·6520·746f·2073··nge·newline·to·s | |||
| 0003bfa0:·7061·6365·2c20·6265·6361·7573·6520·7270··pace,·because·rp | |||
| 0003bfb0:·6d20·7772·6974·6573·2065·6163·6820·7061··m·writes·each·pa | |||
| 0003bfc0:·636b·6167·6520·746f·206e·6577·206c·696e··ckage·to·new·lin | |||
| 0003bfd0:·650a·7061·636b·6167·6573·5f74·6f5f·7265··e.packages_to_re | |||
| 0003bfe0:·696e·7374·616c·6c3d·2224·2872·706d·202d··install="$(rpm·- | |||
| 0003bff0:·7166·2024·6669·6c65·735f·7769·7468·5f69··qf·$files_with_i | |||
| 0003c000:·6e63·6f72·7265·6374·5f68·6173·6820·7c20··ncorrect_hash·|· | |||
| 0003c010:·7472·2027·5c6e·2720·2720·2729·220a·0a0a··tr·'\n'·'·')"... | |||
| 0003c020:·646e·6620·7265·696e·7374·616c·6c20·2d79··dnf·reinstall·-y | |||
| 0003c030:·2024·7061·636b·6167·6573·5f74·6f5f·7265···$packages_to_re | |||
| 0003c040:·696e·7374·616c·6c0a·3c2f·636f·6465·3e3c··install.</code>< | |||
| 0003c050:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c060:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c070:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c080:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c090:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | |||
| 0003c0a0:·3734·2220·7461·6269·6e64·6578·3d22·3022··74"·tabindex="0" | |||
| 0003c0b0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c0c0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c0d0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c0e0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c0f0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c100:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003c110:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c120:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c130:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c140:·6170·7365·2220·6964·3d22·6964·6d37·3237··apse"·id="idm727 | |||
| 0003c150:·3422·3e3c·7461·626c·6520·636c·6173·733d··4"><table·class= | |||
| 0003c160:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003c170:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003c180:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003c190:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003c1a0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003c1b0:·3e68·6967·683c·2f74·643e·3c2f·7472·3e3c··>high</td></tr>< | |||
| 0003c1c0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003c1d0:·6e3a·3c2f·7468·3e3c·7464·3e6d·6564·6975··n:</th><td>mediu | |||
| 0003c1e0:·6d3c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··m</td></tr><tr>< | |||
| 0003c1f0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003c200:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003c210:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c220:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003bf70:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003bf80:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003bf90:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003bfa0:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003bfb0:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003bfc0:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003bfd0:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003bfe0:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003bff0:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003c000:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003c010:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003c020:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c030:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c040:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003c050:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003c060:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003c070:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003c080:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c090:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003c0a0:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003c0b0:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003c0c0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| Max diff block lines reached; 14724030/14768658 bytes (99.70%) of diff not shown. | |||
| Offset 55, 15 lines modified | Offset 55, 15 lines modified | ||
| 55 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·Red·Hat·Enterprise·Linux·9 | 55 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·Red·Hat·Enterprise·Linux·9 |
| 56 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 56 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 57 | ***·CPE·Platforms·*** | 57 | ***·CPE·Platforms·*** |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:9 | 58 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 59 | ····*·cpe:/o:centos:centos:9 | 59 | ····*·cpe:/o:centos:centos:9 |
| 60 | *****·Revision·History·***** | 60 | *****·Revision·History·***** |
| 61 | Current·version:·0.1.65 | 61 | Current·version:·0.1.65 |
| 62 | ····*·draft·(as·of·202 | 62 | ····*·draft·(as·of·2025-02-23) |
| 63 | *****·Table·of·Contents·***** | 63 | *****·Table·of·Contents·***** |
| 64 | ···1.·System_Settings | 64 | ···1.·System_Settings |
| 65 | ·········1.·Installing_and_Maintaining_Software | 65 | ·········1.·Installing_and_Maintaining_Software |
| 66 | ·········2.·Account_and_Access_Control | 66 | ·········2.·Account_and_Access_Control |
| 67 | ·········3.·System_Accounting_with_auditd | 67 | ·········3.·System_Accounting_with_auditd |
| 68 | ·········4.·GRUB2_bootloader_configuration | 68 | ·········4.·GRUB2_bootloader_configuration |
| 69 | ·········5.·Configure_Syslog | 69 | ·········5.·Configure_Syslog |
| Offset 98, 14 lines modified | Offset 98, 24 lines modified | ||
| 98 | $·sudo·dnf·reinstall·PACKAGENAME | 98 | $·sudo·dnf·reinstall·PACKAGENAME |
| 99 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 99 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 100 | $·sudo·rpm·-Uvh·PACKAGENAME | 100 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 101 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 101 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 102 | Severity: ················high | 102 | Severity: ················high |
| 103 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 103 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 104 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 104 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 105 | Remediation_Shell_script_⇲ | ||
| 106 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 107 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 108 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 109 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 110 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 105 | Remediation_Ansible_snippet_⇲ | 111 | Remediation_Ansible_snippet_⇲ |
| 106 | Complexity:·high | 112 | Complexity:·high |
| 107 | Disruption:·medium | 113 | Disruption:·medium |
| 108 | Strategy:···restrict | 114 | Strategy:···restrict |
| 109 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 115 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 110 | ··set_fact: | 116 | ··set_fact: |
| 111 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 117 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 249, 37 lines modified | Offset 259, 56 lines modified | ||
| 249 | ··-·PCI-DSS-Req-11.5 | 259 | ··-·PCI-DSS-Req-11.5 |
| 250 | ··-·high_complexity | 260 | ··-·high_complexity |
| 251 | ··-·high_severity | 261 | ··-·high_severity |
| 252 | ··-·medium_disruption | 262 | ··-·medium_disruption |
| 253 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 254 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 255 | ··-·rpm_verify_hashes | 265 | ··-·rpm_verify_hashes |
| 256 | Remediation_Shell_script_⇲ | ||
| 257 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 258 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 259 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 260 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 261 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 262 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 266 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 263 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 267 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 264 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 268 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 265 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 269 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 266 | $·rpm·-qf·FILENAME | 270 | $·rpm·-qf·FILENAME |
| 267 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 271 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 268 | $·sudo·rpm·--setperms·PACKAGENAME | 272 | $·sudo·rpm·--setperms·PACKAGENAME |
| 269 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 273 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 270 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 274 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 271 | Severity: ················high | 275 | Severity: ················high |
| 272 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 276 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 273 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 277 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 278 | Remediation_Shell_script_⇲ | ||
| 279 | Complexity:·high | ||
| 280 | Disruption:·medium | ||
| 281 | Strategy:···restrict | ||
| 282 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 283 | declare·-A·SETPERMS_RPM_DICT | ||
| 284 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 285 | #·is·expected·by·the·RPM·database | ||
| 286 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 287 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 288 | do | ||
| 289 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 290 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 291 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 292 | ········do | ||
| 293 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 294 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 295 | ········done | ||
| 296 | done | ||
| 297 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 298 | #·correct·values | ||
| 299 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 300 | do | ||
| 301 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 302 | done | ||
| 274 | Remediation_Ansible_snippet_⇲ | 303 | Remediation_Ansible_snippet_⇲ |
| 275 | Complexity:·high | 304 | Complexity:·high |
| 276 | Disruption:·medium | 305 | Disruption:·medium |
| 277 | Strategy:···restrict | 306 | Strategy:···restrict |
| 278 | -·name:·Read·list·of·files·with·incorrect·permissions | 307 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 279 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 308 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 280 | ····--nocaps·--nolinkto·--nouser·--nogroup | 309 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 353, 69 lines modified | Offset 382, 48 lines modified | ||
| 353 | ··-·PCI-DSS-Req-11.5 | 382 | ··-·PCI-DSS-Req-11.5 |
| 354 | ··-·high_complexity | 383 | ··-·high_complexity |
| 355 | ··-·high_severity | 384 | ··-·high_severity |
| 356 | ··-·medium_disruption | 385 | ··-·medium_disruption |
| 357 | ··-·no_reboot_needed | 386 | ··-·no_reboot_needed |
| 358 | ··-·restrict_strategy | 387 | ··-·restrict_strategy |
| 359 | ··-·rpm_verify_permissions | 388 | ··-·rpm_verify_permissions |
| 360 | Remediation_Shell_script_⇲ | ||
| 361 | Complexity:·high | ||
| 362 | Disruption:·medium | ||
| 363 | Strategy:···restrict | ||
| 364 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 365 | declare·-A·SETPERMS_RPM_DICT | ||
| 366 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 367 | #·is·expected·by·the·RPM·database | ||
| 368 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1164293/1172466 bytes (99.30%) of diff not shown. | |||
| Offset 14429, 16 lines modified | Offset 14429, 16 lines modified | ||
| 000385c0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 000385c0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 000385d0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 000385d0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 000385e0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 000385e0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 000385f0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 000385f0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00038600:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00038600:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00038610:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00038610:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00038620:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038620:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038630:·2861·7320·6f66·2032·3032·3 | 00038630:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038640:·3 | 00038640:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038650:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038650:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038660:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038660:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038670:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038670:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038680:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038680:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038690:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038690:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 000386a0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 000386a0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 000386b0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 000386b0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15389, 190 lines modified | Offset 15389, 190 lines modified | ||
| 0003c1c0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003c1c0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c1d0:·6d37·3630·3422·2074·6162·696e·6465·783d··m7604"·tabindex= | 0003c1d0:·6d37·3630·3422·2074·6162·696e·6465·783d··m7604"·tabindex= | ||
| 0003c1e0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003c1e0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003c1f0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003c1f0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003c200:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003c200:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003c210:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003c210:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003c220:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003c220:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003c230:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003c230:·6564·6961·7469·6f6e·2041·6e61·636f·6e64··ediation·Anacond | |||
| 0003c240:·6120·736e·6970·7065·7420·e287·b23c·2f61··a·snippet·...</a | |||
| 0003c250:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c260:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c270:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c280:·6d37·3630·3422·3e3c·7461·626c·6520·636c··m7604"><table·cl | |||
| 0003c290:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c2a0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c2b0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c2c0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c2d0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c2e0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c2f0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003c300:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003c310:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c320:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003c330:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003c340:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c350:·653e·3c63·6f64·653e·0a70·6163·6b61·6765··e><code>.package | |||
| 0003c360:·202d·2d61·6464·3d61·6964·650a·3c2f·636f···--add=aide.</co | |||
| 0003c370:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003c380:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003c390:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003c3a0:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003c3b0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003c3c0:·646d·3736·3035·2220·7461·6269·6e64·6578··dm7605"·tabindex | |||
| 0003c3d0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003c3e0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003c3f0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003c400:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003c410:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003c420:·6d65·6469·6174·696f·6e20·5075·7070·6574··mediation·Puppet | |||
| 0003c430:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003c440:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c450:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c460:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c470:·3736·3035·223e·3c74·6162·6c65·2063·6c61··7605"><table·cla | |||
| 0003c480:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003c490:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003c4a0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003c4b0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003c4c0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003c4d0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c4e0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c4f0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003c500:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c510:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c520:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003c530:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c540:·3e3c·636f·6465·3e69·6e63·6c75·6465·2069··><code>include·i | |||
| 0003c550:·6e73·7461·6c6c·5f61·6964·650a·0a63·6c61··nstall_aide..cla | |||
| 0003c560:·7373·2069·6e73·7461·6c6c·5f61·6964·6520··ss·install_aide· | |||
| 0003c570:·7b0a·2020·7061·636b·6167·6520·7b20·2761··{.··package·{·'a | |||
| 0003c580:·6964·6527·3a0a·2020·2020·656e·7375·7265··ide':.····ensure | |||
| 0003c590:·203d·2667·743b·2027·696e·7374·616c·6c65···=>·'installe | |||
| 0003c5a0:·6427·2c0a·2020·7d0a·7d0a·3c2f·636f·6465··d',.··}.}.</code | |||
| 0003c5b0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c5c0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c5d0:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c5e0:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003c5f0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003c600:·3736·3036·2220·7461·6269·6e64·6578·3d22··7606"·tabindex=" | |||
| 0003c610:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003c620:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003c630:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003c640:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003c650:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003c660:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003c | 0003c240:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | ||
| 0003c | 0003c250:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | ||
| 0003c | 0003c260:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | ||
| 0003c | 0003c270:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | ||
| 0003c | 0003c280:·3630·3422·3e3c·7461·626c·6520·636c·6173··604"><table·clas | ||
| 0003c | 0003c290:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | ||
| 0003c | 0003c2a0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | ||
| 0003c | 0003c2b0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | ||
| 0003c | 0003c2c0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | ||
| 0003c | 0003c2d0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | ||
| 0003c | 0003c2e0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003c | 0003c2f0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | ||
| 0003c | 0003c300:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | ||
| 0003c | 0003c310:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | ||
| 0003c | 0003c320:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | ||
| 0003c | 0003c330:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | ||
| 0003c | 0003c340:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | ||
| 0003c350:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003c360:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003c370:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003c380:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003c390:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003c3a0:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003c3b0:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003c3c0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c3d0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c3e0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c3f0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003c400:·7461·2d74·6172·6765·743d·2223·6964·6d37··ta-target="#idm7 | |||
| 0003c410:·3630·3522·2074·6162·696e·6465·783d·2230··605"·tabindex="0 | |||
| 0003c420:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c430:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c440:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c450:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| Max diff block lines reached; 30968490/30994626 bytes (99.92%) of diff not shown. | |||
| Offset 14453, 15 lines modified | Offset 14453, 15 lines modified | ||
| 00038740:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00038740:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00038750:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00038750:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00038760:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00038760:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00038770:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00038770:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00038780:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00038780:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00038790:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00038790:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 000387a0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 000387a0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 000387b0:·6620·3230·323 | 000387b0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 000387c0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 000387c0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 000387d0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 000387d0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 000387e0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 000387e0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 000387f0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 000387f0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00038800:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00038800:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00038810:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00038810:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00038820:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00038820:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15408, 189 lines modified | Offset 15408, 189 lines modified | ||
| 0003c2f0:·6765·743d·2223·6964·6d37·3630·3422·2074··get="#idm7604"·t | 0003c2f0:·6765·743d·2223·6964·6d37·3630·3422·2074··get="#idm7604"·t | ||
| 0003c300:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003c300:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003c310:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003c310:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003c320:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003c320:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003c330:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003c330:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003c340:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003c340:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003c350:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003c350:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003c360:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003c360:·2041·6e61·636f·6e64·6120·736e·6970·7065···Anaconda·snippe | |||
| 0003c370:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c380:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c390:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c3a0:·2220·6964·3d22·6964·6d37·3630·3422·3e3c··"·id="idm7604">< | |||
| 0003c3b0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c3c0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c3d0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c3e0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c3f0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c400:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003c410:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c420:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c430:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c440:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003c450:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003c460:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003c470:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c480:·0a70·6163·6b61·6765·202d·2d61·6464·3d61··.package·--add=a | |||
| 0003c490:·6964·650a·3c2f·636f·6465·3e3c·2f70·7265··ide.</code></pre | |||
| 0003c4a0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c4b0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c4c0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c4d0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c4e0:·7267·6574·3d22·2369·646d·3736·3035·2220··rget="#idm7605"· | |||
| 0003c4f0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c500:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c510:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c520:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c530:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c540:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003c550:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003c560:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003c570:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003c580:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003c590:·2069·643d·2269·646d·3736·3035·223e·3c74···id="idm7605"><t | |||
| 0003c5a0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003c5b0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003c5c0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003c5d0:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c5e0:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c5f0:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003c600:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c610:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003c620:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c630:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c640:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003c650:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003c660:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | |||
| 0003c670:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003c680:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003c690:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003c6a0:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003c6b0:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003c6c0:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003c6d0:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003c6e0:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c6f0:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c700:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c710:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c720:·6574·3d22·2369·646d·3736·3036·2220·7461··et="#idm7606"·ta | |||
| 0003c730:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c740:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c750:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c760:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c770:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c780:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003c790:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003c | 0003c370:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | ||
| 0003c | 0003c380:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | ||
| 0003c | 0003c390:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | ||
| 0003c | 0003c3a0:·6964·3d22·6964·6d37·3630·3422·3e3c·7461··id="idm7604"><ta | ||
| 0003c | 0003c3b0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | ||
| 0003c | 0003c3c0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | ||
| 0003c | 0003c3d0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | ||
| 0003c | 0003c3e0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | ||
| 0003c | 0003c3f0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | ||
| 0003c | 0003c400:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | ||
| 0003c | 0003c410:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003c | 0003c420:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | ||
| 0003c | 0003c430:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003c | 0003c440:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | ||
| 0003c | 0003c450:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | ||
| 0003c | 0003c460:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | ||
| 0003c | 0003c470:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | ||
| 0003c480:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003c490:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003c4a0:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003c4b0:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003c4c0:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003c4d0:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003c8b0:·6e61·6d65·3a20·456e·7375·7265·2061·6964··name:·Ensure·aid | |||
| 0003c8c0:·6520·6973·2069·6e73·7461·6c6c·6564·0a20··e·is·installed.· | |||
| 0003c8d0:·2070·6163·6b61·6765·3a0a·2020·2020·6e61···package:.····na | |||
| 0003c8e0:·6d65·3a20·6169·6465·0a20·2020·2073·7461··me:·aide.····sta | |||
| 0003c8f0:·7465·3a20·7072·6573·656e·740a·2020·7768··te:·present.··wh | |||
| 0003c900:·656e·3a20·616e·7369·626c·655f·7669·7274··en:·ansible_virt | |||
| 0003c910:·7561·6c69·7a61·7469·6f6e·5f74·7970·6520··ualization_type· | |||
| 0003c920:·6e6f·7420·696e·205b·2264·6f63·6b65·7222··not·in·["docker" | |||
| 0003c930:·2c20·226c·7863·222c·2022·6f70·656e·767a··,·"lxc",·"openvz | |||
| 0003c940:·222c·2022·706f·646d·616e·222c·2022·636f··",·"podman",·"co | |||
| 0003c950:·6e74·6169·6e65·7222·5d0a·2020·7461·6773··ntainer"].··tags | |||
| 0003c960:·3a0a·2020·2d20·434a·4953·2d35·2e31·302e··:.··-·CJIS-5.10. | |||
| Max diff block lines reached; 30887642/30913502 bytes (99.92%) of diff not shown. | |||
| Offset 14341, 15 lines modified | Offset 14341, 15 lines modified | ||
| 00038040:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00038040:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00038050:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00038050:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00038060:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00038060:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00038070:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00038070:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00038080:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00038080:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00038090:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00038090:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 000380a0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 000380a0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 000380b0:·2032·3032·3 | 000380b0:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 000380c0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 000380c0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 000380d0:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 000380d0:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 000380e0:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 000380e0:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 000380f0:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 000380f0:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00038100:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00038100:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00038110:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00038110:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00038120:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00038120:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 15295, 323 lines modified | Offset 15295, 323 lines modified | ||
| 0003bbe0:·7267·6574·3d22·2369·646d·3135·3034·2220··rget="#idm1504"· | 0003bbe0:·7267·6574·3d22·2369·646d·3135·3034·2220··rget="#idm1504"· | ||
| 0003bbf0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003bbf0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003bc00:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003bc00:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003bc10:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003bc10:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003bc20:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003bc20:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003bc30:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003bc30:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003bc40:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003bc40:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003bc50:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003bc60:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bc70:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bc80:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bc90:·643d·2269·646d·3135·3034·223e·3c70·7265··d="idm1504"><pre | |||
| 0003bca0:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003bcb0:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003bcc0:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003bcd0:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003bce0:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003bcf0:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003bd00:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003bd10:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003bd20:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003bd30:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003bd40:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003bd50:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003bd60:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003bd70:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003bd80:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003bc50:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bc60:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bc70:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bc80:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bc90:·2220·6964·3d22·6964·6d31·3530·3422·3e3c··"·id="idm1504">< | |||
| 0003bca0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bcb0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bcc0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bcd0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bce0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bcf0:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003bd00:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003bd10:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003bd20:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003bd30:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003bd40:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003bd50:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003bd60:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bd70:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003bd80:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003bd90:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003bda0:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003bdb0:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003bd | 0003bd90:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003bda0:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | |||
| 0003bdb0:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003bdc0:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003bdd0:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003bde0:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003bdf0:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003be00:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003be10:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003be20:·6861·7368·207c·2074·7220·275c·6e27·2027··hash·|·tr·'\n'·' | |||
| 0003be30:·2027·2922·0a0a·0a64·6e66·2072·6569·6e73···')"...dnf·reins | |||
| 0003be40:·7461·6c6c·202d·7920·2470·6163·6b61·6765··tall·-y·$package | |||
| 0003be50:·735f·746f·5f72·6569·6e73·7461·6c6c·0a3c··s_to_reinstall.< | |||
| 0003be60:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003be70:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003be80:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003be90:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bea0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003beb0:·2223·6964·6d31·3530·3522·2074·6162·696e··"#idm1505"·tabin | |||
| 0003bec0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003bed0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003bee0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003bef0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003bf00:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003bf10:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003bf20:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003bf30:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bf40:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003bf50:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003bf60:·2269·646d·3135·3035·223e·3c74·6162·6c65··"idm1505"><table | |||
| 0003bf70:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003bf80:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003bf90:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003bfa0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003bfb0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003bfc0:·2f74·683e·3c74·643e·6869·6768·3c2f·7464··/th><td>high</td | |||
| 0003bfd0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003bfe0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003bff0:·643e·6d65·6469·756d·3c2f·7464·3e3c·2f74··d>medium</td></t | |||
| 0003c000:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c010:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003c020:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 0003c030:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003bdd0:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003bde0:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003bdf0:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003be00:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003be10:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003be20:·733a·0a20·202d·2043·4a49·532d·352e·3130··s:.··-·CJIS-5.10 | |||
| 0003be30:·2e34·2e31·0a20·202d·204e·4953·542d·3830··.4.1.··-·NIST-80 | |||
| 0003be40:·302d·3137·312d·332e·332e·380a·2020·2d20··0-171-3.3.8.··-· | |||
| 0003be50:·4e49·5354·2d38·3030·2d31·3731·2d33·2e34··NIST-800-171-3.4 | |||
| 0003be60:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003be70:·3533·2d41·552d·3928·3329·0a20·202d·204e··53-AU-9(3).··-·N | |||
| 0003be80:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003be90:·6329·0a20·202d·204e·4953·542d·3830·302d··c).··-·NIST-800- | |||
| 0003bea0:·3533·2d43·4d2d·3628·6429·0a20·202d·204e··53-CM-6(d).··-·N | |||
| 0003beb0:·4953·542d·3830·302d·3533·2d53·492d·370a··IST-800-53-SI-7. | |||
| 0003bec0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bed0:·5349·2d37·2831·290a·2020·2d20·4e49·5354··SI-7(1).··-·NIST | |||
| 0003bee0:·2d38·3030·2d35·332d·5349·2d37·2836·290a··-800-53-SI-7(6). | |||
| Max diff block lines reached; 26259228/26303580 bytes (99.83%) of diff not shown. | |||
| Offset 14313, 16 lines modified | Offset 14313, 16 lines modified | ||
| 00037e80:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00037e80:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00037e90:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00037e90:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00037ea0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00037ea0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00037eb0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00037eb0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00037ec0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00037ec0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00037ed0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00037ed0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ef0:·2020·2020·2861·7320·6f66·2032·3032·3 | 00037ef0:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00037f00:·303 | 00037f00:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00037f10:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00037f10:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00037f20:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00037f20:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00037f30:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00037f30:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00037f40:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00037f40:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00037f50:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00037f50:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00037f60:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00037f60:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00037f70:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00037f70:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15236, 323 lines modified | Offset 15236, 323 lines modified | ||
| 0003b830:·7267·6574·3d22·2369·646d·3135·3034·2220··rget="#idm1504"· | 0003b830:·7267·6574·3d22·2369·646d·3135·3034·2220··rget="#idm1504"· | ||
| 0003b840:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003b840:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003b850:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003b850:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003b860:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003b860:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003b870:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003b870:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003b880:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003b880:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003b890:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003b890:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003b8a0:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003b8b0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b8c0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b8d0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003b8e0:·643d·2269·646d·3135·3034·223e·3c70·7265··d="idm1504"><pre | |||
| 0003b8f0:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003b900:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003b910:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003b920:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003b930:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003b940:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003b950:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003b960:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003b970:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003b980:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003b990:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003b9a0:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003b9b0:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003b9c0:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003b9d0:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003b8a0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003b8b0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003b8c0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003b8d0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003b8e0:·2220·6964·3d22·6964·6d31·3530·3422·3e3c··"·id="idm1504">< | |||
| 0003b8f0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003b900:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003b910:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003b920:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003b930:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003b940:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003b950:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003b960:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003b970:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003b980:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003b990:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003b9a0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003b9b0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003b9c0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003b9d0:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003b9e0:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003b9f0:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003ba00:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003b | 0003b9e0:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003ba20:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003ba30:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003ba40:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003ba50:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003ba60:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003b | 0003b9f0:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | ||
| 0003ba00:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003ba10:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003ba20:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003ba30:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003ba40:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003ba50:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003ba60:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003ba70:·6861·7368·207c·2074·7220·275c·6e27·2027··hash·|·tr·'\n'·' | |||
| 0003ba80:·2027·2922·0a0a·0a64·6e66·2072·6569·6e73···')"...dnf·reins | |||
| 0003ba90:·7461·6c6c·202d·7920·2470·6163·6b61·6765··tall·-y·$package | |||
| 0003baa0:·735f·746f·5f72·6569·6e73·7461·6c6c·0a3c··s_to_reinstall.< | |||
| 0003bab0:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003bac0:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003bad0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bae0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003baf0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003bb00:·2223·6964·6d31·3530·3522·2074·6162·696e··"#idm1505"·tabin | |||
| 0003bb10:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003bb20:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003bb30:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003bb40:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003bb50:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003bb60:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003bb70:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003bb80:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bb90:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003bba0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003bbb0:·2269·646d·3135·3035·223e·3c74·6162·6c65··"idm1505"><table | |||
| 0003bbc0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003bbd0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003bbe0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003bbf0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003bc00:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003bc10:·2f74·683e·3c74·643e·6869·6768·3c2f·7464··/th><td>high</td | |||
| 0003bc20:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003bc30:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003bc40:·643e·6d65·6469·756d·3c2f·7464·3e3c·2f74··d>medium</td></t | |||
| 0003bc50:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003bc60:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003bc70:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 0003bc80:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003bc90:·3e2d·206e·616d·653a·2027·5365·7420·6661··>-·name:·'Set·fa | |||
| 0003bca0:·6374·3a20·5061·636b·6167·6520·6d61·6e61··ct:·Package·mana | |||
| 0003bcb0:·6765·7220·7265·696e·7374·616c·6c20·636f··ger·reinstall·co | |||
| 0003bcc0:·6d6d·616e·6420·2864·6e66·2927·0a20·2073··mmand·(dnf)'.··s | |||
| 0003bcd0:·6574·5f66·6163·743a·0a20·2020·2070·6163··et_fact:.····pac | |||
| 0003bce0:·6b61·6765·5f6d·616e·6167·6572·5f72·6569··kage_manager_rei | |||
| 0003bcf0:·6e73·7461·6c6c·5f63·6d64·3a20·646e·6620··nstall_cmd:·dnf· | |||
| 0003bd00:·7265·696e·7374·616c·6c20·2d79·0a20·2077··reinstall·-y.··w | |||
| 0003bd10:·6865·6e3a·2061·6e73·6962·6c65·5f64·6973··hen:·ansible_dis | |||
| 0003bd20:·7472·6962·7574·696f·6e20·3d3d·2022·4665··tribution·==·"Fe | |||
| 0003bd30:·646f·7261·220a·2020·7461·6773·3a0a·2020··dora".··tags:.·· | |||
| 0003bd40:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| Max diff block lines reached; 13217573/13262063 bytes (99.66%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:fedoraproject:fedora:35 | 40 | ····*·cpe:/o:fedoraproject:fedora:35 |
| 41 | ····*·cpe:/o:fedoraproject:fedora:36 | 41 | ····*·cpe:/o:fedoraproject:fedora:36 |
| 42 | ····*·cpe:/o:fedoraproject:fedora:37 | 42 | ····*·cpe:/o:fedoraproject:fedora:37 |
| 43 | ····*·cpe:/o:fedoraproject:fedora:38 | 43 | ····*·cpe:/o:fedoraproject:fedora:38 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·Account_and_Access_Control | 50 | ·········2.·Account_and_Access_Control |
| 51 | ·········3.·System_Accounting_with_auditd | 51 | ·········3.·System_Accounting_with_auditd |
| 52 | ·········4.·GRUB2_bootloader_configuration | 52 | ·········4.·GRUB2_bootloader_configuration |
| 53 | ·········5.·Configure_Syslog | 53 | ·········5.·Configure_Syslog |
| Offset 81, 14 lines modified | Offset 81, 24 lines modified | ||
| 81 | $·sudo·dnf·reinstall·PACKAGENAME | 81 | $·sudo·dnf·reinstall·PACKAGENAME |
| 82 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 82 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 83 | $·sudo·rpm·-Uvh·PACKAGENAME | 83 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 84 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 84 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 85 | Severity: ················high | 85 | Severity: ················high |
| 86 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 86 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 87 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 87 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 88 | Remediation_Shell_script_⇲ | ||
| 89 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 90 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 91 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 92 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 93 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 88 | Remediation_Ansible_snippet_⇲ | 94 | Remediation_Ansible_snippet_⇲ |
| 89 | Complexity:·high | 95 | Complexity:·high |
| 90 | Disruption:·medium | 96 | Disruption:·medium |
| 91 | Strategy:···restrict | 97 | Strategy:···restrict |
| 92 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 98 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 93 | ··set_fact: | 99 | ··set_fact: |
| 94 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 100 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 232, 37 lines modified | Offset 242, 56 lines modified | ||
| 232 | ··-·PCI-DSS-Req-11.5 | 242 | ··-·PCI-DSS-Req-11.5 |
| 233 | ··-·high_complexity | 243 | ··-·high_complexity |
| 234 | ··-·high_severity | 244 | ··-·high_severity |
| 235 | ··-·medium_disruption | 245 | ··-·medium_disruption |
| 236 | ··-·no_reboot_needed | 246 | ··-·no_reboot_needed |
| 237 | ··-·restrict_strategy | 247 | ··-·restrict_strategy |
| 238 | ··-·rpm_verify_hashes | 248 | ··-·rpm_verify_hashes |
| 239 | Remediation_Shell_script_⇲ | ||
| 240 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 241 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 242 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 243 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 244 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 245 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 249 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 246 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 250 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 247 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 251 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 248 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 252 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 249 | $·rpm·-qf·FILENAME | 253 | $·rpm·-qf·FILENAME |
| 250 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 254 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 251 | $·sudo·rpm·--setperms·PACKAGENAME | 255 | $·sudo·rpm·--setperms·PACKAGENAME |
| 252 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 256 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 253 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 257 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 254 | Severity: ················high | 258 | Severity: ················high |
| 255 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 259 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 256 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 260 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 261 | Remediation_Shell_script_⇲ | ||
| 262 | Complexity:·high | ||
| 263 | Disruption:·medium | ||
| 264 | Strategy:···restrict | ||
| 265 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 266 | declare·-A·SETPERMS_RPM_DICT | ||
| 267 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 268 | #·is·expected·by·the·RPM·database | ||
| 269 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 270 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 271 | do | ||
| 272 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 273 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 274 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 275 | ········do | ||
| 276 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 277 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 278 | ········done | ||
| 279 | done | ||
| 280 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 281 | #·correct·values | ||
| 282 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 283 | do | ||
| 284 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 285 | done | ||
| 257 | Remediation_Ansible_snippet_⇲ | 286 | Remediation_Ansible_snippet_⇲ |
| 258 | Complexity:·high | 287 | Complexity:·high |
| 259 | Disruption:·medium | 288 | Disruption:·medium |
| 260 | Strategy:···restrict | 289 | Strategy:···restrict |
| 261 | -·name:·Read·list·of·files·with·incorrect·permissions | 290 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 262 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 291 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 263 | ····--nocaps·--nolinkto·--nouser·--nogroup | 292 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 336, 69 lines modified | Offset 365, 48 lines modified | ||
| 336 | ··-·PCI-DSS-Req-11.5 | 365 | ··-·PCI-DSS-Req-11.5 |
| 337 | ··-·high_complexity | 366 | ··-·high_complexity |
| 338 | ··-·high_severity | 367 | ··-·high_severity |
| 339 | ··-·medium_disruption | 368 | ··-·medium_disruption |
| 340 | ··-·no_reboot_needed | 369 | ··-·no_reboot_needed |
| 341 | ··-·restrict_strategy | 370 | ··-·restrict_strategy |
| 342 | ··-·rpm_verify_permissions | 371 | ··-·rpm_verify_permissions |
| 343 | Remediation_Shell_script_⇲ | ||
| 344 | Complexity:·high | ||
| 345 | Disruption:·medium | ||
| 346 | Strategy:···restrict | ||
| 347 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 348 | declare·-A·SETPERMS_RPM_DICT | ||
| 349 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 350 | #·is·expected·by·the·RPM·database | ||
| 351 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 970148/978265 bytes (99.17%) of diff not shown. | |||
| Offset 14319, 15 lines modified | Offset 14319, 15 lines modified | ||
| 00037ee0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037ee0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037ef0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037ef0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037f00:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037f00:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037f10:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037f10:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037f20:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037f20:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037f30:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037f30:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037f40:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037f40:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037f50:·3 | 00037f50:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037f60:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037f60:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037f70:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037f70:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037f80:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037f80:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037f90:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037f90:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037fa0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037fa0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037fb0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037fb0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037fc0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037fc0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15227, 324 lines modified | Offset 15227, 324 lines modified | ||
| 0003b7a0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b7a0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b7b0:·3d22·2369·646d·3135·3034·2220·7461·6269··="#idm1504"·tabi | 0003b7b0:·3d22·2369·646d·3135·3034·2220·7461·6269··="#idm1504"·tabi | ||
| 0003b7c0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b7c0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b7d0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b7d0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b7e0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b7e0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b7f0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b7f0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b800:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b800:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b810:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b810:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003b820:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003b830:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b8 | 0003b820:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003b830:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003b840:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003b850:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003b860:·646d·3135·3034·223e·3c70·7265·3e3c·636f··dm1504"><pre><co | |||
| 0003b870:·6465·3e0a·2320·4669·6e64·2077·6869·6368··de>.#·Find·which | |||
| 0003b880:·2066·696c·6573·2068·6176·6520·696e·636f···files·have·inco | |||
| 0003b890:·7272·6563·7420·6861·7368·2028·6e6f·7420··rrect·hash·(not· | |||
| 0003b8a0:·696e·202f·6574·632c·2062·6563·6175·7365··in·/etc,·because | |||
| 0003b8b0:·206f·6620·7468·6520·7379·7374·656d·2072···of·the·system·r | |||
| 0003b8c0:·656c·6174·6564·2063·6f6e·6669·6720·6669··elated·config·fi | |||
| 0003b8d0:·6c65·7329·2061·6e64·2074·6865·6e20·6765··les)·and·then·ge | |||
| 0003b8e0:·7420·6669·6c65·7320·6e61·6d65·730a·6669··t·files·names.fi | |||
| 0003b8f0:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003b900:·6374·5f68·6173·683d·2224·2872·706d·202d··ct_hash="$(rpm·- | |||
| 0003b910:·5661·202d·2d6e·6f63·6f6e·6669·6720·7c20··Va·--noconfig·|· | |||
| 0003b920:·6772·6570·202d·4520·275e·2e2e·3527·207c··grep·-E·'^..5'·| | |||
| 0003b930:·2061·776b·2027·7b70·7269·6e74·2024·4e46···awk·'{print·$NF | |||
| 0003b940:·7d27·2029·220a·0a23·2046·726f·6d20·6669··}'·)"..#·From·fi | |||
| 0003b950:·6c65·7320·6e61·6d65·7320·6765·7420·7061··les·names·get·pa | |||
| 0003b960:·636b·6167·6520·6e61·6d65·7320·616e·6420··ckage·names·and· | |||
| 0003b970:·6368·616e·6765·206e·6577·6c69·6e65·2074··change·newline·t | |||
| 0003b980:·6f20·7370·6163·652c·2062·6563·6175·7365··o·space,·because | |||
| 0003b990:·2072·706d·2077·7269·7465·7320·6561·6368···rpm·writes·each | |||
| 0003b9a0:·2070·6163·6b61·6765·2074·6f20·6e65·7720···package·to·new· | |||
| 0003b9b0:·6c69·6e65·0a70·6163·6b61·6765·735f·746f··line.packages_to | |||
| 0003b9c0:·5f72·6569·6e73·7461·6c6c·3d22·2428·7270··_reinstall="$(rp | |||
| 0003b9d0:·6d20·2d71·6620·2466·696c·6573·5f77·6974··m·-qf·$files_wit | |||
| 0003b9e0:·685f·696e·636f·7272·6563·745f·6861·7368··h_incorrect_hash | |||
| 0003b9f0:·207c·2074·7220·275c·6e27·2027·2027·2922···|·tr·'\n'·'·')" | |||
| 0003ba00:·0a0a·0a64·6e66·2072·6569·6e73·7461·6c6c··...dnf·reinstall | |||
| 0003ba10:·202d·7920·2470·6163·6b61·6765·735f·746f···-y·$packages_to | |||
| 0003ba20:·5f72·6569·6e73·7461·6c6c·0a3c·2f63·6f64··_reinstall.</cod | |||
| 0003ba30:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003ba40:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003ba50:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003b | 0003ba60:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003ba70:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003ba80:·6d31·3530·3522·2074·6162·696e·6465·783d··m1505"·tabindex= | |||
| 0003ba90:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003baa0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bab0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bac0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bad0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bae0:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003baf0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bb00:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bb10:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bb20:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bb30:·3135·3035·223e·3c74·6162·6c65·2063·6c61··1505"><table·cla | |||
| 0003bb40:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bb50:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bb60:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bb70:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bb80:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bb90:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003bba0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bbb0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003bbc0:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003bbd0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bbe0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003bbf0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bc00:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003b860:·3d22·6964·6d31·3530·3422·3e3c·7461·626c··="idm1504"><tabl | |||
| 0003b870:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003b880:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003b890:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003b8a0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003b8b0:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003b8c0:·3c2f·7468·3e3c·7464·3e68·6967·683c·2f74··</th><td>high</t | |||
| 0003b8d0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003b8e0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b8f0:·7464·3e6d·6564·6975·6d3c·2f74·643e·3c2f··td>medium</td></ | |||
| 0003b900:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003b910:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 0003b920:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 0003b930:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003b940:·653e·2d20·6e61·6d65·3a20·2753·6574·2066··e>-·name:·'Set·f | |||
| 0003b950:·6163·743a·2050·6163·6b61·6765·206d·616e··act:·Package·man | |||
| 0003b960:·6167·6572·2072·6569·6e73·7461·6c6c·2063··ager·reinstall·c | |||
| 0003b970:·6f6d·6d61·6e64·2028·646e·6629·270a·2020··ommand·(dnf)'.·· | |||
| 0003b980:·7365·745f·6661·6374·3a0a·2020·2020·7061··set_fact:.····pa | |||
| 0003b990:·636b·6167·655f·6d61·6e61·6765·725f·7265··ckage_manager_re | |||
| 0003b9a0:·696e·7374·616c·6c5f·636d·643a·2064·6e66··install_cmd:·dnf | |||
| 0003b9b0:·2072·6569·6e73·7461·6c6c·202d·790a·2020···reinstall·-y.·· | |||
| 0003b9c0:·7768·656e·3a20·616e·7369·626c·655f·6469··when:·ansible_di | |||
| 0003b9d0:·7374·7269·6275·7469·6f6e·203d·3d20·2246··stribution·==·"F | |||
| 0003b9e0:·6564·6f72·6122·0a20·2074·6167·733a·0a20··edora".··tags:.· | |||
| 0003b9f0:·202d·2043·4a49·532d·352e·3130·2e34·2e31···-·CJIS-5.10.4.1 | |||
| 0003ba00:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | |||
| 0003ba10:·312d·332e·332e·380a·2020·2d20·4e49·5354··1-3.3.8.··-·NIST | |||
| 0003ba20:·2d38·3030·2d31·3731·2d33·2e34·2e31·0a20··-800-171-3.4.1.· | |||
| 0003ba30:·202d·204e·4953·542d·3830·302d·3533·2d41···-·NIST-800-53-A | |||
| 0003ba40:·552d·3928·3329·0a20·202d·204e·4953·542d··U-9(3).··-·NIST- | |||
| 0003ba50:·3830·302d·3533·2d43·4d2d·3628·6329·0a20··800-53-CM-6(c).· | |||
| 0003ba60:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003ba70:·4d2d·3628·6429·0a20·202d·204e·4953·542d··M-6(d).··-·NIST- | |||
| 0003ba80:·3830·302d·3533·2d53·492d·370a·2020·2d20··800-53-SI-7.··-· | |||
| 0003ba90:·4e49·5354·2d38·3030·2d35·332d·5349·2d37··NIST-800-53-SI-7 | |||
| 0003baa0:·2831·290a·2020·2d20·4e49·5354·2d38·3030··(1).··-·NIST-800 | |||
| 0003bab0:·2d35·332d·5349·2d37·2836·290a·2020·2d20··-53-SI-7(6).··-· | |||
| Max diff block lines reached; 7075951/7105399 bytes (99.59%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:fedoraproject:fedora:35 | 41 | ····*·cpe:/o:fedoraproject:fedora:35 |
| 42 | ····*·cpe:/o:fedoraproject:fedora:36 | 42 | ····*·cpe:/o:fedoraproject:fedora:36 |
| 43 | ····*·cpe:/o:fedoraproject:fedora:37 | 43 | ····*·cpe:/o:fedoraproject:fedora:37 |
| 44 | ····*·cpe:/o:fedoraproject:fedora:38 | 44 | ····*·cpe:/o:fedoraproject:fedora:38 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·System_Accounting_with_auditd | 52 | ·········3.·System_Accounting_with_auditd |
| 53 | ·········4.·Network_Configuration_and_Firewalls | 53 | ·········4.·Network_Configuration_and_Firewalls |
| 54 | ·········5.·File_Permissions_and_Masks | 54 | ·········5.·File_Permissions_and_Masks |
| Offset 80, 14 lines modified | Offset 80, 24 lines modified | ||
| 80 | $·sudo·dnf·reinstall·PACKAGENAME | 80 | $·sudo·dnf·reinstall·PACKAGENAME |
| 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 82 | $·sudo·rpm·-Uvh·PACKAGENAME | 82 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 84 | Severity: ················high | 84 | Severity: ················high |
| 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 87 | Remediation_Shell_script_⇲ | ||
| 88 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 89 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 90 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 91 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 92 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 87 | Remediation_Ansible_snippet_⇲ | 93 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·high | 94 | Complexity:·high |
| 89 | Disruption:·medium | 95 | Disruption:·medium |
| 90 | Strategy:···restrict | 96 | Strategy:···restrict |
| 91 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 97 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 92 | ··set_fact: | 98 | ··set_fact: |
| 93 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 99 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 231, 37 lines modified | Offset 241, 56 lines modified | ||
| 231 | ··-·PCI-DSS-Req-11.5 | 241 | ··-·PCI-DSS-Req-11.5 |
| 232 | ··-·high_complexity | 242 | ··-·high_complexity |
| 233 | ··-·high_severity | 243 | ··-·high_severity |
| 234 | ··-·medium_disruption | 244 | ··-·medium_disruption |
| 235 | ··-·no_reboot_needed | 245 | ··-·no_reboot_needed |
| 236 | ··-·restrict_strategy | 246 | ··-·restrict_strategy |
| 237 | ··-·rpm_verify_hashes | 247 | ··-·rpm_verify_hashes |
| 238 | Remediation_Shell_script_⇲ | ||
| 239 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 240 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 241 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 242 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 243 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 244 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 248 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 245 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 249 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 246 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 250 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 247 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 251 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 248 | $·rpm·-qf·FILENAME | 252 | $·rpm·-qf·FILENAME |
| 249 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 253 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 250 | $·sudo·rpm·--setperms·PACKAGENAME | 254 | $·sudo·rpm·--setperms·PACKAGENAME |
| 251 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 255 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 252 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 256 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 253 | Severity: ················high | 257 | Severity: ················high |
| 254 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 258 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 255 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 259 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 260 | Remediation_Shell_script_⇲ | ||
| 261 | Complexity:·high | ||
| 262 | Disruption:·medium | ||
| 263 | Strategy:···restrict | ||
| 264 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 265 | declare·-A·SETPERMS_RPM_DICT | ||
| 266 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 267 | #·is·expected·by·the·RPM·database | ||
| 268 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 269 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 270 | do | ||
| 271 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 272 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 273 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 274 | ········do | ||
| 275 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 276 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 277 | ········done | ||
| 278 | done | ||
| 279 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 280 | #·correct·values | ||
| 281 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 282 | do | ||
| 283 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 284 | done | ||
| 256 | Remediation_Ansible_snippet_⇲ | 285 | Remediation_Ansible_snippet_⇲ |
| 257 | Complexity:·high | 286 | Complexity:·high |
| 258 | Disruption:·medium | 287 | Disruption:·medium |
| 259 | Strategy:···restrict | 288 | Strategy:···restrict |
| 260 | -·name:·Read·list·of·files·with·incorrect·permissions | 289 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 261 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 290 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 262 | ····--nocaps·--nolinkto·--nouser·--nogroup | 291 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 335, 57 lines modified | Offset 364, 42 lines modified | ||
| 335 | ··-·PCI-DSS-Req-11.5 | 364 | ··-·PCI-DSS-Req-11.5 |
| 336 | ··-·high_complexity | 365 | ··-·high_complexity |
| 337 | ··-·high_severity | 366 | ··-·high_severity |
| 338 | ··-·medium_disruption | 367 | ··-·medium_disruption |
| 339 | ··-·no_reboot_needed | 368 | ··-·no_reboot_needed |
| 340 | ··-·restrict_strategy | 369 | ··-·restrict_strategy |
| 341 | ··-·rpm_verify_permissions | 370 | ··-·rpm_verify_permissions |
| 342 | Remediation_Shell_script_⇲ | ||
| 343 | Complexity:·high | ||
| 344 | Disruption:·medium | ||
| 345 | Strategy:···restrict | ||
| 346 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 347 | declare·-A·SETPERMS_RPM_DICT | ||
| 348 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 349 | #·is·expected·by·the·RPM·database | ||
| 350 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 612847/620978 bytes (98.69%) of diff not shown. | |||
| Offset 14332, 15 lines modified | Offset 14332, 15 lines modified | ||
| 00037fb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037fb0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037fc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037fc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037fd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037fd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037fe0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037fe0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037ff0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037ff0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00038000:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00038000:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00038010:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00038010:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00038020:·7320·6f66·2032·3032·3 | 00038020:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00038030:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038030:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038040:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00038040:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00038050:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00038050:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00038060:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00038060:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00038070:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00038070:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00038080:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00038080:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00038090:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00038090:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ |
| Offset 53, 15 lines modified | Offset 53, 15 lines modified | ||
| 53 | Profile·Title·NIST·800-53·Moderate-Impact·Baseline·for·Apple·macOS·10.15 | 53 | Profile·Title·NIST·800-53·Moderate-Impact·Baseline·for·Apple·macOS·10.15 |
| 54 | ··············Catalina | 54 | ··············Catalina |
| 55 | Profile·ID····xccdf_org.ssgproject.content_profile_moderate | 55 | Profile·ID····xccdf_org.ssgproject.content_profile_moderate |
| 56 | ***·CPE·Platforms·*** | 56 | ***·CPE·Platforms·*** |
| 57 | ····*·cpe:/o:apple:macos:10.15 | 57 | ····*·cpe:/o:apple:macos:10.15 |
| 58 | *****·Revision·History·***** | 58 | *****·Revision·History·***** |
| 59 | Current·version:·0.1.65 | 59 | Current·version:·0.1.65 |
| 60 | ····*·draft·(as·of·202 | 60 | ····*·draft·(as·of·2025-02-23) |
| 61 | *****·Table·of·Contents·***** | 61 | *****·Table·of·Contents·***** |
| 62 | ···1.·System_Accounting_with_audit | 62 | ···1.·System_Accounting_with_audit |
| 63 | ·········1.·Configure_auditd | 63 | ·········1.·Configure_auditd |
| 64 | *****·Checklist·***** | 64 | *****·Checklist·***** |
| 65 | Group ·Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15· Group·contains·2·groups | 65 | Group ·Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15· Group·contains·2·groups |
| 66 | and·2·rules | 66 | and·2·rules |
| 67 | Group ·System·Accounting·with·audit· Group·contains·1·group·and·2·rules | 67 | Group ·System·Accounting·with·audit· Group·contains·1·group·and·2·rules |
| Offset 14624, 16 lines modified | Offset 14624, 16 lines modified | ||
| 000391f0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 000391f0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00039200:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00039200:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00039210:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00039210:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00039220:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00039220:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00039230:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00039230:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00039240:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00039240:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00039250:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00039250:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00039260:·2020·2020·2861·7320·6f66·2032·3032·3 | 00039260:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00039270:·303 | 00039270:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00039280:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00039280:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00039290:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00039290:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 000392a0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 000392a0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 000392b0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 000392b0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 000392c0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 000392c0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 000392d0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 000392d0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 000392e0:·6772·6f75·705f·6f70·656e·7368·6966·7422··group_openshift" | 000392e0:·6772·6f75·705f·6f70·656e·7368·6966·7422··group_openshift" |
| Offset 65, 15 lines modified | Offset 65, 15 lines modified | ||
| 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 66 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 66 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 70 | *****·Revision·History·***** | 70 | *****·Revision·History·***** |
| 71 | Current·version:·0.1.65 | 71 | Current·version:·0.1.65 |
| 72 | ····*·draft·(as·of·202 | 72 | ····*·draft·(as·of·2025-02-23) |
| 73 | *****·Table·of·Contents·***** | 73 | *****·Table·of·Contents·***** |
| 74 | ···1.·Kubernetes_Settings | 74 | ···1.·Kubernetes_Settings |
| 75 | ·········1.·OpenShift_etcd_Settings | 75 | ·········1.·OpenShift_etcd_Settings |
| 76 | ·········2.·Kubernetes_Kubelet_Settings | 76 | ·········2.·Kubernetes_Kubelet_Settings |
| 77 | ·········3.·OpenShift_-_Master_Node_Settings | 77 | ·········3.·OpenShift_-_Master_Node_Settings |
| 78 | ·········4.·Kubernetes_-_Worker_Node_Settings | 78 | ·········4.·Kubernetes_-_Worker_Node_Settings |
| 79 | *****·Checklist·***** | 79 | *****·Checklist·***** |
| Offset 14624, 15 lines modified | Offset 14624, 15 lines modified | ||
| 000391f0:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 000391f0:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00039200:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00039200:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00039210:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00039210:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00039220:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00039220:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00039230:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00039230:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 00039240:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 00039240:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 00039250:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 00039250:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 00039260:·323 | 00039260:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 00039270:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 00039270:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00039280:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00039280:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00039290:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00039290:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 000392a0:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 000392a0:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 000392b0:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 000392b0:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 000392c0:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 000392c0:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 000392d0:·6e74·5f67·726f·7570·5f6f·7065·6e73·6869··nt_group_openshi | 000392d0:·6e74·5f67·726f·7570·5f6f·7065·6e73·6869··nt_group_openshi |
| Offset 65, 15 lines modified | Offset 65, 15 lines modified | ||
| 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 66 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 66 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 70 | *****·Revision·History·***** | 70 | *****·Revision·History·***** |
| 71 | Current·version:·0.1.65 | 71 | Current·version:·0.1.65 |
| 72 | ····*·draft·(as·of·202 | 72 | ····*·draft·(as·of·2025-02-23) |
| 73 | *****·Table·of·Contents·***** | 73 | *****·Table·of·Contents·***** |
| 74 | ···1.·Kubernetes_Settings | 74 | ···1.·Kubernetes_Settings |
| 75 | ·········1.·Kubernetes_-_Account_and_Access_Control | 75 | ·········1.·Kubernetes_-_Account_and_Access_Control |
| 76 | ·········2.·OpenShift_Kube_API_Server | 76 | ·········2.·OpenShift_Kube_API_Server |
| 77 | ·········3.·Authentication | 77 | ·········3.·Authentication |
| 78 | ·········4.·OpenShift_Controller_Settings | 78 | ·········4.·OpenShift_Controller_Settings |
| 79 | ·········5.·OpenShift_etcd_Settings | 79 | ·········5.·OpenShift_etcd_Settings |
| Offset 14618, 15 lines modified | Offset 14618, 15 lines modified | ||
| 00039190:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00039190:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 000391a0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 000391a0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 000391b0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 000391b0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 000391c0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 000391c0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 000391d0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 000391d0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 000391e0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 000391e0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 000391f0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 000391f0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00039200:·3 | 00039200:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00039210:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00039210:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00039220:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00039220:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00039230:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00039230:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00039240:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00039240:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00039250:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00039250:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00039260:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00039260:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00039270:·745f·6772·6f75·705f·6f70·656e·7368·6966··t_group_openshif | 00039270:·745f·6772·6f75·705f·6f70·656e·7368·6966··t_group_openshif |
| Offset 64, 15 lines modified | Offset 64, 15 lines modified | ||
| 64 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 64 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 66 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 66 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 69 | *****·Revision·History·***** | 69 | *****·Revision·History·***** |
| 70 | Current·version:·0.1.65 | 70 | Current·version:·0.1.65 |
| 71 | ····*·draft·(as·of·202 | 71 | ····*·draft·(as·of·2025-02-23) |
| 72 | *****·Table·of·Contents·***** | 72 | *****·Table·of·Contents·***** |
| 73 | ···1.·Kubernetes_Settings | 73 | ···1.·Kubernetes_Settings |
| 74 | ·········1.·OpenShift_Kube_API_Server | 74 | ·········1.·OpenShift_Kube_API_Server |
| 75 | ·········2.·Authentication | 75 | ·········2.·Authentication |
| 76 | ·········3.·Kubernetes_-_General_Security_Practices | 76 | ·········3.·Kubernetes_-_General_Security_Practices |
| 77 | ·········4.·Role-based_Acess_Control | 77 | ·········4.·Role-based_Acess_Control |
| 78 | ·········5.·Kubernetes_-_Registry_Security_Practices | 78 | ·········5.·Kubernetes_-_Registry_Security_Practices |
| Offset 14670, 16 lines modified | Offset 14670, 16 lines modified | ||
| 000394d0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 000394d0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 000394e0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 000394e0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 000394f0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 000394f0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00039500:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00039500:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00039510:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00039510:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00039520:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00039520:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00039530:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00039530:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00039540:·2028·6173·206f·6620·3230·323 | 00039540:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00039550:·323 | 00039550:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00039560:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00039560:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00039570:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00039570:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00039580:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00039580:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00039590:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00039590:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 000395a0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 000395a0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 000395b0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 000395b0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 000395c0:·7570·5f6f·7065·6e73·6869·6674·223e·4b75··up_openshift">Ku | 000395c0:·7570·5f6f·7065·6e73·6869·6674·223e·4b75··up_openshift">Ku |
| Offset 78, 15 lines modified | Offset 78, 15 lines modified | ||
| 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 83 | *****·Revision·History·***** | 83 | *****·Revision·History·***** |
| 84 | Current·version:·0.1.65 | 84 | Current·version:·0.1.65 |
| 85 | ····*·draft·(as·of·202 | 85 | ····*·draft·(as·of·2025-02-23) |
| 86 | *****·Table·of·Contents·***** | 86 | *****·Table·of·Contents·***** |
| 87 | ···1.·Kubernetes_Settings | 87 | ···1.·Kubernetes_Settings |
| 88 | ·········1.·System_and_Software_Integrity | 88 | ·········1.·System_and_Software_Integrity |
| 89 | ·········2.·OpenShift_etcd_Settings | 89 | ·········2.·OpenShift_etcd_Settings |
| 90 | ·········3.·Kubernetes_Kubelet_Settings | 90 | ·········3.·Kubernetes_Kubelet_Settings |
| 91 | ·········4.·OpenShift_-_Logging_Settings | 91 | ·········4.·OpenShift_-_Logging_Settings |
| 92 | ·········5.·OpenShift_-_Master_Node_Settings | 92 | ·········5.·OpenShift_-_Master_Node_Settings |
| Offset 14670, 16 lines modified | Offset 14670, 16 lines modified | ||
| 000394d0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 000394d0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 000394e0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 000394e0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 000394f0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 000394f0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00039500:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00039500:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00039510:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00039510:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00039520:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00039520:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00039530:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00039530:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00039540:·2020·2020·2861·7320·6f66·2032·3032·3 | 00039540:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00039550:·303 | 00039550:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00039560:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00039560:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00039570:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00039570:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00039580:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00039580:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00039590:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00039590:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 000395a0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 000395a0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 000395b0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 000395b0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 000395c0:·6772·6f75·705f·6f70·656e·7368·6966·7422··group_openshift" | 000395c0:·6772·6f75·705f·6f70·656e·7368·6966·7422··group_openshift" |
| Offset 78, 15 lines modified | Offset 78, 15 lines modified | ||
| 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 83 | *****·Revision·History·***** | 83 | *****·Revision·History·***** |
| 84 | Current·version:·0.1.65 | 84 | Current·version:·0.1.65 |
| 85 | ····*·draft·(as·of·202 | 85 | ····*·draft·(as·of·2025-02-23) |
| 86 | *****·Table·of·Contents·***** | 86 | *****·Table·of·Contents·***** |
| 87 | ···1.·Kubernetes_Settings | 87 | ···1.·Kubernetes_Settings |
| 88 | ·········1.·System_and_Software_Integrity | 88 | ·········1.·System_and_Software_Integrity |
| 89 | ·········2.·Kubernetes_-_Account_and_Access_Control | 89 | ·········2.·Kubernetes_-_Account_and_Access_Control |
| 90 | ·········3.·OpenShift_Kube_API_Server | 90 | ·········3.·OpenShift_Kube_API_Server |
| 91 | ·········4.·Authentication | 91 | ·········4.·Authentication |
| 92 | ·········5.·OpenShift_Controller_Settings | 92 | ·········5.·OpenShift_Controller_Settings |
| Offset 14671, 16 lines modified | Offset 14671, 16 lines modified | ||
| 000394e0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 000394e0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 000394f0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 000394f0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00039500:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00039500:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00039510:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00039510:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00039520:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00039520:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00039530:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00039530:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00039540:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00039540:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00039550:·2020·2020·2028·6173·206f·6620·3230·323 | 00039550:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00039560:·2d30·3 | 00039560:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00039570:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00039570:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00039580:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00039580:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00039590:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00039590:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 000395a0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 000395a0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 000395b0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 000395b0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 000395c0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 000395c0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 000395d0:·5f67·726f·7570·5f6f·7065·6e73·6869·6674··_group_openshift | 000395d0:·5f67·726f·7570·5f6f·7065·6e73·6869·6674··_group_openshift |
| Offset 78, 15 lines modified | Offset 78, 15 lines modified | ||
| 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 83 | *****·Revision·History·***** | 83 | *****·Revision·History·***** |
| 84 | Current·version:·0.1.65 | 84 | Current·version:·0.1.65 |
| 85 | ····*·draft·(as·of·202 | 85 | ····*·draft·(as·of·2025-02-23) |
| 86 | *****·Table·of·Contents·***** | 86 | *****·Table·of·Contents·***** |
| 87 | ···1.·Kubernetes_Settings | 87 | ···1.·Kubernetes_Settings |
| 88 | ·········1.·System_and_Software_Integrity | 88 | ·········1.·System_and_Software_Integrity |
| 89 | ·········2.·OpenShift_etcd_Settings | 89 | ·········2.·OpenShift_etcd_Settings |
| 90 | ·········3.·Kubernetes_Kubelet_Settings | 90 | ·········3.·Kubernetes_Kubelet_Settings |
| 91 | ·········4.·OpenShift_-_Logging_Settings | 91 | ·········4.·OpenShift_-_Logging_Settings |
| 92 | ·········5.·OpenShift_-_Master_Node_Settings | 92 | ·········5.·OpenShift_-_Master_Node_Settings |
| Offset 14672, 15 lines modified | Offset 14672, 15 lines modified | ||
| 000394f0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 000394f0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00039500:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00039500:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00039510:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00039510:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00039520:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00039520:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00039530:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00039530:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00039540:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00039540:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00039550:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00039550:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00039560:·3032·3 | 00039560:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00039570:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00039570:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00039580:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00039580:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00039590:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00039590:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 000395a0:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 000395a0:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 000395b0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 000395b0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 000395c0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 000395c0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 000395d0:·656e·745f·6772·6f75·705f·6f70·656e·7368··ent_group_opensh | 000395d0:·656e·745f·6772·6f75·705f·6f70·656e·7368··ent_group_opensh |
| Offset 78, 15 lines modified | Offset 78, 15 lines modified | ||
| 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 78 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 79 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 80 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 81 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 82 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 83 | *****·Revision·History·***** | 83 | *****·Revision·History·***** |
| 84 | Current·version:·0.1.65 | 84 | Current·version:·0.1.65 |
| 85 | ····*·draft·(as·of·202 | 85 | ····*·draft·(as·of·2025-02-23) |
| 86 | *****·Table·of·Contents·***** | 86 | *****·Table·of·Contents·***** |
| 87 | ···1.·Kubernetes_Settings | 87 | ···1.·Kubernetes_Settings |
| 88 | ·········1.·System_and_Software_Integrity | 88 | ·········1.·System_and_Software_Integrity |
| 89 | ·········2.·Kubernetes_-_Account_and_Access_Control | 89 | ·········2.·Kubernetes_-_Account_and_Access_Control |
| 90 | ·········3.·OpenShift_Kube_API_Server | 90 | ·········3.·OpenShift_Kube_API_Server |
| 91 | ·········4.·Authentication | 91 | ·········4.·Authentication |
| 92 | ·········5.·OpenShift_Controller_Settings | 92 | ·········5.·OpenShift_Controller_Settings |
| Offset 14633, 15 lines modified | Offset 14633, 15 lines modified | ||
| 00039280:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00039280:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00039290:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00039290:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 000392a0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 000392a0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 000392b0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 000392b0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 000392c0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 000392c0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 000392d0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 000392d0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 000392e0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 000392e0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 000392f0:·7320·6f66·2032·3032·3 | 000392f0:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00039300:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00039300:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00039310:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00039310:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00039320:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00039320:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00039330:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00039330:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00039340:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00039340:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00039350:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00039350:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00039360:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00039360:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ |
| Offset 67, 15 lines modified | Offset 67, 15 lines modified | ||
| 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 70 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 70 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 71 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 71 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 72 | *****·Revision·History·***** | 72 | *****·Revision·History·***** |
| 73 | Current·version:·0.1.65 | 73 | Current·version:·0.1.65 |
| 74 | ····*·draft·(as·of·202 | 74 | ····*·draft·(as·of·2025-02-23) |
| 75 | *****·Table·of·Contents·***** | 75 | *****·Table·of·Contents·***** |
| 76 | ···1.·Kubernetes_Settings | 76 | ···1.·Kubernetes_Settings |
| 77 | ·········1.·System_and_Software_Integrity | 77 | ·········1.·System_and_Software_Integrity |
| 78 | ·········2.·OpenShift_etcd_Settings | 78 | ·········2.·OpenShift_etcd_Settings |
| 79 | ·········3.·Kubernetes_Kubelet_Settings | 79 | ·········3.·Kubernetes_Kubelet_Settings |
| 80 | ·········4.·OpenShift_-_Logging_Settings | 80 | ·········4.·OpenShift_-_Logging_Settings |
| 81 | ·········5.·OpenShift_-_Master_Node_Settings | 81 | ·········5.·OpenShift_-_Master_Node_Settings |
| Offset 14633, 16 lines modified | Offset 14633, 16 lines modified | ||
| 00039280:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00039280:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00039290:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00039290:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 000392a0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 000392a0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 000392b0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 000392b0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 000392c0:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 000392c0:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 000392d0:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 000392d0:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 000392e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000392e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000392f0:·2028·6173·206f·6620·3230·323 | 000392f0:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00039300:·323 | 00039300:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00039310:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00039310:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00039320:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00039320:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00039330:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00039330:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00039340:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00039340:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00039350:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00039350:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00039360:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00039360:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00039370:·7570·5f6f·7065·6e73·6869·6674·223e·4b75··up_openshift">Ku | 00039370:·7570·5f6f·7065·6e73·6869·6674·223e·4b75··up_openshift">Ku |
| Offset 67, 15 lines modified | Offset 67, 15 lines modified | ||
| 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 67 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 68 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 69 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 70 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 70 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 71 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 71 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 72 | *****·Revision·History·***** | 72 | *****·Revision·History·***** |
| 73 | Current·version:·0.1.65 | 73 | Current·version:·0.1.65 |
| 74 | ····*·draft·(as·of·202 | 74 | ····*·draft·(as·of·2025-02-23) |
| 75 | *****·Table·of·Contents·***** | 75 | *****·Table·of·Contents·***** |
| 76 | ···1.·Kubernetes_Settings | 76 | ···1.·Kubernetes_Settings |
| 77 | ·········1.·System_and_Software_Integrity | 77 | ·········1.·System_and_Software_Integrity |
| 78 | ·········2.·Kubernetes_-_Account_and_Access_Control | 78 | ·········2.·Kubernetes_-_Account_and_Access_Control |
| 79 | ·········3.·OpenShift_Kube_API_Server | 79 | ·········3.·OpenShift_Kube_API_Server |
| 80 | ·········4.·Authentication | 80 | ·········4.·Authentication |
| 81 | ·········5.·OpenShift_Controller_Settings | 81 | ·········5.·OpenShift_Controller_Settings |
| Offset 14603, 15 lines modified | Offset 14603, 15 lines modified | ||
| 000390a0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 000390a0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 000390b0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 000390b0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 000390c0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 000390c0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 000390d0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 000390d0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 000390e0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 000390e0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 000390f0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 000390f0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00039100:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00039100:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00039110:·3032·3 | 00039110:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00039120:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00039120:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00039130:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00039130:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00039140:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00039140:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00039150:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00039150:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00039160:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00039160:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00039170:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00039170:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00039180:·656e·745f·6772·6f75·705f·6f70·656e·7368··ent_group_opensh | 00039180:·656e·745f·6772·6f75·705f·6f70·656e·7368··ent_group_opensh |
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 61 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 62 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 62 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 63 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 63 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 64 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 64 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·Kubernetes_Settings | 70 | ···1.·Kubernetes_Settings |
| 71 | ·········1.·OpenShift_etcd_Settings | 71 | ·········1.·OpenShift_etcd_Settings |
| 72 | ·········2.·Kubernetes_Kubelet_Settings | 72 | ·········2.·Kubernetes_Kubelet_Settings |
| 73 | ·········3.·OpenShift_-_Logging_Settings | 73 | ·········3.·OpenShift_-_Logging_Settings |
| 74 | ·········4.·OpenShift_-_Master_Node_Settings | 74 | ·········4.·OpenShift_-_Master_Node_Settings |
| 75 | ·········5.·Kubernetes_-_Worker_Node_Settings | 75 | ·········5.·Kubernetes_-_Worker_Node_Settings |
| Offset 14602, 16 lines modified | Offset 14602, 16 lines modified | ||
| 00039090:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00039090:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 000390a0:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 000390a0:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 000390b0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 000390b0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 000390c0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 000390c0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 000390d0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 000390d0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 000390e0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 000390e0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 000390f0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000390f0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00039100:·2020·2028·6173·206f·6620·3230·323 | 00039100:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00039110:·3 | 00039110:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00039120:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00039120:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00039130:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00039130:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00039140:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00039140:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00039150:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00039150:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00039160:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00039160:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00039170:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00039170:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00039180:·726f·7570·5f6f·7065·6e73·6869·6674·223e··roup_openshift"> | 00039180:·726f·7570·5f6f·7065·6e73·6869·6674·223e··roup_openshift"> |
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 | 61 | ····*·cpe:/a:redhat:openshift_container_platform:4.6 |
| 62 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 | 62 | ····*·cpe:/a:redhat:openshift_container_platform:4.7 |
| 63 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 | 63 | ····*·cpe:/a:redhat:openshift_container_platform:4.8 |
| 64 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 | 64 | ····*·cpe:/a:redhat:openshift_container_platform:4.9 |
| 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 | 65 | ····*·cpe:/a:redhat:openshift_container_platform:4.1 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·Kubernetes_Settings | 70 | ···1.·Kubernetes_Settings |
| 71 | ·········1.·System_and_Software_Integrity | 71 | ·········1.·System_and_Software_Integrity |
| 72 | ·········2.·Kubernetes_-_Account_and_Access_Control | 72 | ·········2.·Kubernetes_-_Account_and_Access_Control |
| 73 | ·········3.·OpenShift_Kube_API_Server | 73 | ·········3.·OpenShift_Kube_API_Server |
| 74 | ·········4.·Authentication | 74 | ·········4.·Authentication |
| 75 | ·········5.·OpenShift_Controller_Settings | 75 | ·········5.·OpenShift_Controller_Settings |
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037dd0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037de0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037de0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037df0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037df0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037e00:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037e00:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037e10:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037e10:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037e20:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037e20:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037e30:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037e30:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037e40:·3230·323 | 00037e40:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037e50:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037e60:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037e60:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037e70:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037e70:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037e80:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037e80:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037e90:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037e90:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037ea0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037ea0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037eb0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037eb0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15223, 192 lines modified | Offset 15223, 192 lines modified | ||
| 0003b760:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003b760:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003b770:·646d·3632·3833·2220·7461·6269·6e64·6578··dm6283"·tabindex | 0003b770:·646d·3632·3833·2220·7461·6269·6e64·6578··dm6283"·tabindex | ||
| 0003b780:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003b780:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003b790:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003b790:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003b7a0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003b7a0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003b7b0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003b7b0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003b7c0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003b7c0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003b7d0:·6d65·6469·6174·696f·6e20·5075·7070·6574··mediation·Puppet | |||
| 0003b7d0:·6d65·6469·6174·696f·6e20·416e·6163·6f6e··mediation·Anacon | |||
| 0003b7e0:·6461·2073·6e69·7070·6574·20e2·87b2·3c2f··da·snippet·...</ | |||
| 0003b7f0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003b800:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003b810:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003b820:·646d·3632·3833·223e·3c74·6162·6c65·2063··dm6283"><table·c | |||
| 0003b830:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003b840:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003b850:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003b860:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003b870:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003b880:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003b890:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003b8a0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003b8b0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003b8c0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003b8d0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003b8e0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003b8f0:·7265·3e3c·636f·6465·3e0a·7061·636b·6167··re><code>.packag | |||
| 0003b900:·6520·2d2d·6164·643d·6169·6465·0a3c·2f63··e·--add=aide.</c | |||
| 0003b910:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003b920:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003b930:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003b940:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003b950:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003b960:·6964·6d36·3238·3422·2074·6162·696e·6465··idm6284"·tabinde | |||
| 0003b970:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003b980:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003b990:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003b9a0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003b9b0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003b9c0:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | |||
| 0003b9d0:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | |||
| 0003b9e0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003b9f0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003ba00:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003ba10:·6d36·3238·3422·3e3c·7461·626c·6520·636c··m6284"><table·cl | |||
| 0003ba20:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003ba30:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003ba40:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003ba50:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003ba60:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003ba70:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003ba80:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003ba90:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003baa0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003bab0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bac0:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003bad0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003bae0:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003baf0:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003bb00:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003bb10:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003bb20:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003bb30:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003bb40:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003bb50:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bb60:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bb70:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bb80:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bb90:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bba0:·6d36·3238·3522·2074·6162·696e·6465·783d··m6285"·tabindex= | |||
| 0003bbb0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bbc0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bbd0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bbe0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bbf0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bc00:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b | 0003b7e0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | ||
| 0003b | 0003b7f0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | ||
| 0003b | 0003b800:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | ||
| 0003b | 0003b810:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | ||
| 0003b | 0003b820:·3632·3833·223e·3c74·6162·6c65·2063·6c61··6283"><table·cla | ||
| 0003b | 0003b830:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | ||
| 0003b | 0003b840:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | ||
| 0003b | 0003b850:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | ||
| 0003b | 0003b860:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | ||
| 0003b | 0003b870:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | ||
| 0003b | 0003b880:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003b | 0003b890:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003b | 0003b8a0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | ||
| 0003b | 0003b8b0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003b | 0003b8c0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | ||
| 0003b | 0003b8d0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | ||
| 0003b | 0003b8e0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | ||
| 0003b8f0:·3e3c·636f·6465·3e69·6e63·6c75·6465·2069··><code>include·i | |||
| 0003b900:·6e73·7461·6c6c·5f61·6964·650a·0a63·6c61··nstall_aide..cla | |||
| 0003b910:·7373·2069·6e73·7461·6c6c·5f61·6964·6520··ss·install_aide· | |||
| 0003b920:·7b0a·2020·7061·636b·6167·6520·7b20·2761··{.··package·{·'a | |||
| 0003b930:·6964·6527·3a0a·2020·2020·656e·7375·7265··ide':.····ensure | |||
| 0003b940:·203d·2667·743b·2027·696e·7374·616c·6c65···=>·'installe | |||
| 0003b950:·6427·2c0a·2020·7d0a·7d0a·3c2f·636f·6465··d',.··}.}.</code | |||
| 0003b960:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003b970:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003b980:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003b990:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003b9a0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003b9b0:·3632·3834·2220·7461·6269·6e64·6578·3d22··6284"·tabindex=" | |||
| 0003b9c0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003b9d0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003b9e0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003b9f0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003ba00:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| Max diff block lines reached; 6076591/6102865 bytes (99.57%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(enhanced) | 44 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_enhanced | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_enhanced |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:7 | 47 | ····*·cpe:/o:oracle:linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, | 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, |
| 108 | ············OL07-00-020029,·SV-251701r833031_rule | 108 | ············OL07-00-020029,·SV-251701r833031_rule |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····yum·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 144, 28 lines modified | Offset 152, 20 lines modified | ||
| 144 | ··-·no_reboot_needed | 152 | ··-·no_reboot_needed |
| 145 | ··-·package_aide_installed | 153 | ··-·package_aide_installed |
| 146 | Remediation_OSBuild_Blueprint_snippet_⇲ | 154 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 147 | [[packages]] | 155 | [[packages]] |
| 148 | name·=·"aide" | 156 | name·=·"aide" |
| 149 | version·=·"*" | 157 | version·=·"*" |
| 150 | Remediation_ | 158 | Remediation_Anaconda_snippet_⇲ |
| 151 | Complexity:·low | 159 | Complexity:·low |
| 152 | Disruption:·low | 160 | Disruption:·low |
| 153 | Strategy:···enable | 161 | Strategy:···enable |
| 154 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 155 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | package·--add=aide | ||
| 156 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 157 | ····yum·install·-y·"aide" | ||
| 158 | fi | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 164 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/sbin/aide·--init | 165 | $·sudo·/usr/sbin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 168 | database·can·be·installed·as·follows: | 169 | database·can·be·installed·as·follows: |
| Offset 179, 14 lines modified | Offset 179, 28 lines modified | ||
| 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 186 | Remediation_Shell_script_⇲ | ||
| 187 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 188 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 189 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 190 | ····yum·install·-y·"aide" | ||
| 191 | fi | ||
| 192 | /usr/sbin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 186 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 187 | Complexity:·low | 198 | Complexity:·low |
| 188 | Disruption:·low | 199 | Disruption:·low |
| 189 | Strategy:···restrict | 200 | Strategy:···restrict |
| 190 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 191 | ··package: | 202 | ··package: |
| 192 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 251, 28 lines modified | Offset 265, 14 lines modified | ||
| 251 | ··-·PCI-DSS-Req-11.5 | 265 | ··-·PCI-DSS-Req-11.5 |
| 252 | ··-·aide_build_database | 266 | ··-·aide_build_database |
| 253 | ··-·low_complexity | 267 | ··-·low_complexity |
| 254 | ··-·low_disruption | 268 | ··-·low_disruption |
| 255 | ··-·medium_severity | 269 | ··-·medium_severity |
| 256 | ··-·no_reboot_needed | 270 | ··-·no_reboot_needed |
| Max diff block lines reached; 643932/648551 bytes (99.29%) of diff not shown. | |||
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037dd0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037de0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037de0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037df0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037df0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037e00:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037e00:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037e10:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037e10:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037e20:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037e20:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037e30:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037e30:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037e40:·3230·323 | 00037e40:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037e50:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037e60:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037e60:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037e70:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037e70:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037e80:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037e80:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037e90:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037e90:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037ea0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037ea0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037eb0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037eb0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15223, 192 lines modified | Offset 15223, 192 lines modified | ||
| 0003b760:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003b760:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003b770:·646d·3632·3833·2220·7461·6269·6e64·6578··dm6283"·tabindex | 0003b770:·646d·3632·3833·2220·7461·6269·6e64·6578··dm6283"·tabindex | ||
| 0003b780:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003b780:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003b790:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003b790:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003b7a0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003b7a0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003b7b0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003b7b0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003b7c0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003b7c0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003b7d0:·6d65·6469·6174·696f·6e20·5075·7070·6574··mediation·Puppet | |||
| 0003b7d0:·6d65·6469·6174·696f·6e20·416e·6163·6f6e··mediation·Anacon | |||
| 0003b7e0:·6461·2073·6e69·7070·6574·20e2·87b2·3c2f··da·snippet·...</ | |||
| 0003b7f0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003b800:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003b810:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003b820:·646d·3632·3833·223e·3c74·6162·6c65·2063··dm6283"><table·c | |||
| 0003b830:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003b840:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003b850:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003b860:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003b870:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003b880:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003b890:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003b8a0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003b8b0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003b8c0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003b8d0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003b8e0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003b8f0:·7265·3e3c·636f·6465·3e0a·7061·636b·6167··re><code>.packag | |||
| 0003b900:·6520·2d2d·6164·643d·6169·6465·0a3c·2f63··e·--add=aide.</c | |||
| 0003b910:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003b920:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003b930:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003b940:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003b950:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003b960:·6964·6d36·3238·3422·2074·6162·696e·6465··idm6284"·tabinde | |||
| 0003b970:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003b980:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003b990:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003b9a0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003b9b0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003b9c0:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | |||
| 0003b9d0:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | |||
| 0003b9e0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003b9f0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003ba00:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003ba10:·6d36·3238·3422·3e3c·7461·626c·6520·636c··m6284"><table·cl | |||
| 0003ba20:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003ba30:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003ba40:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003ba50:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003ba60:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003ba70:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003ba80:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003ba90:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003baa0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003bab0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bac0:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003bad0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003bae0:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003baf0:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003bb00:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003bb10:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003bb20:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003bb30:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003bb40:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003bb50:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bb60:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bb70:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bb80:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bb90:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bba0:·6d36·3238·3522·2074·6162·696e·6465·783d··m6285"·tabindex= | |||
| 0003bbb0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bbc0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bbd0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bbe0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bbf0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bc00:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b | 0003b7e0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | ||
| 0003b | 0003b7f0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | ||
| 0003b | 0003b800:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | ||
| 0003b | 0003b810:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | ||
| 0003b | 0003b820:·3632·3833·223e·3c74·6162·6c65·2063·6c61··6283"><table·cla | ||
| 0003b | 0003b830:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | ||
| 0003b | 0003b840:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | ||
| 0003b | 0003b850:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | ||
| 0003b | 0003b860:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | ||
| 0003b | 0003b870:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | ||
| 0003b | 0003b880:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003b | 0003b890:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003b | 0003b8a0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | ||
| 0003b | 0003b8b0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003b | 0003b8c0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | ||
| 0003b | 0003b8d0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | ||
| 0003b | 0003b8e0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | ||
| 0003b8f0:·3e3c·636f·6465·3e69·6e63·6c75·6465·2069··><code>include·i | |||
| 0003b900:·6e73·7461·6c6c·5f61·6964·650a·0a63·6c61··nstall_aide..cla | |||
| 0003b910:·7373·2069·6e73·7461·6c6c·5f61·6964·6520··ss·install_aide· | |||
| 0003b920:·7b0a·2020·7061·636b·6167·6520·7b20·2761··{.··package·{·'a | |||
| 0003b930:·6964·6527·3a0a·2020·2020·656e·7375·7265··ide':.····ensure | |||
| 0003b940:·203d·2667·743b·2027·696e·7374·616c·6c65···=>·'installe | |||
| 0003b950:·6427·2c0a·2020·7d0a·7d0a·3c2f·636f·6465··d',.··}.}.</code | |||
| 0003b960:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003b970:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003b980:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003b990:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003b9a0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003b9b0:·3632·3834·2220·7461·6269·6e64·6578·3d22··6284"·tabindex=" | |||
| 0003b9c0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003b9d0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003b9e0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003b9f0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003ba00:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| Max diff block lines reached; 6345745/6372019 bytes (99.59%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·DRAFT·-·ANSSI-BP-028·(high) | 44 | Profile·Title·DRAFT·-·ANSSI-BP-028·(high) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_high | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_high |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:7 | 47 | ····*·cpe:/o:oracle:linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, | 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, |
| 108 | ············OL07-00-020029,·SV-251701r833031_rule | 108 | ············OL07-00-020029,·SV-251701r833031_rule |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····yum·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 144, 28 lines modified | Offset 152, 20 lines modified | ||
| 144 | ··-·no_reboot_needed | 152 | ··-·no_reboot_needed |
| 145 | ··-·package_aide_installed | 153 | ··-·package_aide_installed |
| 146 | Remediation_OSBuild_Blueprint_snippet_⇲ | 154 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 147 | [[packages]] | 155 | [[packages]] |
| 148 | name·=·"aide" | 156 | name·=·"aide" |
| 149 | version·=·"*" | 157 | version·=·"*" |
| 150 | Remediation_ | 158 | Remediation_Anaconda_snippet_⇲ |
| 151 | Complexity:·low | 159 | Complexity:·low |
| 152 | Disruption:·low | 160 | Disruption:·low |
| 153 | Strategy:···enable | 161 | Strategy:···enable |
| 154 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 155 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | package·--add=aide | ||
| 156 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 157 | ····yum·install·-y·"aide" | ||
| 158 | fi | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 164 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/sbin/aide·--init | 165 | $·sudo·/usr/sbin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 168 | database·can·be·installed·as·follows: | 169 | database·can·be·installed·as·follows: |
| Offset 179, 14 lines modified | Offset 179, 28 lines modified | ||
| 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 186 | Remediation_Shell_script_⇲ | ||
| 187 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 188 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 189 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 190 | ····yum·install·-y·"aide" | ||
| 191 | fi | ||
| 192 | /usr/sbin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 186 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 187 | Complexity:·low | 198 | Complexity:·low |
| 188 | Disruption:·low | 199 | Disruption:·low |
| 189 | Strategy:···restrict | 200 | Strategy:···restrict |
| 190 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 191 | ··package: | 202 | ··package: |
| 192 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 251, 28 lines modified | Offset 265, 14 lines modified | ||
| 251 | ··-·PCI-DSS-Req-11.5 | 265 | ··-·PCI-DSS-Req-11.5 |
| 252 | ··-·aide_build_database | 266 | ··-·aide_build_database |
| 253 | ··-·low_complexity | 267 | ··-·low_complexity |
| 254 | ··-·low_disruption | 268 | ··-·low_disruption |
| 255 | ··-·medium_severity | 269 | ··-·medium_severity |
| 256 | ··-·no_reboot_needed | 270 | ··-·no_reboot_needed |
| Max diff block lines reached; 672187/676806 bytes (99.32%) of diff not shown. | |||
| Offset 14303, 15 lines modified | Offset 14303, 15 lines modified | ||
| 00037de0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037de0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037df0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037df0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037e00:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037e00:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037e10:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037e10:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037e20:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037e20:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037e30:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037e30:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037e40:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037e40:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037e50:·3230·323 | 00037e50:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037e60:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037e60:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037e70:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037e70:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037e80:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037e80:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037e90:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037e90:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037ea0:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037ea0:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037eb0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037eb0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037ec0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037ec0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15218, 191 lines modified | Offset 15218, 191 lines modified | ||
| 0003b710:·6574·3d22·2369·646d·3632·3833·2220·7461··et="#idm6283"·ta | 0003b710:·6574·3d22·2369·646d·3632·3833·2220·7461··et="#idm6283"·ta | ||
| 0003b720:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003b720:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003b730:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003b730:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003b740:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003b740:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003b750:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003b750:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003b760:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003b760:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003b770:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003b770:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003b780:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003b780:·416e·6163·6f6e·6461·2073·6e69·7070·6574··Anaconda·snippet | |||
| 0003b790:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003b7a0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003b7b0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003b7c0:·2069·643d·2269·646d·3632·3833·223e·3c74···id="idm6283"><t | |||
| 0003b7d0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003b7e0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003b7f0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003b800:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003b810:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003b820:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003b830:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003b840:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003b850:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003b860:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003b870:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003b880:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003b890:·626c·653e·3c70·7265·3e3c·636f·6465·3e0a··ble><pre><code>. | |||
| 0003b8a0:·7061·636b·6167·6520·2d2d·6164·643d·6169··package·--add=ai | |||
| 0003b8b0:·6465·0a3c·2f63·6f64·653e·3c2f·7072·653e··de.</code></pre> | |||
| 0003b8c0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003b8d0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003b8e0:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003b8f0:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003b900:·6765·743d·2223·6964·6d36·3238·3422·2074··get="#idm6284"·t | |||
| 0003b910:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003b920:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003b930:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003b940:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003b950:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003b960:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003b970:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003b980:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b990:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b9a0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b9b0:·6964·3d22·6964·6d36·3238·3422·3e3c·7461··id="idm6284"><ta | |||
| 0003b9c0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b9d0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b9e0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b9f0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003ba00:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003ba10:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003ba20:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003ba30:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003ba40:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003ba50:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003ba60:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003ba70:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003ba80:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | |||
| 0003ba90:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003baa0:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003bab0:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003bac0:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003bad0:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003bae0:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003baf0:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bb00:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bb10:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bb20:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bb30:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bb40:·743d·2223·6964·6d36·3238·3522·2074·6162··t="#idm6285"·tab | |||
| 0003bb50:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bb60:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bb70:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bb80:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bb90:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bba0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003bbb0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003b | 0003b790:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | ||
| 0003b | 0003b7a0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | ||
| 0003b | 0003b7b0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | ||
| 0003b | 0003b7c0:·643d·2269·646d·3632·3833·223e·3c74·6162··d="idm6283"><tab | ||
| 0003b | 0003b7d0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | ||
| 0003b | 0003b7e0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | ||
| 0003b | 0003b7f0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | ||
| 0003b | 0003b800:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | ||
| 0003b | 0003b810:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | ||
| 0003b | 0003b820:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | ||
| 0003b | 0003b830:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | ||
| 0003b | 0003b840:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | ||
| 0003b | 0003b850:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003b | 0003b860:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | ||
| 0003b | 0003b870:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | ||
| 0003b | 0003b880:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003b | 0003b890:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | ||
| 0003b8a0:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003b8b0:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003b8c0:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003b8d0:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003b8e0:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003b8f0:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003b900:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003b910:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003b920:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003b930:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003b940:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003b950:·3d22·2369·646d·3632·3834·2220·7461·6269··="#idm6284"·tabi | |||
| 0003b960:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003b970:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003b980:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003b990:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003b9a0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003b9b0:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | |||
| Max diff block lines reached; 5864202/5890338 bytes (99.56%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(intermediary) | 44 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_intermediary | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_intermediary |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:7 | 47 | ····*·cpe:/o:oracle:linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·Configure_Syslog | 56 | ·········4.·Configure_Syslog |
| 57 | ·········5.·Network_Configuration_and_Firewalls | 57 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 101, 31 lines modified | Offset 101, 39 lines modified | ||
| 101 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 101 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 102 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 102 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 103 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 103 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 104 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 104 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 105 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 105 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 106 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, | 106 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, |
| 107 | ············OL07-00-020029,·SV-251701r833031_rule | 107 | ············OL07-00-020029,·SV-251701r833031_rule |
| 108 | Remediation_Anaconda_snippet_⇲ | ||
| 109 | Complexity:·low | ||
| 110 | Disruption:·low | ||
| 111 | Strategy:···enable | ||
| 112 | package·--add=aide | ||
| 113 | Remediation_Puppet_snippet_⇲ | 108 | Remediation_Puppet_snippet_⇲ |
| 114 | Complexity:·low | 109 | Complexity:·low |
| 115 | Disruption:·low | 110 | Disruption:·low |
| 116 | Strategy:···enable | 111 | Strategy:···enable |
| 117 | include·install_aide | 112 | include·install_aide |
| 118 | class·install_aide·{ | 113 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 114 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 115 | ····ensure·=>·'installed', |
| 121 | ··} | 116 | ··} |
| 122 | } | 117 | } |
| 118 | Remediation_Shell_script_⇲ | ||
| 119 | Complexity:·low | ||
| 120 | Disruption:·low | ||
| 121 | Strategy:···enable | ||
| 122 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 123 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 124 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 125 | ····yum·install·-y·"aide" | ||
| 126 | fi | ||
| 127 | else | ||
| 128 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 129 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 130 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 131 | Complexity:·low |
| 125 | Disruption:·low | 132 | Disruption:·low |
| 126 | Strategy:···enable | 133 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 134 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 135 | ··package: |
| 129 | ····name:·aide | 136 | ····name:·aide |
| Offset 143, 28 lines modified | Offset 151, 20 lines modified | ||
| 143 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 144 | ··-·package_aide_installed | 152 | ··-·package_aide_installed |
| 145 | Remediation_OSBuild_Blueprint_snippet_⇲ | 153 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 146 | [[packages]] | 154 | [[packages]] |
| 147 | name·=·"aide" | 155 | name·=·"aide" |
| 148 | version·=·"*" | 156 | version·=·"*" |
| 149 | Remediation_ | 157 | Remediation_Anaconda_snippet_⇲ |
| 150 | Complexity:·low | 158 | Complexity:·low |
| 151 | Disruption:·low | 159 | Disruption:·low |
| 152 | Strategy:···enable | 160 | Strategy:···enable |
| 153 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 154 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | package·--add=aide | ||
| 155 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 156 | ····yum·install·-y·"aide" | ||
| 157 | fi | ||
| 158 | else | ||
| 159 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 160 | fi | ||
| 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 162 | Run·the·following·command·to·generate·a·new·database: | 163 | Run·the·following·command·to·generate·a·new·database: |
| 163 | $·sudo·/usr/sbin/aide·--init | 164 | $·sudo·/usr/sbin/aide·--init |
| 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 165 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 166 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 167 | database·can·be·installed·as·follows: | 168 | database·can·be·installed·as·follows: |
| Offset 178, 14 lines modified | Offset 178, 28 lines modified | ||
| 178 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 178 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 179 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 179 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 180 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 180 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 181 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 181 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 182 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 182 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 183 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 183 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 184 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 184 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 185 | Remediation_Shell_script_⇲ | ||
| 186 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 187 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 188 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 189 | ····yum·install·-y·"aide" | ||
| 190 | fi | ||
| 191 | /usr/sbin/aide·--init | ||
| 192 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 193 | else | ||
| 194 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 195 | fi | ||
| 185 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 186 | Complexity:·low | 197 | Complexity:·low |
| 187 | Disruption:·low | 198 | Disruption:·low |
| 188 | Strategy:···restrict | 199 | Strategy:···restrict |
| 189 | -·name:·Ensure·AIDE·is·installed | 200 | -·name:·Ensure·AIDE·is·installed |
| 190 | ··package: | 201 | ··package: |
| 191 | ····name:·'{{·item·}}' | 202 | ····name:·'{{·item·}}' |
| Offset 250, 28 lines modified | Offset 264, 14 lines modified | ||
| 250 | ··-·PCI-DSS-Req-11.5 | 264 | ··-·PCI-DSS-Req-11.5 |
| 251 | ··-·aide_build_database | 265 | ··-·aide_build_database |
| 252 | ··-·low_complexity | 266 | ··-·low_complexity |
| 253 | ··-·low_disruption | 267 | ··-·low_disruption |
| 254 | ··-·medium_severity | 268 | ··-·medium_severity |
| 255 | ··-·no_reboot_needed | 269 | ··-·no_reboot_needed |
| Max diff block lines reached; 620179/624811 bytes (99.26%) of diff not shown. | |||
| Offset 14301, 16 lines modified | Offset 14301, 16 lines modified | ||
| 00037dc0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00037dc0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00037dd0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00037dd0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00037de0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00037de0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00037df0:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00037df0:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00037e00:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00037e00:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00037e10:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00037e10:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00037e20:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037e20:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037e30:·2020·2020·2028·6173·206f·6620·3230·323 | 00037e30:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00037e40:·2d30·3 | 00037e40:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00037e50:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00037e50:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00037e60:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00037e60:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00037e70:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00037e70:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00037e80:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00037e80:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00037e90:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00037e90:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00037ea0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00037ea0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00037eb0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00037eb0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 14990, 143 lines modified | Offset 14990, 143 lines modified | ||
| 0003a8d0:·7461·7267·6574·3d22·2369·646d·3130·3031··target="#idm1001 | 0003a8d0:·7461·7267·6574·3d22·2369·646d·3130·3031··target="#idm1001 | ||
| 0003a8e0:·3522·2074·6162·696e·6465·783d·2230·2220··5"·tabindex="0"· | 0003a8e0:·3522·2074·6162·696e·6465·783d·2230·2220··5"·tabindex="0"· | ||
| 0003a8f0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003a8f0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003a900:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003a900:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003a910:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003a910:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003a920:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003a920:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003a930:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003a930:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003a940:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003a9 | 0003a940:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003a950:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003a960:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003a970:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003a980:·2220·6964·3d22·6964·6d31·3030·3135·223e··"·id="idm10015"> | |||
| 0003a9 | 0003a990:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003a9a0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003a970:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003a980:·7073·6522·2069·643d·2269·646d·3130·3031··pse"·id="idm1001 | |||
| 0003a990:·3522·3e3c·7461·626c·6520·636c·6173·733d··5"><table·class= | |||
| 0003a9a0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003a9b0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003a9 | 0003a9b0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003a9c0:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003a9d0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003a9d0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003a9e0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003a9f0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003aa00:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003a | 0003a9e0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003a | 0003a9f0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003aa00:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003aa10:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003aa20:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003aa30:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003aa40:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003aa50:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003aa60:·6465·3e0a·666f·7220·6620·696e·202f·6574··de>.for·f·in·/et | |||
| 0003aa70:·632f·7375·646f·6572·7320·2f65·7463·2f73··c/sudoers·/etc/s | |||
| 0003aa80:·7564·6f65·7273·2e64·2f2a·203b·2064·6f0a··udoers.d/*·;·do. | |||
| 0003aa90:·2020·6966·205b·2021·202d·6520·2224·6622····if·[·!·-e·"$f" | |||
| 0003aaa0:·205d·203b·2074·6865·6e0a·2020·2020·636f···]·;·then.····co | |||
| 0003aab0:·6e74·696e·7565·0a20·2066·690a·2020·6d61··ntinue.··fi.··ma | |||
| 0003aac0:·7463·6869·6e67·5f6c·6973·743d·2428·6772··tching_list=$(gr | |||
| 0003aad0:·6570·202d·5020·275e·283f·2123·292e·2a5b··ep·-P·'^(?!#).*[ | |||
| 0003aae0:·5c73·5d2b·5c21·6175·7468·656e·7469·6361··\s]+\!authentica | |||
| 0003aaf0:·7465·2e2a·2427·2024·6620·7c20·756e·6971··te.*$'·$f·|·uniq | |||
| 0003ab00:·2029·0a20·2069·6620·2120·7465·7374·202d···).··if·!·test·- | |||
| 0003ab10:·7a20·2224·6d61·7463·6869·6e67·5f6c·6973··z·"$matching_lis | |||
| 0003ab20:·7422·3b20·7468·656e·0a20·2020·2077·6869··t";·then.····whi | |||
| 0003ab30:·6c65·2049·4653·3d20·7265·6164·202d·7220··le·IFS=·read·-r· | |||
| 0003ab40:·656e·7472·793b·2064·6f0a·2020·2020·2020··entry;·do.······ | |||
| 0003ab50:·2320·636f·6d6d·656e·7420·6f75·7420·2221··#·comment·out·"! | |||
| 0003aa30:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003aa40:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003aa50:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003aa60:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4669··<code>-·name:·Fi | |||
| 0003aa70:·6e64·202f·6574·632f·7375·646f·6572·732e··nd·/etc/sudoers. | |||
| 0003aa80:·642f·2066·696c·6573·0a20·2066·696e·643a··d/·files.··find: | |||
| 0003aa90:·0a20·2020·2070·6174·6873·3a0a·2020·2020··.····paths:.···· | |||
| 0003aaa0:·2d20·2f65·7463·2f73·7564·6f65·7273·2e64··-·/etc/sudoers.d | |||
| 0003aab0:·2f0a·2020·7265·6769·7374·6572·3a20·7375··/.··register:·su | |||
| 0003aac0:·646f·6572·730a·2020·7461·6773·3a0a·2020··doers.··tags:.·· | |||
| 0003aad0:·2d20·4449·5341·2d53·5449·472d·4f4c·3037··-·DISA-STIG-OL07 | |||
| 0003aae0:·2d30·302d·3031·3033·3530·0a20·202d·204e··-00-010350.··-·N | |||
| 0003aaf0:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003ab00:·6129·0a20·202d·204e·4953·542d·3830·302d··a).··-·NIST-800- | |||
| 0003ab10:·3533·2d49·412d·3131·0a20·202d·206c·6f77··53-IA-11.··-·low | |||
| 0003ab20:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003ab30:·6c6f·775f·6469·7372·7570·7469·6f6e·0a20··low_disruption.· | |||
| 0003ab40:·202d·206d·6564·6975·6d5f·7365·7665·7269···-·medium_severi | |||
| 0003ab50:·7479·0a20·202d·206e·6f5f·7265·626f·6f74··ty.··-·no_reboot | |||
| 0003ab60:·5f6e·6565·6465·640a·2020·2d20·7265·7374··_needed.··-·rest | |||
| 0003ab70:·7269·6374·5f73·7472·6174·6567·790a·2020··rict_strategy.·· | |||
| 0003ab80:·2d20·7375·646f·5f72·656d·6f76·655f·6e6f··-·sudo_remove_no | |||
| 0003ab90:·5f61·7574·6865·6e74·6963·6174·650a·0a2d··_authenticate..- | |||
| 0003aba0:·206e·616d·653a·2052·656d·6f76·6520·6c69···name:·Remove·li | |||
| 0003abb0:·6e65·7320·636f·6e74·6169·6e69·6e67·2021··nes·containing·! | |||
| 0003ab | 0003ab60:·6175·7468·656e·7469·6361·7465·2220·6d61··authenticate"·ma | ||
| 0003ab70:·7463·6865·7320·746f·2070·7265·7365·7276··tches·to·preserv | |||
| 0003ab80:·6520·7573·6572·2064·6174·610a·2020·2020··e·user·data.···· | |||
| 0003ab90:·2020·7365·6420·2d69·2022·732f·5e24·7b65····sed·-i·"s/^${e | |||
| 0003aba0:·6e74·7279·7d24·2f23·2026·616d·703b·2f67··ntry}$/#·&/g | |||
| 0003abb0:·2220·2466·0a20·2020·2064·6f6e·6520·266c··"·$f.····done·&l | |||
| 0003abc0:·743b·266c·743b·266c·743b·2022·246d·6174··t;<<·"$mat | |||
| 0003abd0:·6368·696e·675f·6c69·7374·220a·0a20·2020··ching_list"..··· | |||
| 0003abd0:·6d20·7375·646f·6572·7320·6669·6c65·730a··m·sudoers·files. | |||
| 0003abe0:·2020·7265·706c·6163·653a·0a20·2020·2072····replace:.····r | |||
| 0003abf0:·6567·6578·703a·2028·5e28·3f21·2329·2e2a··egexp:·(^(?!#).* | |||
| 0003ac00:·5b5c·735d·2b5c·2161·7574·6865·6e74·6963··[\s]+\!authentic | |||
| 0003ac10:·6174·652e·2a24·290a·2020·2020·7265·706c··ate.*$).····repl | |||
| 0003ac20:·6163·653a·2027·2320·5c67·266c·743b·3126··ace:·'#·\g<1& | |||
| 0003ac30:·6774·3b27·0a20·2020·2070·6174·683a·2027··gt;'.····path:·' | |||
| 0003ac40:·7b7b·2069·7465·6d2e·7061·7468·207d·7d27··{{·item.path·}}' | |||
| 0003ac50:·0a20·2020·2076·616c·6964·6174·653a·202f··.····validate:·/ | |||
| 0003a | 0003abe0:·202f·7573·722f·7362·696e·2f76·6973·7564···/usr/sbin/visud | ||
| 0003abf0:·6f20·2d63·6620·2466·2026·616d·703b·2667··o·-cf·$f·&&g | |||
| 0003ac00:·743b·202f·6465·762f·6e75·6c6c·207c·7c20··t;·/dev/null·||· | |||
| 0003ac10:·6563·686f·2022·4661·696c·2074·6f20·7661··echo·"Fail·to·va | |||
| 0003ac20:·6c69·6461·7465·2024·6620·7769·7468·2076··lidate·$f·with·v | |||
| 0003ac30:·6973·7564·6f22·0a20·2066·690a·646f·6e65··isudo".··fi.done | |||
| 0003ac40:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003ac50:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003ac60:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003ac70:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003ac80:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003ac90:·743d·2223·6964·6d31·3030·3136·2220·7461··t="#idm10016"·ta | |||
| 0003aca0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003acb0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003acc0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003acd0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003ace0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| Max diff block lines reached; 2327502/2347152 bytes (99.16%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(minimal) | 44 | Profile·Title·ANSSI-BP-028·(minimal) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_minimal | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_nt28_minimal |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:7 | 47 | ····*·cpe:/o:oracle:linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·Configure_Syslog | 55 | ·········3.·Configure_Syslog |
| 56 | ·········4.·File_Permissions_and_Masks | 56 | ·········4.·File_Permissions_and_Masks |
| 57 | ···2.·Services | 57 | ···2.·Services |
| Offset 88, 14 lines modified | Offset 88, 33 lines modified | ||
| 88 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 88 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 89 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 89 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 90 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 90 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 91 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 91 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 92 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 92 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 93 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 93 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 94 | ············000373-VMM-001490,·OL07-00-010350,·SV-228569r603260_rule | 94 | ············000373-VMM-001490,·OL07-00-010350,·SV-228569r603260_rule |
| 95 | Remediation_Shell_script_⇲ | ||
| 96 | Complexity:·low | ||
| 97 | Disruption:·low | ||
| 98 | Strategy:···restrict | ||
| 99 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 100 | ··if·[·!·-e·"$f"·]·;·then | ||
| 101 | ····continue | ||
| 102 | ··fi | ||
| 103 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 104 | ··if·!·test·-z·"$matching_list";·then | ||
| 105 | ····while·IFS=·read·-r·entry;·do | ||
| 106 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 107 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 108 | ····done·<<<·"$matching_list" | ||
| 109 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 110 | ··fi | ||
| 111 | done | ||
| 95 | Remediation_Ansible_snippet_⇲ | 112 | Remediation_Ansible_snippet_⇲ |
| 96 | Complexity:·low | 113 | Complexity:·low |
| 97 | Disruption:·low | 114 | Disruption:·low |
| 98 | Strategy:···restrict | 115 | Strategy:···restrict |
| 99 | -·name:·Find·/etc/sudoers.d/·files | 116 | -·name:·Find·/etc/sudoers.d/·files |
| 100 | ··find: | 117 | ··find: |
| 101 | ····paths: | 118 | ····paths: |
| Offset 127, 33 lines modified | Offset 146, 14 lines modified | ||
| 127 | ··-·NIST-800-53-IA-11 | 146 | ··-·NIST-800-53-IA-11 |
| 128 | ··-·low_complexity | 147 | ··-·low_complexity |
| 129 | ··-·low_disruption | 148 | ··-·low_disruption |
| 130 | ··-·medium_severity | 149 | ··-·medium_severity |
| 131 | ··-·no_reboot_needed | 150 | ··-·no_reboot_needed |
| 132 | ··-·restrict_strategy | 151 | ··-·restrict_strategy |
| 133 | ··-·sudo_remove_no_authenticate | 152 | ··-·sudo_remove_no_authenticate |
| 134 | Remediation_Shell_script_⇲ | ||
| 135 | Complexity:·low | ||
| 136 | Disruption:·low | ||
| 137 | Strategy:···restrict | ||
| 138 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 139 | ··if·[·!·-e·"$f"·]·;·then | ||
| 140 | ····continue | ||
| 141 | ··fi | ||
| 142 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 143 | ··if·!·test·-z·"$matching_list";·then | ||
| 144 | ····while·IFS=·read·-r·entry;·do | ||
| 145 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 146 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 147 | ····done·<<<·"$matching_list" | ||
| 148 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 149 | ··fi | ||
| 150 | done | ||
| 151 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 153 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 152 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 154 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 153 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 155 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 154 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 156 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 155 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 157 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 156 | ············have·authorization. | 158 | ············have·authorization. |
| 157 | Rationale: | 159 | Rationale: |
| Offset 164, 14 lines modified | Offset 164, 33 lines modified | ||
| 164 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 164 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 165 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 165 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 166 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 166 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 167 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 167 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 168 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 168 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 169 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 169 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 170 | ············000373-VMM-001490,·OL07-00-010340,·SV-221692r833019_rule | 170 | ············000373-VMM-001490,·OL07-00-010340,·SV-221692r833019_rule |
| 171 | Remediation_Shell_script_⇲ | ||
| 172 | Complexity:·low | ||
| 173 | Disruption:·low | ||
| 174 | Strategy:···restrict | ||
| 175 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 176 | ··if·[·!·-e·"$f"·]·;·then | ||
| 177 | ····continue | ||
| 178 | ··fi | ||
| 179 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 180 | ··if·!·test·-z·"$matching_list";·then | ||
| 181 | ····while·IFS=·read·-r·entry;·do | ||
| 182 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 183 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 184 | ····done·<<<·"$matching_list" | ||
| 185 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 186 | ··fi | ||
| 187 | done | ||
| 171 | Remediation_Ansible_snippet_⇲ | 188 | Remediation_Ansible_snippet_⇲ |
| 172 | Complexity:·low | 189 | Complexity:·low |
| 173 | Disruption:·low | 190 | Disruption:·low |
| 174 | Strategy:···restrict | 191 | Strategy:···restrict |
| 175 | -·name:·Find·/etc/sudoers.d/·files | 192 | -·name:·Find·/etc/sudoers.d/·files |
| 176 | ··find: | 193 | ··find: |
| 177 | ····paths: | 194 | ····paths: |
| Offset 203, 33 lines modified | Offset 222, 14 lines modified | ||
| 203 | ··-·NIST-800-53-IA-11 | 222 | ··-·NIST-800-53-IA-11 |
| 204 | ··-·low_complexity | 223 | ··-·low_complexity |
| 205 | ··-·low_disruption | 224 | ··-·low_disruption |
| 206 | ··-·medium_severity | 225 | ··-·medium_severity |
| 207 | ··-·no_reboot_needed | 226 | ··-·no_reboot_needed |
| 208 | ··-·restrict_strategy | 227 | ··-·restrict_strategy |
| 209 | ··-·sudo_remove_nopasswd | 228 | ··-·sudo_remove_nopasswd |
| 210 | Remediation_Shell_script_⇲ | ||
| 211 | Complexity:·low | ||
| Max diff block lines reached; 159533/164969 bytes (96.70%) of diff not shown. | |||
| Offset 14289, 16 lines modified | Offset 14289, 16 lines modified | ||
| 00037d00:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00037d00:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00037d10:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00037d10:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 00037d20:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 00037d20:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00037d30:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00037d30:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00037d40:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00037d40:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00037d50:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00037d50:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00037d60:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d60:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d70:·2028·6173·206f·6620·3230·323 | 00037d70:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00037d80:·323 | 00037d80:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00037d90:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00037d90:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00037da0:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00037da0:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00037db0:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00037db0:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00037dc0:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00037dc0:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00037dd0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00037dd0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00037de0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00037de0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00037df0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 00037df0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | ||
| Offset 15212, 335 lines modified | Offset 15212, 335 lines modified | ||
| 0003b6b0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003b6b0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003b6c0:·6964·6d35·3934·3622·2074·6162·696e·6465··idm5946"·tabinde | 0003b6c0:·6964·6d35·3934·3622·2074·6162·696e·6465··idm5946"·tabinde | ||
| 0003b6d0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003b6d0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003b6e0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003b6e0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003b6f0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003b6f0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003b700:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003b700:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003b710:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003b710:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003b720:·656d·6564·6961·7469·6f6e·20 | 0003b720:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003b730:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003b740:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003b750:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003b760:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003b770:·646d·3539·3436·223e·3c74·6162·6c65·2063··dm5946"><table·c | |||
| 0003b780:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003b790:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003b7a0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003b7b0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003b7c0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003b7d0:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003b7e0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003b7f0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003b800:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003b810:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003b820:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003b830:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003b | 0003b730:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | ||
| 0003b740:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003b750:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003b760:·6c6c·6170·7365·2220·6964·3d22·6964·6d35··llapse"·id="idm5 | |||
| 0003b770:·3934·3622·3e3c·7072·653e·3c63·6f64·653e··946"><pre><code> | |||
| 0003b780:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003b790:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003b7a0:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003b7b0:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003b7c0:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003b7d0:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003b7e0:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003b7f0:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003b800:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003b810:·6861·7368·3d22·2428·7270·6d20·2d56·6120··hash="$(rpm·-Va· | |||
| 0003b820:·2d2d·6e6f·636f·6e66·6967·207c·2067·7265··--noconfig·|·gre | |||
| 0003b830:·7020·2d45·2027·5e2e·2e35·2720·7c20·6177··p·-E·'^..5'·|·aw | |||
| 0003b840:·6b20·277b·7072·696e·7420·244e·467d·2720··k·'{print·$NF}'· | |||
| 0003b850:·2922·0a0a·2320·4672·6f6d·2066·696c·6573··)"..#·From·files | |||
| 0003b8 | 0003b860:·206e·616d·6573·2067·6574·2070·6163·6b61···names·get·packa | ||
| 0003b870:·6765·206e·616d·6573·2061·6e64·2063·6861··ge·names·and·cha | |||
| 0003b880:·6e67·6520·6e65·776c·696e·6520·746f·2073··nge·newline·to·s | |||
| 0003b890:·7061·6365·2c20·6265·6361·7573·6520·7270··pace,·because·rp | |||
| 0003b8a0:·6d20·7772·6974·6573·2065·6163·6820·7061··m·writes·each·pa | |||
| 0003b8b0:·636b·6167·6520·746f·206e·6577·206c·696e··ckage·to·new·lin | |||
| 0003b8c0:·650a·7061·636b·6167·6573·5f74·6f5f·7265··e.packages_to_re | |||
| 0003b8d0:·696e·7374·616c·6c3d·2224·2872·706d·202d··install="$(rpm·- | |||
| 0003b8e0:·7166·2024·6669·6c65·735f·7769·7468·5f69··qf·$files_with_i | |||
| 0003b8f0:·6e63·6f72·7265·6374·5f68·6173·6820·7c20··ncorrect_hash·|· | |||
| 0003b900:·7472·2027·5c6e·2720·2720·2729·220a·0a0a··tr·'\n'·'·')"... | |||
| 0003b860:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003b870:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003b880:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003b890:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003b8a0:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003b8b0:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003b8c0:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003b8d0:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003b8e0:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003b8f0:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003b900:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003b910:·2d20·4449·5341·2d53·5449·472d·4f4c·3037··-·DISA-STIG-OL07 | |||
| 0003b920:·2d30·302d·3031·3030·3230·0a20·202d·204e··-00-010020.··-·N | |||
| 0003b930:·4953·542d·3830·302d·3137·312d·332e·332e··IST-800-171-3.3. | |||
| 0003b940:·380a·2020·2d20·4e49·5354·2d38·3030·2d31··8.··-·NIST-800-1 | |||
| 0003b950:·3731·2d33·2e34·2e31·0a20·202d·204e·4953··71-3.4.1.··-·NIS | |||
| 0003b960:·542d·3830·302d·3533·2d41·552d·3928·3329··T-800-53-AU-9(3) | |||
| 0003b970:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003b980:·2d43·4d2d·3628·6329·0a20·202d·204e·4953··-CM-6(c).··-·NIS | |||
| 0003b990:·542d·3830·302d·3533·2d43·4d2d·3628·6429··T-800-53-CM-6(d) | |||
| 0003b9a0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003b9b0:·2d53·492d·370a·2020·2d20·4e49·5354·2d38··-SI-7.··-·NIST-8 | |||
| 0003b9c0:·3030·2d35·332d·5349·2d37·2831·290a·2020··00-53-SI-7(1).·· | |||
| 0003b9d0:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003b9e0:·2d37·2836·290a·2020·2d20·5043·492d·4453··-7(6).··-·PCI-DS | |||
| 0003b9f0:·532d·5265·712d·3131·2e35·0a20·202d·2068··S-Req-11.5.··-·h | |||
| 0003ba00:·6967·685f·636f·6d70·6c65·7869·7479·0a20··igh_complexity.· | |||
| 0003ba10:·202d·2068·6967·685f·7365·7665·7269·7479···-·high_severity | |||
| 0003ba20:·0a20·202d·206d·6564·6975·6d5f·6469·7372··.··-·medium_disr | |||
| 0003ba30:·7570·7469·6f6e·0a20·202d·206e·6f5f·7265··uption.··-·no_re | |||
| 0003ba40:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003ba50:·7265·7374·7269·6374·5f73·7472·6174·6567··restrict_strateg | |||
| 0003ba60:·790a·2020·2d20·7270·6d5f·7665·7269·6679··y.··-·rpm_verify | |||
| 0003ba70:·5f68·6173·6865·730a·0a2d·206e·616d·653a··_hashes..-·name: | |||
| 0003ba80:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003ba90:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003baa0:·7374·616c·6c20·636f·6d6d·616e·6420·2879··stall·command·(y | |||
| 0003bab0:·756d·2927·0a20·2073·6574·5f66·6163·743a··um)'.··set_fact: | |||
| 0003bac0:·0a20·2020·2070·6163·6b61·6765·5f6d·616e··.····package_man | |||
| 0003bad0:·6167·6572·5f72·6569·6e73·7461·6c6c·5f63··ager_reinstall_c | |||
| 0003b | 0003b910:·7975·6d20·7265·696e·7374·616c·6c20·2d79··yum·reinstall·-y | ||
| 0003b | 0003b920:·2024·7061·636b·6167·6573·5f74·6f5f·7265···$packages_to_re | ||
| 0003b930:·696e·7374·616c·6c0a·3c2f·636f·6465·3e3c··install.</code>< | |||
| 0003b940:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003b950:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003b960:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003b970:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003b980:·612d·7461·7267·6574·3d22·2369·646d·3539··a-target="#idm59 | |||
| 0003b990:·3437·2220·7461·6269·6e64·6578·3d22·3022··47"·tabindex="0" | |||
| 0003b9a0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003b9b0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003b9c0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003b9d0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003b9e0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003b9f0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| Max diff block lines reached; 8074962/8098614 bytes (99.71%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | *****·Profile·Information·***** | 40 | *****·Profile·Information·***** |
| 41 | Profile·Title·Criminal·Justice·Information·Services·(CJIS)·Security·Policy | 41 | Profile·Title·Criminal·Justice·Information·Services·(CJIS)·Security·Policy |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cjis | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cjis |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:oracle:linux:7 | 44 | ····*·cpe:/o:oracle:linux:7 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·System_Accounting_with_auditd | 52 | ·········3.·System_Accounting_with_auditd |
| 53 | ·········4.·GRUB2_bootloader_configuration | 53 | ·········4.·GRUB2_bootloader_configuration |
| 54 | ·········5.·Network_Configuration_and_Firewalls | 54 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 80, 14 lines modified | Offset 80, 24 lines modified | ||
| 80 | $·sudo·yum·reinstall·PACKAGENAME | 80 | $·sudo·yum·reinstall·PACKAGENAME |
| 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 82 | $·sudo·rpm·-Uvh·PACKAGENAME | 82 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 84 | Severity: ················high | 84 | Severity: ················high |
| 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule | 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule |
| 87 | Remediation_Shell_script_⇲ | ||
| 88 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 89 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 90 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 91 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 92 | yum·reinstall·-y·$packages_to_reinstall | ||
| 87 | Remediation_Ansible_snippet_⇲ | 93 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·high | 94 | Complexity:·high |
| 89 | Disruption:·medium | 95 | Disruption:·medium |
| 90 | Strategy:···restrict | 96 | Strategy:···restrict |
| 91 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 97 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 92 | ··set_fact: | 98 | ··set_fact: |
| 93 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 99 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 237, 37 lines modified | Offset 247, 56 lines modified | ||
| 237 | ··-·PCI-DSS-Req-11.5 | 247 | ··-·PCI-DSS-Req-11.5 |
| 238 | ··-·high_complexity | 248 | ··-·high_complexity |
| 239 | ··-·high_severity | 249 | ··-·high_severity |
| 240 | ··-·medium_disruption | 250 | ··-·medium_disruption |
| 241 | ··-·no_reboot_needed | 251 | ··-·no_reboot_needed |
| 242 | ··-·restrict_strategy | 252 | ··-·restrict_strategy |
| 243 | ··-·rpm_verify_hashes | 253 | ··-·rpm_verify_hashes |
| 244 | Remediation_Shell_script_⇲ | ||
| 245 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 246 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 247 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 248 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 249 | yum·reinstall·-y·$packages_to_reinstall | ||
| 250 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 254 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 251 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 255 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 252 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 256 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 253 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 257 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 254 | $·rpm·-qf·FILENAME | 258 | $·rpm·-qf·FILENAME |
| 255 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 259 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 256 | $·sudo·rpm·--setperms·PACKAGENAME | 260 | $·sudo·rpm·--setperms·PACKAGENAME |
| 257 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 261 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 258 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 262 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 259 | Severity: ················high | 263 | Severity: ················high |
| 260 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 264 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 261 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule | 265 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule |
| 266 | Remediation_Shell_script_⇲ | ||
| 267 | Complexity:·high | ||
| 268 | Disruption:·medium | ||
| 269 | Strategy:···restrict | ||
| 270 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 271 | declare·-A·SETPERMS_RPM_DICT | ||
| 272 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 273 | #·is·expected·by·the·RPM·database | ||
| 274 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 275 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 276 | do | ||
| 277 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 278 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 279 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 280 | ········do | ||
| 281 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 282 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 283 | ········done | ||
| 284 | done | ||
| 285 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 286 | #·correct·values | ||
| 287 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 288 | do | ||
| 289 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 290 | done | ||
| 262 | Remediation_Ansible_snippet_⇲ | 291 | Remediation_Ansible_snippet_⇲ |
| 263 | Complexity:·high | 292 | Complexity:·high |
| 264 | Disruption:·medium | 293 | Disruption:·medium |
| 265 | Strategy:···restrict | 294 | Strategy:···restrict |
| 266 | -·name:·Read·list·of·files·with·incorrect·permissions | 295 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 267 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 296 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 268 | ····--nocaps·--nolinkto·--nouser·--nogroup | 297 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 344, 69 lines modified | Offset 373, 48 lines modified | ||
| 344 | ··-·PCI-DSS-Req-11.5 | 373 | ··-·PCI-DSS-Req-11.5 |
| 345 | ··-·high_complexity | 374 | ··-·high_complexity |
| 346 | ··-·high_severity | 375 | ··-·high_severity |
| 347 | ··-·medium_disruption | 376 | ··-·medium_disruption |
| 348 | ··-·no_reboot_needed | 377 | ··-·no_reboot_needed |
| 349 | ··-·restrict_strategy | 378 | ··-·restrict_strategy |
| 350 | ··-·rpm_verify_permissions | 379 | ··-·rpm_verify_permissions |
| 351 | Remediation_Shell_script_⇲ | ||
| 352 | Complexity:·high | ||
| 353 | Disruption:·medium | ||
| 354 | Strategy:···restrict | ||
| 355 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 356 | declare·-A·SETPERMS_RPM_DICT | ||
| 357 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 358 | #·is·expected·by·the·RPM·database | ||
| 359 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 769528/777785 bytes (98.94%) of diff not shown. | |||
| Offset 14329, 16 lines modified | Offset 14329, 16 lines modified | ||
| 00037f80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037f80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037f90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037f90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037fa0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037fa0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037fb0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037fb0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037fc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037fc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037fd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037fd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037fe0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037fe0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ff0:·2861·7320·6f66·2032·3032·3 | 00037ff0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038000:·3 | 00038000:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038010:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038010:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038020:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038020:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038030:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038030:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038040:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038040:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038050:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038050:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038060:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038060:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038070:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038070:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15200, 123 lines modified | Offset 15200, 123 lines modified | ||
| 0003b5f0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b5f0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b600:·3d22·2369·646d·3638·3130·2220·7461·6269··="#idm6810"·tabi | 0003b600:·3d22·2369·646d·3638·3130·2220·7461·6269··="#idm6810"·tabi | ||
| 0003b610:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b610:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b620:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b620:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b630:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b630:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b640:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b640:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b650:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b650:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b660:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b660:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003b670:·6 | 0003b670:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003b680:· | 0003b680:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | ||
| 0003b690:· | 0003b690:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | ||
| 0003b6a0:· | 0003b6a0:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | ||
| 0003b6b0:·64 | 0003b6b0:·646d·3638·3130·223e·3c70·7265·3e3c·636f··dm6810"><pre><co | ||
| 0003b6c0:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003b6d0:·2d2d·6164·643d·6472·6163·7574·2d66·6970··--add=dracut-fip | |||
| 0003b6e0:·730a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··s.</code></pre>< | |||
| 0003b6f0:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003b700:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003b710:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003b720:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003b730:·6574·3d22·2369·646d·3638·3131·2220·7461··et="#idm6811"·ta | |||
| 0003b740:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003b750:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003b760:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003b770:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003b780:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003b790:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003b7a0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b7b0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b | 0003b6c0:·6465·3e23·2052·656d·6564·6961·7469·6f6e··de>#·Remediation | ||
| 0003b6d0:·2069·7320·6170·706c·6963·6162·6c65·206f···is·applicable·o | |||
| 0003b6e0:·6e6c·7920·696e·2063·6572·7461·696e·2070··nly·in·certain·p | |||
| 0003b6f0:·6c61·7466·6f72·6d73·0a69·6620·5b20·2120··latforms.if·[·!· | |||
| 0003b700:·2d66·202f·2e64·6f63·6b65·7265·6e76·205d··-f·/.dockerenv·] | |||
| 0003b710:·2026·616d·703b·2661·6d70·3b20·5b20·2120···&&·[·!· | |||
| 0003b720:·2d66·202f·7275·6e2f·2e63·6f6e·7461·696e··-f·/run/.contain | |||
| 0003b730:·6572·656e·7620·5d3b·2074·6865·6e0a·0a69··erenv·];·then..i | |||
| 0003b740:·6620·2120·7270·6d20·2d71·202d·2d71·7569··f·!·rpm·-q·--qui | |||
| 0003b750:·6574·2022·6472·6163·7574·2d66·6970·7322··et·"dracut-fips" | |||
| 0003b760:·203b·2074·6865·6e0a·2020·2020·7975·6d20···;·then.····yum· | |||
| 0003b770:·696e·7374·616c·6c20·2d79·2022·6472·6163··install·-y·"drac | |||
| 0003b780:·7574·2d66·6970·7322·0a66·690a·0a65·6c73··ut-fips".fi..els | |||
| 0003b790:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003b7a0:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003b7b0:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003b7c0:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003b7d0:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003b7e0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003b7f0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003b800:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003b | 0003b810:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003b7e0:·6964·3d22·6964·6d36·3831·3122·3e3c·7461··id="idm6811"><ta | |||
| 0003b7f0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b800:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b810:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b820:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003b830:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003b840:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003b850:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003b8 | 0003b820:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003b830:·6d36·3831·3122·2074·6162·696e·6465·783d··m6811"·tabindex= | |||
| 0003b840:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003b850:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003b860:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003b870:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003b880:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003b890:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b8a0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b8b0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b8c0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b8d0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b8e0:·3638·3131·223e·3c74·6162·6c65·2063·6c61··6811"><table·cla | |||
| 0003b8f0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b900:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b910:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b920:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b930:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003b | 0003b940:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003b | 0003b950:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003b | 0003b960:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | ||
| 0003b8a0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003b8b0:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003b8c0:·6e61·6d65·3a20·456e·7375·7265·2064·7261··name:·Ensure·dra | |||
| 0003b8d0:·6375·742d·6669·7073·2069·7320·696e·7374··cut-fips·is·inst | |||
| 0003b8e0:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 0003b8f0:·0a20·2020·206e·616d·653a·2064·7261·6375··.····name:·dracu | |||
| 0003b900:·742d·6669·7073·0a20·2020·2073·7461·7465··t-fips.····state | |||
| 0003b910:·3a20·7072·6573·656e·740a·2020·7768·656e··:·present.··when | |||
| 0003b920:·3a0a·2020·2d20·616e·7369·626c·655f·7669··:.··-·ansible_vi | |||
| 0003b930:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003b940:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003b950:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003b960:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003b970:·636f·6e74·6169·6e65·7222·5d0a·2020·2d20··container"].··-· | |||
| 0003b980:·616e·7369·626c·655f·6469·7374·7269·6275··ansible_distribu | |||
| 0003b990:·7469·6f6e·203d·3d20·2752·6564·4861·7427··tion·==·'RedHat' | |||
| 0003b9a0:·0a20·2074·6167·733a·0a20·202d·2043·4a49··.··tags:.··-·CJI | |||
| 0003b9b0:·532d·352e·3130·2e31·2e32·0a20·202d·204e··S-5.10.1.2.··-·N | |||
| 0003b9 | 0003b970:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003b980:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003b990:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003b9a0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003b9b0:·3e3c·636f·6465·3e2d·206e·616d·653a·2045··><code>-·name:·E | |||
| 0003b9c0:·6e73·7572·6520·6472·6163·7574·2d66·6970··nsure·dracut-fip | |||
| 0003b9d0:·7320·6973·2069·6e73·7461·6c6c·6564·0a20··s·is·installed.· | |||
| 0003b9e0:·2070·6163·6b61·6765·3a0a·2020·2020·6e61···package:.····na | |||
| 0003b9f0:·6d65·3a20·6472·6163·7574·2d66·6970·730a··me:·dracut-fips. | |||
| 0003ba00:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | |||
| 0003ba10:·6e74·0a20·2077·6865·6e3a·0a20·202d·2061··nt.··when:.··-·a | |||
| 0003ba20:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| Max diff block lines reached; 4723851/4740741 bytes (99.64%) of diff not shown. | |||
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | Profile·Title·Unclassified·Information·in·Non-federal·Information·Systems·and | 50 | Profile·Title·Unclassified·Information·in·Non-federal·Information·Systems·and |
| 51 | ··············Organizations·(NIST·800-171) | 51 | ··············Organizations·(NIST·800-171) |
| 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui | 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui |
| 53 | ***·CPE·Platforms·*** | 53 | ***·CPE·Platforms·*** |
| 54 | ····*·cpe:/o:oracle:linux:7 | 54 | ····*·cpe:/o:oracle:linux:7 |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·System_Settings | 59 | ···1.·System_Settings |
| 60 | ·········1.·Installing_and_Maintaining_Software | 60 | ·········1.·Installing_and_Maintaining_Software |
| 61 | ·········2.·Account_and_Access_Control | 61 | ·········2.·Account_and_Access_Control |
| 62 | ·········3.·System_Accounting_with_auditd | 62 | ·········3.·System_Accounting_with_auditd |
| 63 | ·········4.·GRUB2_bootloader_configuration | 63 | ·········4.·GRUB2_bootloader_configuration |
| 64 | ·········5.·Network_Configuration_and_Firewalls | 64 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 86, 17 lines modified | Offset 86, 25 lines modified | ||
| 86 | To·enable·FIPS,·the·system·requires·that·the·dracut-fips·package·be·installed.·The·dracut-fips·package·can·be·installed·with·the·following·command: | 86 | To·enable·FIPS,·the·system·requires·that·the·dracut-fips·package·be·installed.·The·dracut-fips·package·can·be·installed·with·the·following·command: |
| 87 | $·sudo·yum·install·dracut-fips | 87 | $·sudo·yum·install·dracut-fips |
| 88 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 88 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 89 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 89 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 90 | Severity: ················medium | 90 | Severity: ················medium |
| 91 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed | 91 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed |
| 92 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 92 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 93 | Remediation_ | 93 | Remediation_Shell_script_⇲ |
| 94 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 95 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 94 | 96 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | |
| 97 | ····yum·install·-y·"dracut-fips" | ||
| 98 | fi | ||
| 99 | else | ||
| 100 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 101 | fi | ||
| 95 | Remediation_Ansible_snippet_⇲ | 102 | Remediation_Ansible_snippet_⇲ |
| 96 | Complexity:·low | 103 | Complexity:·low |
| 97 | Disruption:·low | 104 | Disruption:·low |
| 98 | Strategy:···enable | 105 | Strategy:···enable |
| 99 | -·name:·Ensure·dracut-fips·is·installed | 106 | -·name:·Ensure·dracut-fips·is·installed |
| 100 | ··package: | 107 | ··package: |
| 101 | ····name:·dracut-fips | 108 | ····name:·dracut-fips |
| Offset 116, 25 lines modified | Offset 124, 17 lines modified | ||
| 116 | ··-·NIST-800-53-SC-13 | 124 | ··-·NIST-800-53-SC-13 |
| 117 | ··-·enable_strategy | 125 | ··-·enable_strategy |
| 118 | ··-·low_complexity | 126 | ··-·low_complexity |
| 119 | ··-·low_disruption | 127 | ··-·low_disruption |
| 120 | ··-·medium_severity | 128 | ··-·medium_severity |
| 121 | ··-·no_reboot_needed | 129 | ··-·no_reboot_needed |
| 122 | ··-·package_dracut-fips_installed | 130 | ··-·package_dracut-fips_installed |
| 131 | Remediation_Anaconda_snippet_⇲ | ||
| 123 | Remediation_Shell_script_⇲ | ||
| 124 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 125 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 126 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 127 | ····yum·install·-y·"dracut-fips" | ||
| 128 | fi | ||
| 132 | package·--add=dracut-fips | ||
| 129 | else | ||
| 130 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 131 | fi | ||
| 132 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** | 133 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** |
| 133 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: | 134 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: |
| 134 | $·sudo·yum·install·dracut-fips | 135 | $·sudo·yum·install·dracut-fips |
| 135 | dracut·-f | 136 | dracut·-f |
| 136 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: | 137 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: |
| 137 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" | 138 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" |
| 138 | Finally,·rebuild·the·grub.cfg·file·by·using·the | 139 | Finally,·rebuild·the·grub.cfg·file·by·using·the |
| Offset 149, 17 lines modified | Offset 149, 80 lines modified | ||
| 149 | will·overwrite·the·existing·initramfs·file. | 149 | will·overwrite·the·existing·initramfs·file. |
| 150 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 150 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 151 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 151 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 152 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 152 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 153 | Severity: ················high | 153 | Severity: ················high |
| 154 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode | 154 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode |
| 155 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL07-00-021350,·SV-221758r603260_rule | 155 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL07-00-021350,·SV-221758r603260_rule |
| 156 | Remediation_ | 156 | Remediation_Shell_script_⇲ |
| 157 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 158 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·rpm·--quiet·-q·grub2-common;·};·then | ||
| 157 | 159 | #·prelink·not·installed | |
| 160 | if·test·-e·/etc/sysconfig/prelink·-o·-e·/usr/sbin/prelink;·then | ||
| 161 | ····if·grep·-q·^PRELINKING·/etc/sysconfig/prelink | ||
| 162 | ····then | ||
| 163 | ········sed·-i·'s/^PRELINKING[:blank:]*=[:blank:]*[:alpha:]*/PRELINKING=no/'·/etc/sysconfig/prelink | ||
| 164 | ····else | ||
| 165 | ········printf·'\n'·>>·/etc/sysconfig/prelink | ||
| 166 | ········printf·'%s\n'·'#·Set·PRELINKING=no·per·security·requirements'·'PRELINKING=no'·>>·/etc/sysconfig/prelink | ||
| 167 | ····fi | ||
| 168 | ····#·Undo·previous·prelink·changes·to·binaries·if·prelink·is·available. | ||
| 169 | ····if·test·-x·/usr/sbin/prelink;·then | ||
| 170 | ········/usr/sbin/prelink·-ua | ||
| 171 | ····fi | ||
| 172 | fi | ||
| 173 | if·grep·-q·-m1·-o·aes·/proc/cpuinfo;·then | ||
| 174 | » if·!·rpm·-q·--quiet·"dracut-fips-aesni"·;·then | ||
| 175 | ····yum·install·-y·"dracut-fips-aesni" | ||
| 176 | fi | ||
| 177 | fi | ||
| 178 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 179 | ····yum·install·-y·"dracut-fips" | ||
| 180 | fi | ||
| 181 | dracut·-f | ||
| 182 | #·Correct·the·form·of·default·kernel·command·line·in··grub | ||
| 183 | if·grep·-q·'^GRUB_CMDLINE_LINUX=.*fips=.*"'··/etc/default/grub;·then | ||
| 184 | » #·modify·the·GRUB·command-line·if·a·fips=·arg·already·exists | ||
| 185 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)fips=[^[:space:]]*\(.*"\)/\1·fips=1·\2/'··/etc/default/grub | ||
| 186 | else | ||
| 187 | » #·no·existing·fips=arg·is·present,·append·it | ||
| 188 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)"/\1·fips=1"/'··/etc/default/grub | ||
| 189 | fi | ||
| 190 | #·Get·the·UUID·of·the·device·mounted·at·root·(/). | ||
| 191 | ROOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/) | ||
| 192 | #·Get·the·UUID·of·the·device·mounted·at·/boot. | ||
| 193 | BOOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/boot) | ||
| 194 | if·[·"${ROOT_UUID}"·==·"${BOOT_UUID}"·];·then | ||
| 195 | » #·root·UUID·same·as·boot·UUID,·so·do·not·modify·the·GRUB·command-line·or·add·boot·arg·to·kernel·command·line | ||
| 196 | » #·Correct·the·form·of·kernel·command·line·for·each·installed·kernel·in·the·bootloader | ||
| 197 | » /sbin/grubby·--update-kernel=ALL·--args="fips=1" | ||
| Max diff block lines reached; 613911/623549 bytes (98.45%) of diff not shown. | |||
| Offset 14297, 15 lines modified | Offset 14297, 15 lines modified | ||
| 00037d80:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00037d80:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00037d90:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00037d90:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00037da0:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00037da0:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00037db0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00037db0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00037dc0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00037dc0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00037dd0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00037dd0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00037de0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00037de0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00037df0:·6620·3230·323 | 00037df0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00037e00:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00037e00:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00037e10:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00037e10:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00037e20:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00037e20:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00037e30:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00037e30:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00037e40:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00037e40:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00037e50:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00037e50:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00037e60:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00037e60:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15243, 334 lines modified | Offset 15243, 334 lines modified | ||
| 0003b8a0:·7461·2d74·6172·6765·743d·2223·6964·6d35··ta-target="#idm5 | 0003b8a0:·7461·2d74·6172·6765·743d·2223·6964·6d35··ta-target="#idm5 | ||
| 0003b8b0:·3934·3622·2074·6162·696e·6465·783d·2230··946"·tabindex="0 | 0003b8b0:·3934·3622·2074·6162·696e·6465·783d·2230··946"·tabindex="0 | ||
| 0003b8c0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 0003b8c0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 0003b8d0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 0003b8d0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 0003b8e0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 0003b8e0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 0003b8f0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 0003b8f0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 0003b900:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 0003b900:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 0003b910:·6961·7469·6f6e·20 | 0003b910:·6961·7469·6f6e·2053·6865·6c6c·2073·6372··iation·Shell·scr | ||
| 0003b920:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003b930:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003b940:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003b950:·6c61·7073·6522·2069·643d·2269·646d·3539··lapse"·id="idm59 | |||
| 0003b960:·3436·223e·3c74·6162·6c65·2063·6c61·7373··46"><table·class | |||
| 0003b970:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003b980:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003b990:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003b9a0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003b9b0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003b9c0:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003b9d0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003b9e0:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003b9f0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003ba00:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003ba10:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003ba20:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003ba30:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003ba40:·653a·2027·5365·7420·6661·6374·3a20·5061··e:·'Set·fact:·Pa | |||
| 0003ba50:·636b·6167·6520·6d61·6e61·6765·7220·7265··ckage·manager·re | |||
| 0003ba60:·696e·7374·616c·6c20·636f·6d6d·616e·6420··install·command· | |||
| 0003ba70:·2864·6e66·2927·0a20·2073·6574·5f66·6163··(dnf)'.··set_fac | |||
| 0003b | 0003b920:·6970·7420·e287·b23c·2f61·3e3c·6272·3e3c··ipt·...</a><br>< | ||
| 0003b930:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003b940:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003b950:·7365·2220·6964·3d22·6964·6d35·3934·3622··se"·id="idm5946" | |||
| 0003b960:·3e3c·7072·653e·3c63·6f64·653e·0a23·2046··><pre><code>.#·F | |||
| 0003b970:·696e·6420·7768·6963·6820·6669·6c65·7320··ind·which·files· | |||
| 0003b980:·6861·7665·2069·6e63·6f72·7265·6374·2068··have·incorrect·h | |||
| 0003b990:·6173·6820·286e·6f74·2069·6e20·2f65·7463··ash·(not·in·/etc | |||
| 0003b9a0:·2c20·6265·6361·7573·6520·6f66·2074·6865··,·because·of·the | |||
| 0003b9b0:·2073·7973·7465·6d20·7265·6c61·7465·6420···system·related· | |||
| 0003b9c0:·636f·6e66·6967·2066·696c·6573·2920·616e··config·files)·an | |||
| 0003b9d0:·6420·7468·656e·2067·6574·2066·696c·6573··d·then·get·files | |||
| 0003b9e0:·206e·616d·6573·0a66·696c·6573·5f77·6974···names.files_wit | |||
| 0003b9f0:·685f·696e·636f·7272·6563·745f·6861·7368··h_incorrect_hash | |||
| 0003ba00:·3d22·2428·7270·6d20·2d56·6120·2d2d·6e6f··="$(rpm·-Va·--no | |||
| 0003ba10:·636f·6e66·6967·207c·2067·7265·7020·2d45··config·|·grep·-E | |||
| 0003ba20:·2027·5e2e·2e35·2720·7c20·6177·6b20·277b···'^..5'·|·awk·'{ | |||
| 0003ba30:·7072·696e·7420·244e·467d·2720·2922·0a0a··print·$NF}'·)".. | |||
| 0003ba40:·2320·4672·6f6d·2066·696c·6573·206e·616d··#·From·files·nam | |||
| 0003ba50:·6573·2067·6574·2070·6163·6b61·6765·206e··es·get·package·n | |||
| 0003ba60:·616d·6573·2061·6e64·2063·6861·6e67·6520··ames·and·change· | |||
| 0003ba70:·6e65·776c·696e·6520·746f·2073·7061·6365··newline·to·space | |||
| 0003ba80:·2c20·6265·6361·7573·6520·7270·6d20·7772··,·because·rpm·wr | |||
| 0003ba90:·6974·6573·2065·6163·6820·7061·636b·6167··ites·each·packag | |||
| 0003baa0:·6520·746f·206e·6577·206c·696e·650a·7061··e·to·new·line.pa | |||
| 0003bab0:·636b·6167·6573·5f74·6f5f·7265·696e·7374··ckages_to_reinst | |||
| 0003bac0:·616c·6c3d·2224·2872·706d·202d·7166·2024··all="$(rpm·-qf·$ | |||
| 0003bad0:·6669·6c65·735f·7769·7468·5f69·6e63·6f72··files_with_incor | |||
| 0003bae0:·7265·6374·5f68·6173·6820·7c20·7472·2027··rect_hash·|·tr·' | |||
| 0003baf0:·5c6e·2720·2720·2729·220a·0a0a·7975·6d20··\n'·'·')"...yum· | |||
| 0003bb00:·7265·696e·7374·616c·6c20·2d79·2024·7061··reinstall·-y·$pa | |||
| 0003bb10:·636b·6167·6573·5f74·6f5f·7265·696e·7374··ckages_to_reinst | |||
| 0003bb20:·616c·6c0a·3c2f·636f·6465·3e3c·2f70·7265··all.</code></pre | |||
| 0003bb30:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003bb40:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003bb50:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003bb60:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003bb70:·7267·6574·3d22·2369·646d·3539·3437·2220··rget="#idm5947"· | |||
| 0003bb80:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bb90:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bba0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bbb0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bbc0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003bbd0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003bbe0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bbf0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bc00:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bc10:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bc20:·2220·6964·3d22·6964·6d35·3934·3722·3e3c··"·id="idm5947">< | |||
| 0003bc30:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bc40:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bc50:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bc60:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bc70:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bc80:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003bc90:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003bca0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003bcb0:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003bcc0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003bcd0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003bce0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003bcf0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bd00:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003bd10:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003b | 0003bd20:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | ||
| 0003bd30:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003bd40:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003bd50:·2020·7061·636b·6167·655f·6d61·6e61·6765····package_manage | |||
| 0003bd60:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003bd70:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003bd80:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003baa0:·5f63·6d64·3a20·646e·6620·7265·696e·7374··_cmd:·dnf·reinst | |||
| 0003bab0:·616c·6c20·2d79·0a20·2077·6865·6e3a·2061··all·-y.··when:·a | |||
| 0003bac0:·6e73·6962·6c65·5f64·6973·7472·6962·7574··nsible_distribut | |||
| 0003bad0:·696f·6e20·3d3d·2022·4665·646f·7261·220a··ion·==·"Fedora". | |||
| 0003bae0:·2020·7461·6773·3a0a·2020·2d20·434a·4953····tags:.··-·CJIS | |||
| 0003baf0:·2d35·2e31·302e·342e·310a·2020·2d20·4449··-5.10.4.1.··-·DI | |||
| 0003bb00:·5341·2d53·5449·472d·4f4c·3037·2d30·302d··SA-STIG-OL07-00- | |||
| 0003bb10:·3031·3030·3230·0a20·202d·204e·4953·542d··010020.··-·NIST- | |||
| 0003bb20:·3830·302d·3137·312d·332e·332e·380a·2020··800-171-3.3.8.·· | |||
| 0003bb30:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| Max diff block lines reached; 5723631/5747697 bytes (99.58%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | *****·Profile·Information·***** | 41 | *****·Profile·Information·***** |
| 42 | Profile·Title·[DRAFT]·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight | 42 | Profile·Title·[DRAFT]·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:oracle:linux:7 | 45 | ····*·cpe:/o:oracle:linux:7 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·Configure_Syslog | 54 | ·········4.·Configure_Syslog |
| 55 | ·········5.·Network_Configuration_and_Firewalls | 55 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 86, 14 lines modified | Offset 86, 24 lines modified | ||
| 86 | $·sudo·yum·reinstall·PACKAGENAME | 86 | $·sudo·yum·reinstall·PACKAGENAME |
| 87 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 87 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 88 | $·sudo·rpm·-Uvh·PACKAGENAME | 88 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 89 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 89 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 90 | Severity: ················high | 90 | Severity: ················high |
| 91 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 91 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 92 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule | 92 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule |
| 93 | Remediation_Shell_script_⇲ | ||
| 94 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 95 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 96 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 97 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 98 | yum·reinstall·-y·$packages_to_reinstall | ||
| 93 | Remediation_Ansible_snippet_⇲ | 99 | Remediation_Ansible_snippet_⇲ |
| 94 | Complexity:·high | 100 | Complexity:·high |
| 95 | Disruption:·medium | 101 | Disruption:·medium |
| 96 | Strategy:···restrict | 102 | Strategy:···restrict |
| 97 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 103 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 98 | ··set_fact: | 104 | ··set_fact: |
| 99 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 105 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 243, 36 lines modified | Offset 253, 51 lines modified | ||
| 243 | ··-·PCI-DSS-Req-11.5 | 253 | ··-·PCI-DSS-Req-11.5 |
| 244 | ··-·high_complexity | 254 | ··-·high_complexity |
| 245 | ··-·high_severity | 255 | ··-·high_severity |
| 246 | ··-·medium_disruption | 256 | ··-·medium_disruption |
| 247 | ··-·no_reboot_needed | 257 | ··-·no_reboot_needed |
| 248 | ··-·restrict_strategy | 258 | ··-·restrict_strategy |
| 249 | ··-·rpm_verify_hashes | 259 | ··-·rpm_verify_hashes |
| 250 | Remediation_Shell_script_⇲ | ||
| 251 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 252 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 253 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 254 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 255 | yum·reinstall·-y·$packages_to_reinstall | ||
| 256 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 260 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 257 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 261 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 258 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 262 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 259 | run·the·following·command·to·determine·which·package·owns·it: | 263 | run·the·following·command·to·determine·which·package·owns·it: |
| 260 | $·rpm·-qf·FILENAME | 264 | $·rpm·-qf·FILENAME |
| 261 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 265 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 262 | $·sudo·rpm·--setugids·PACKAGENAME | 266 | $·sudo·rpm·--setugids·PACKAGENAME |
| 263 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 267 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 264 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 268 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 265 | Severity: ················high | 269 | Severity: ················high |
| 266 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 270 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 267 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule | 271 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule |
| 272 | Remediation_Shell_script_⇲ | ||
| 273 | Complexity:·high | ||
| 274 | Disruption:·medium | ||
| 275 | Strategy:···restrict | ||
| 276 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 277 | declare·-A·SETPERMS_RPM_DICT | ||
| 278 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 279 | #·is·expected·by·the·RPM·database | ||
| 280 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 281 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 282 | do | ||
| 283 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 284 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 285 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 286 | done | ||
| 287 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 288 | #·correct·values | ||
| 289 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 290 | do | ||
| 291 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 292 | done | ||
| 268 | Remediation_Ansible_snippet_⇲ | 293 | Remediation_Ansible_snippet_⇲ |
| 269 | Complexity:·high | 294 | Complexity:·high |
| 270 | Disruption:·medium | 295 | Disruption:·medium |
| 271 | Strategy:···restrict | 296 | Strategy:···restrict |
| 272 | -·name:·Read·list·of·files·with·incorrect·ownership | 297 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 273 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 298 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 274 | ····--nocaps·--nolinkto·--nomode | 299 | ····--nocaps·--nolinkto·--nomode |
| Offset 346, 52 lines modified | Offset 371, 56 lines modified | ||
| 346 | ··-·PCI-DSS-Req-11.5 | 371 | ··-·PCI-DSS-Req-11.5 |
| 347 | ··-·high_complexity | 372 | ··-·high_complexity |
| 348 | ··-·high_severity | 373 | ··-·high_severity |
| 349 | ··-·medium_disruption | 374 | ··-·medium_disruption |
| 350 | ··-·no_reboot_needed | 375 | ··-·no_reboot_needed |
| 351 | ··-·restrict_strategy | 376 | ··-·restrict_strategy |
| 352 | ··-·rpm_verify_ownership | 377 | ··-·rpm_verify_ownership |
| 378 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 379 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 380 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 381 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 382 | $·rpm·-qf·FILENAME | ||
| 383 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 384 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 385 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 386 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 387 | Severity: ················high | ||
| 388 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 389 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule | ||
| 353 | Remediation_Shell_script_⇲ | 390 | Remediation_Shell_script_⇲ |
| 354 | Complexity:·high | 391 | Complexity:·high |
| 355 | Disruption:·medium | 392 | Disruption:·medium |
| 356 | Strategy:···restrict | 393 | Strategy:···restrict |
| Max diff block lines reached; 584733/594005 bytes (98.44%) of diff not shown. | |||
| Offset 14315, 16 lines modified | Offset 14315, 16 lines modified | ||
| 00037ea0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00037ea0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00037eb0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00037eb0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00037ec0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00037ec0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00037ed0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00037ed0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00037ee0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00037ee0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00037ef0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00037ef0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037f10:·2020·2020·2861·7320·6f66·2032·3032·3 | 00037f10:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00037f20:·303 | 00037f20:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00037f30:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00037f30:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00037f40:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00037f40:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00037f50:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00037f50:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00037f60:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00037f60:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00037f70:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00037f70:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00037f80:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00037f80:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00037f90:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00037f90:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15274, 335 lines modified | Offset 15274, 335 lines modified | ||
| 0003ba90:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003ba90:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003baa0:·6964·6d35·3934·3622·2074·6162·696e·6465··idm5946"·tabinde | 0003baa0:·6964·6d35·3934·3622·2074·6162·696e·6465··idm5946"·tabinde | ||
| 0003bab0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003bab0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003bac0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003bac0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003bad0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003bad0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003bae0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003bae0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003baf0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003baf0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003bb00:·656d·6564·6961·7469·6f6e·20 | 0003bb00:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003bb10:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bb20:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bb30:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bb40:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bb50:·646d·3539·3436·223e·3c74·6162·6c65·2063··dm5946"><table·c | |||
| 0003bb60:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bb70:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bb80:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bb90:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bba0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bbb0:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003bbc0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bbd0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bbe0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003bbf0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bc00:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003bc10:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003b | 0003bb10:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | ||
| 0003bb20:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bb30:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bb40:·6c6c·6170·7365·2220·6964·3d22·6964·6d35··llapse"·id="idm5 | |||
| 0003bb50:·3934·3622·3e3c·7072·653e·3c63·6f64·653e··946"><pre><code> | |||
| 0003bb60:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003bb70:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003bb80:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003bb90:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003bba0:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003bbb0:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003bbc0:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003bbd0:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003bbe0:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003bbf0:·6861·7368·3d22·2428·7270·6d20·2d56·6120··hash="$(rpm·-Va· | |||
| 0003bc00:·2d2d·6e6f·636f·6e66·6967·207c·2067·7265··--noconfig·|·gre | |||
| 0003bc10:·7020·2d45·2027·5e2e·2e35·2720·7c20·6177··p·-E·'^..5'·|·aw | |||
| 0003bc20:·6b20·277b·7072·696e·7420·244e·467d·2720··k·'{print·$NF}'· | |||
| 0003bc30:·2922·0a0a·2320·4672·6f6d·2066·696c·6573··)"..#·From·files | |||
| 0003bc | 0003bc40:·206e·616d·6573·2067·6574·2070·6163·6b61···names·get·packa | ||
| 0003bc50:·6765·206e·616d·6573·2061·6e64·2063·6861··ge·names·and·cha | |||
| 0003bc60:·6e67·6520·6e65·776c·696e·6520·746f·2073··nge·newline·to·s | |||
| 0003bc70:·7061·6365·2c20·6265·6361·7573·6520·7270··pace,·because·rp | |||
| 0003bc80:·6d20·7772·6974·6573·2065·6163·6820·7061··m·writes·each·pa | |||
| 0003bc90:·636b·6167·6520·746f·206e·6577·206c·696e··ckage·to·new·lin | |||
| 0003bca0:·650a·7061·636b·6167·6573·5f74·6f5f·7265··e.packages_to_re | |||
| 0003bcb0:·696e·7374·616c·6c3d·2224·2872·706d·202d··install="$(rpm·- | |||
| 0003bcc0:·7166·2024·6669·6c65·735f·7769·7468·5f69··qf·$files_with_i | |||
| 0003bcd0:·6e63·6f72·7265·6374·5f68·6173·6820·7c20··ncorrect_hash·|· | |||
| 0003bce0:·7472·2027·5c6e·2720·2720·2729·220a·0a0a··tr·'\n'·'·')"... | |||
| 0003bc40:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003bc50:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003bc60:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003bc70:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003bc80:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003bc90:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003bca0:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003bcb0:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003bcc0:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003bcd0:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003bce0:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003bcf0:·2d20·4449·5341·2d53·5449·472d·4f4c·3037··-·DISA-STIG-OL07 | |||
| 0003bd00:·2d30·302d·3031·3030·3230·0a20·202d·204e··-00-010020.··-·N | |||
| 0003bd10:·4953·542d·3830·302d·3137·312d·332e·332e··IST-800-171-3.3. | |||
| 0003bd20:·380a·2020·2d20·4e49·5354·2d38·3030·2d31··8.··-·NIST-800-1 | |||
| 0003bd30:·3731·2d33·2e34·2e31·0a20·202d·204e·4953··71-3.4.1.··-·NIS | |||
| 0003bd40:·542d·3830·302d·3533·2d41·552d·3928·3329··T-800-53-AU-9(3) | |||
| 0003bd50:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003bd60:·2d43·4d2d·3628·6329·0a20·202d·204e·4953··-CM-6(c).··-·NIS | |||
| 0003bd70:·542d·3830·302d·3533·2d43·4d2d·3628·6429··T-800-53-CM-6(d) | |||
| 0003bd80:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003bd90:·2d53·492d·370a·2020·2d20·4e49·5354·2d38··-SI-7.··-·NIST-8 | |||
| 0003bda0:·3030·2d35·332d·5349·2d37·2831·290a·2020··00-53-SI-7(1).·· | |||
| 0003bdb0:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003bdc0:·2d37·2836·290a·2020·2d20·5043·492d·4453··-7(6).··-·PCI-DS | |||
| 0003bdd0:·532d·5265·712d·3131·2e35·0a20·202d·2068··S-Req-11.5.··-·h | |||
| 0003bde0:·6967·685f·636f·6d70·6c65·7869·7479·0a20··igh_complexity.· | |||
| 0003bdf0:·202d·2068·6967·685f·7365·7665·7269·7479···-·high_severity | |||
| 0003be00:·0a20·202d·206d·6564·6975·6d5f·6469·7372··.··-·medium_disr | |||
| 0003be10:·7570·7469·6f6e·0a20·202d·206e·6f5f·7265··uption.··-·no_re | |||
| 0003be20:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003be30:·7265·7374·7269·6374·5f73·7472·6174·6567··restrict_strateg | |||
| 0003be40:·790a·2020·2d20·7270·6d5f·7665·7269·6679··y.··-·rpm_verify | |||
| 0003be50:·5f68·6173·6865·730a·0a2d·206e·616d·653a··_hashes..-·name: | |||
| 0003be60:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003be70:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003be80:·7374·616c·6c20·636f·6d6d·616e·6420·2879··stall·command·(y | |||
| 0003be90:·756d·2927·0a20·2073·6574·5f66·6163·743a··um)'.··set_fact: | |||
| 0003bea0:·0a20·2020·2070·6163·6b61·6765·5f6d·616e··.····package_man | |||
| 0003beb0:·6167·6572·5f72·6569·6e73·7461·6c6c·5f63··ager_reinstall_c | |||
| 0003b | 0003bcf0:·7975·6d20·7265·696e·7374·616c·6c20·2d79··yum·reinstall·-y | ||
| 0003b | 0003bd00:·2024·7061·636b·6167·6573·5f74·6f5f·7265···$packages_to_re | ||
| 0003bd10:·696e·7374·616c·6c0a·3c2f·636f·6465·3e3c··install.</code>< | |||
| 0003bd20:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bd30:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bd40:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bd50:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bd60:·612d·7461·7267·6574·3d22·2369·646d·3539··a-target="#idm59 | |||
| 0003bd70:·3437·2220·7461·6269·6e64·6578·3d22·3022··47"·tabindex="0" | |||
| 0003bd80:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bd90:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bda0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bdb0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003bdc0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003bdd0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| Max diff block lines reached; 15712507/15736159 bytes (99.85%) of diff not shown. | |||
| Offset 46, 15 lines modified | Offset 46, 15 lines modified | ||
| 46 | *****·Profile·Information·***** | 46 | *****·Profile·Information·***** |
| 47 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) | 47 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) |
| 48 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa | 48 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa |
| 49 | ***·CPE·Platforms·*** | 49 | ***·CPE·Platforms·*** |
| 50 | ····*·cpe:/o:oracle:linux:7 | 50 | ····*·cpe:/o:oracle:linux:7 |
| 51 | *****·Revision·History·***** | 51 | *****·Revision·History·***** |
| 52 | Current·version:·0.1.65 | 52 | Current·version:·0.1.65 |
| 53 | ····*·draft·(as·of·202 | 53 | ····*·draft·(as·of·2025-02-23) |
| 54 | *****·Table·of·Contents·***** | 54 | *****·Table·of·Contents·***** |
| 55 | ···1.·System_Settings | 55 | ···1.·System_Settings |
| 56 | ·········1.·Installing_and_Maintaining_Software | 56 | ·········1.·Installing_and_Maintaining_Software |
| 57 | ·········2.·Account_and_Access_Control | 57 | ·········2.·Account_and_Access_Control |
| 58 | ·········3.·System_Accounting_with_auditd | 58 | ·········3.·System_Accounting_with_auditd |
| 59 | ·········4.·GRUB2_bootloader_configuration | 59 | ·········4.·GRUB2_bootloader_configuration |
| 60 | ·········5.·Configure_Syslog | 60 | ·········5.·Configure_Syslog |
| Offset 93, 14 lines modified | Offset 93, 24 lines modified | ||
| 93 | $·sudo·yum·reinstall·PACKAGENAME | 93 | $·sudo·yum·reinstall·PACKAGENAME |
| 94 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 94 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 95 | $·sudo·rpm·-Uvh·PACKAGENAME | 95 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 96 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 96 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 97 | Severity: ················high | 97 | Severity: ················high |
| 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 99 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule | 99 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule |
| 100 | Remediation_Shell_script_⇲ | ||
| 101 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 102 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 103 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 104 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 105 | yum·reinstall·-y·$packages_to_reinstall | ||
| 100 | Remediation_Ansible_snippet_⇲ | 106 | Remediation_Ansible_snippet_⇲ |
| 101 | Complexity:·high | 107 | Complexity:·high |
| 102 | Disruption:·medium | 108 | Disruption:·medium |
| 103 | Strategy:···restrict | 109 | Strategy:···restrict |
| 104 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 110 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 105 | ··set_fact: | 111 | ··set_fact: |
| 106 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 112 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 250, 37 lines modified | Offset 260, 56 lines modified | ||
| 250 | ··-·PCI-DSS-Req-11.5 | 260 | ··-·PCI-DSS-Req-11.5 |
| 251 | ··-·high_complexity | 261 | ··-·high_complexity |
| 252 | ··-·high_severity | 262 | ··-·high_severity |
| 253 | ··-·medium_disruption | 263 | ··-·medium_disruption |
| 254 | ··-·no_reboot_needed | 264 | ··-·no_reboot_needed |
| 255 | ··-·restrict_strategy | 265 | ··-·restrict_strategy |
| 256 | ··-·rpm_verify_hashes | 266 | ··-·rpm_verify_hashes |
| 257 | Remediation_Shell_script_⇲ | ||
| 258 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 259 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 260 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 261 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 262 | yum·reinstall·-y·$packages_to_reinstall | ||
| 263 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 267 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 264 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 268 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 265 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 269 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 266 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 270 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 267 | $·rpm·-qf·FILENAME | 271 | $·rpm·-qf·FILENAME |
| 268 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 272 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 269 | $·sudo·rpm·--setperms·PACKAGENAME | 273 | $·sudo·rpm·--setperms·PACKAGENAME |
| 270 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 274 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 271 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 275 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 272 | Severity: ················high | 276 | Severity: ················high |
| 273 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 277 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 274 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule | 278 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule |
| 279 | Remediation_Shell_script_⇲ | ||
| 280 | Complexity:·high | ||
| 281 | Disruption:·medium | ||
| 282 | Strategy:···restrict | ||
| 283 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 284 | declare·-A·SETPERMS_RPM_DICT | ||
| 285 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 286 | #·is·expected·by·the·RPM·database | ||
| 287 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 288 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 289 | do | ||
| 290 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 291 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 292 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 293 | ········do | ||
| 294 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 295 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 296 | ········done | ||
| 297 | done | ||
| 298 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 299 | #·correct·values | ||
| 300 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 301 | do | ||
| 302 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 303 | done | ||
| 275 | Remediation_Ansible_snippet_⇲ | 304 | Remediation_Ansible_snippet_⇲ |
| 276 | Complexity:·high | 305 | Complexity:·high |
| 277 | Disruption:·medium | 306 | Disruption:·medium |
| 278 | Strategy:···restrict | 307 | Strategy:···restrict |
| 279 | -·name:·Read·list·of·files·with·incorrect·permissions | 308 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 280 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 309 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 281 | ····--nocaps·--nolinkto·--nouser·--nogroup | 310 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 357, 43 lines modified | Offset 386, 14 lines modified | ||
| 357 | ··-·PCI-DSS-Req-11.5 | 386 | ··-·PCI-DSS-Req-11.5 |
| 358 | ··-·high_complexity | 387 | ··-·high_complexity |
| 359 | ··-·high_severity | 388 | ··-·high_severity |
| 360 | ··-·medium_disruption | 389 | ··-·medium_disruption |
| 361 | ··-·no_reboot_needed | 390 | ··-·no_reboot_needed |
| 362 | ··-·restrict_strategy | 391 | ··-·restrict_strategy |
| 363 | ··-·rpm_verify_permissions | 392 | ··-·rpm_verify_permissions |
| 364 | Remediation_Shell_script_⇲ | ||
| 365 | Complexity:·high | ||
| 366 | Disruption:·medium | ||
| 367 | Strategy:···restrict | ||
| 368 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 369 | declare·-A·SETPERMS_RPM_DICT | ||
| 370 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 371 | #·is·expected·by·the·RPM·database | ||
| 372 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1120827/1129055 bytes (99.27%) of diff not shown. | |||
| Offset 14368, 15 lines modified | Offset 14368, 15 lines modified | ||
| 000381f0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 000381f0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038200:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038200:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038210:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038210:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038220:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038220:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038230:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038230:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038240:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038240:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038250:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038250:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038260:·3 | 00038260:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038270:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038270:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038280:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038280:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038290:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038290:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 000382a0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 000382a0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 000382b0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 000382b0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 000382c0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 000382c0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 000382d0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 000382d0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15342, 334 lines modified | Offset 15342, 334 lines modified | ||
| 0003bed0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003bed0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003bee0:·3539·3436·2220·7461·6269·6e64·6578·3d22··5946"·tabindex=" | 0003bee0:·3539·3436·2220·7461·6269·6e64·6578·3d22··5946"·tabindex=" | ||
| 0003bef0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003bef0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003bf00:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003bf00:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003bf10:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003bf10:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003bf20:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003bf20:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003bf30:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003bf30:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003bf40:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003bf50:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bf60:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bf70:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bf80:·6c6c·6170·7365·2220·6964·3d22·6964·6d35··llapse"·id="idm5 | |||
| 0003bf90:·3934·3622·3e3c·7461·626c·6520·636c·6173··946"><table·clas | |||
| 0003bfa0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bfb0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bfc0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bfd0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bfe0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bff0:·7464·3e68·6967·683c·2f74·643e·3c2f·7472··td>high</td></tr | |||
| 0003c000:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c010:·696f·6e3a·3c2f·7468·3e3c·7464·3e6d·6564··ion:</th><td>med | |||
| 0003c020:·6975·6d3c·2f74·643e·3c2f·7472·3e3c·7472··ium</td></tr><tr | |||
| 0003c030:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c040:·7468·3e3c·7464·3e72·6573·7472·6963·743c··th><td>restrict< | |||
| 0003c050:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c060:·3e3c·7072·653e·3c63·6f64·653e·2d20·6e61··><pre><code>-·na | |||
| 0003c070:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| 0003c080:·6163·6b61·6765·206d·616e·6167·6572·2072··ackage·manager·r | |||
| 0003c090:·6569·6e73·7461·6c6c·2063·6f6d·6d61·6e64··einstall·command | |||
| 0003c0a0:·2028·646e·6629·270a·2020·7365·745f·6661···(dnf)'.··set_fa | |||
| 0003 | 0003bf40:·6469·6174·696f·6e20·5368·656c·6c20·7363··diation·Shell·sc | ||
| 0003bf50:·7269·7074·20e2·87b2·3c2f·613e·3c62·723e··ript·...</a><br> | |||
| 0003bf60:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bf70:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bf80:·7073·6522·2069·643d·2269·646d·3539·3436··pse"·id="idm5946 | |||
| 0003bf90:·223e·3c70·7265·3e3c·636f·6465·3e0a·2320··"><pre><code>.#· | |||
| 0003bfa0:·4669·6e64·2077·6869·6368·2066·696c·6573··Find·which·files | |||
| 0003bfb0:·2068·6176·6520·696e·636f·7272·6563·7420···have·incorrect· | |||
| 0003bfc0:·6861·7368·2028·6e6f·7420·696e·202f·6574··hash·(not·in·/et | |||
| 0003bfd0:·632c·2062·6563·6175·7365·206f·6620·7468··c,·because·of·th | |||
| 0003bfe0:·6520·7379·7374·656d·2072·656c·6174·6564··e·system·related | |||
| 0003bff0:·2063·6f6e·6669·6720·6669·6c65·7329·2061···config·files)·a | |||
| 0003c000:·6e64·2074·6865·6e20·6765·7420·6669·6c65··nd·then·get·file | |||
| 0003c010:·7320·6e61·6d65·730a·6669·6c65·735f·7769··s·names.files_wi | |||
| 0003c020:·7468·5f69·6e63·6f72·7265·6374·5f68·6173··th_incorrect_has | |||
| 0003c030:·683d·2224·2872·706d·202d·5661·202d·2d6e··h="$(rpm·-Va·--n | |||
| 0003c040:·6f63·6f6e·6669·6720·7c20·6772·6570·202d··oconfig·|·grep·- | |||
| 0003c050:·4520·275e·2e2e·3527·207c·2061·776b·2027··E·'^..5'·|·awk·' | |||
| 0003c060:·7b70·7269·6e74·2024·4e46·7d27·2029·220a··{print·$NF}'·)". | |||
| 0003c070:·0a23·2046·726f·6d20·6669·6c65·7320·6e61··.#·From·files·na | |||
| 0003c080:·6d65·7320·6765·7420·7061·636b·6167·6520··mes·get·package· | |||
| 0003c090:·6e61·6d65·7320·616e·6420·6368·616e·6765··names·and·change | |||
| 0003c0a0:·206e·6577·6c69·6e65·2074·6f20·7370·6163···newline·to·spac | |||
| 0003c0b0:·652c·2062·6563·6175·7365·2072·706d·2077··e,·because·rpm·w | |||
| 0003c0c0:·7269·7465·7320·6561·6368·2070·6163·6b61··rites·each·packa | |||
| 0003c0d0:·6765·2074·6f20·6e65·7720·6c69·6e65·0a70··ge·to·new·line.p | |||
| 0003c0e0:·6163·6b61·6765·735f·746f·5f72·6569·6e73··ackages_to_reins | |||
| 0003c0f0:·7461·6c6c·3d22·2428·7270·6d20·2d71·6620··tall="$(rpm·-qf· | |||
| 0003c100:·2466·696c·6573·5f77·6974·685f·696e·636f··$files_with_inco | |||
| 0003c110:·7272·6563·745f·6861·7368·207c·2074·7220··rrect_hash·|·tr· | |||
| 0003c120:·275c·6e27·2027·2027·2922·0a0a·0a79·756d··'\n'·'·')"...yum | |||
| 0003c130:·2072·6569·6e73·7461·6c6c·202d·7920·2470···reinstall·-y·$p | |||
| 0003c140:·6163·6b61·6765·735f·746f·5f72·6569·6e73··ackages_to_reins | |||
| 0003c150:·7461·6c6c·0a3c·2f63·6f64·653e·3c2f·7072··tall.</code></pr | |||
| 0003c160:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c170:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c180:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c190:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c1a0:·6172·6765·743d·2223·6964·6d35·3934·3722··arget="#idm5947" | |||
| 0003c1b0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c1c0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c1d0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c1e0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c1f0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c200:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c210:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003c220:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c230:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c240:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c250:·6522·2069·643d·2269·646d·3539·3437·223e··e"·id="idm5947"> | |||
| 0003c260:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c270:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c280:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c290:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c2a0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c2b0:·7869·7479·3a3c·2f74·683e·3c74·643e·6869··xity:</th><td>hi | |||
| 0003c2c0:·6768·3c2f·7464·3e3c·2f74·723e·3c74·723e··gh</td></tr><tr> | |||
| 0003c2d0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c2e0:·2f74·683e·3c74·643e·6d65·6469·756d·3c2f··/th><td>medium</ | |||
| 0003c2f0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c300:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003c310:·643e·7265·7374·7269·6374·3c2f·7464·3e3c··d>restrict</td>< | |||
| 0003c320:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c330:·3e3c·636f·6465·3e2d·206e·616d·653a·2027··><code>-·name:·' | |||
| 0003c340:·5365·7420·6661·6374·3a20·5061·636b·6167··Set·fact:·Packag | |||
| 0003c | 0003c350:·6520·6d61·6e61·6765·7220·7265·696e·7374··e·manager·reinst | ||
| 0003c360:·616c·6c20·636f·6d6d·616e·6420·2864·6e66··all·command·(dnf | |||
| 0003c370:·2927·0a20·2073·6574·5f66·6163·743a·0a20··)'.··set_fact:.· | |||
| 0003c380:·2020·2070·6163·6b61·6765·5f6d·616e·6167·····package_manag | |||
| 0003c390:·6572·5f72·6569·6e73·7461·6c6c·5f63·6d64··er_reinstall_cmd | |||
| 0003c3a0:·3a20·646e·6620·7265·696e·7374·616c·6c20··:·dnf·reinstall· | |||
| 0003c3b0:·2d79·0a20·2077·6865·6e3a·2061·6e73·6962··-y.··when:·ansib | |||
| 0003c0d0:·6c5f·636d·643a·2064·6e66·2072·6569·6e73··l_cmd:·dnf·reins | |||
| 0003c0e0:·7461·6c6c·202d·790a·2020·7768·656e·3a20··tall·-y.··when:· | |||
| 0003c0f0:·616e·7369·626c·655f·6469·7374·7269·6275··ansible_distribu | |||
| 0003c100:·7469·6f6e·203d·3d20·2246·6564·6f72·6122··tion·==·"Fedora" | |||
| 0003c110:·0a20·2074·6167·733a·0a20·202d·2043·4a49··.··tags:.··-·CJI | |||
| 0003c120:·532d·352e·3130·2e34·2e31·0a20·202d·2044··S-5.10.4.1.··-·D | |||
| 0003c130:·4953·412d·5354·4947·2d4f·4c30·372d·3030··ISA-STIG-OL07-00 | |||
| 0003c140:·2d30·3130·3032·300a·2020·2d20·4e49·5354··-010020.··-·NIST | |||
| 0003c150:·2d38·3030·2d31·3731·2d33·2e33·2e38·0a20··-800-171-3.3.8.· | |||
| Max diff block lines reached; 24094484/24117722 bytes (99.90%) of diff not shown. | |||
| Offset 14304, 16 lines modified | Offset 14304, 16 lines modified | ||
| 00037df0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037df0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037e00:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037e00:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037e10:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037e10:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037e20:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037e20:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037e30:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037e30:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037e40:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037e40:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e60:·2861·7320·6f66·2032·3032·3 | 00037e60:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037e70:·3 | 00037e70:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037e80:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037e80:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037e90:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037e90:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037ea0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037ea0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037eb0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037eb0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037ec0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037ec0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037ed0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037ed0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037ee0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037ee0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15175, 123 lines modified | Offset 15175, 123 lines modified | ||
| 0003b460:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b460:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b470:·3d22·2369·646d·3638·3130·2220·7461·6269··="#idm6810"·tabi | 0003b470:·3d22·2369·646d·3638·3130·2220·7461·6269··="#idm6810"·tabi | ||
| 0003b480:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b480:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b490:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b490:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b4a0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b4a0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b4b0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b4b0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b4c0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b4c0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b4d0:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b4d0:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003b4e0:·6 | 0003b4e0:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003b4f0:· | 0003b4f0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | ||
| 0003b500:· | 0003b500:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | ||
| 0003b510:· | 0003b510:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | ||
| 0003b520:·64 | 0003b520:·646d·3638·3130·223e·3c70·7265·3e3c·636f··dm6810"><pre><co | ||
| 0003b530:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003b540:·2d2d·6164·643d·6472·6163·7574·2d66·6970··--add=dracut-fip | |||
| 0003b550:·730a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··s.</code></pre>< | |||
| 0003b560:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003b570:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003b580:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003b590:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003b5a0:·6574·3d22·2369·646d·3638·3131·2220·7461··et="#idm6811"·ta | |||
| 0003b5b0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003b5c0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003b5d0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003b5e0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003b5f0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003b600:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003b610:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b620:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b | 0003b530:·6465·3e23·2052·656d·6564·6961·7469·6f6e··de>#·Remediation | ||
| 0003b540:·2069·7320·6170·706c·6963·6162·6c65·206f···is·applicable·o | |||
| 0003b550:·6e6c·7920·696e·2063·6572·7461·696e·2070··nly·in·certain·p | |||
| 0003b560:·6c61·7466·6f72·6d73·0a69·6620·5b20·2120··latforms.if·[·!· | |||
| 0003b570:·2d66·202f·2e64·6f63·6b65·7265·6e76·205d··-f·/.dockerenv·] | |||
| 0003b580:·2026·616d·703b·2661·6d70·3b20·5b20·2120···&&·[·!· | |||
| 0003b590:·2d66·202f·7275·6e2f·2e63·6f6e·7461·696e··-f·/run/.contain | |||
| 0003b5a0:·6572·656e·7620·5d3b·2074·6865·6e0a·0a69··erenv·];·then..i | |||
| 0003b5b0:·6620·2120·7270·6d20·2d71·202d·2d71·7569··f·!·rpm·-q·--qui | |||
| 0003b5c0:·6574·2022·6472·6163·7574·2d66·6970·7322··et·"dracut-fips" | |||
| 0003b5d0:·203b·2074·6865·6e0a·2020·2020·7975·6d20···;·then.····yum· | |||
| 0003b5e0:·696e·7374·616c·6c20·2d79·2022·6472·6163··install·-y·"drac | |||
| 0003b5f0:·7574·2d66·6970·7322·0a66·690a·0a65·6c73··ut-fips".fi..els | |||
| 0003b600:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003b610:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003b620:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003b630:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003b640:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003b650:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003b660:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003b670:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003b6 | 0003b680:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003b650:·6964·3d22·6964·6d36·3831·3122·3e3c·7461··id="idm6811"><ta | |||
| 0003b660:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b670:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b680:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b690:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003b6a0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003b6b0:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003b6c0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003b6 | 0003b690:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003b6a0:·6d36·3831·3122·2074·6162·696e·6465·783d··m6811"·tabindex= | |||
| 0003b6b0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003b6c0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003b6d0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003b6e0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003b6f0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003b700:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b710:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b720:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b730:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b740:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b750:·3638·3131·223e·3c74·6162·6c65·2063·6c61··6811"><table·cla | |||
| 0003b760:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b770:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b780:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b790:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b7a0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003b | 0003b7b0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003b | 0003b7c0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003b7 | 0003b7d0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | ||
| 0003b710:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003b720:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003b730:·6e61·6d65·3a20·456e·7375·7265·2064·7261··name:·Ensure·dra | |||
| 0003b740:·6375·742d·6669·7073·2069·7320·696e·7374··cut-fips·is·inst | |||
| 0003b750:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 0003b760:·0a20·2020·206e·616d·653a·2064·7261·6375··.····name:·dracu | |||
| 0003b770:·742d·6669·7073·0a20·2020·2073·7461·7465··t-fips.····state | |||
| 0003b780:·3a20·7072·6573·656e·740a·2020·7768·656e··:·present.··when | |||
| 0003b790:·3a0a·2020·2d20·616e·7369·626c·655f·7669··:.··-·ansible_vi | |||
| 0003b7a0:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003b7b0:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003b7c0:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003b7d0:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003b7e0:·636f·6e74·6169·6e65·7222·5d0a·2020·2d20··container"].··-· | |||
| 0003b7f0:·616e·7369·626c·655f·6469·7374·7269·6275··ansible_distribu | |||
| 0003b800:·7469·6f6e·203d·3d20·2752·6564·4861·7427··tion·==·'RedHat' | |||
| 0003b810:·0a20·2074·6167·733a·0a20·202d·2043·4a49··.··tags:.··-·CJI | |||
| 0003b820:·532d·352e·3130·2e31·2e32·0a20·202d·204e··S-5.10.1.2.··-·N | |||
| 0003b | 0003b7e0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003b7f0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003b800:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003b810:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003b820:·3e3c·636f·6465·3e2d·206e·616d·653a·2045··><code>-·name:·E | |||
| 0003b830:·6e73·7572·6520·6472·6163·7574·2d66·6970··nsure·dracut-fip | |||
| 0003b840:·7320·6973·2069·6e73·7461·6c6c·6564·0a20··s·is·installed.· | |||
| 0003b850:·2070·6163·6b61·6765·3a0a·2020·2020·6e61···package:.····na | |||
| 0003b860:·6d65·3a20·6472·6163·7574·2d66·6970·730a··me:·dracut-fips. | |||
| 0003b870:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | |||
| 0003b880:·6e74·0a20·2077·6865·6e3a·0a20·202d·2061··nt.··when:.··-·a | |||
| 0003b890:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| Max diff block lines reached; 4723851/4740741 bytes (99.64%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·[DRAFT]·Protection·Profile·for·General·Purpose·Operating·Systems | 44 | Profile·Title·[DRAFT]·Protection·Profile·for·General·Purpose·Operating·Systems |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:7 | 47 | ····*·cpe:/o:oracle:linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Network_Configuration_and_Firewalls | 57 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 79, 17 lines modified | Offset 79, 25 lines modified | ||
| 79 | To·enable·FIPS,·the·system·requires·that·the·dracut-fips·package·be·installed.·The·dracut-fips·package·can·be·installed·with·the·following·command: | 79 | To·enable·FIPS,·the·system·requires·that·the·dracut-fips·package·be·installed.·The·dracut-fips·package·can·be·installed·with·the·following·command: |
| 80 | $·sudo·yum·install·dracut-fips | 80 | $·sudo·yum·install·dracut-fips |
| 81 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 81 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 82 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 82 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 83 | Severity: ················medium | 83 | Severity: ················medium |
| 84 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed | 84 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed |
| 85 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 85 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 86 | Remediation_ | 86 | Remediation_Shell_script_⇲ |
| 87 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 88 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 87 | 89 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | |
| 90 | ····yum·install·-y·"dracut-fips" | ||
| 91 | fi | ||
| 92 | else | ||
| 93 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 94 | fi | ||
| 88 | Remediation_Ansible_snippet_⇲ | 95 | Remediation_Ansible_snippet_⇲ |
| 89 | Complexity:·low | 96 | Complexity:·low |
| 90 | Disruption:·low | 97 | Disruption:·low |
| 91 | Strategy:···enable | 98 | Strategy:···enable |
| 92 | -·name:·Ensure·dracut-fips·is·installed | 99 | -·name:·Ensure·dracut-fips·is·installed |
| 93 | ··package: | 100 | ··package: |
| 94 | ····name:·dracut-fips | 101 | ····name:·dracut-fips |
| Offset 109, 25 lines modified | Offset 117, 17 lines modified | ||
| 109 | ··-·NIST-800-53-SC-13 | 117 | ··-·NIST-800-53-SC-13 |
| 110 | ··-·enable_strategy | 118 | ··-·enable_strategy |
| 111 | ··-·low_complexity | 119 | ··-·low_complexity |
| 112 | ··-·low_disruption | 120 | ··-·low_disruption |
| 113 | ··-·medium_severity | 121 | ··-·medium_severity |
| 114 | ··-·no_reboot_needed | 122 | ··-·no_reboot_needed |
| 115 | ··-·package_dracut-fips_installed | 123 | ··-·package_dracut-fips_installed |
| 124 | Remediation_Anaconda_snippet_⇲ | ||
| 116 | Remediation_Shell_script_⇲ | ||
| 117 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 118 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 119 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 120 | ····yum·install·-y·"dracut-fips" | ||
| 121 | fi | ||
| 125 | package·--add=dracut-fips | ||
| 122 | else | ||
| 123 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 124 | fi | ||
| 125 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** | 126 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** |
| 126 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: | 127 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: |
| 127 | $·sudo·yum·install·dracut-fips | 128 | $·sudo·yum·install·dracut-fips |
| 128 | dracut·-f | 129 | dracut·-f |
| 129 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: | 130 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: |
| 130 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" | 131 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" |
| 131 | Finally,·rebuild·the·grub.cfg·file·by·using·the | 132 | Finally,·rebuild·the·grub.cfg·file·by·using·the |
| Offset 142, 17 lines modified | Offset 142, 80 lines modified | ||
| 142 | will·overwrite·the·existing·initramfs·file. | 142 | will·overwrite·the·existing·initramfs·file. |
| 143 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 143 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 144 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 144 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 145 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 145 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 146 | Severity: ················high | 146 | Severity: ················high |
| 147 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode | 147 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode |
| 148 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL07-00-021350,·SV-221758r603260_rule | 148 | Identifiers·and·References·References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL07-00-021350,·SV-221758r603260_rule |
| 149 | Remediation_ | 149 | Remediation_Shell_script_⇲ |
| 150 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 151 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·rpm·--quiet·-q·grub2-common;·};·then | ||
| 150 | 152 | #·prelink·not·installed | |
| 153 | if·test·-e·/etc/sysconfig/prelink·-o·-e·/usr/sbin/prelink;·then | ||
| 154 | ····if·grep·-q·^PRELINKING·/etc/sysconfig/prelink | ||
| 155 | ····then | ||
| 156 | ········sed·-i·'s/^PRELINKING[:blank:]*=[:blank:]*[:alpha:]*/PRELINKING=no/'·/etc/sysconfig/prelink | ||
| 157 | ····else | ||
| 158 | ········printf·'\n'·>>·/etc/sysconfig/prelink | ||
| 159 | ········printf·'%s\n'·'#·Set·PRELINKING=no·per·security·requirements'·'PRELINKING=no'·>>·/etc/sysconfig/prelink | ||
| 160 | ····fi | ||
| 161 | ····#·Undo·previous·prelink·changes·to·binaries·if·prelink·is·available. | ||
| 162 | ····if·test·-x·/usr/sbin/prelink;·then | ||
| 163 | ········/usr/sbin/prelink·-ua | ||
| 164 | ····fi | ||
| 165 | fi | ||
| 166 | if·grep·-q·-m1·-o·aes·/proc/cpuinfo;·then | ||
| 167 | » if·!·rpm·-q·--quiet·"dracut-fips-aesni"·;·then | ||
| 168 | ····yum·install·-y·"dracut-fips-aesni" | ||
| 169 | fi | ||
| 170 | fi | ||
| 171 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 172 | ····yum·install·-y·"dracut-fips" | ||
| 173 | fi | ||
| 174 | dracut·-f | ||
| 175 | #·Correct·the·form·of·default·kernel·command·line·in··grub | ||
| 176 | if·grep·-q·'^GRUB_CMDLINE_LINUX=.*fips=.*"'··/etc/default/grub;·then | ||
| 177 | » #·modify·the·GRUB·command-line·if·a·fips=·arg·already·exists | ||
| 178 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)fips=[^[:space:]]*\(.*"\)/\1·fips=1·\2/'··/etc/default/grub | ||
| 179 | else | ||
| 180 | » #·no·existing·fips=arg·is·present,·append·it | ||
| 181 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)"/\1·fips=1"/'··/etc/default/grub | ||
| 182 | fi | ||
| 183 | #·Get·the·UUID·of·the·device·mounted·at·root·(/). | ||
| 184 | ROOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/) | ||
| 185 | #·Get·the·UUID·of·the·device·mounted·at·/boot. | ||
| 186 | BOOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/boot) | ||
| 187 | if·[·"${ROOT_UUID}"·==·"${BOOT_UUID}"·];·then | ||
| 188 | » #·root·UUID·same·as·boot·UUID,·so·do·not·modify·the·GRUB·command-line·or·add·boot·arg·to·kernel·command·line | ||
| 189 | » #·Correct·the·form·of·kernel·command·line·for·each·installed·kernel·in·the·bootloader | ||
| 190 | » /sbin/grubby·--update-kernel=ALL·--args="fips=1" | ||
| Max diff block lines reached; 613911/623540 bytes (98.46%) of diff not shown. | |||
| Offset 14280, 16 lines modified | Offset 14280, 16 lines modified | ||
| 00037c70:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037c70:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037c80:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037c80:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037c90:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037c90:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037ca0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037ca0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037cb0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037cb0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037cc0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037cc0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037cd0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037cd0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ce0:·2020·2861·7320·6f66·2032·3032·3 | 00037ce0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037cf0:·2d32·3 | 00037cf0:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037d00:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037d00:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037d10:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037d10:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037d20:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037d20:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037d30:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037d30:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037d40:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037d40:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037d50:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037d50:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037d60:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037d60:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15214, 334 lines modified | Offset 15214, 334 lines modified | ||
| 0003b6d0:·7267·6574·3d22·2369·646d·3539·3436·2220··rget="#idm5946"· | 0003b6d0:·7267·6574·3d22·2369·646d·3539·3436·2220··rget="#idm5946"· | ||
| 0003b6e0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003b6e0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003b6f0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003b6f0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003b700:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003b700:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003b710:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003b710:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003b720:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003b720:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003b730:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003b730:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003b740:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003b750:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b760:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b770:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003b780:·643d·2269·646d·3539·3436·223e·3c70·7265··d="idm5946"><pre | |||
| 0003b790:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003b7a0:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003b7b0:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003b7c0:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003b7d0:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003b7e0:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003b7f0:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003b800:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003b810:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003b820:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003b830:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003b840:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003b850:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003b860:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003b870:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003b740:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003b750:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003b760:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003b770:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003b780:·2220·6964·3d22·6964·6d35·3934·3622·3e3c··"·id="idm5946">< | |||
| 0003b790:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003b7a0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003b7b0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003b7c0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003b7d0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003b7e0:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003b7f0:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003b800:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003b810:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003b820:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003b830:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003b840:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003b850:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003b860:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003b870:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003b880:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003b890:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003b8a0:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003b8 | 0003b880:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003b890:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | |||
| 0003b8a0:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003b8b0:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003b8c0:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003b8d0:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003b8e0:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003b8f0:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003b8c0:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003b8d0:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003b8e0:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003b8f0:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003b900:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003b910:·733a·0a20·202d·2043·4a49·532d·352e·3130··s:.··-·CJIS-5.10 | |||
| 0003b920:·2e34·2e31·0a20·202d·2044·4953·412d·5354··.4.1.··-·DISA-ST | |||
| 0003b930:·4947·2d4f·4c30·372d·3030·2d30·3130·3032··IG-OL07-00-01002 | |||
| 0003b940:·300a·2020·2d20·4e49·5354·2d38·3030·2d31··0.··-·NIST-800-1 | |||
| 0003b950:·3731·2d33·2e33·2e38·0a20·202d·204e·4953··71-3.3.8.··-·NIS | |||
| 0003b960:·542d·3830·302d·3137·312d·332e·342e·310a··T-800-171-3.4.1. | |||
| 0003b970:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003b980:·4155·2d39·2833·290a·2020·2d20·4e49·5354··AU-9(3).··-·NIST | |||
| 0003b990:·2d38·3030·2d35·332d·434d·2d36·2863·290a··-800-53-CM-6(c). | |||
| 0003b9a0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003b9b0:·434d·2d36·2864·290a·2020·2d20·4e49·5354··CM-6(d).··-·NIST | |||
| 0003b9c0:·2d38·3030·2d35·332d·5349·2d37·0a20·202d··-800-53-SI-7.··- | |||
| 0003b9d0:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003b9e0:·3728·3129·0a20·202d·204e·4953·542d·3830··7(1).··-·NIST-80 | |||
| 0003b9f0:·302d·3533·2d53·492d·3728·3629·0a20·202d··0-53-SI-7(6).··- | |||
| 0003ba00:·2050·4349·2d44·5353·2d52·6571·2d31·312e···PCI-DSS-Req-11. | |||
| 0003ba10:·350a·2020·2d20·6869·6768·5f63·6f6d·706c··5.··-·high_compl | |||
| 0003ba20:·6578·6974·790a·2020·2d20·6869·6768·5f73··exity.··-·high_s | |||
| 0003ba30:·6576·6572·6974·790a·2020·2d20·6d65·6469··everity.··-·medi | |||
| 0003ba40:·756d·5f64·6973·7275·7074·696f·6e0a·2020··um_disruption.·· | |||
| 0003ba50:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003ba60:·6564·0a20·202d·2072·6573·7472·6963·745f··ed.··-·restrict_ | |||
| 0003ba70:·7374·7261·7465·6779·0a20·202d·2072·706d··strategy.··-·rpm | |||
| 0003ba80:·5f76·6572·6966·795f·6861·7368·6573·0a0a··_verify_hashes.. | |||
| 0003ba90:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003baa0:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003bab0:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003bac0:·6d61·6e64·2028·7975·6d29·270a·2020·7365··mand·(yum)'.··se | |||
| 0003bad0:·745f·6661·6374·3a0a·2020·2020·7061·636b··t_fact:.····pack | |||
| 0003bae0:·6167·655f·6d61·6e61·6765·725f·7265·696e··age_manager_rein | |||
| 0003baf0:·7374·616c·6c5f·636d·643a·2079·756d·2072··stall_cmd:·yum·r | |||
| 0003bb00:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003bb10:·656e·3a20·2861·6e73·6962·6c65·5f64·6973··en:·(ansible_dis | |||
| 0003bb20:·7472·6962·7574·696f·6e20·3d3d·2022·5265··tribution·==·"Re | |||
| 0003bb30:·6448·6174·2220·6f72·2061·6e73·6962·6c65··dHat"·or·ansible | |||
| 0003bb40:·5f64·6973·7472·6962·7574·696f·6e20·3d3d··_distribution·== | |||
| 0003bb50:·2022·4365·6e74·4f53·2220·6f72·2061·6e73···"CentOS"·or·ans | |||
| 0003bb60:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003bb70:·6e0a·2020·2020·3d3d·2022·4f72·6163·6c65··n.····==·"Oracle | |||
| 0003bb80:·4c69·6e75·7822·290a·2020·7461·6773·3a0a··Linux").··tags:. | |||
| 0003bb90:·2020·2d20·434a·4953·2d35·2e31·302e·342e····-·CJIS-5.10.4. | |||
| 0003bba0:·310a·2020·2d20·4449·5341·2d53·5449·472d··1.··-·DISA-STIG- | |||
| 0003bbb0:·4f4c·3037·2d30·302d·3031·3030·3230·0a20··OL07-00-010020.· | |||
| 0003bbc0:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003bbd0:·332e·332e·380a·2020·2d20·4e49·5354·2d38··3.3.8.··-·NIST-8 | |||
| 0003bbe0:·3030·2d31·3731·2d33·2e34·2e31·0a20·202d··00-171-3.4.1.··- | |||
| 0003bbf0:·204e·4953·542d·3830·302d·3533·2d41·552d···NIST-800-53-AU- | |||
| Max diff block lines reached; 8475303/8498817 bytes (99.72%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·Draft·for·Oracle·Linux·7 | 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·Draft·for·Oracle·Linux·7 |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:oracle:linux:7 | 41 | ····*·cpe:/o:oracle:linux:7 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 79, 14 lines modified | Offset 79, 24 lines modified | ||
| 79 | $·sudo·yum·reinstall·PACKAGENAME | 79 | $·sudo·yum·reinstall·PACKAGENAME |
| 80 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 80 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 81 | $·sudo·rpm·-Uvh·PACKAGENAME | 81 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 82 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 82 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 83 | Severity: ················high | 83 | Severity: ················high |
| 84 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 84 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 85 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule | 85 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule |
| 86 | Remediation_Shell_script_⇲ | ||
| 87 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 88 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 89 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 90 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 91 | yum·reinstall·-y·$packages_to_reinstall | ||
| 86 | Remediation_Ansible_snippet_⇲ | 92 | Remediation_Ansible_snippet_⇲ |
| 87 | Complexity:·high | 93 | Complexity:·high |
| 88 | Disruption:·medium | 94 | Disruption:·medium |
| 89 | Strategy:···restrict | 95 | Strategy:···restrict |
| 90 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 96 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 91 | ··set_fact: | 97 | ··set_fact: |
| 92 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 98 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 236, 37 lines modified | Offset 246, 56 lines modified | ||
| 236 | ··-·PCI-DSS-Req-11.5 | 246 | ··-·PCI-DSS-Req-11.5 |
| 237 | ··-·high_complexity | 247 | ··-·high_complexity |
| 238 | ··-·high_severity | 248 | ··-·high_severity |
| 239 | ··-·medium_disruption | 249 | ··-·medium_disruption |
| 240 | ··-·no_reboot_needed | 250 | ··-·no_reboot_needed |
| 241 | ··-·restrict_strategy | 251 | ··-·restrict_strategy |
| 242 | ··-·rpm_verify_hashes | 252 | ··-·rpm_verify_hashes |
| 243 | Remediation_Shell_script_⇲ | ||
| 244 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 245 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 246 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 247 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 248 | yum·reinstall·-y·$packages_to_reinstall | ||
| 249 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 253 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 250 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 254 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 251 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 255 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 252 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 256 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 253 | $·rpm·-qf·FILENAME | 257 | $·rpm·-qf·FILENAME |
| 254 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 258 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 255 | $·sudo·rpm·--setperms·PACKAGENAME | 259 | $·sudo·rpm·--setperms·PACKAGENAME |
| 256 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 260 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 257 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 261 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 258 | Severity: ················high | 262 | Severity: ················high |
| 259 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 263 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 260 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule | 264 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule |
| 265 | Remediation_Shell_script_⇲ | ||
| 266 | Complexity:·high | ||
| 267 | Disruption:·medium | ||
| 268 | Strategy:···restrict | ||
| 269 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 270 | declare·-A·SETPERMS_RPM_DICT | ||
| 271 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 272 | #·is·expected·by·the·RPM·database | ||
| 273 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 274 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 275 | do | ||
| 276 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 277 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 278 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 279 | ········do | ||
| 280 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 281 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 282 | ········done | ||
| 283 | done | ||
| 284 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 285 | #·correct·values | ||
| 286 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 287 | do | ||
| 288 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 289 | done | ||
| 261 | Remediation_Ansible_snippet_⇲ | 290 | Remediation_Ansible_snippet_⇲ |
| 262 | Complexity:·high | 291 | Complexity:·high |
| 263 | Disruption:·medium | 292 | Disruption:·medium |
| 264 | Strategy:···restrict | 293 | Strategy:···restrict |
| 265 | -·name:·Read·list·of·files·with·incorrect·permissions | 294 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 266 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 295 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 267 | ····--nocaps·--nolinkto·--nouser·--nogroup | 296 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 343, 69 lines modified | Offset 372, 48 lines modified | ||
| 343 | ··-·PCI-DSS-Req-11.5 | 372 | ··-·PCI-DSS-Req-11.5 |
| 344 | ··-·high_complexity | 373 | ··-·high_complexity |
| 345 | ··-·high_severity | 374 | ··-·high_severity |
| 346 | ··-·medium_disruption | 375 | ··-·medium_disruption |
| 347 | ··-·no_reboot_needed | 376 | ··-·no_reboot_needed |
| 348 | ··-·restrict_strategy | 377 | ··-·restrict_strategy |
| 349 | ··-·rpm_verify_permissions | 378 | ··-·rpm_verify_permissions |
| 350 | Remediation_Shell_script_⇲ | ||
| 351 | Complexity:·high | ||
| 352 | Disruption:·medium | ||
| 353 | Strategy:···restrict | ||
| 354 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 355 | declare·-A·SETPERMS_RPM_DICT | ||
| 356 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 357 | #·is·expected·by·the·RPM·database | ||
| 358 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 727773/736010 bytes (98.88%) of diff not shown. | |||
| Offset 14289, 15 lines modified | Offset 14289, 15 lines modified | ||
| 00037d00:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037d00:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037d10:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037d10:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037d20:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037d20:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037d30:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037d30:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037d40:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037d40:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037d50:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037d50:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037d60:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037d60:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037d70:·206f·6620·3230·323 | 00037d70:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037d80:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d80:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d90:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037d90:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037da0:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037da0:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037db0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037db0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037dc0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037dc0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037dd0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037dd0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037de0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037de0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 14653, 168 lines modified | Offset 14653, 168 lines modified | ||
| 000393c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 000393c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 000393d0:·3d22·2369·646d·3936·3637·2220·7461·6269··="#idm9667"·tabi | 000393d0:·3d22·2369·646d·3936·3637·2220·7461·6269··="#idm9667"·tabi | ||
| 000393e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 000393e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 000393f0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 000393f0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 00039400:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 00039400:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 00039410:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 00039410:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 00039420:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 00039420:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 00039430:·223e·5265·6d65·6469·6174·696f·6e20· | 00039430:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | ||
| 00039440:· | 00039440:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | ||
| 00039450:· | 00039450:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 00039460:· | 00039460:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 00039470:· | 00039470:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 00039480:· | 00039480:·2269·646d·3936·3637·223e·3c74·6162·6c65··"idm9667"><table | ||
| 00039490:· | 00039490:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 000394a0:· | 000394a0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 000394b0:·6 | 000394b0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 000394c0:· | 000394c0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 000394d0:· | 000394d0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 000394e0:· | 000394e0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 000394f0:· | 000394f0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 00039500:· | 00039500:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 00039510:· | 00039510:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 00039520:· | 00039520:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 00039530:· | 00039530:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | ||
| 00039540:· | 00039540:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | ||
| 00039550:·653e·3c70·7265·3e3c·636f·6465·3e0a·7061··e><pre><code>.pa | |||
| 00039560:·636b·6167·6520·2d2d·6164·643d·676c·6962··ckage·--add=glib | |||
| 00039570:·630a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··c.</code></pre>< | |||
| 00039580:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 00039590:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 000395a0:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 000395b0:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 000395c0:·6574·3d22·2369·646d·3936·3638·2220·7461··et="#idm9668"·ta | |||
| 000395d0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 000395e0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 000395f0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 00039600:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 00039610:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 00039620:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 00039630:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 00039640:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 00039650:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 00039660:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 00039670:·643d·2269·646d·3936·3638·223e·3c74·6162··d="idm9668"><tab | |||
| 00039680:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 00039690:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 000396a0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 000396b0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 000396c0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 000396d0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 000396e0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 000396f0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 00039700:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 00039710:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 00039720:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 00039730:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 00039 | 00039550:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | ||
| 00039 | 00039560:·6465·2069·6e73·7461·6c6c·5f67·6c69·6263··de·install_glibc | ||
| 00039 | 00039570:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | ||
| 00039 | 00039580:·676c·6962·6320·7b0a·2020·7061·636b·6167··glibc·{.··packag | ||
| 00039 | 00039590:·6520·7b20·2767·6c69·6263·273a·0a20·2020··e·{·'glibc':.··· | ||
| 00039 | 000395a0:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | ||
| 00039 | 000395b0:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | ||
| 00039 | 000395c0:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | ||
| 00039 | 000395d0:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | ||
| 00039 | 000395e0:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | ||
| 00039 | 000395f0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | ||
| 00039 | 00039600:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 00039 | 00039610:·743d·2223·6964·6d39·3636·3822·2074·6162··t="#idm9668"·tab | ||
| 00039 | 00039620:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 00039 | 00039630:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 00039 | 00039640:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 00039 | 00039650:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 00039 | 00039660:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 00039 | 00039670:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 00039870:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 00039880:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 00039 | 00039680:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | ||
| 00039690:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 000396a0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 000396b0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 000396c0:·6964·6d39·3636·3822·3e3c·7461·626c·6520··idm9668"><table· | |||
| 000396d0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 000396e0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 000396f0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 00039700:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 00039710:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 00039720:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 00039730:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 00039740:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 00039750:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 00039760:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 00039770:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 00039780:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 00039790:·7072·653e·3c63·6f64·653e·0a69·6620·2120··pre><code>.if·!· | |||
| 000397a0:·7270·6d20·2d71·202d·2d71·7569·6574·2022··rpm·-q·--quiet·" | |||
| 000397b0:·676c·6962·6322·203b·2074·6865·6e0a·2020··glibc"·;·then.·· | |||
| 000397c0:·2020·7975·6d20·696e·7374·616c·6c20·2d79····yum·install·-y | |||
| 000397d0:·2022·676c·6962·6322·0a66·690a·3c2f·636f···"glibc".fi.</co | |||
| 000397e0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 000397f0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 00039800:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 000398 | 00039810:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | ||
| 000398b0:·2069·643d·2269·646d·3936·3639·223e·3c74···id="idm9669"><t | |||
| 000398c0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 000398d0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 000398e0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 000398f0:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 00039900:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 00039910:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 00039920:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| Max diff block lines reached; 168832/181720 bytes (92.91%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | *****·Profile·Information·***** | 39 | *****·Profile·Information·***** |
| 40 | Profile·Title·Security·Profile·of·Oracle·Linux·7·for·SAP | 40 | Profile·Title·Security·Profile·of·Oracle·Linux·7·for·SAP |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_sap | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_sap |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:oracle:linux:7 | 43 | ····*·cpe:/o:oracle:linux:7 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·File_Permissions_and_Masks | 50 | ·········2.·File_Permissions_and_Masks |
| 51 | ···2.·Services | 51 | ···2.·Services |
| 52 | ·········1.·Obsolete_Services | 52 | ·········1.·Obsolete_Services |
| 53 | *****·Checklist·***** | 53 | *****·Checklist·***** |
| Offset 65, 31 lines modified | Offset 65, 33 lines modified | ||
| 65 | minimum·requirement·on·glibc.·The·glibc·package·can·be·installed·with·the·following·command: | 65 | minimum·requirement·on·glibc.·The·glibc·package·can·be·installed·with·the·following·command: |
| 66 | $·sudo·yum·install·glibc | 66 | $·sudo·yum·install·glibc |
| 67 | Rationale:·················The·glibc·package·contains·standard·C·and·math·libraries·used·by·multiple·programs·on·Linux.·The·glibc·shipped·with·first·release·of·each | 67 | Rationale:·················The·glibc·package·contains·standard·C·and·math·libraries·used·by·multiple·programs·on·Linux.·The·glibc·shipped·with·first·release·of·each |
| 68 | ···························major·Linux·version·is·often·not·sufficient·for·SAP.·An·update·is·required·after·the·first·OS·installation. | 68 | ···························major·Linux·version·is·often·not·sufficient·for·SAP.·An·update·is·required·after·the·first·OS·installation. |
| 69 | Severity: ················medium | 69 | Severity: ················medium |
| 70 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_glibc_installed | 70 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_glibc_installed |
| 71 | Identifiers·and·References | 71 | Identifiers·and·References |
| 72 | Remediation_Anaconda_snippet_⇲ | ||
| 73 | Complexity:·low | ||
| 74 | Disruption:·low | ||
| 75 | Strategy:···enable | ||
| 76 | package·--add=glibc | ||
| 77 | Remediation_Puppet_snippet_⇲ | 72 | Remediation_Puppet_snippet_⇲ |
| 78 | Complexity:·low | 73 | Complexity:·low |
| 79 | Disruption:·low | 74 | Disruption:·low |
| 80 | Strategy:···enable | 75 | Strategy:···enable |
| 81 | include·install_glibc | 76 | include·install_glibc |
| 82 | class·install_glibc·{ | 77 | class·install_glibc·{ |
| 83 | ··package·{·'glibc': | 78 | ··package·{·'glibc': |
| 84 | ····ensure·=>·'installed', | 79 | ····ensure·=>·'installed', |
| 85 | ··} | 80 | ··} |
| 86 | } | 81 | } |
| 82 | Remediation_Shell_script_⇲ | ||
| 83 | Complexity:·low | ||
| 84 | Disruption:·low | ||
| 85 | Strategy:···enable | ||
| 86 | if·!·rpm·-q·--quiet·"glibc"·;·then | ||
| 87 | ····yum·install·-y·"glibc" | ||
| 88 | fi | ||
| 87 | Remediation_Ansible_snippet_⇲ | 89 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·low | 90 | Complexity:·low |
| 89 | Disruption:·low | 91 | Disruption:·low |
| 90 | Strategy:···enable | 92 | Strategy:···enable |
| 91 | -·name:·Ensure·glibc·is·installed | 93 | -·name:·Ensure·glibc·is·installed |
| 92 | ··package: | 94 | ··package: |
| 93 | ····name:·glibc | 95 | ····name:·glibc |
| Offset 102, 48 lines modified | Offset 104, 48 lines modified | ||
| 102 | ··-·no_reboot_needed | 104 | ··-·no_reboot_needed |
| 103 | ··-·package_glibc_installed | 105 | ··-·package_glibc_installed |
| 104 | Remediation_OSBuild_Blueprint_snippet_⇲ | 106 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 105 | [[packages]] | 107 | [[packages]] |
| 106 | name·=·"glibc" | 108 | name·=·"glibc" |
| 107 | version·=·"*" | 109 | version·=·"*" |
| 108 | Remediation_ | 110 | Remediation_Anaconda_snippet_⇲ |
| 109 | Complexity:·low | 111 | Complexity:·low |
| 110 | Disruption:·low | 112 | Disruption:·low |
| 111 | Strategy:···enable | 113 | Strategy:···enable |
| 114 | package·--add=glibc | ||
| 112 | if·!·rpm·-q·--quiet·"glibc"·;·then | ||
| 113 | ····yum·install·-y·"glibc" | ||
| 114 | fi | ||
| 115 | ***·Rule ·Package·uuidd·Installed· [ref]·*** | 115 | ***·Rule ·Package·uuidd·Installed· [ref]·*** |
| 116 | The·package·uuidd·is·not·installed·on·normal·Linux·distribution·by·default.·Applications·require·this·package·to·avoid·database·inconsistences·caused·by·duplicated | 116 | The·package·uuidd·is·not·installed·on·normal·Linux·distribution·by·default.·Applications·require·this·package·to·avoid·database·inconsistences·caused·by·duplicated |
| 117 | UUIDs.·Especially·in·banking·services·with·SAP·where·massive·UUIDs·are·created·in·a·short·time·period,·it·is·important·to·install·the·package·uuidd.·More·information | 117 | UUIDs.·Especially·in·banking·services·with·SAP·where·massive·UUIDs·are·created·in·a·short·time·period,·it·is·important·to·install·the·package·uuidd.·More·information |
| 118 | can·be·found·in·SAP·note·1391070.·The·uuidd·package·can·be·installed·with·the·following·command: | 118 | can·be·found·in·SAP·note·1391070.·The·uuidd·package·can·be·installed·with·the·following·command: |
| 119 | $·sudo·yum·install·uuidd | 119 | $·sudo·yum·install·uuidd |
| 120 | Rationale:·················The·uuidd·package·contains·a·userspace·daemon·(uuidd)·which·is·used·to·generate·unique·identifiers·even·at·very·high·rates·on·SMP·systems. | 120 | Rationale:·················The·uuidd·package·contains·a·userspace·daemon·(uuidd)·which·is·used·to·generate·unique·identifiers·even·at·very·high·rates·on·SMP·systems. |
| 121 | Severity: ················medium | 121 | Severity: ················medium |
| 122 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_uuidd_installed | 122 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_uuidd_installed |
| 123 | Identifiers·and·References | 123 | Identifiers·and·References |
| 124 | Remediation_Anaconda_snippet_⇲ | ||
| 125 | Complexity:·low | ||
| 126 | Disruption:·low | ||
| 127 | Strategy:···enable | ||
| 128 | package·--add=uuidd | ||
| 129 | Remediation_Puppet_snippet_⇲ | 124 | Remediation_Puppet_snippet_⇲ |
| 130 | Complexity:·low | 125 | Complexity:·low |
| 131 | Disruption:·low | 126 | Disruption:·low |
| 132 | Strategy:···enable | 127 | Strategy:···enable |
| 133 | include·install_uuidd | 128 | include·install_uuidd |
| 134 | class·install_uuidd·{ | 129 | class·install_uuidd·{ |
| 135 | ··package·{·'uuidd': | 130 | ··package·{·'uuidd': |
| 136 | ····ensure·=>·'installed', | 131 | ····ensure·=>·'installed', |
| 137 | ··} | 132 | ··} |
| 138 | } | 133 | } |
| 134 | Remediation_Shell_script_⇲ | ||
| 135 | Complexity:·low | ||
| 136 | Disruption:·low | ||
| 137 | Strategy:···enable | ||
| 138 | if·!·rpm·-q·--quiet·"uuidd"·;·then | ||
| 139 | ····yum·install·-y·"uuidd" | ||
| 140 | fi | ||
| 139 | Remediation_Ansible_snippet_⇲ | 141 | Remediation_Ansible_snippet_⇲ |
| 140 | Complexity:·low | 142 | Complexity:·low |
| 141 | Disruption:·low | 143 | Disruption:·low |
| 142 | Strategy:···enable | 144 | Strategy:···enable |
| 143 | -·name:·Ensure·uuidd·is·installed | 145 | -·name:·Ensure·uuidd·is·installed |
| 144 | ··package: | 146 | ··package: |
| 145 | ····name:·uuidd | 147 | ····name:·uuidd |
| Offset 156, 22 lines modified | Offset 158, 20 lines modified | ||
| 156 | ··-·no_reboot_needed | 158 | ··-·no_reboot_needed |
| 157 | ··-·package_uuidd_installed | 159 | ··-·package_uuidd_installed |
| 158 | Remediation_OSBuild_Blueprint_snippet_⇲ | 160 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 159 | [[packages]] | 161 | [[packages]] |
| 160 | name·=·"uuidd" | 162 | name·=·"uuidd" |
| 161 | version·=·"*" | 163 | version·=·"*" |
| 162 | Remediation_ | 164 | Remediation_Anaconda_snippet_⇲ |
| 163 | Complexity:·low | 165 | Complexity:·low |
| 164 | Disruption:·low | 166 | Disruption:·low |
| 165 | Strategy:···enable | 167 | Strategy:···enable |
| 168 | package·--add=uuidd | ||
| Max diff block lines reached; 16609/20595 bytes (80.65%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037ce0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037ce0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037cf0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037cf0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037d00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037d00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d30:·7320·6f66·2032·3032·3 | 00037d30:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037da0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037da0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15206, 334 lines modified | Offset 15206, 334 lines modified | ||
| 0003b650:·612d·7461·7267·6574·3d22·2369·646d·3539··a-target="#idm59 | 0003b650:·612d·7461·7267·6574·3d22·2369·646d·3539··a-target="#idm59 | ||
| 0003b660:·3436·2220·7461·6269·6e64·6578·3d22·3022··46"·tabindex="0" | 0003b660:·3436·2220·7461·6269·6e64·6578·3d22·3022··46"·tabindex="0" | ||
| 0003b670:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003b670:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003b680:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003b680:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003b690:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003b690:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003b6a0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003b6a0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003b6b0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003b6b0:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003b6c0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003b6d0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003b6e0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003b6f0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003b700:·6170·7365·2220·6964·3d22·6964·6d35·3934··apse"·id="idm594 | |||
| 0003b710:·3622·3e3c·7461·626c·6520·636c·6173·733d··6"><table·class= | |||
| 0003b720:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003b730:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003b740:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003b750:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003b760:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003b770:·3e68·6967·683c·2f74·643e·3c2f·7472·3e3c··>high</td></tr>< | |||
| 0003b780:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003b790:·6e3a·3c2f·7468·3e3c·7464·3e6d·6564·6975··n:</th><td>mediu | |||
| 0003b7a0:·6d3c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··m</td></tr><tr>< | |||
| 0003b7b0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003b7c0:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003b7d0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003b7e0:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003b7f0:·3a20·2753·6574·2066·6163·743a·2050·6163··:·'Set·fact:·Pac | |||
| 0003b800:·6b61·6765·206d·616e·6167·6572·2072·6569··kage·manager·rei | |||
| 0003b810:·6e73·7461·6c6c·2063·6f6d·6d61·6e64·2028··nstall·command·( | |||
| 0003b820:·646e·6629·270a·2020·7365·745f·6661·6374··dnf)'.··set_fact | |||
| 0003b | 0003b6c0:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | ||
| 0003b6d0:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003b6e0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003b6f0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003b700:·6522·2069·643d·2269·646d·3539·3436·223e··e"·id="idm5946"> | |||
| 0003b710:·3c70·7265·3e3c·636f·6465·3e0a·2320·4669··<pre><code>.#·Fi | |||
| 0003b720:·6e64·2077·6869·6368·2066·696c·6573·2068··nd·which·files·h | |||
| 0003b730:·6176·6520·696e·636f·7272·6563·7420·6861··ave·incorrect·ha | |||
| 0003b740:·7368·2028·6e6f·7420·696e·202f·6574·632c··sh·(not·in·/etc, | |||
| 0003b750:·2062·6563·6175·7365·206f·6620·7468·6520···because·of·the· | |||
| 0003b760:·7379·7374·656d·2072·656c·6174·6564·2063··system·related·c | |||
| 0003b770:·6f6e·6669·6720·6669·6c65·7329·2061·6e64··onfig·files)·and | |||
| 0003b780:·2074·6865·6e20·6765·7420·6669·6c65·7320···then·get·files· | |||
| 0003b790:·6e61·6d65·730a·6669·6c65·735f·7769·7468··names.files_with | |||
| 0003b7a0:·5f69·6e63·6f72·7265·6374·5f68·6173·683d··_incorrect_hash= | |||
| 0003b7b0:·2224·2872·706d·202d·5661·202d·2d6e·6f63··"$(rpm·-Va·--noc | |||
| 0003b7c0:·6f6e·6669·6720·7c20·6772·6570·202d·4520··onfig·|·grep·-E· | |||
| 0003b7d0:·275e·2e2e·3527·207c·2061·776b·2027·7b70··'^..5'·|·awk·'{p | |||
| 0003b7e0:·7269·6e74·2024·4e46·7d27·2029·220a·0a23··rint·$NF}'·)"..# | |||
| 0003b7f0:·2046·726f·6d20·6669·6c65·7320·6e61·6d65···From·files·name | |||
| 0003b800:·7320·6765·7420·7061·636b·6167·6520·6e61··s·get·package·na | |||
| 0003b810:·6d65·7320·616e·6420·6368·616e·6765·206e··mes·and·change·n | |||
| 0003b820:·6577·6c69·6e65·2074·6f20·7370·6163·652c··ewline·to·space, | |||
| 0003b830:·2062·6563·6175·7365·2072·706d·2077·7269···because·rpm·wri | |||
| 0003b840:·7465·7320·6561·6368·2070·6163·6b61·6765··tes·each·package | |||
| 0003b850:·2074·6f20·6e65·7720·6c69·6e65·0a70·6163···to·new·line.pac | |||
| 0003b860:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003b870:·6c6c·3d22·2428·7270·6d20·2d71·6620·2466··ll="$(rpm·-qf·$f | |||
| 0003b880:·696c·6573·5f77·6974·685f·696e·636f·7272··iles_with_incorr | |||
| 0003b890:·6563·745f·6861·7368·207c·2074·7220·275c··ect_hash·|·tr·'\ | |||
| 0003b8a0:·6e27·2027·2027·2922·0a0a·0a79·756d·2072··n'·'·')"...yum·r | |||
| 0003b8b0:·6569·6e73·7461·6c6c·202d·7920·2470·6163··einstall·-y·$pac | |||
| 0003b8c0:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003b8d0:·6c6c·0a3c·2f63·6f64·653e·3c2f·7072·653e··ll.</code></pre> | |||
| 0003b8e0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003b8f0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003b900:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003b910:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003b920:·6765·743d·2223·6964·6d35·3934·3722·2074··get="#idm5947"·t | |||
| 0003b930:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003b940:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003b950:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003b960:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003b970:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003b980:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003b990:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003b9a0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003b9b0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003b9c0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003b9d0:·2069·643d·2269·646d·3539·3437·223e·3c74···id="idm5947"><t | |||
| 0003b9e0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003b9f0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003ba00:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003ba10:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003ba20:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003ba30:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003ba40:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003ba50:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003ba60:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003ba70:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003ba80:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003ba90:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003baa0:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003bab0:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003bac0:·7420·6661·6374·3a20·5061·636b·6167·6520··t·fact:·Package· | |||
| 0003b | 0003bad0:·6d61·6e61·6765·7220·7265·696e·7374·616c··manager·reinstal | ||
| 0003bae0:·6c20·636f·6d6d·616e·6420·2864·6e66·2927··l·command·(dnf)' | |||
| 0003baf0:·0a20·2073·6574·5f66·6163·743a·0a20·2020··.··set_fact:.··· | |||
| 0003bb00:·2070·6163·6b61·6765·5f6d·616e·6167·6572···package_manager | |||
| 0003b850:·636d·643a·2064·6e66·2072·6569·6e73·7461··cmd:·dnf·reinsta | |||
| 0003b860:·6c6c·202d·790a·2020·7768·656e·3a20·616e··ll·-y.··when:·an | |||
| 0003b870:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003b880:·6f6e·203d·3d20·2246·6564·6f72·6122·0a20··on·==·"Fedora".· | |||
| 0003b890:·2074·6167·733a·0a20·202d·2043·4a49·532d···tags:.··-·CJIS- | |||
| 0003b8a0:·352e·3130·2e34·2e31·0a20·202d·2044·4953··5.10.4.1.··-·DIS | |||
| 0003b8b0:·412d·5354·4947·2d4f·4c30·372d·3030·2d30··A-STIG-OL07-00-0 | |||
| 0003b8c0:·3130·3032·300a·2020·2d20·4e49·5354·2d38··10020.··-·NIST-8 | |||
| 0003b8d0:·3030·2d31·3731·2d33·2e33·2e38·0a20·202d··00-171-3.3.8.··- | |||
| 0003b8e0:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003b8f0:·342e·310a·2020·2d20·4e49·5354·2d38·3030··4.1.··-·NIST-800 | |||
| 0003b900:·2d35·332d·4155·2d39·2833·290a·2020·2d20··-53-AU-9(3).··-· | |||
| Max diff block lines reached; 9140684/9164750 bytes (99.74%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Oracle·Linux·7 | 39 | Profile·Title·Standard·System·Security·Profile·for·Oracle·Linux·7 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:oracle:linux:7 | 42 | ····*·cpe:/o:oracle:linux:7 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 78, 14 lines modified | Offset 78, 24 lines modified | ||
| 78 | $·sudo·yum·reinstall·PACKAGENAME | 78 | $·sudo·yum·reinstall·PACKAGENAME |
| 79 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 79 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 80 | $·sudo·rpm·-Uvh·PACKAGENAME | 80 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 81 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 81 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 82 | Severity: ················high | 82 | Severity: ················high |
| 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 84 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule | 84 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·OL07-00-010020,·SV-221653r603260_rule |
| 85 | Remediation_Shell_script_⇲ | ||
| 86 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 87 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 88 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 89 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 90 | yum·reinstall·-y·$packages_to_reinstall | ||
| 85 | Remediation_Ansible_snippet_⇲ | 91 | Remediation_Ansible_snippet_⇲ |
| 86 | Complexity:·high | 92 | Complexity:·high |
| 87 | Disruption:·medium | 93 | Disruption:·medium |
| 88 | Strategy:···restrict | 94 | Strategy:···restrict |
| 89 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 95 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 90 | ··set_fact: | 96 | ··set_fact: |
| 91 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 97 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 235, 37 lines modified | Offset 245, 56 lines modified | ||
| 235 | ··-·PCI-DSS-Req-11.5 | 245 | ··-·PCI-DSS-Req-11.5 |
| 236 | ··-·high_complexity | 246 | ··-·high_complexity |
| 237 | ··-·high_severity | 247 | ··-·high_severity |
| 238 | ··-·medium_disruption | 248 | ··-·medium_disruption |
| 239 | ··-·no_reboot_needed | 249 | ··-·no_reboot_needed |
| 240 | ··-·restrict_strategy | 250 | ··-·restrict_strategy |
| 241 | ··-·rpm_verify_hashes | 251 | ··-·rpm_verify_hashes |
| 242 | Remediation_Shell_script_⇲ | ||
| 243 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 244 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 245 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 246 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 247 | yum·reinstall·-y·$packages_to_reinstall | ||
| 248 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 252 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 249 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 253 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 250 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 254 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 251 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 255 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 252 | $·rpm·-qf·FILENAME | 256 | $·rpm·-qf·FILENAME |
| 253 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 257 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 254 | $·sudo·rpm·--setperms·PACKAGENAME | 258 | $·sudo·rpm·--setperms·PACKAGENAME |
| 255 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 259 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 256 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 260 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 257 | Severity: ················high | 261 | Severity: ················high |
| 258 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 262 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 259 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule | 263 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·OL07-00-010010,·SV-221652r833014_rule |
| 264 | Remediation_Shell_script_⇲ | ||
| 265 | Complexity:·high | ||
| 266 | Disruption:·medium | ||
| 267 | Strategy:···restrict | ||
| 268 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 269 | declare·-A·SETPERMS_RPM_DICT | ||
| 270 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 271 | #·is·expected·by·the·RPM·database | ||
| 272 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 273 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 274 | do | ||
| 275 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 276 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 277 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 278 | ········do | ||
| 279 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 280 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 281 | ········done | ||
| 282 | done | ||
| 283 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 284 | #·correct·values | ||
| 285 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 286 | do | ||
| 287 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 288 | done | ||
| 260 | Remediation_Ansible_snippet_⇲ | 289 | Remediation_Ansible_snippet_⇲ |
| 261 | Complexity:·high | 290 | Complexity:·high |
| 262 | Disruption:·medium | 291 | Disruption:·medium |
| 263 | Strategy:···restrict | 292 | Strategy:···restrict |
| 264 | -·name:·Read·list·of·files·with·incorrect·permissions | 293 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 265 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 294 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 266 | ····--nocaps·--nolinkto·--nouser·--nogroup | 295 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 342, 43 lines modified | Offset 371, 14 lines modified | ||
| 342 | ··-·PCI-DSS-Req-11.5 | 371 | ··-·PCI-DSS-Req-11.5 |
| 343 | ··-·high_complexity | 372 | ··-·high_complexity |
| 344 | ··-·high_severity | 373 | ··-·high_severity |
| 345 | ··-·medium_disruption | 374 | ··-·medium_disruption |
| 346 | ··-·no_reboot_needed | 375 | ··-·no_reboot_needed |
| 347 | ··-·restrict_strategy | 376 | ··-·restrict_strategy |
| 348 | ··-·rpm_verify_permissions | 377 | ··-·rpm_verify_permissions |
| 349 | Remediation_Shell_script_⇲ | ||
| 350 | Complexity:·high | ||
| 351 | Disruption:·medium | ||
| 352 | Strategy:···restrict | ||
| 353 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 354 | declare·-A·SETPERMS_RPM_DICT | ||
| 355 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 356 | #·is·expected·by·the·RPM·database | ||
| 357 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 668832/677052 bytes (98.79%) of diff not shown. | |||
| Offset 14278, 15 lines modified | Offset 14278, 15 lines modified | ||
| 00037c50:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037c50:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037c60:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037c60:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037c70:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037c70:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037c80:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037c80:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037c90:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037c90:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037ca0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037ca0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037cb0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037cb0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037cc0:·3230·323 | 00037cc0:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037cd0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037cd0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037ce0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037ce0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037cf0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037cf0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037d00:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037d00:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037d10:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037d10:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037d20:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037d20:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037d30:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037d30:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15263, 334 lines modified | Offset 15263, 334 lines modified | ||
| 0003b9e0:·6574·3d22·2369·646d·3539·3436·2220·7461··et="#idm5946"·ta | 0003b9e0:·6574·3d22·2369·646d·3539·3436·2220·7461··et="#idm5946"·ta | ||
| 0003b9f0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003b9f0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003ba00:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003ba00:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003ba10:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003ba10:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003ba20:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003ba20:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003ba30:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003ba30:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003ba40:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003ba40:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003ba50:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | |||
| 0003ba60:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003ba70:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003ba80:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003ba90:·2269·646d·3539·3436·223e·3c70·7265·3e3c··"idm5946"><pre>< | |||
| 0003baa0:·636f·6465·3e0a·2320·4669·6e64·2077·6869··code>.#·Find·whi | |||
| 0003bab0:·6368·2066·696c·6573·2068·6176·6520·696e··ch·files·have·in | |||
| 0003bac0:·636f·7272·6563·7420·6861·7368·2028·6e6f··correct·hash·(no | |||
| 0003bad0:·7420·696e·202f·6574·632c·2062·6563·6175··t·in·/etc,·becau | |||
| 0003bae0:·7365·206f·6620·7468·6520·7379·7374·656d··se·of·the·system | |||
| 0003baf0:·2072·656c·6174·6564·2063·6f6e·6669·6720···related·config· | |||
| 0003bb00:·6669·6c65·7329·2061·6e64·2074·6865·6e20··files)·and·then· | |||
| 0003bb10:·6765·7420·6669·6c65·7320·6e61·6d65·730a··get·files·names. | |||
| 0003ba50:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003ba60:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003ba70:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003ba80:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003ba90:·6964·3d22·6964·6d35·3934·3622·3e3c·7461··id="idm5946"><ta | |||
| 0003baa0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003bab0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003bac0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003bad0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003bae0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003baf0:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003bb00:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bb10:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003bb20:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003bb30:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bb40:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003bb50:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003bb60:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bb70:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003bb80:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003bb90:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | |||
| 0003bba0:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003bbb0:·2020·7365·745f·6661·6374·3a0a·2020·2020····set_fact:.···· | |||
| 0003bbc0:·7061·636b·6167·655f·6d61·6e61·6765·725f··package_manager_ | |||
| 0003bbd0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003bbe0:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003bbf0:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003bc00:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003bc10:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003bc20:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003bc30:·2e31·0a20·202d·2044·4953·412d·5354·4947··.1.··-·DISA-STIG | |||
| 0003bc40:·2d4f·4c30·372d·3030·2d30·3130·3032·300a··-OL07-00-010020. | |||
| 0003bc50:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003bc60:·2d33·2e33·2e38·0a20·202d·204e·4953·542d··-3.3.8.··-·NIST- | |||
| 0003bc70:·3830·302d·3137·312d·332e·342e·310a·2020··800-171-3.4.1.·· | |||
| 0003bc80:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003bc90:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003bca0:·3030·2d35·332d·434d·2d36·2863·290a·2020··00-53-CM-6(c).·· | |||
| 0003bcb0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003bcc0:·2d36·2864·290a·2020·2d20·4e49·5354·2d38··-6(d).··-·NIST-8 | |||
| 0003bcd0:·3030·2d35·332d·5349·2d37·0a20·202d·204e··00-53-SI-7.··-·N | |||
| 0003bce0:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003bcf0:·3129·0a20·202d·204e·4953·542d·3830·302d··1).··-·NIST-800- | |||
| 0003bd00:·3533·2d53·492d·3728·3629·0a20·202d·2050··53-SI-7(6).··-·P | |||
| 0003bd10:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003bd20:·2020·2d20·6869·6768·5f63·6f6d·706c·6578····-·high_complex | |||
| 0003bd30:·6974·790a·2020·2d20·6869·6768·5f73·6576··ity.··-·high_sev | |||
| 0003bd40:·6572·6974·790a·2020·2d20·6d65·6469·756d··erity.··-·medium | |||
| 0003bd50:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | |||
| 0003bd60:·6e6f·5f72·6562·6f6f·745f·6e65·6564·6564··no_reboot_needed | |||
| 0003bd70:·0a20·202d·2072·6573·7472·6963·745f·7374··.··-·restrict_st | |||
| 0003bd80:·7261·7465·6779·0a20·202d·2072·706d·5f76··rategy.··-·rpm_v | |||
| 0003bd90:·6572·6966·795f·6861·7368·6573·0a0a·2d20··erify_hashes..-· | |||
| 0003bda0:·6e61·6d65·3a20·2753·6574·2066·6163·743a··name:·'Set·fact: | |||
| 0003bdb0:·2050·6163·6b61·6765·206d·616e·6167·6572···Package·manager | |||
| 0003bdc0:·2072·6569·6e73·7461·6c6c·2063·6f6d·6d61···reinstall·comma | |||
| 0003bdd0:·6e64·2028·7975·6d29·270a·2020·7365·745f··nd·(yum)'.··set_ | |||
| 0003bde0:·6661·6374·3a0a·2020·2020·7061·636b·6167··fact:.····packag | |||
| 0003bdf0:·655f·6d61·6e61·6765·725f·7265·696e·7374··e_manager_reinst | |||
| 0003be00:·616c·6c5f·636d·643a·2079·756d·2072·6569··all_cmd:·yum·rei | |||
| 0003be10:·6e73·7461·6c6c·202d·790a·2020·7768·656e··nstall·-y.··when | |||
| 0003be20:·3a20·2861·6e73·6962·6c65·5f64·6973·7472··:·(ansible_distr | |||
| 0003be30:·6962·7574·696f·6e20·3d3d·2022·5265·6448··ibution·==·"RedH | |||
| 0003be40:·6174·2220·6f72·2061·6e73·6962·6c65·5f64··at"·or·ansible_d | |||
| 0003be50:·6973·7472·6962·7574·696f·6e20·3d3d·2022··istribution·==·" | |||
| 0003be60:·4365·6e74·4f53·2220·6f72·2061·6e73·6962··CentOS"·or·ansib | |||
| 0003be70:·6c65·5f64·6973·7472·6962·7574·696f·6e0a··le_distribution. | |||
| 0003be80:·2020·2020·3d3d·2022·4f72·6163·6c65·4c69······==·"OracleLi | |||
| 0003be90:·6e75·7822·290a·2020·7461·6773·3a0a·2020··nux").··tags:.·· | |||
| 0003bea0:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| 0003beb0:·2020·2d20·4449·5341·2d53·5449·472d·4f4c····-·DISA-STIG-OL | |||
| 0003bec0:·3037·2d30·302d·3031·3030·3230·0a20·202d··07-00-010020.··- | |||
| 0003bed0:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003bee0:·332e·380a·2020·2d20·4e49·5354·2d38·3030··3.8.··-·NIST-800 | |||
| 0003bef0:·2d31·3731·2d33·2e34·2e31·0a20·202d·204e··-171-3.4.1.··-·N | |||
| 0003bf00:·4953·542d·3830·302d·3533·2d41·552d·3928··IST-800-53-AU-9( | |||
| 0003bf10:·3329·0a20·202d·204e·4953·542d·3830·302d··3).··-·NIST-800- | |||
| 0003bf20:·3533·2d43·4d2d·3628·6329·0a20·202d·204e··53-CM-6(c).··-·N | |||
| 0003bf30:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003bf40:·6429·0a20·202d·204e·4953·542d·3830·302d··d).··-·NIST-800- | |||
| 0003bf50:·3533·2d53·492d·370a·2020·2d20·4e49·5354··53-SI-7.··-·NIST | |||
| 0003bf60:·2d38·3030·2d35·332d·5349·2d37·2831·290a··-800-53-SI-7(1). | |||
| 0003bf70:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bf80:·5349·2d37·2836·290a·2020·2d20·5043·492d··SI-7(6).··-·PCI- | |||
| 0003bf90:·4453·532d·5265·712d·3131·2e35·0a20·202d··DSS-Req-11.5.··- | |||
| 0003bfa0:·2068·6967·685f·636f·6d70·6c65·7869·7479···high_complexity | |||
| 0003bfb0:·0a20·202d·2068·6967·685f·7365·7665·7269··.··-·high_severi | |||
| 0003bfc0:·7479·0a20·202d·206d·6564·6975·6d5f·6469··ty.··-·medium_di | |||
| 0003bfd0:·7372·7570·7469·6f6e·0a20·202d·206e·6f5f··sruption.··-·no_ | |||
| 0003bfe0:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 0003bff0:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| Max diff block lines reached; 18933413/18956789 bytes (99.88%) of diff not shown. | |||
| Offset 14301, 16 lines modified | Offset 14301, 16 lines modified | ||
| 00037dc0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00037dc0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00037dd0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00037dd0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 00037de0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 00037de0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00037df0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00037df0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00037e00:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00037e00:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00037e10:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00037e10:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00037e20:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e20:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e30:·2028·6173·206f·6620·3230·323 | 00037e30:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00037e40:·323 | 00037e40:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00037e50:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00037e50:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00037e60:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00037e60:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00037e70:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00037e70:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00037e80:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00037e80:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00037e90:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00037e90:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00037ea0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00037ea0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00037eb0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 00037eb0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | ||
| Offset 15281, 334 lines modified | Offset 15281, 334 lines modified | ||
| 0003bb00:·2d74·6172·6765·743d·2223·6964·6d35·3934··-target="#idm594 | 0003bb00:·2d74·6172·6765·743d·2223·6964·6d35·3934··-target="#idm594 | ||
| 0003bb10:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | 0003bb10:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | ||
| 0003bb20:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003bb20:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003bb30:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003bb30:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bb40:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bb40:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003bb50:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003bb50:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003bb60:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003bb60:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bb70:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003bb80:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003bb90:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bba0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bbb0:·7073·6522·2069·643d·2269·646d·3539·3436··pse"·id="idm5946 | |||
| 0003bbc0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bbd0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003bbe0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003bbf0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003bc00:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003bc10:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003bc20:·6869·6768·3c2f·7464·3e3c·2f74·723e·3c74··high</td></tr><t | |||
| 0003bc30:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003bc40:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003bc50:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bc60:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bc70:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003bc80:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bc90:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003bca0:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003bcb0:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003bcc0:·7374·616c·6c20·636f·6d6d·616e·6420·2864··stall·command·(d | |||
| 0003bcd0:·6e66·2927·0a20·2073·6574·5f66·6163·743a··nf)'.··set_fact: | |||
| 0003b | 0003bb70:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003bb80:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bb90:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bba0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bbb0:·2220·6964·3d22·6964·6d35·3934·3622·3e3c··"·id="idm5946">< | |||
| 0003bbc0:·7072·653e·3c63·6f64·653e·0a23·2046·696e··pre><code>.#·Fin | |||
| 0003bbd0:·6420·7768·6963·6820·6669·6c65·7320·6861··d·which·files·ha | |||
| 0003bbe0:·7665·2069·6e63·6f72·7265·6374·2068·6173··ve·incorrect·has | |||
| 0003bbf0:·6820·286e·6f74·2069·6e20·2f65·7463·2c20··h·(not·in·/etc,· | |||
| 0003bc00:·6265·6361·7573·6520·6f66·2074·6865·2073··because·of·the·s | |||
| 0003bc10:·7973·7465·6d20·7265·6c61·7465·6420·636f··ystem·related·co | |||
| 0003bc20:·6e66·6967·2066·696c·6573·2920·616e·6420··nfig·files)·and· | |||
| 0003bc30:·7468·656e·2067·6574·2066·696c·6573·206e··then·get·files·n | |||
| 0003bc40:·616d·6573·0a66·696c·6573·5f77·6974·685f··ames.files_with_ | |||
| 0003bc50:·696e·636f·7272·6563·745f·6861·7368·3d22··incorrect_hash=" | |||
| 0003bc60:·2428·7270·6d20·2d56·6120·2d2d·6e6f·636f··$(rpm·-Va·--noco | |||
| 0003bc70:·6e66·6967·207c·2067·7265·7020·2d45·2027··nfig·|·grep·-E·' | |||
| 0003bc80:·5e2e·2e35·2720·7c20·6177·6b20·277b·7072··^..5'·|·awk·'{pr | |||
| 0003bc90:·696e·7420·244e·467d·2720·2922·0a0a·2320··int·$NF}'·)"..#· | |||
| 0003bca0:·4672·6f6d·2066·696c·6573·206e·616d·6573··From·files·names | |||
| 0003bcb0:·2067·6574·2070·6163·6b61·6765·206e·616d···get·package·nam | |||
| 0003bcc0:·6573·2061·6e64·2063·6861·6e67·6520·6e65··es·and·change·ne | |||
| 0003bcd0:·776c·696e·6520·746f·2073·7061·6365·2c20··wline·to·space,· | |||
| 0003bce0:·6265·6361·7573·6520·7270·6d20·7772·6974··because·rpm·writ | |||
| 0003bcf0:·6573·2065·6163·6820·7061·636b·6167·6520··es·each·package· | |||
| 0003bd00:·746f·206e·6577·206c·696e·650a·7061·636b··to·new·line.pack | |||
| 0003bd10:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003bd20:·6c3d·2224·2872·706d·202d·7166·2024·6669··l="$(rpm·-qf·$fi | |||
| 0003bd30:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003bd40:·6374·5f68·6173·6820·7c20·7472·2027·5c6e··ct_hash·|·tr·'\n | |||
| 0003bd50:·2720·2720·2729·220a·0a0a·7975·6d20·7265··'·'·')"...yum·re | |||
| 0003bd60:·696e·7374·616c·6c20·2d79·2024·7061·636b··install·-y·$pack | |||
| 0003bd70:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003bd80:·6c0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··l.</code></pre>< | |||
| 0003bd90:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003bda0:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003bdb0:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003bdc0:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003bdd0:·6574·3d22·2369·646d·3539·3437·2220·7461··et="#idm5947"·ta | |||
| 0003bde0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003bdf0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003be00:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003be10:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003be20:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003be30:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003be40:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003be50:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003be60:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003be70:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003be80:·6964·3d22·6964·6d35·3934·3722·3e3c·7461··id="idm5947"><ta | |||
| 0003be90:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003bea0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003beb0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003bec0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003bed0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003bee0:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003bef0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bf00:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003bf10:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003bf20:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bf30:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003bf40:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003bf50:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bf60:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003bf70:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003b | 0003bf80:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | ||
| 0003bf90:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003bfa0:·2020·7365·745f·6661·6374·3a0a·2020·2020····set_fact:.···· | |||
| 0003bfb0:·7061·636b·6167·655f·6d61·6e61·6765·725f··package_manager_ | |||
| 0003bfc0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003bfd0:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003bd00:·6d64·3a20·646e·6620·7265·696e·7374·616c··md:·dnf·reinstal | |||
| 0003bd10:·6c20·2d79·0a20·2077·6865·6e3a·2061·6e73··l·-y.··when:·ans | |||
| 0003bd20:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003bd30:·6e20·3d3d·2022·4665·646f·7261·220a·2020··n·==·"Fedora".·· | |||
| 0003bd40:·7461·6773·3a0a·2020·2d20·434a·4953·2d35··tags:.··-·CJIS-5 | |||
| 0003bd50:·2e31·302e·342e·310a·2020·2d20·4449·5341··.10.4.1.··-·DISA | |||
| 0003bd60:·2d53·5449·472d·4f4c·3037·2d30·302d·3031··-STIG-OL07-00-01 | |||
| 0003bd70:·3030·3230·0a20·202d·204e·4953·542d·3830··0020.··-·NIST-80 | |||
| 0003bd80:·302d·3137·312d·332e·332e·380a·2020·2d20··0-171-3.3.8.··-· | |||
| Max diff block lines reached; 18901091/18938819 bytes (99.80%) of diff not shown. | |||
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037dd0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037de0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037de0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037df0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037df0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037e00:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037e00:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037e10:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037e10:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037e20:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037e20:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037e30:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037e30:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037e40:·7320·6f66·2032·3032·3 | 00037e40:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037e50:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037e50:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037e60:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037e60:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037e70:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037e70:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037e80:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037e80:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037e90:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037e90:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037ea0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037ea0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037eb0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037eb0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15223, 192 lines modified | Offset 15223, 192 lines modified | ||
| 0003b760:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003b760:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003b770:·743d·2223·6964·6d35·3935·3722·2074·6162··t="#idm5957"·tab | 0003b770:·743d·2223·6964·6d35·3935·3722·2074·6162··t="#idm5957"·tab | ||
| 0003b780:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003b780:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003b790:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003b790:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003b7a0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003b7a0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003b7b0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003b7b0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003b7c0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003b7c0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003b7d0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003b7d0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | ||
| 0003b7e0:·6e61·636f·6e64·6120·736e·6970·7065·7420··naconda·snippet· | |||
| 0003b7f0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b800:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b810:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b820:·6964·3d22·6964·6d35·3935·3722·3e3c·7461··id="idm5957"><ta | |||
| 0003b830:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b840:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b850:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b860:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003b870:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003b880:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003b890:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003b8a0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003b8b0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003b8c0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003b8d0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003b8e0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003b8f0:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a70··le><pre><code>.p | |||
| 0003b900:·6163·6b61·6765·202d·2d61·6464·3d61·6964··ackage·--add=aid | |||
| 0003b910:·650a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··e.</code></pre>< | |||
| 0003b920:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003b930:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003b940:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003b950:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003b960:·6574·3d22·2369·646d·3539·3538·2220·7461··et="#idm5958"·ta | |||
| 0003b970:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003b980:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003b990:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003b9a0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003b9b0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003b9c0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003b9d0:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003b9e0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b9f0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003ba00:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003ba10:·643d·2269·646d·3539·3538·223e·3c74·6162··d="idm5958"><tab | |||
| 0003ba20:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003ba30:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003ba40:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003ba50:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003ba60:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003ba70:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003ba80:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003ba90:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003baa0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bab0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bac0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003bad0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bae0:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | |||
| 0003baf0:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003bb00:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003bb10:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003bb20:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003bb30:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003bb40:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003bb50:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003bb60:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003bb70:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003bb80:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003bb90:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003bba0:·3d22·2369·646d·3539·3539·2220·7461·6269··="#idm5959"·tabi | |||
| 0003bbb0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003bbc0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003bbd0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003bbe0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003bbf0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003bc00:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003b | 0003b7e0:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | ||
| 0003b | 0003b7f0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | ||
| 0003b | 0003b800:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | ||
| 0003b | 0003b810:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | ||
| 0003b | 0003b820:·3d22·6964·6d35·3935·3722·3e3c·7461·626c··="idm5957"><tabl | ||
| 0003b | 0003b830:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | ||
| 0003b | 0003b840:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | ||
| 0003b | 0003b850:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | ||
| 0003b | 0003b860:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | ||
| 0003b | 0003b870:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | ||
| 0003b | 0003b880:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003b | 0003b890:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | ||
| 0003b | 0003b8a0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | ||
| 0003b | 0003b8b0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003b | 0003b8c0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | ||
| 0003b | 0003b8d0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | ||
| 0003b | 0003b8e0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | ||
| 0003b8f0:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003b900:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003b910:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003b920:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003b930:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003b940:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003b950:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003b960:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003b970:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003b980:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003b990:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003b9a0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003b9b0:·2223·6964·6d35·3935·3822·2074·6162·696e··"#idm5958"·tabin | |||
| 0003b9c0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003b9d0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003b9e0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003b9f0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003ba00:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003ba10:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | |||
| Max diff block lines reached; 6258403/6284677 bytes (99.58%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(enhanced) | 44 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:8 | 47 | ····*·cpe:/o:oracle:linux:8 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, | 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, |
| 108 | ············OL08-00-010359,·SV-252654r818758_rule | 108 | ············OL08-00-010359,·SV-252654r818758_rule |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····yum·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 144, 28 lines modified | Offset 152, 20 lines modified | ||
| 144 | ··-·no_reboot_needed | 152 | ··-·no_reboot_needed |
| 145 | ··-·package_aide_installed | 153 | ··-·package_aide_installed |
| 146 | Remediation_OSBuild_Blueprint_snippet_⇲ | 154 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 147 | [[packages]] | 155 | [[packages]] |
| 148 | name·=·"aide" | 156 | name·=·"aide" |
| 149 | version·=·"*" | 157 | version·=·"*" |
| 150 | Remediation_ | 158 | Remediation_Anaconda_snippet_⇲ |
| 151 | Complexity:·low | 159 | Complexity:·low |
| 152 | Disruption:·low | 160 | Disruption:·low |
| 153 | Strategy:···enable | 161 | Strategy:···enable |
| 154 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 155 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | package·--add=aide | ||
| 156 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 157 | ····yum·install·-y·"aide" | ||
| 158 | fi | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 164 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/sbin/aide·--init | 165 | $·sudo·/usr/sbin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 168 | database·can·be·installed·as·follows: | 169 | database·can·be·installed·as·follows: |
| Offset 179, 14 lines modified | Offset 179, 28 lines modified | ||
| 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 186 | Remediation_Shell_script_⇲ | ||
| 187 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 188 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 189 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 190 | ····yum·install·-y·"aide" | ||
| 191 | fi | ||
| 192 | /usr/sbin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 186 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 187 | Complexity:·low | 198 | Complexity:·low |
| 188 | Disruption:·low | 199 | Disruption:·low |
| 189 | Strategy:···restrict | 200 | Strategy:···restrict |
| 190 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 191 | ··package: | 202 | ··package: |
| 192 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 251, 28 lines modified | Offset 265, 14 lines modified | ||
| 251 | ··-·PCI-DSS-Req-11.5 | 265 | ··-·PCI-DSS-Req-11.5 |
| 252 | ··-·aide_build_database | 266 | ··-·aide_build_database |
| 253 | ··-·low_complexity | 267 | ··-·low_complexity |
| 254 | ··-·low_disruption | 268 | ··-·low_disruption |
| 255 | ··-·medium_severity | 269 | ··-·medium_severity |
| 256 | ··-·no_reboot_needed | 270 | ··-·no_reboot_needed |
| Max diff block lines reached; 667886/672505 bytes (99.31%) of diff not shown. | |||
| Offset 14301, 15 lines modified | Offset 14301, 15 lines modified | ||
| 00037dc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037dc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037dd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037dd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037de0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037de0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037df0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037df0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037e00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037e00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037e10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037e10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037e20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037e20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037e30:·7320·6f66·2032·3032·3 | 00037e30:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037e40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037e40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037e50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037e50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037e60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037e60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037e70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037e70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037e80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037e80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037e90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037e90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037ea0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037ea0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15222, 192 lines modified | Offset 15222, 192 lines modified | ||
| 0003b750:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003b750:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003b760:·743d·2223·6964·6d35·3935·3722·2074·6162··t="#idm5957"·tab | 0003b760:·743d·2223·6964·6d35·3935·3722·2074·6162··t="#idm5957"·tab | ||
| 0003b770:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003b770:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003b780:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003b780:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003b790:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003b790:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003b7a0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003b7a0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003b7b0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003b7b0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003b7c0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003b7c0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | ||
| 0003b7d0:·6e61·636f·6e64·6120·736e·6970·7065·7420··naconda·snippet· | |||
| 0003b7e0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b7f0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b800:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b810:·6964·3d22·6964·6d35·3935·3722·3e3c·7461··id="idm5957"><ta | |||
| 0003b820:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b830:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b840:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b850:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003b860:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003b870:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003b880:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003b890:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003b8a0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003b8b0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003b8c0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003b8d0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003b8e0:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a70··le><pre><code>.p | |||
| 0003b8f0:·6163·6b61·6765·202d·2d61·6464·3d61·6964··ackage·--add=aid | |||
| 0003b900:·650a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··e.</code></pre>< | |||
| 0003b910:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003b920:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003b930:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003b940:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003b950:·6574·3d22·2369·646d·3539·3538·2220·7461··et="#idm5958"·ta | |||
| 0003b960:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003b970:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003b980:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003b990:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003b9a0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003b9b0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003b9c0:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003b9d0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b9e0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b9f0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003ba00:·643d·2269·646d·3539·3538·223e·3c74·6162··d="idm5958"><tab | |||
| 0003ba10:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003ba20:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003ba30:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003ba40:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003ba50:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003ba60:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003ba70:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003ba80:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003ba90:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003baa0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bab0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003bac0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bad0:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | |||
| 0003bae0:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003baf0:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003bb00:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003bb10:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003bb20:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003bb30:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003bb40:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003bb50:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003bb60:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003bb70:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003bb80:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003bb90:·3d22·2369·646d·3539·3539·2220·7461·6269··="#idm5959"·tabi | |||
| 0003bba0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003bbb0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003bbc0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003bbd0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003bbe0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003bbf0:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003b | 0003b7d0:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | ||
| 0003b | 0003b7e0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | ||
| 0003b | 0003b7f0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | ||
| 0003b | 0003b800:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | ||
| 0003b | 0003b810:·3d22·6964·6d35·3935·3722·3e3c·7461·626c··="idm5957"><tabl | ||
| 0003b | 0003b820:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | ||
| 0003b | 0003b830:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | ||
| 0003b | 0003b840:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | ||
| 0003b | 0003b850:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | ||
| 0003b | 0003b860:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | ||
| 0003b | 0003b870:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003b | 0003b880:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | ||
| 0003b | 0003b890:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | ||
| 0003b | 0003b8a0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003b | 0003b8b0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | ||
| 0003b | 0003b8c0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | ||
| 0003b | 0003b8d0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | ||
| 0003b8e0:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003b8f0:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003b900:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003b910:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003b920:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003b930:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003b940:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003b950:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003b960:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003b970:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003b980:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003b990:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003b9a0:·2223·6964·6d35·3935·3822·2074·6162·696e··"#idm5958"·tabin | |||
| 0003b9b0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003b9c0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003b9d0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003b9e0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003b9f0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003ba00:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | |||
| Max diff block lines reached; 6512446/6538720 bytes (99.60%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(high) | 44 | Profile·Title·ANSSI-BP-028·(high) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:8 | 47 | ····*·cpe:/o:oracle:linux:8 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 102, 31 lines modified | Offset 102, 39 lines modified | ||
| 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, | 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, |
| 108 | ············OL08-00-010359,·SV-252654r818758_rule | 108 | ············OL08-00-010359,·SV-252654r818758_rule |
| 109 | Remediation_Anaconda_snippet_⇲ | ||
| 110 | Complexity:·low | ||
| 111 | Disruption:·low | ||
| 112 | Strategy:···enable | ||
| 113 | package·--add=aide | ||
| 114 | Remediation_Puppet_snippet_⇲ | 109 | Remediation_Puppet_snippet_⇲ |
| 115 | Complexity:·low | 110 | Complexity:·low |
| 116 | Disruption:·low | 111 | Disruption:·low |
| 117 | Strategy:···enable | 112 | Strategy:···enable |
| 118 | include·install_aide | 113 | include·install_aide |
| 119 | class·install_aide·{ | 114 | class·install_aide·{ |
| 120 | ··package·{·'aide': | 115 | ··package·{·'aide': |
| 121 | ····ensure·=>·'installed', | 116 | ····ensure·=>·'installed', |
| 122 | ··} | 117 | ··} |
| 123 | } | 118 | } |
| 119 | Remediation_Shell_script_⇲ | ||
| 120 | Complexity:·low | ||
| 121 | Disruption:·low | ||
| 122 | Strategy:···enable | ||
| 123 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 124 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 125 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 126 | ····yum·install·-y·"aide" | ||
| 127 | fi | ||
| 128 | else | ||
| 129 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 130 | fi | ||
| 124 | Remediation_Ansible_snippet_⇲ | 131 | Remediation_Ansible_snippet_⇲ |
| 125 | Complexity:·low | 132 | Complexity:·low |
| 126 | Disruption:·low | 133 | Disruption:·low |
| 127 | Strategy:···enable | 134 | Strategy:···enable |
| 128 | -·name:·Ensure·aide·is·installed | 135 | -·name:·Ensure·aide·is·installed |
| 129 | ··package: | 136 | ··package: |
| 130 | ····name:·aide | 137 | ····name:·aide |
| Offset 144, 28 lines modified | Offset 152, 20 lines modified | ||
| 144 | ··-·no_reboot_needed | 152 | ··-·no_reboot_needed |
| 145 | ··-·package_aide_installed | 153 | ··-·package_aide_installed |
| 146 | Remediation_OSBuild_Blueprint_snippet_⇲ | 154 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 147 | [[packages]] | 155 | [[packages]] |
| 148 | name·=·"aide" | 156 | name·=·"aide" |
| 149 | version·=·"*" | 157 | version·=·"*" |
| 150 | Remediation_ | 158 | Remediation_Anaconda_snippet_⇲ |
| 151 | Complexity:·low | 159 | Complexity:·low |
| 152 | Disruption:·low | 160 | Disruption:·low |
| 153 | Strategy:···enable | 161 | Strategy:···enable |
| 154 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 155 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | package·--add=aide | ||
| 156 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 157 | ····yum·install·-y·"aide" | ||
| 158 | fi | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 164 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/sbin/aide·--init | 165 | $·sudo·/usr/sbin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 168 | database·can·be·installed·as·follows: | 169 | database·can·be·installed·as·follows: |
| Offset 179, 14 lines modified | Offset 179, 28 lines modified | ||
| 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 179 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 180 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 181 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 182 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 183 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 184 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 185 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 186 | Remediation_Shell_script_⇲ | ||
| 187 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 188 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 189 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 190 | ····yum·install·-y·"aide" | ||
| 191 | fi | ||
| 192 | /usr/sbin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 186 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 187 | Complexity:·low | 198 | Complexity:·low |
| 188 | Disruption:·low | 199 | Disruption:·low |
| 189 | Strategy:···restrict | 200 | Strategy:···restrict |
| 190 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 191 | ··package: | 202 | ··package: |
| 192 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 251, 28 lines modified | Offset 265, 14 lines modified | ||
| 251 | ··-·PCI-DSS-Req-11.5 | 265 | ··-·PCI-DSS-Req-11.5 |
| 252 | ··-·aide_build_database | 266 | ··-·aide_build_database |
| 253 | ··-·low_complexity | 267 | ··-·low_complexity |
| 254 | ··-·low_disruption | 268 | ··-·low_disruption |
| 255 | ··-·medium_severity | 269 | ··-·medium_severity |
| 256 | ··-·no_reboot_needed | 270 | ··-·no_reboot_needed |
| Max diff block lines reached; 695587/700198 bytes (99.34%) of diff not shown. | |||
| Offset 14303, 15 lines modified | Offset 14303, 15 lines modified | ||
| 00037de0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037de0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037df0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037df0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037e00:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037e00:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037e10:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037e10:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037e20:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037e20:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037e30:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037e30:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037e40:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037e40:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037e50:·7320·6f66·2032·3032·3 | 00037e50:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037e60:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037e60:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037e70:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037e70:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037e80:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037e80:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037e90:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037e90:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037ea0:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037ea0:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037eb0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037eb0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037ec0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037ec0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15218, 191 lines modified | Offset 15218, 191 lines modified | ||
| 0003b710:·2d74·6172·6765·743d·2223·6964·6d35·3935··-target="#idm595 | 0003b710:·2d74·6172·6765·743d·2223·6964·6d35·3935··-target="#idm595 | ||
| 0003b720:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | 0003b720:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | ||
| 0003b730:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003b730:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003b740:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003b740:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003b750:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003b750:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003b760:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003b760:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003b770:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003b770:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003b780:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003b780:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003b790:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003b7a0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003b7b0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003b7c0:·6170·7365·2220·6964·3d22·6964·6d35·3935··apse"·id="idm595 | |||
| 0003b7d0:·3722·3e3c·7461·626c·6520·636c·6173·733d··7"><table·class= | |||
| 0003b7e0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003b7f0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003b800:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003b810:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003b820:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003b830:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003b840:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003b850:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003b860:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003b870:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003b880:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003b890:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003b8a0:·6f64·653e·0a70·6163·6b61·6765·202d·2d61··ode>.package·--a | |||
| 0003b8b0:·6464·3d61·6964·650a·3c2f·636f·6465·3e3c··dd=aide.</code>< | |||
| 0003b8c0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003b8d0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003b8e0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003b8f0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003b900:·612d·7461·7267·6574·3d22·2369·646d·3539··a-target="#idm59 | |||
| 0003b910:·3538·2220·7461·6269·6e64·6578·3d22·3022··58"·tabindex="0" | |||
| 0003b920:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003b930:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003b940:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003b950:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003b960:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003b970:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003b980:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003b990:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003b9a0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003b9b0:·7073·6522·2069·643d·2269·646d·3539·3538··pse"·id="idm5958 | |||
| 0003b9c0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003b9d0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003b9e0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003b9f0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003ba00:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003ba10:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003ba20:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003ba30:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003ba40:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003ba50:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003ba60:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003ba70:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003ba80:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003ba90:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003baa0:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003bab0:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003bac0:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003bad0:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003bae0:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003baf0:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003bb00:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003bb10:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003bb20:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003bb30:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003bb40:·7461·7267·6574·3d22·2369·646d·3539·3539··target="#idm5959 | |||
| 0003bb50:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003bb60:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003bb70:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003bb80:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003bb90:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003bba0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003bbb0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003b | 0003b790:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | ||
| 0003b | 0003b7a0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | ||
| 0003b | 0003b7b0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | ||
| 0003b | 0003b7c0:·7365·2220·6964·3d22·6964·6d35·3935·3722··se"·id="idm5957" | ||
| 0003b | 0003b7d0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | ||
| 0003b | 0003b7e0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | ||
| 0003b | 0003b7f0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003b | 0003b800:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003b | 0003b810:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | ||
| 0003b | 0003b820:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | ||
| 0003b | 0003b830:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003b | 0003b840:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | ||
| 0003b | 0003b850:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003b | 0003b860:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | ||
| 0003b | 0003b870:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | ||
| 0003b | 0003b880:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003b | 0003b890:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | ||
| 0003b8a0:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003b8b0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003b8c0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003b8d0:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003b8e0:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003b8f0:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003b900:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003b910:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003b920:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003b930:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003b940:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003b950:·6172·6765·743d·2223·6964·6d35·3935·3822··arget="#idm5958" | |||
| 0003b960:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003b970:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003b980:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003b990:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003b9a0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003b9b0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| Max diff block lines reached; 6043737/6069873 bytes (99.57%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(intermediary) | 44 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:8 | 47 | ····*·cpe:/o:oracle:linux:8 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·Configure_Syslog | 56 | ·········4.·Configure_Syslog |
| 57 | ·········5.·Network_Configuration_and_Firewalls | 57 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 101, 31 lines modified | Offset 101, 39 lines modified | ||
| 101 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 101 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 102 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 102 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 103 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 103 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 104 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 104 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 105 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 105 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 106 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, | 106 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199, |
| 107 | ············OL08-00-010359,·SV-252654r818758_rule | 107 | ············OL08-00-010359,·SV-252654r818758_rule |
| 108 | Remediation_Anaconda_snippet_⇲ | ||
| 109 | Complexity:·low | ||
| 110 | Disruption:·low | ||
| 111 | Strategy:···enable | ||
| 112 | package·--add=aide | ||
| 113 | Remediation_Puppet_snippet_⇲ | 108 | Remediation_Puppet_snippet_⇲ |
| 114 | Complexity:·low | 109 | Complexity:·low |
| 115 | Disruption:·low | 110 | Disruption:·low |
| 116 | Strategy:···enable | 111 | Strategy:···enable |
| 117 | include·install_aide | 112 | include·install_aide |
| 118 | class·install_aide·{ | 113 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 114 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 115 | ····ensure·=>·'installed', |
| 121 | ··} | 116 | ··} |
| 122 | } | 117 | } |
| 118 | Remediation_Shell_script_⇲ | ||
| 119 | Complexity:·low | ||
| 120 | Disruption:·low | ||
| 121 | Strategy:···enable | ||
| 122 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 123 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 124 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 125 | ····yum·install·-y·"aide" | ||
| 126 | fi | ||
| 127 | else | ||
| 128 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 129 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 130 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 131 | Complexity:·low |
| 125 | Disruption:·low | 132 | Disruption:·low |
| 126 | Strategy:···enable | 133 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 134 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 135 | ··package: |
| 129 | ····name:·aide | 136 | ····name:·aide |
| Offset 143, 28 lines modified | Offset 151, 20 lines modified | ||
| 143 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 144 | ··-·package_aide_installed | 152 | ··-·package_aide_installed |
| 145 | Remediation_OSBuild_Blueprint_snippet_⇲ | 153 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 146 | [[packages]] | 154 | [[packages]] |
| 147 | name·=·"aide" | 155 | name·=·"aide" |
| 148 | version·=·"*" | 156 | version·=·"*" |
| 149 | Remediation_ | 157 | Remediation_Anaconda_snippet_⇲ |
| 150 | Complexity:·low | 158 | Complexity:·low |
| 151 | Disruption:·low | 159 | Disruption:·low |
| 152 | Strategy:···enable | 160 | Strategy:···enable |
| 153 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 154 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | package·--add=aide | ||
| 155 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 156 | ····yum·install·-y·"aide" | ||
| 157 | fi | ||
| 158 | else | ||
| 159 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 160 | fi | ||
| 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 162 | Run·the·following·command·to·generate·a·new·database: | 163 | Run·the·following·command·to·generate·a·new·database: |
| 163 | $·sudo·/usr/sbin/aide·--init | 164 | $·sudo·/usr/sbin/aide·--init |
| 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 165 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 166 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 167 | database·can·be·installed·as·follows: | 168 | database·can·be·installed·as·follows: |
| Offset 178, 14 lines modified | Offset 178, 28 lines modified | ||
| 178 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 178 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 179 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 179 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 180 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 180 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 181 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 181 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 182 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 182 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 183 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 183 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 184 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 184 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 185 | Remediation_Shell_script_⇲ | ||
| 186 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 187 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 188 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 189 | ····yum·install·-y·"aide" | ||
| 190 | fi | ||
| 191 | /usr/sbin/aide·--init | ||
| 192 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 193 | else | ||
| 194 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 195 | fi | ||
| 185 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 186 | Complexity:·low | 197 | Complexity:·low |
| 187 | Disruption:·low | 198 | Disruption:·low |
| 188 | Strategy:···restrict | 199 | Strategy:···restrict |
| 189 | -·name:·Ensure·AIDE·is·installed | 200 | -·name:·Ensure·AIDE·is·installed |
| 190 | ··package: | 201 | ··package: |
| 191 | ····name:·'{{·item·}}' | 202 | ····name:·'{{·item·}}' |
| Offset 250, 28 lines modified | Offset 264, 14 lines modified | ||
| 250 | ··-·PCI-DSS-Req-11.5 | 264 | ··-·PCI-DSS-Req-11.5 |
| 251 | ··-·aide_build_database | 265 | ··-·aide_build_database |
| 252 | ··-·low_complexity | 266 | ··-·low_complexity |
| 253 | ··-·low_disruption | 267 | ··-·low_disruption |
| 254 | ··-·medium_severity | 268 | ··-·medium_severity |
| 255 | ··-·no_reboot_needed | 269 | ··-·no_reboot_needed |
| Max diff block lines reached; 639325/643957 bytes (99.28%) of diff not shown. | |||
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00037dd0:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00037de0:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00037de0:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00037df0:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00037df0:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00037e00:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00037e00:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00037e10:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00037e10:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00037e20:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00037e20:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 00037e30:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 00037e30:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00037e40:·2032·3032·3 | 00037e40:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 00037e50:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 00037e60:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 00037e60:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 00037e70:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 00037e70:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 00037e80:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 00037e80:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00037e90:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00037e90:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00037ea0:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00037ea0:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00037eb0:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00037eb0:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 14990, 143 lines modified | Offset 14990, 143 lines modified | ||
| 0003a8d0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003a8d0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003a8e0:·646d·3939·3934·2220·7461·6269·6e64·6578··dm9994"·tabindex | 0003a8e0:·646d·3939·3934·2220·7461·6269·6e64·6578··dm9994"·tabindex | ||
| 0003a8f0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003a8f0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003a900:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003a900:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003a910:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003a910:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003a920:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003a920:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003a930:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003a930:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003a940:·6d65·6469·6174·696f·6e20· | 0003a940:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | ||
| 0003a950:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | |||
| 0003a960:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003a970:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003a980:·6c61·7073·6522·2069·643d·2269·646d·3939··lapse"·id="idm99 | |||
| 0003a990:·3934·223e·3c74·6162·6c65·2063·6c61·7373··94"><table·class | |||
| 0003a9a0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003a950:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003a960:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003a970:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003a980:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003a990:·6d39·3939·3422·3e3c·7461·626c·6520·636c··m9994"><table·cl | |||
| 0003a9a0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003a9b0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003a9 | 0003a9b0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003a9d0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003a9e0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003a9f0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003a | 0003a9c0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003a9d0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003a9e0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003a9f0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003aa00:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003aa10:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003aa20:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003aa30:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003aa40:·643e·7265·7374·7269·6374·3c2f·7464·3e3c··d>restrict</td>< | |||
| 0003aa50:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003aa60:·3e3c·636f·6465·3e0a·666f·7220·6620·696e··><code>.for·f·in | |||
| 0003aa70:·202f·6574·632f·7375·646f·6572·7320·2f65···/etc/sudoers·/e | |||
| 0003aa80:·7463·2f73·7564·6f65·7273·2e64·2f2a·203b··tc/sudoers.d/*·; | |||
| 0003aa90:·2064·6f0a·2020·6966·205b·2021·202d·6520···do.··if·[·!·-e· | |||
| 0003aaa0:·2224·6622·205d·203b·2074·6865·6e0a·2020··"$f"·]·;·then.·· | |||
| 0003aab0:·2020·636f·6e74·696e·7565·0a20·2066·690a····continue.··fi. | |||
| 0003aac0:·2020·6d61·7463·6869·6e67·5f6c·6973·743d····matching_list= | |||
| 0003aad0:·2428·6772·6570·202d·5020·275e·283f·2123··$(grep·-P·'^(?!# | |||
| 0003aae0:·292e·2a5b·5c73·5d2b·5c21·6175·7468·656e··).*[\s]+\!authen | |||
| 0003aaf0:·7469·6361·7465·2e2a·2427·2024·6620·7c20··ticate.*$'·$f·|· | |||
| 0003ab00:·756e·6971·2029·0a20·2069·6620·2120·7465··uniq·).··if·!·te | |||
| 0003ab10:·7374·202d·7a20·2224·6d61·7463·6869·6e67··st·-z·"$matching | |||
| 0003ab20:·5f6c·6973·7422·3b20·7468·656e·0a20·2020··_list";·then.··· | |||
| 0003ab30:·2077·6869·6c65·2049·4653·3d20·7265·6164···while·IFS=·read | |||
| 0003ab40:·202d·7220·656e·7472·793b·2064·6f0a·2020···-r·entry;·do.·· | |||
| 0003ab50:·2020·2020·2320·636f·6d6d·656e·7420·6f75······#·comment·ou | |||
| 0003ab60:·7420·2221·6175·7468·656e·7469·6361·7465··t·"!authenticate | |||
| 0003ab70:·2220·6d61·7463·6865·7320·746f·2070·7265··"·matches·to·pre | |||
| 0003ab80:·7365·7276·6520·7573·6572·2064·6174·610a··serve·user·data. | |||
| 0003ab90:·2020·2020·2020·7365·6420·2d69·2022·732f········sed·-i·"s/ | |||
| 0003aba0:·5e24·7b65·6e74·7279·7d24·2f23·2026·616d··^${entry}$/#·&am | |||
| 0003abb0:·703b·2f67·2220·2466·0a20·2020·2064·6f6e··p;/g"·$f.····don | |||
| 0003abc0:·6520·266c·743b·266c·743b·266c·743b·2022··e·<<<·" | |||
| 0003abd0:·246d·6174·6368·696e·675f·6c69·7374·220a··$matching_list". | |||
| 0003abe0:·0a20·2020·202f·7573·722f·7362·696e·2f76··.····/usr/sbin/v | |||
| 0003abf0:·6973·7564·6f20·2d63·6620·2466·2026·616d··isudo·-cf·$f·&am | |||
| 0003ac00:·703b·2667·743b·202f·6465·762f·6e75·6c6c··p;>·/dev/null | |||
| 0003ac10:·207c·7c20·6563·686f·2022·4661·696c·2074···||·echo·"Fail·t | |||
| 0003ac20:·6f20·7661·6c69·6461·7465·2024·6620·7769··o·validate·$f·wi | |||
| 0003ac30:·7468·2076·6973·7564·6f22·0a20·2066·690a··th·visudo".··fi. | |||
| 0003ac40:·646f·6e65·0a3c·2f63·6f64·653e·3c2f·7072··done.</code></pr | |||
| 0003ac50:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003ac60:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003ac70:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003ac80:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003ac90:·6172·6765·743d·2223·6964·6d39·3939·3522··arget="#idm9995" | |||
| 0003aca0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003acb0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003acc0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003acd0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003ace0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003acf0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003ad00:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003ad10:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003ad20:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003ad30:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003ad40:·6522·2069·643d·2269·646d·3939·3935·223e··e"·id="idm9995"> | |||
| 0003ad50:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003ad60:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003ad70:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003ad80:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003ad90:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003a | 0003ada0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003a | 0003adb0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003aa30:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003aa40:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003aa50:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003aa60:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003aa70:·3a20·4669·6e64·202f·6574·632f·7375·646f··:·Find·/etc/sudo | |||
| 0003aa80:·6572·732e·642f·2066·696c·6573·0a20·2066··ers.d/·files.··f | |||
| 0003aa90:·696e·643a·0a20·2020·2070·6174·6873·3a0a··ind:.····paths:. | |||
| 0003aaa0:·2020·2020·2d20·2f65·7463·2f73·7564·6f65······-·/etc/sudoe | |||
| 0003aab0:·7273·2e64·2f0a·2020·7265·6769·7374·6572··rs.d/.··register | |||
| 0003aac0:·3a20·7375·646f·6572·730a·2020·7461·6773··:·sudoers.··tags | |||
| 0003aad0:·3a0a·2020·2d20·4449·5341·2d53·5449·472d··:.··-·DISA-STIG- | |||
| 0003aae0:·4f4c·3038·2d30·302d·3031·3033·3831·0a20··OL08-00-010381.· | |||
| 0003aaf0:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003ab00:·4d2d·3628·6129·0a20·202d·204e·4953·542d··M-6(a).··-·NIST- | |||
| 0003ab10:·3830·302d·3533·2d49·412d·3131·0a20·202d··800-53-IA-11.··- | |||
| 0003ab20:·206c·6f77·5f63·6f6d·706c·6578·6974·790a···low_complexity. | |||
| 0003ab30:·2020·2d20·6c6f·775f·6469·7372·7570·7469····-·low_disrupti | |||
| 0003a | 0003adc0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003add0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003ade0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003adf0:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003ae00:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| Max diff block lines reached; 2430797/2450309 bytes (99.20%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(minimal) | 44 | Profile·Title·ANSSI-BP-028·(minimal) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:8 | 47 | ····*·cpe:/o:oracle:linux:8 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·Configure_Syslog | 55 | ·········3.·Configure_Syslog |
| 56 | ·········4.·File_Permissions_and_Masks | 56 | ·········4.·File_Permissions_and_Masks |
| 57 | ···2.·Services | 57 | ···2.·Services |
| Offset 87, 14 lines modified | Offset 87, 33 lines modified | ||
| 87 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 87 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 88 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 88 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 89 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 89 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 90 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 90 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 91 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 91 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 92 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 92 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 93 | ············000373-VMM-001490,·OL08-00-010381,·SV-248582r779312_rule | 93 | ············000373-VMM-001490,·OL08-00-010381,·SV-248582r779312_rule |
| 94 | Remediation_Shell_script_⇲ | ||
| 95 | Complexity:·low | ||
| 96 | Disruption:·low | ||
| 97 | Strategy:···restrict | ||
| 98 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 99 | ··if·[·!·-e·"$f"·]·;·then | ||
| 100 | ····continue | ||
| 101 | ··fi | ||
| 102 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 103 | ··if·!·test·-z·"$matching_list";·then | ||
| 104 | ····while·IFS=·read·-r·entry;·do | ||
| 105 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 106 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 107 | ····done·<<<·"$matching_list" | ||
| 108 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 109 | ··fi | ||
| 110 | done | ||
| 94 | Remediation_Ansible_snippet_⇲ | 111 | Remediation_Ansible_snippet_⇲ |
| 95 | Complexity:·low | 112 | Complexity:·low |
| 96 | Disruption:·low | 113 | Disruption:·low |
| 97 | Strategy:···restrict | 114 | Strategy:···restrict |
| 98 | -·name:·Find·/etc/sudoers.d/·files | 115 | -·name:·Find·/etc/sudoers.d/·files |
| 99 | ··find: | 116 | ··find: |
| 100 | ····paths: | 117 | ····paths: |
| Offset 126, 33 lines modified | Offset 145, 14 lines modified | ||
| 126 | ··-·NIST-800-53-IA-11 | 145 | ··-·NIST-800-53-IA-11 |
| 127 | ··-·low_complexity | 146 | ··-·low_complexity |
| 128 | ··-·low_disruption | 147 | ··-·low_disruption |
| 129 | ··-·medium_severity | 148 | ··-·medium_severity |
| 130 | ··-·no_reboot_needed | 149 | ··-·no_reboot_needed |
| 131 | ··-·restrict_strategy | 150 | ··-·restrict_strategy |
| 132 | ··-·sudo_remove_no_authenticate | 151 | ··-·sudo_remove_no_authenticate |
| 133 | Remediation_Shell_script_⇲ | ||
| 134 | Complexity:·low | ||
| 135 | Disruption:·low | ||
| 136 | Strategy:···restrict | ||
| 137 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 138 | ··if·[·!·-e·"$f"·]·;·then | ||
| 139 | ····continue | ||
| 140 | ··fi | ||
| 141 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 142 | ··if·!·test·-z·"$matching_list";·then | ||
| 143 | ····while·IFS=·read·-r·entry;·do | ||
| 144 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 145 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 146 | ····done·<<<·"$matching_list" | ||
| 147 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 148 | ··fi | ||
| 149 | done | ||
| 150 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 152 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 151 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 153 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 152 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 154 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 153 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 155 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 154 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 156 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 155 | ············have·authorization. | 157 | ············have·authorization. |
| 156 | Rationale: | 158 | Rationale: |
| Offset 163, 14 lines modified | Offset 163, 33 lines modified | ||
| 163 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 163 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 164 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 164 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 165 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 165 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 166 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 166 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 167 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 167 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 168 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 168 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 169 | ············000373-VMM-001490,·OL08-00-010380,·SV-248581r833208_rule | 169 | ············000373-VMM-001490,·OL08-00-010380,·SV-248581r833208_rule |
| 170 | Remediation_Shell_script_⇲ | ||
| 171 | Complexity:·low | ||
| 172 | Disruption:·low | ||
| 173 | Strategy:···restrict | ||
| 174 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 175 | ··if·[·!·-e·"$f"·]·;·then | ||
| 176 | ····continue | ||
| 177 | ··fi | ||
| 178 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 179 | ··if·!·test·-z·"$matching_list";·then | ||
| 180 | ····while·IFS=·read·-r·entry;·do | ||
| 181 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 182 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 183 | ····done·<<<·"$matching_list" | ||
| 184 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 185 | ··fi | ||
| 186 | done | ||
| 170 | Remediation_Ansible_snippet_⇲ | 187 | Remediation_Ansible_snippet_⇲ |
| 171 | Complexity:·low | 188 | Complexity:·low |
| 172 | Disruption:·low | 189 | Disruption:·low |
| 173 | Strategy:···restrict | 190 | Strategy:···restrict |
| 174 | -·name:·Find·/etc/sudoers.d/·files | 191 | -·name:·Find·/etc/sudoers.d/·files |
| 175 | ··find: | 192 | ··find: |
| 176 | ····paths: | 193 | ····paths: |
| Offset 202, 33 lines modified | Offset 221, 14 lines modified | ||
| 202 | ··-·NIST-800-53-IA-11 | 221 | ··-·NIST-800-53-IA-11 |
| 203 | ··-·low_complexity | 222 | ··-·low_complexity |
| 204 | ··-·low_disruption | 223 | ··-·low_disruption |
| 205 | ··-·medium_severity | 224 | ··-·medium_severity |
| 206 | ··-·no_reboot_needed | 225 | ··-·no_reboot_needed |
| 207 | ··-·restrict_strategy | 226 | ··-·restrict_strategy |
| 208 | ··-·sudo_remove_nopasswd | 227 | ··-·sudo_remove_nopasswd |
| 209 | Remediation_Shell_script_⇲ | ||
| 210 | Complexity:·low | ||
| Max diff block lines reached; 169936/175372 bytes (96.90%) of diff not shown. | |||
| Offset 14289, 16 lines modified | Offset 14289, 16 lines modified | ||
| 00037d00:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00037d00:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00037d10:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00037d10:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 00037d20:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 00037d20:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00037d30:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00037d30:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00037d40:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00037d40:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00037d50:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00037d50:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00037d60:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d60:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d70:·2028·6173·206f·6620·3230·323 | 00037d70:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00037d80:·323 | 00037d80:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00037d90:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00037d90:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00037da0:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00037da0:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00037db0:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00037db0:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00037dc0:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00037dc0:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00037dd0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00037dd0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00037de0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00037de0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00037df0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 00037df0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | ||
| Offset 15200, 323 lines modified | Offset 15200, 323 lines modified | ||
| 0003b5f0:·6574·3d22·2369·646d·3536·3234·2220·7461··et="#idm5624"·ta | 0003b5f0:·6574·3d22·2369·646d·3536·3234·2220·7461··et="#idm5624"·ta | ||
| 0003b600:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003b600:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003b610:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003b610:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003b620:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003b620:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003b630:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003b630:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003b640:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003b640:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003b650:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003b650:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003b660:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b670:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b680:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b690:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b6a0:·6964·3d22·6964·6d35·3632·3422·3e3c·7461··id="idm5624"><ta | |||
| 0003b6b0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b6c0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b6d0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b6e0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003b6f0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003b700:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003b710:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003b720:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003b730:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003b740:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003b750:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003b760:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003b770:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003b780:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003b790:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003b7a0:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | |||
| 0003b7b0:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003b7c0:·2020·7365·745f·6661·6374·3a0a·2020·2020····set_fact:.···· | |||
| 0003b7d0:·7061·636b·6167·655f·6d61·6e61·6765·725f··package_manager_ | |||
| 0003b7e0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003b7f0:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003b800:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003b810:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003b820:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003b830:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003b840:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003b850:·3137·312d·332e·332e·380a·2020·2d20·4e49··171-3.3.8.··-·NI | |||
| 0003b860:·5354·2d38·3030·2d31·3731·2d33·2e34·2e31··ST-800-171-3.4.1 | |||
| 0003b870:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003b880:·2d41·552d·3928·3329·0a20·202d·204e·4953··-AU-9(3).··-·NIS | |||
| 0003b890:·542d·3830·302d·3533·2d43·4d2d·3628·6329··T-800-53-CM-6(c) | |||
| 0003b8a0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003b8b0:·2d43·4d2d·3628·6429·0a20·202d·204e·4953··-CM-6(d).··-·NIS | |||
| 0003b8c0:·542d·3830·302d·3533·2d53·492d·370a·2020··T-800-53-SI-7.·· | |||
| 0003b8d0:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003b8e0:·2d37·2831·290a·2020·2d20·4e49·5354·2d38··-7(1).··-·NIST-8 | |||
| 0003b8f0:·3030·2d35·332d·5349·2d37·2836·290a·2020··00-53-SI-7(6).·· | |||
| 0003b900:·2d20·5043·492d·4453·532d·5265·712d·3131··-·PCI-DSS-Req-11 | |||
| 0003b910:·2e35·0a20·202d·2068·6967·685f·636f·6d70··.5.··-·high_comp | |||
| 0003b920:·6c65·7869·7479·0a20·202d·2068·6967·685f··lexity.··-·high_ | |||
| 0003b930:·7365·7665·7269·7479·0a20·202d·206d·6564··severity.··-·med | |||
| 0003b940:·6975·6d5f·6469·7372·7570·7469·6f6e·0a20··ium_disruption.· | |||
| 0003b950:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 0003b960:·6465·640a·2020·2d20·7265·7374·7269·6374··ded.··-·restrict | |||
| 0003b970:·5f73·7472·6174·6567·790a·2020·2d20·7270··_strategy.··-·rp | |||
| 0003b | 0003b660:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | ||
| 0003b670:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003b680:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003b690:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003b6a0:·2269·646d·3536·3234·223e·3c70·7265·3e3c··"idm5624"><pre>< | |||
| 0003b6b0:·636f·6465·3e0a·2320·4669·6e64·2077·6869··code>.#·Find·whi | |||
| 0003b6c0:·6368·2066·696c·6573·2068·6176·6520·696e··ch·files·have·in | |||
| 0003b6d0:·636f·7272·6563·7420·6861·7368·2028·6e6f··correct·hash·(no | |||
| 0003b6e0:·7420·696e·202f·6574·632c·2062·6563·6175··t·in·/etc,·becau | |||
| 0003b6f0:·7365·206f·6620·7468·6520·7379·7374·656d··se·of·the·system | |||
| 0003b700:·2072·656c·6174·6564·2063·6f6e·6669·6720···related·config· | |||
| 0003b710:·6669·6c65·7329·2061·6e64·2074·6865·6e20··files)·and·then· | |||
| 0003b720:·6765·7420·6669·6c65·7320·6e61·6d65·730a··get·files·names. | |||
| 0003b730:·6669·6c65·735f·7769·7468·5f69·6e63·6f72··files_with_incor | |||
| 0003b740:·7265·6374·5f68·6173·683d·2224·2872·706d··rect_hash="$(rpm | |||
| 0003b750:·202d·5661·202d·2d6e·6f63·6f6e·6669·6720···-Va·--noconfig· | |||
| 0003b760:·7c20·6772·6570·202d·4520·275e·2e2e·3527··|·grep·-E·'^..5' | |||
| 0003b770:·207c·2061·776b·2027·7b70·7269·6e74·2024···|·awk·'{print·$ | |||
| 0003b780:·4e46·7d27·2029·220a·0a23·2046·726f·6d20··NF}'·)"..#·From· | |||
| 0003b790:·6669·6c65·7320·6e61·6d65·7320·6765·7420··files·names·get· | |||
| 0003b7a0:·7061·636b·6167·6520·6e61·6d65·7320·616e··package·names·an | |||
| 0003b7b0:·6420·6368·616e·6765·206e·6577·6c69·6e65··d·change·newline | |||
| 0003b7c0:·2074·6f20·7370·6163·652c·2062·6563·6175···to·space,·becau | |||
| 0003b7d0:·7365·2072·706d·2077·7269·7465·7320·6561··se·rpm·writes·ea | |||
| 0003b7e0:·6368·2070·6163·6b61·6765·2074·6f20·6e65··ch·package·to·ne | |||
| 0003b7f0:·7720·6c69·6e65·0a70·6163·6b61·6765·735f··w·line.packages_ | |||
| 0003b800:·746f·5f72·6569·6e73·7461·6c6c·3d22·2428··to_reinstall="$( | |||
| 0003b810:·7270·6d20·2d71·6620·2466·696c·6573·5f77··rpm·-qf·$files_w | |||
| 0003b820:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003b830:·7368·207c·2074·7220·275c·6e27·2027·2027··sh·|·tr·'\n'·'·' | |||
| 0003b840:·2922·0a0a·0a79·756d·2072·6569·6e73·7461··)"...yum·reinsta | |||
| 0003b850:·6c6c·202d·7920·2470·6163·6b61·6765·735f··ll·-y·$packages_ | |||
| 0003b860:·746f·5f72·6569·6e73·7461·6c6c·0a3c·2f63··to_reinstall.</c | |||
| 0003b870:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003b880:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003b890:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003b8a0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003b8b0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003b8c0:·6964·6d35·3632·3522·2074·6162·696e·6465··idm5625"·tabinde | |||
| 0003b8d0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003b8e0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003b8f0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003b900:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003b910:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003b920:·656d·6564·6961·7469·6f6e·2041·6e73·6962··emediation·Ansib | |||
| 0003b930:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003b940:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003b950:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003b960:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003b970:·646d·3536·3235·223e·3c74·6162·6c65·2063··dm5625"><table·c | |||
| 0003b980:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003b990:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003b9a0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| Max diff block lines reached; 9194967/9239457 bytes (99.52%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | *****·Profile·Information·***** | 40 | *****·Profile·Information·***** |
| 41 | Profile·Title·Criminal·Justice·Information·Services·(CJIS)·Security·Policy | 41 | Profile·Title·Criminal·Justice·Information·Services·(CJIS)·Security·Policy |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cjis | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cjis |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:oracle:linux:8 | 44 | ····*·cpe:/o:oracle:linux:8 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·System_Accounting_with_auditd | 52 | ·········3.·System_Accounting_with_auditd |
| 53 | ·········4.·GRUB2_bootloader_configuration | 53 | ·········4.·GRUB2_bootloader_configuration |
| 54 | ·········5.·Network_Configuration_and_Firewalls | 54 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 80, 14 lines modified | Offset 80, 24 lines modified | ||
| 80 | $·sudo·yum·reinstall·PACKAGENAME | 80 | $·sudo·yum·reinstall·PACKAGENAME |
| 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 82 | $·sudo·rpm·-Uvh·PACKAGENAME | 82 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 84 | Severity: ················high | 84 | Severity: ················high |
| 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 87 | Remediation_Shell_script_⇲ | ||
| 88 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 89 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 90 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 91 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 92 | yum·reinstall·-y·$packages_to_reinstall | ||
| 87 | Remediation_Ansible_snippet_⇲ | 93 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·high | 94 | Complexity:·high |
| 89 | Disruption:·medium | 95 | Disruption:·medium |
| 90 | Strategy:···restrict | 96 | Strategy:···restrict |
| 91 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 97 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 92 | ··set_fact: | 98 | ··set_fact: |
| 93 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 99 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 231, 37 lines modified | Offset 241, 56 lines modified | ||
| 231 | ··-·PCI-DSS-Req-11.5 | 241 | ··-·PCI-DSS-Req-11.5 |
| 232 | ··-·high_complexity | 242 | ··-·high_complexity |
| 233 | ··-·high_severity | 243 | ··-·high_severity |
| 234 | ··-·medium_disruption | 244 | ··-·medium_disruption |
| 235 | ··-·no_reboot_needed | 245 | ··-·no_reboot_needed |
| 236 | ··-·restrict_strategy | 246 | ··-·restrict_strategy |
| 237 | ··-·rpm_verify_hashes | 247 | ··-·rpm_verify_hashes |
| 238 | Remediation_Shell_script_⇲ | ||
| 239 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 240 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 241 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 242 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 243 | yum·reinstall·-y·$packages_to_reinstall | ||
| 244 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 248 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 245 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 249 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 246 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 250 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 247 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 251 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 248 | $·rpm·-qf·FILENAME | 252 | $·rpm·-qf·FILENAME |
| 249 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 253 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 250 | $·sudo·rpm·--setperms·PACKAGENAME | 254 | $·sudo·rpm·--setperms·PACKAGENAME |
| 251 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 255 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 252 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 256 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 253 | Severity: ················high | 257 | Severity: ················high |
| 254 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 258 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 255 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 259 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 260 | Remediation_Shell_script_⇲ | ||
| 261 | Complexity:·high | ||
| 262 | Disruption:·medium | ||
| 263 | Strategy:···restrict | ||
| 264 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 265 | declare·-A·SETPERMS_RPM_DICT | ||
| 266 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 267 | #·is·expected·by·the·RPM·database | ||
| 268 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 269 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 270 | do | ||
| 271 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 272 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 273 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 274 | ········do | ||
| 275 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 276 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 277 | ········done | ||
| 278 | done | ||
| 279 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 280 | #·correct·values | ||
| 281 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 282 | do | ||
| 283 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 284 | done | ||
| 256 | Remediation_Ansible_snippet_⇲ | 285 | Remediation_Ansible_snippet_⇲ |
| 257 | Complexity:·high | 286 | Complexity:·high |
| 258 | Disruption:·medium | 287 | Disruption:·medium |
| 259 | Strategy:···restrict | 288 | Strategy:···restrict |
| 260 | -·name:·Read·list·of·files·with·incorrect·permissions | 289 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 261 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 290 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 262 | ····--nocaps·--nolinkto·--nouser·--nogroup | 291 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 335, 69 lines modified | Offset 364, 48 lines modified | ||
| 335 | ··-·PCI-DSS-Req-11.5 | 364 | ··-·PCI-DSS-Req-11.5 |
| 336 | ··-·high_complexity | 365 | ··-·high_complexity |
| 337 | ··-·high_severity | 366 | ··-·high_severity |
| 338 | ··-·medium_disruption | 367 | ··-·medium_disruption |
| 339 | ··-·no_reboot_needed | 368 | ··-·no_reboot_needed |
| 340 | ··-·restrict_strategy | 369 | ··-·restrict_strategy |
| 341 | ··-·rpm_verify_permissions | 370 | ··-·rpm_verify_permissions |
| 342 | Remediation_Shell_script_⇲ | ||
| 343 | Complexity:·high | ||
| 344 | Disruption:·medium | ||
| 345 | Strategy:···restrict | ||
| 346 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 347 | declare·-A·SETPERMS_RPM_DICT | ||
| 348 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 349 | #·is·expected·by·the·RPM·database | ||
| 350 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 831725/839904 bytes (99.03%) of diff not shown. | |||
| Offset 14329, 16 lines modified | Offset 14329, 16 lines modified | ||
| 00037f80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037f80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037f90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037f90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037fa0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037fa0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037fb0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037fb0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037fc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037fc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037fd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037fd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037fe0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037fe0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ff0:·2861·7320·6f66·2032·3032·3 | 00037ff0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038000:·3 | 00038000:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038010:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038010:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038020:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038020:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038030:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038030:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038040:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038040:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038050:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038050:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038060:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038060:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038070:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038070:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15267, 192 lines modified | Offset 15267, 192 lines modified | ||
| 0003ba20:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003ba20:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003ba30:·6964·6d35·3935·3722·2074·6162·696e·6465··idm5957"·tabinde | 0003ba30:·6964·6d35·3935·3722·2074·6162·696e·6465··idm5957"·tabinde | ||
| 0003ba40:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003ba40:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003ba50:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003ba50:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003ba60:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003ba60:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003ba70:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003ba70:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003ba80:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003ba80:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003ba90:·656d·6564·6961·7469·6f6e·20 | 0003ba90:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | ||
| 0003baa0:·6e64·6120·736e·6970·7065·7420·e287·b23c··nda·snippet·...< | |||
| 0003bab0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bac0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bad0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bae0:·6964·6d35·3935·3722·3e3c·7461·626c·6520··idm5957"><table· | |||
| 0003baf0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bb00:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bb10:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bb20:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bb30:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bb40:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bb50:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bb60:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bb70:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003bb80:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003bb90:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003bba0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003bbb0:·7072·653e·3c63·6f64·653e·0a70·6163·6b61··pre><code>.packa | |||
| 0003bbc0:·6765·202d·2d61·6464·3d61·6964·650a·3c2f··ge·--add=aide.</ | |||
| 0003bbd0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bbe0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003bbf0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003bc00:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003bc10:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003bc20:·2369·646d·3539·3538·2220·7461·6269·6e64··#idm5958"·tabind | |||
| 0003bc30:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bc40:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003bc50:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bc60:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003bc70:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003bc80:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | |||
| 0003bc90:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | |||
| 0003bca0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bcb0:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bcc0:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bcd0:·646d·3539·3538·223e·3c74·6162·6c65·2063··dm5958"><table·c | |||
| 0003bce0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bcf0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bd00:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bd10:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bd20:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bd30:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bd40:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bd50:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003bd60:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bd70:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003bd80:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003bd90:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bda0:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | |||
| 0003bdb0:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003bdc0:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003bdd0:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003bde0:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003bdf0:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003be00:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003be10:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003be20:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003be30:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003be40:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003be50:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003be60:·646d·3539·3539·2220·7461·6269·6e64·6578··dm5959"·tabindex | |||
| 0003be70:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003be80:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003be90:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003bea0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003beb0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003bec0:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003b | 0003baa0:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | ||
| 0003b | 0003bab0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | ||
| 0003b | 0003bac0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | ||
| 0003b | 0003bad0:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | ||
| 0003b | 0003bae0:·6d35·3935·3722·3e3c·7461·626c·6520·636c··m5957"><table·cl | ||
| 0003b | 0003baf0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | ||
| 0003b | 0003bb00:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | ||
| 0003b | 0003bb10:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | ||
| 0003b | 0003bb20:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | ||
| 0003b | 0003bb30:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | ||
| 0003b | 0003bb40:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003b | 0003bb50:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | ||
| 0003b | 0003bb60:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | ||
| 0003b | 0003bb70:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003b | 0003bb80:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | ||
| 0003b | 0003bb90:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | ||
| 0003b | 0003bba0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | ||
| 0003bbb0:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003bbc0:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003bbd0:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003bbe0:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003bbf0:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003bc00:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003bc10:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003bc20:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bc30:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bc40:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bc50:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bc60:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bc70:·6d35·3935·3822·2074·6162·696e·6465·783d··m5958"·tabindex= | |||
| 0003bc80:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bc90:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bca0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bcb0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bcc0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| Max diff block lines reached; 7359483/7385895 bytes (99.64%) of diff not shown. | |||
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | Profile·Title·Unclassified·Information·in·Non-federal·Information·Systems·and | 50 | Profile·Title·Unclassified·Information·in·Non-federal·Information·Systems·and |
| 51 | ··············Organizations·(NIST·800-171) | 51 | ··············Organizations·(NIST·800-171) |
| 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui | 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui |
| 53 | ***·CPE·Platforms·*** | 53 | ***·CPE·Platforms·*** |
| 54 | ····*·cpe:/o:oracle:linux:8 | 54 | ····*·cpe:/o:oracle:linux:8 |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·System_Settings | 59 | ···1.·System_Settings |
| 60 | ·········1.·Installing_and_Maintaining_Software | 60 | ·········1.·Installing_and_Maintaining_Software |
| 61 | ·········2.·Account_and_Access_Control | 61 | ·········2.·Account_and_Access_Control |
| 62 | ·········3.·System_Accounting_with_auditd | 62 | ·········3.·System_Accounting_with_auditd |
| 63 | ·········4.·GRUB2_bootloader_configuration | 63 | ·········4.·GRUB2_bootloader_configuration |
| 64 | ·········5.·Configure_Syslog | 64 | ·········5.·Configure_Syslog |
| Offset 91, 31 lines modified | Offset 91, 39 lines modified | ||
| 91 | ***·Rule ·Install·AIDE· [ref]·*** | 91 | ***·Rule ·Install·AIDE· [ref]·*** |
| 92 | The·aide·package·can·be·installed·with·the·following·command: | 92 | The·aide·package·can·be·installed·with·the·following·command: |
| 93 | $·sudo·yum·install·aide | 93 | $·sudo·yum·install·aide |
| 94 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 94 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 95 | Severity: ················medium | 95 | Severity: ················medium |
| 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 97 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·OL08-00-010359,·SV-252654r818758_rule | 97 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·OL08-00-010359,·SV-252654r818758_rule |
| 98 | Remediation_Anaconda_snippet_⇲ | ||
| 99 | Complexity:·low | ||
| 100 | Disruption:·low | ||
| 101 | Strategy:···enable | ||
| 102 | package·--add=aide | ||
| 103 | Remediation_Puppet_snippet_⇲ | 98 | Remediation_Puppet_snippet_⇲ |
| 104 | Complexity:·low | 99 | Complexity:·low |
| 105 | Disruption:·low | 100 | Disruption:·low |
| 106 | Strategy:···enable | 101 | Strategy:···enable |
| 107 | include·install_aide | 102 | include·install_aide |
| 108 | class·install_aide·{ | 103 | class·install_aide·{ |
| 109 | ··package·{·'aide': | 104 | ··package·{·'aide': |
| 110 | ····ensure·=>·'installed', | 105 | ····ensure·=>·'installed', |
| 111 | ··} | 106 | ··} |
| 112 | } | 107 | } |
| 108 | Remediation_Shell_script_⇲ | ||
| 109 | Complexity:·low | ||
| 110 | Disruption:·low | ||
| 111 | Strategy:···enable | ||
| 112 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 113 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 114 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 115 | ····yum·install·-y·"aide" | ||
| 116 | fi | ||
| 117 | else | ||
| 118 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 119 | fi | ||
| 113 | Remediation_Ansible_snippet_⇲ | 120 | Remediation_Ansible_snippet_⇲ |
| 114 | Complexity:·low | 121 | Complexity:·low |
| 115 | Disruption:·low | 122 | Disruption:·low |
| 116 | Strategy:···enable | 123 | Strategy:···enable |
| 117 | -·name:·Ensure·aide·is·installed | 124 | -·name:·Ensure·aide·is·installed |
| 118 | ··package: | 125 | ··package: |
| 119 | ····name:·aide | 126 | ····name:·aide |
| Offset 133, 28 lines modified | Offset 141, 20 lines modified | ||
| 133 | ··-·no_reboot_needed | 141 | ··-·no_reboot_needed |
| 134 | ··-·package_aide_installed | 142 | ··-·package_aide_installed |
| 135 | Remediation_OSBuild_Blueprint_snippet_⇲ | 143 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 136 | [[packages]] | 144 | [[packages]] |
| 137 | name·=·"aide" | 145 | name·=·"aide" |
| 138 | version·=·"*" | 146 | version·=·"*" |
| 139 | Remediation_ | 147 | Remediation_Anaconda_snippet_⇲ |
| 140 | Complexity:·low | 148 | Complexity:·low |
| 141 | Disruption:·low | 149 | Disruption:·low |
| 142 | Strategy:···enable | 150 | Strategy:···enable |
| 143 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 144 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 151 | package·--add=aide | ||
| 145 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 146 | ····yum·install·-y·"aide" | ||
| 147 | fi | ||
| 148 | else | ||
| 149 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 150 | fi | ||
| 151 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 152 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 152 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 153 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 153 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·8. | 154 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·8. |
| 154 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 155 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 155 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 156 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 163, 14 lines modified | Offset 163, 27 lines modified | ||
| 163 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 163 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 164 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 164 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 165 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 165 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 166 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 166 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 167 | Severity: ················high | 167 | Severity: ················high |
| 168 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 168 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 169 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL08-00-010020,·SV-248524r818787_rule | 169 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL08-00-010020,·SV-248524r818787_rule |
| 170 | Remediation_Shell_script_⇲ | ||
| 171 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 172 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 173 | fips-mode-setup·--enable | ||
| 174 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 175 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 176 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 177 | fi | ||
| 178 | else | ||
| 179 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 180 | fi | ||
| 170 | Remediation_Ansible_snippet_⇲ | 181 | Remediation_Ansible_snippet_⇲ |
| 171 | Complexity:·medium | 182 | Complexity:·medium |
| 172 | Disruption:·medium | 183 | Disruption:·medium |
| 173 | Reboot:·····true | 184 | Reboot:·····true |
| 174 | Strategy:···restrict | 185 | Strategy:···restrict |
| 175 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 186 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 176 | ··command:·/usr/bin/fips-mode-setup·--check | 187 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 228, 27 lines modified | Offset 241, 14 lines modified | ||
| 228 | ··-·NIST-800-53-SC-13 | 241 | ··-·NIST-800-53-SC-13 |
| 229 | ··-·enable_dracut_fips_module | 242 | ··-·enable_dracut_fips_module |
| 230 | ··-·high_severity | 243 | ··-·high_severity |
| 231 | ··-·medium_complexity | 244 | ··-·medium_complexity |
| 232 | ··-·medium_disruption | 245 | ··-·medium_disruption |
| 233 | ··-·reboot_required | 246 | ··-·reboot_required |
| 234 | ··-·restrict_strategy | 247 | ··-·restrict_strategy |
| Max diff block lines reached; 950278/957558 bytes (99.24%) of diff not shown. | |||
| Offset 14297, 15 lines modified | Offset 14297, 15 lines modified | ||
| 00037d80:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00037d80:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00037d90:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00037d90:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00037da0:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00037da0:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00037db0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00037db0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00037dc0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00037dc0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00037dd0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00037dd0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00037de0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00037de0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00037df0:·6620·3230·323 | 00037df0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00037e00:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00037e00:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00037e10:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00037e10:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00037e20:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00037e20:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00037e30:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00037e30:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00037e40:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00037e40:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00037e50:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00037e50:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00037e60:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00037e60:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15237, 323 lines modified | Offset 15237, 323 lines modified | ||
| 0003b840:·6574·3d22·2369·646d·3536·3234·2220·7461··et="#idm5624"·ta | 0003b840:·6574·3d22·2369·646d·3536·3234·2220·7461··et="#idm5624"·ta | ||
| 0003b850:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003b850:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003b860:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003b860:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003b870:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003b870:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003b880:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003b880:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003b890:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003b890:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003b8a0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003b8a0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003b8b0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b8c0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b8d0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b8e0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b8f0:·6964·3d22·6964·6d35·3632·3422·3e3c·7461··id="idm5624"><ta | |||
| 0003b900:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b910:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003b920:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003b930:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003b940:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003b950:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003b960:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003b970:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003b980:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003b990:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003b9a0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003b9b0:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003b9c0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003b9d0:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003b9e0:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003b9f0:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | |||
| 0003ba00:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003b | 0003b8b0:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | ||
| 0003b8c0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003b8d0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003b8e0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003b8f0:·2269·646d·3536·3234·223e·3c70·7265·3e3c··"idm5624"><pre>< | |||
| 0003b900:·636f·6465·3e0a·2320·4669·6e64·2077·6869··code>.#·Find·whi | |||
| 0003b910:·6368·2066·696c·6573·2068·6176·6520·696e··ch·files·have·in | |||
| 0003b920:·636f·7272·6563·7420·6861·7368·2028·6e6f··correct·hash·(no | |||
| 0003b930:·7420·696e·202f·6574·632c·2062·6563·6175··t·in·/etc,·becau | |||
| 0003b940:·7365·206f·6620·7468·6520·7379·7374·656d··se·of·the·system | |||
| 0003b950:·2072·656c·6174·6564·2063·6f6e·6669·6720···related·config· | |||
| 0003b960:·6669·6c65·7329·2061·6e64·2074·6865·6e20··files)·and·then· | |||
| 0003b970:·6765·7420·6669·6c65·7320·6e61·6d65·730a··get·files·names. | |||
| 0003b980:·6669·6c65·735f·7769·7468·5f69·6e63·6f72··files_with_incor | |||
| 0003b990:·7265·6374·5f68·6173·683d·2224·2872·706d··rect_hash="$(rpm | |||
| 0003b9a0:·202d·5661·202d·2d6e·6f63·6f6e·6669·6720···-Va·--noconfig· | |||
| 0003b9b0:·7c20·6772·6570·202d·4520·275e·2e2e·3527··|·grep·-E·'^..5' | |||
| 0003b9c0:·207c·2061·776b·2027·7b70·7269·6e74·2024···|·awk·'{print·$ | |||
| 0003b9d0:·4e46·7d27·2029·220a·0a23·2046·726f·6d20··NF}'·)"..#·From· | |||
| 0003b9e0:·6669·6c65·7320·6e61·6d65·7320·6765·7420··files·names·get· | |||
| 0003b9f0:·7061·636b·6167·6520·6e61·6d65·7320·616e··package·names·an | |||
| 0003ba00:·6420·6368·616e·6765·206e·6577·6c69·6e65··d·change·newline | |||
| 0003ba10:·2074·6f20·7370·6163·652c·2062·6563·6175···to·space,·becau | |||
| 0003ba20:·7365·2072·706d·2077·7269·7465·7320·6561··se·rpm·writes·ea | |||
| 0003ba30:·6368·2070·6163·6b61·6765·2074·6f20·6e65··ch·package·to·ne | |||
| 0003ba40:·7720·6c69·6e65·0a70·6163·6b61·6765·735f··w·line.packages_ | |||
| 0003ba50:·746f·5f72·6569·6e73·7461·6c6c·3d22·2428··to_reinstall="$( | |||
| 0003ba60:·7270·6d20·2d71·6620·2466·696c·6573·5f77··rpm·-qf·$files_w | |||
| 0003ba70:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003ba80:·7368·207c·2074·7220·275c·6e27·2027·2027··sh·|·tr·'\n'·'·' | |||
| 0003ba90:·2922·0a0a·0a79·756d·2072·6569·6e73·7461··)"...yum·reinsta | |||
| 0003baa0:·6c6c·202d·7920·2470·6163·6b61·6765·735f··ll·-y·$packages_ | |||
| 0003bab0:·746f·5f72·6569·6e73·7461·6c6c·0a3c·2f63··to_reinstall.</c | |||
| 0003bac0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003bad0:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003bae0:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003baf0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003bb00:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003bb10:·6964·6d35·3632·3522·2074·6162·696e·6465··idm5625"·tabinde | |||
| 0003bb20:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003bb30:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003bb40:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003bb50:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003bb60:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003bb70:·656d·6564·6961·7469·6f6e·2041·6e73·6962··emediation·Ansib | |||
| 0003bb80:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bb90:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bba0:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bbb0:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bbc0:·646d·3536·3235·223e·3c74·6162·6c65·2063··dm5625"><table·c | |||
| 0003bbd0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bbe0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bbf0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bc00:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bc10:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bc20:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003bc30:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bc40:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bc50:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003bc60:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bc70:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003bc80:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003bc90:·626c·653e·3c70·7265·3e3c·636f·6465·3e2d··ble><pre><code>- | |||
| 0003bca0:·206e·616d·653a·2027·5365·7420·6661·6374···name:·'Set·fact | |||
| 0003ba20 | 0003bcb0:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | ||
| 0003ba30:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003ba40:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003ba50:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003ba60:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003ba70:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003b | 0003bcc0:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | ||
| 0003bcd0:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003bce0:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003bcf0:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003bd00:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003bd10:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003bd20:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003bd30:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003bd40:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003bd50:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003bd60:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003b | 0003bd70:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | ||
| Max diff block lines reached; 5833341/5877693 bytes (99.25%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | *****·Profile·Information·***** | 41 | *****·Profile·Information·***** |
| 42 | Profile·Title·[DRAFT]·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight | 42 | Profile·Title·[DRAFT]·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:oracle:linux:8 | 45 | ····*·cpe:/o:oracle:linux:8 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·Configure_Syslog | 54 | ·········4.·Configure_Syslog |
| 55 | ·········5.·Network_Configuration_and_Firewalls | 55 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 87, 14 lines modified | Offset 87, 24 lines modified | ||
| 87 | $·sudo·yum·reinstall·PACKAGENAME | 87 | $·sudo·yum·reinstall·PACKAGENAME |
| 88 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 88 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 89 | $·sudo·rpm·-Uvh·PACKAGENAME | 89 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 90 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 90 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 91 | Severity: ················high | 91 | Severity: ················high |
| 92 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 92 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 93 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 93 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 94 | Remediation_Shell_script_⇲ | ||
| 95 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 96 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 97 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 98 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 99 | yum·reinstall·-y·$packages_to_reinstall | ||
| 94 | Remediation_Ansible_snippet_⇲ | 100 | Remediation_Ansible_snippet_⇲ |
| 95 | Complexity:·high | 101 | Complexity:·high |
| 96 | Disruption:·medium | 102 | Disruption:·medium |
| 97 | Strategy:···restrict | 103 | Strategy:···restrict |
| 98 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 104 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 99 | ··set_fact: | 105 | ··set_fact: |
| 100 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 106 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 238, 36 lines modified | Offset 248, 51 lines modified | ||
| 238 | ··-·PCI-DSS-Req-11.5 | 248 | ··-·PCI-DSS-Req-11.5 |
| 239 | ··-·high_complexity | 249 | ··-·high_complexity |
| 240 | ··-·high_severity | 250 | ··-·high_severity |
| 241 | ··-·medium_disruption | 251 | ··-·medium_disruption |
| 242 | ··-·no_reboot_needed | 252 | ··-·no_reboot_needed |
| 243 | ··-·restrict_strategy | 253 | ··-·restrict_strategy |
| 244 | ··-·rpm_verify_hashes | 254 | ··-·rpm_verify_hashes |
| 245 | Remediation_Shell_script_⇲ | ||
| 246 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 247 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 248 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 249 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 250 | yum·reinstall·-y·$packages_to_reinstall | ||
| 251 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 255 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 252 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 256 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 253 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 257 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 254 | run·the·following·command·to·determine·which·package·owns·it: | 258 | run·the·following·command·to·determine·which·package·owns·it: |
| 255 | $·rpm·-qf·FILENAME | 259 | $·rpm·-qf·FILENAME |
| 256 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 260 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 257 | $·sudo·rpm·--setugids·PACKAGENAME | 261 | $·sudo·rpm·--setugids·PACKAGENAME |
| 258 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 262 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 259 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 263 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 260 | Severity: ················high | 264 | Severity: ················high |
| 261 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 265 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 262 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 266 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 267 | Remediation_Shell_script_⇲ | ||
| 268 | Complexity:·high | ||
| 269 | Disruption:·medium | ||
| 270 | Strategy:···restrict | ||
| 271 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 272 | declare·-A·SETPERMS_RPM_DICT | ||
| 273 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 274 | #·is·expected·by·the·RPM·database | ||
| 275 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 276 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 277 | do | ||
| 278 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 279 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 280 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 281 | done | ||
| 282 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 283 | #·correct·values | ||
| 284 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 285 | do | ||
| 286 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 287 | done | ||
| 263 | Remediation_Ansible_snippet_⇲ | 288 | Remediation_Ansible_snippet_⇲ |
| 264 | Complexity:·high | 289 | Complexity:·high |
| 265 | Disruption:·medium | 290 | Disruption:·medium |
| 266 | Strategy:···restrict | 291 | Strategy:···restrict |
| 267 | -·name:·Read·list·of·files·with·incorrect·ownership | 292 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 268 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 293 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 269 | ····--nocaps·--nolinkto·--nomode | 294 | ····--nocaps·--nolinkto·--nomode |
| Offset 338, 52 lines modified | Offset 363, 56 lines modified | ||
| 338 | ··-·PCI-DSS-Req-11.5 | 363 | ··-·PCI-DSS-Req-11.5 |
| 339 | ··-·high_complexity | 364 | ··-·high_complexity |
| 340 | ··-·high_severity | 365 | ··-·high_severity |
| 341 | ··-·medium_disruption | 366 | ··-·medium_disruption |
| 342 | ··-·no_reboot_needed | 367 | ··-·no_reboot_needed |
| 343 | ··-·restrict_strategy | 368 | ··-·restrict_strategy |
| 344 | ··-·rpm_verify_ownership | 369 | ··-·rpm_verify_ownership |
| 370 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 371 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 372 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 373 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 374 | $·rpm·-qf·FILENAME | ||
| 375 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 376 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 377 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 378 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 379 | Severity: ················high | ||
| 380 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 381 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 345 | Remediation_Shell_script_⇲ | 382 | Remediation_Shell_script_⇲ |
| 346 | Complexity:·high | 383 | Complexity:·high |
| 347 | Disruption:·medium | 384 | Disruption:·medium |
| 348 | Strategy:···restrict | 385 | Strategy:···restrict |
| Max diff block lines reached; 598137/607292 bytes (98.49%) of diff not shown. | |||
| Offset 14315, 16 lines modified | Offset 14315, 16 lines modified | ||
| 00037ea0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00037ea0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00037eb0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00037eb0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00037ec0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00037ec0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00037ed0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00037ed0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00037ee0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00037ee0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00037ef0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00037ef0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037f10:·2020·2020·2861·7320·6f66·2032·3032·3 | 00037f10:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00037f20:·303 | 00037f20:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00037f30:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00037f30:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00037f40:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00037f40:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00037f50:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00037f50:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00037f60:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00037f60:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00037f70:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00037f70:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00037f80:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00037f80:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00037f90:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00037f90:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15262, 323 lines modified | Offset 15262, 323 lines modified | ||
| 0003b9d0:·6574·3d22·2369·646d·3536·3234·2220·7461··et="#idm5624"·ta | 0003b9d0:·6574·3d22·2369·646d·3536·3234·2220·7461··et="#idm5624"·ta | ||
| 0003b9e0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003b9e0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003b9f0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003b9f0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003ba00:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003ba00:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003ba10:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003ba10:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003ba20:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003ba20:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003ba30:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003ba30:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003ba40:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003ba50:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003ba60:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003ba70:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003ba80:·6964·3d22·6964·6d35·3632·3422·3e3c·7461··id="idm5624"><ta | |||
| 0003ba90:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003baa0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003bab0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003bac0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003bad0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003bae0:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003baf0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bb00:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003bb10:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003bb20:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bb30:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003bb40:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003bb50:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bb60:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003bb70:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003bb80:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | |||
| 0003bb90:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003b | 0003ba40:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | ||
| 0003ba50:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003ba60:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003ba70:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003ba80:·2269·646d·3536·3234·223e·3c70·7265·3e3c··"idm5624"><pre>< | |||
| 0003ba90:·636f·6465·3e0a·2320·4669·6e64·2077·6869··code>.#·Find·whi | |||
| 0003baa0:·6368·2066·696c·6573·2068·6176·6520·696e··ch·files·have·in | |||
| 0003bab0:·636f·7272·6563·7420·6861·7368·2028·6e6f··correct·hash·(no | |||
| 0003bac0:·7420·696e·202f·6574·632c·2062·6563·6175··t·in·/etc,·becau | |||
| 0003bad0:·7365·206f·6620·7468·6520·7379·7374·656d··se·of·the·system | |||
| 0003bae0:·2072·656c·6174·6564·2063·6f6e·6669·6720···related·config· | |||
| 0003baf0:·6669·6c65·7329·2061·6e64·2074·6865·6e20··files)·and·then· | |||
| 0003bb00:·6765·7420·6669·6c65·7320·6e61·6d65·730a··get·files·names. | |||
| 0003bb10:·6669·6c65·735f·7769·7468·5f69·6e63·6f72··files_with_incor | |||
| 0003bb20:·7265·6374·5f68·6173·683d·2224·2872·706d··rect_hash="$(rpm | |||
| 0003bb30:·202d·5661·202d·2d6e·6f63·6f6e·6669·6720···-Va·--noconfig· | |||
| 0003bb40:·7c20·6772·6570·202d·4520·275e·2e2e·3527··|·grep·-E·'^..5' | |||
| 0003bb50:·207c·2061·776b·2027·7b70·7269·6e74·2024···|·awk·'{print·$ | |||
| 0003bb60:·4e46·7d27·2029·220a·0a23·2046·726f·6d20··NF}'·)"..#·From· | |||
| 0003bb70:·6669·6c65·7320·6e61·6d65·7320·6765·7420··files·names·get· | |||
| 0003bb80:·7061·636b·6167·6520·6e61·6d65·7320·616e··package·names·an | |||
| 0003bb90:·6420·6368·616e·6765·206e·6577·6c69·6e65··d·change·newline | |||
| 0003bba0:·2074·6f20·7370·6163·652c·2062·6563·6175···to·space,·becau | |||
| 0003bbb0:·7365·2072·706d·2077·7269·7465·7320·6561··se·rpm·writes·ea | |||
| 0003bbc0:·6368·2070·6163·6b61·6765·2074·6f20·6e65··ch·package·to·ne | |||
| 0003bbd0:·7720·6c69·6e65·0a70·6163·6b61·6765·735f··w·line.packages_ | |||
| 0003bbe0:·746f·5f72·6569·6e73·7461·6c6c·3d22·2428··to_reinstall="$( | |||
| 0003bbf0:·7270·6d20·2d71·6620·2466·696c·6573·5f77··rpm·-qf·$files_w | |||
| 0003bc00:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003bc10:·7368·207c·2074·7220·275c·6e27·2027·2027··sh·|·tr·'\n'·'·' | |||
| 0003bc20:·2922·0a0a·0a79·756d·2072·6569·6e73·7461··)"...yum·reinsta | |||
| 0003bc30:·6c6c·202d·7920·2470·6163·6b61·6765·735f··ll·-y·$packages_ | |||
| 0003bc40:·746f·5f72·6569·6e73·7461·6c6c·0a3c·2f63··to_reinstall.</c | |||
| 0003bc50:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003bc60:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003bc70:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003bc80:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003bc90:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003bca0:·6964·6d35·3632·3522·2074·6162·696e·6465··idm5625"·tabinde | |||
| 0003bcb0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003bcc0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003bcd0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003bce0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003bcf0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003bd00:·656d·6564·6961·7469·6f6e·2041·6e73·6962··emediation·Ansib | |||
| 0003bd10:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bd20:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bd30:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bd40:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bd50:·646d·3536·3235·223e·3c74·6162·6c65·2063··dm5625"><table·c | |||
| 0003bd60:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bd70:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bd80:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bd90:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bda0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bdb0:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003bdc0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bdd0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bde0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003bdf0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003be00:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003be10:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003be20:·626c·653e·3c70·7265·3e3c·636f·6465·3e2d··ble><pre><code>- | |||
| 0003be30:·206e·616d·653a·2027·5365·7420·6661·6374···name:·'Set·fact | |||
| 0003b | 0003be40:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | ||
| 0003bbc0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003bbd0:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003bbe0:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003bbf0:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003bc00:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003b | 0003be50:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | ||
| 0003be60:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003be70:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003be80:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003be90:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003bea0:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003beb0:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003bec0:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003bed0:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003bee0:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003bef0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| Max diff block lines reached; 16714534/16759024 bytes (99.73%) of diff not shown. | |||
| Offset 46, 15 lines modified | Offset 46, 15 lines modified | ||
| 46 | *****·Profile·Information·***** | 46 | *****·Profile·Information·***** |
| 47 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) | 47 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) |
| 48 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa | 48 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa |
| 49 | ***·CPE·Platforms·*** | 49 | ***·CPE·Platforms·*** |
| 50 | ····*·cpe:/o:oracle:linux:8 | 50 | ····*·cpe:/o:oracle:linux:8 |
| 51 | *****·Revision·History·***** | 51 | *****·Revision·History·***** |
| 52 | Current·version:·0.1.65 | 52 | Current·version:·0.1.65 |
| 53 | ····*·draft·(as·of·202 | 53 | ····*·draft·(as·of·2025-02-23) |
| 54 | *****·Table·of·Contents·***** | 54 | *****·Table·of·Contents·***** |
| 55 | ···1.·System_Settings | 55 | ···1.·System_Settings |
| 56 | ·········1.·Installing_and_Maintaining_Software | 56 | ·········1.·Installing_and_Maintaining_Software |
| 57 | ·········2.·Account_and_Access_Control | 57 | ·········2.·Account_and_Access_Control |
| 58 | ·········3.·System_Accounting_with_auditd | 58 | ·········3.·System_Accounting_with_auditd |
| 59 | ·········4.·GRUB2_bootloader_configuration | 59 | ·········4.·GRUB2_bootloader_configuration |
| 60 | ·········5.·Configure_Syslog | 60 | ·········5.·Configure_Syslog |
| Offset 93, 14 lines modified | Offset 93, 24 lines modified | ||
| 93 | $·sudo·yum·reinstall·PACKAGENAME | 93 | $·sudo·yum·reinstall·PACKAGENAME |
| 94 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 94 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 95 | $·sudo·rpm·-Uvh·PACKAGENAME | 95 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 96 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 96 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 97 | Severity: ················high | 97 | Severity: ················high |
| 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 99 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 99 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 100 | Remediation_Shell_script_⇲ | ||
| 101 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 102 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 103 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 104 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 105 | yum·reinstall·-y·$packages_to_reinstall | ||
| 100 | Remediation_Ansible_snippet_⇲ | 106 | Remediation_Ansible_snippet_⇲ |
| 101 | Complexity:·high | 107 | Complexity:·high |
| 102 | Disruption:·medium | 108 | Disruption:·medium |
| 103 | Strategy:···restrict | 109 | Strategy:···restrict |
| 104 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 110 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 105 | ··set_fact: | 111 | ··set_fact: |
| 106 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 112 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 244, 37 lines modified | Offset 254, 56 lines modified | ||
| 244 | ··-·PCI-DSS-Req-11.5 | 254 | ··-·PCI-DSS-Req-11.5 |
| 245 | ··-·high_complexity | 255 | ··-·high_complexity |
| 246 | ··-·high_severity | 256 | ··-·high_severity |
| 247 | ··-·medium_disruption | 257 | ··-·medium_disruption |
| 248 | ··-·no_reboot_needed | 258 | ··-·no_reboot_needed |
| 249 | ··-·restrict_strategy | 259 | ··-·restrict_strategy |
| 250 | ··-·rpm_verify_hashes | 260 | ··-·rpm_verify_hashes |
| 251 | Remediation_Shell_script_⇲ | ||
| 252 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 253 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 254 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 255 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 256 | yum·reinstall·-y·$packages_to_reinstall | ||
| 257 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 261 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 258 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 262 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 259 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 263 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 260 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 264 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 261 | $·rpm·-qf·FILENAME | 265 | $·rpm·-qf·FILENAME |
| 262 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 266 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 263 | $·sudo·rpm·--setperms·PACKAGENAME | 267 | $·sudo·rpm·--setperms·PACKAGENAME |
| 264 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 268 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 265 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 269 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 266 | Severity: ················high | 270 | Severity: ················high |
| 267 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 271 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 268 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 272 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 273 | Remediation_Shell_script_⇲ | ||
| 274 | Complexity:·high | ||
| 275 | Disruption:·medium | ||
| 276 | Strategy:···restrict | ||
| 277 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 278 | declare·-A·SETPERMS_RPM_DICT | ||
| 279 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 280 | #·is·expected·by·the·RPM·database | ||
| 281 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 282 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 283 | do | ||
| 284 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 285 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 286 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 287 | ········do | ||
| 288 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 289 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 290 | ········done | ||
| 291 | done | ||
| 292 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 293 | #·correct·values | ||
| 294 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 295 | do | ||
| 296 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 297 | done | ||
| 269 | Remediation_Ansible_snippet_⇲ | 298 | Remediation_Ansible_snippet_⇲ |
| 270 | Complexity:·high | 299 | Complexity:·high |
| 271 | Disruption:·medium | 300 | Disruption:·medium |
| 272 | Strategy:···restrict | 301 | Strategy:···restrict |
| 273 | -·name:·Read·list·of·files·with·incorrect·permissions | 302 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 274 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 303 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 275 | ····--nocaps·--nolinkto·--nouser·--nogroup | 304 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 348, 43 lines modified | Offset 377, 14 lines modified | ||
| 348 | ··-·PCI-DSS-Req-11.5 | 377 | ··-·PCI-DSS-Req-11.5 |
| 349 | ··-·high_complexity | 378 | ··-·high_complexity |
| 350 | ··-·high_severity | 379 | ··-·high_severity |
| 351 | ··-·medium_disruption | 380 | ··-·medium_disruption |
| 352 | ··-·no_reboot_needed | 381 | ··-·no_reboot_needed |
| 353 | ··-·restrict_strategy | 382 | ··-·restrict_strategy |
| 354 | ··-·rpm_verify_permissions | 383 | ··-·rpm_verify_permissions |
| 355 | Remediation_Shell_script_⇲ | ||
| 356 | Complexity:·high | ||
| 357 | Disruption:·medium | ||
| 358 | Strategy:···restrict | ||
| 359 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 360 | declare·-A·SETPERMS_RPM_DICT | ||
| 361 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 362 | #·is·expected·by·the·RPM·database | ||
| 363 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1198566/1206729 bytes (99.32%) of diff not shown. | |||
| Offset 14304, 16 lines modified | Offset 14304, 16 lines modified | ||
| 00037df0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037df0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037e00:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037e00:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037e10:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037e10:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037e20:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037e20:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037e30:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037e30:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037e40:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037e40:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e60:·2861·7320·6f66·2032·3032·3 | 00037e60:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037e70:·3 | 00037e70:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037e80:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037e80:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037e90:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037e90:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037ea0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037ea0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037eb0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037eb0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037ec0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037ec0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037ed0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037ed0:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037ee0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037ee0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15242, 192 lines modified | Offset 15242, 192 lines modified | ||
| 0003b890:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003b890:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003b8a0:·6964·6d35·3935·3722·2074·6162·696e·6465··idm5957"·tabinde | 0003b8a0:·6964·6d35·3935·3722·2074·6162·696e·6465··idm5957"·tabinde | ||
| 0003b8b0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003b8b0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003b8c0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003b8c0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003b8d0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003b8d0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003b8e0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003b8e0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003b8f0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003b8f0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003b900:·656d·6564·6961·7469·6f6e·20 | 0003b900:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | ||
| 0003b910:·6e64·6120·736e·6970·7065·7420·e287·b23c··nda·snippet·...< | |||
| 0003b920:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003b930:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003b940:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003b950:·6964·6d35·3935·3722·3e3c·7461·626c·6520··idm5957"><table· | |||
| 0003b960:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003b970:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003b980:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003b990:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003b9a0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003b9b0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003b9c0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003b9d0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003b9e0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003b9f0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003ba00:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003ba10:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003ba20:·7072·653e·3c63·6f64·653e·0a70·6163·6b61··pre><code>.packa | |||
| 0003ba30:·6765·202d·2d61·6464·3d61·6964·650a·3c2f··ge·--add=aide.</ | |||
| 0003ba40:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003ba50:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003ba60:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003ba70:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003ba80:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003ba90:·2369·646d·3539·3538·2220·7461·6269·6e64··#idm5958"·tabind | |||
| 0003baa0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bab0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003bac0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bad0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003bae0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003baf0:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | |||
| 0003bb00:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | |||
| 0003bb10:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bb20:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bb30:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bb40:·646d·3539·3538·223e·3c74·6162·6c65·2063··dm5958"><table·c | |||
| 0003bb50:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bb60:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bb70:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bb80:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bb90:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bba0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bbb0:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bbc0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003bbd0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bbe0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003bbf0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003bc00:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bc10:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | |||
| 0003bc20:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003bc30:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003bc40:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003bc50:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003bc60:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003bc70:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003bc80:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bc90:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bca0:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bcb0:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003bcc0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003bcd0:·646d·3539·3539·2220·7461·6269·6e64·6578··dm5959"·tabindex | |||
| 0003bce0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003bcf0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003bd00:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003bd10:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003bd20:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003bd30:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003b | 0003b910:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | ||
| 0003b | 0003b920:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | ||
| 0003b | 0003b930:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | ||
| 0003b | 0003b940:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | ||
| 0003b | 0003b950:·6d35·3935·3722·3e3c·7461·626c·6520·636c··m5957"><table·cl | ||
| 0003b | 0003b960:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | ||
| 0003b | 0003b970:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | ||
| 0003b | 0003b980:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | ||
| 0003b | 0003b990:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | ||
| 0003b | 0003b9a0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | ||
| 0003b | 0003b9b0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003b | 0003b9c0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | ||
| 0003b | 0003b9d0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | ||
| 0003b | 0003b9e0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003b | 0003b9f0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | ||
| 0003b | 0003ba00:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | ||
| 0003b | 0003ba10:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | ||
| 0003ba20:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003ba30:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003ba40:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003ba50:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003ba60:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003ba70:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003ba80:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003ba90:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003baa0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bab0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bac0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bad0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bae0:·6d35·3935·3822·2074·6162·696e·6465·783d··m5958"·tabindex= | |||
| 0003baf0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bb00:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bb10:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bb20:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bb30:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| Max diff block lines reached; 7359483/7385895 bytes (99.64%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·[DRAFT]·Protection·Profile·for·General·Purpose·Operating·Systems | 44 | Profile·Title·[DRAFT]·Protection·Profile·for·General·Purpose·Operating·Systems |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:8 | 47 | ····*·cpe:/o:oracle:linux:8 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 84, 31 lines modified | Offset 84, 39 lines modified | ||
| 84 | ***·Rule ·Install·AIDE· [ref]·*** | 84 | ***·Rule ·Install·AIDE· [ref]·*** |
| 85 | The·aide·package·can·be·installed·with·the·following·command: | 85 | The·aide·package·can·be·installed·with·the·following·command: |
| 86 | $·sudo·yum·install·aide | 86 | $·sudo·yum·install·aide |
| 87 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 87 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 88 | Severity: ················medium | 88 | Severity: ················medium |
| 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 90 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·OL08-00-010359,·SV-252654r818758_rule | 90 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·OL08-00-010359,·SV-252654r818758_rule |
| 91 | Remediation_Anaconda_snippet_⇲ | ||
| 92 | Complexity:·low | ||
| 93 | Disruption:·low | ||
| 94 | Strategy:···enable | ||
| 95 | package·--add=aide | ||
| 96 | Remediation_Puppet_snippet_⇲ | 91 | Remediation_Puppet_snippet_⇲ |
| 97 | Complexity:·low | 92 | Complexity:·low |
| 98 | Disruption:·low | 93 | Disruption:·low |
| 99 | Strategy:···enable | 94 | Strategy:···enable |
| 100 | include·install_aide | 95 | include·install_aide |
| 101 | class·install_aide·{ | 96 | class·install_aide·{ |
| 102 | ··package·{·'aide': | 97 | ··package·{·'aide': |
| 103 | ····ensure·=>·'installed', | 98 | ····ensure·=>·'installed', |
| 104 | ··} | 99 | ··} |
| 105 | } | 100 | } |
| 101 | Remediation_Shell_script_⇲ | ||
| 102 | Complexity:·low | ||
| 103 | Disruption:·low | ||
| 104 | Strategy:···enable | ||
| 105 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 106 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 107 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 108 | ····yum·install·-y·"aide" | ||
| 109 | fi | ||
| 110 | else | ||
| 111 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 112 | fi | ||
| 106 | Remediation_Ansible_snippet_⇲ | 113 | Remediation_Ansible_snippet_⇲ |
| 107 | Complexity:·low | 114 | Complexity:·low |
| 108 | Disruption:·low | 115 | Disruption:·low |
| 109 | Strategy:···enable | 116 | Strategy:···enable |
| 110 | -·name:·Ensure·aide·is·installed | 117 | -·name:·Ensure·aide·is·installed |
| 111 | ··package: | 118 | ··package: |
| 112 | ····name:·aide | 119 | ····name:·aide |
| Offset 126, 28 lines modified | Offset 134, 20 lines modified | ||
| 126 | ··-·no_reboot_needed | 134 | ··-·no_reboot_needed |
| 127 | ··-·package_aide_installed | 135 | ··-·package_aide_installed |
| 128 | Remediation_OSBuild_Blueprint_snippet_⇲ | 136 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 129 | [[packages]] | 137 | [[packages]] |
| 130 | name·=·"aide" | 138 | name·=·"aide" |
| 131 | version·=·"*" | 139 | version·=·"*" |
| 132 | Remediation_ | 140 | Remediation_Anaconda_snippet_⇲ |
| 133 | Complexity:·low | 141 | Complexity:·low |
| 134 | Disruption:·low | 142 | Disruption:·low |
| 135 | Strategy:···enable | 143 | Strategy:···enable |
| 136 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 137 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 144 | package·--add=aide | ||
| 138 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 139 | ····yum·install·-y·"aide" | ||
| 140 | fi | ||
| 141 | else | ||
| 142 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 143 | fi | ||
| 144 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 145 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 145 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 146 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 146 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·8. | 147 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·8. |
| 147 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 148 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 148 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 149 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 156, 14 lines modified | Offset 156, 27 lines modified | ||
| 156 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 156 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 157 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 157 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 158 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 158 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 159 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 159 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 160 | Severity: ················high | 160 | Severity: ················high |
| 161 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 161 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 162 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL08-00-010020,·SV-248524r818787_rule | 162 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·OL08-00-010020,·SV-248524r818787_rule |
| 163 | Remediation_Shell_script_⇲ | ||
| 164 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 165 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 166 | fips-mode-setup·--enable | ||
| 167 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 168 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 169 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 170 | fi | ||
| 171 | else | ||
| 172 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 173 | fi | ||
| 163 | Remediation_Ansible_snippet_⇲ | 174 | Remediation_Ansible_snippet_⇲ |
| 164 | Complexity:·medium | 175 | Complexity:·medium |
| 165 | Disruption:·medium | 176 | Disruption:·medium |
| 166 | Reboot:·····true | 177 | Reboot:·····true |
| 167 | Strategy:···restrict | 178 | Strategy:···restrict |
| 168 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 179 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 169 | ··command:·/usr/bin/fips-mode-setup·--check | 180 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 221, 27 lines modified | Offset 234, 14 lines modified | ||
| 221 | ··-·NIST-800-53-SC-13 | 234 | ··-·NIST-800-53-SC-13 |
| 222 | ··-·enable_dracut_fips_module | 235 | ··-·enable_dracut_fips_module |
| 223 | ··-·high_severity | 236 | ··-·high_severity |
| 224 | ··-·medium_complexity | 237 | ··-·medium_complexity |
| 225 | ··-·medium_disruption | 238 | ··-·medium_disruption |
| 226 | ··-·reboot_required | 239 | ··-·reboot_required |
| 227 | ··-·restrict_strategy | 240 | ··-·restrict_strategy |
| Max diff block lines reached; 950278/957549 bytes (99.24%) of diff not shown. | |||
| Offset 14280, 16 lines modified | Offset 14280, 16 lines modified | ||
| 00037c70:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037c70:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037c80:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037c80:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037c90:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037c90:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037ca0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037ca0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037cb0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037cb0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037cc0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037cc0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037cd0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037cd0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ce0:·2020·2861·7320·6f66·2032·3032·3 | 00037ce0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037cf0:·2d32·3 | 00037cf0:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037d00:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037d00:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037d10:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037d10:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037d20:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037d20:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037d30:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037d30:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037d40:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037d40:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037d50:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037d50:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037d60:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037d60:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15207, 324 lines modified | Offset 15207, 324 lines modified | ||
| 0003b660:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003b660:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003b670:·6d35·3632·3422·2074·6162·696e·6465·783d··m5624"·tabindex= | 0003b670:·6d35·3632·3422·2074·6162·696e·6465·783d··m5624"·tabindex= | ||
| 0003b680:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003b680:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003b690:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003b690:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003b6a0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003b6a0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003b6b0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003b6b0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003b6c0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003b6c0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003b6d0:·6564·6961·7469·6f6e·20 | 0003b6d0:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0003b6e0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b6f0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b700:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b710:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b720:·3536·3234·223e·3c74·6162·6c65·2063·6c61··5624"><table·cla | |||
| 0003b730:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b740:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b750:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b760:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b770:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003b780:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003b790:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003b7a0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003b7b0:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003b7c0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003b7d0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003b7e0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003b7f0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003b800:·616d·653a·2027·5365·7420·6661·6374·3a20··ame:·'Set·fact:· | |||
| 0003b810:·5061·636b·6167·6520·6d61·6e61·6765·7220··Package·manager· | |||
| 0003b820:·7265·696e·7374·616c·6c20·636f·6d6d·616e··reinstall·comman | |||
| 0003b830:·6420·2864·6e66·2927·0a20·2073·6574·5f66··d·(dnf)'.··set_f | |||
| 0003b840:·6163·743a·0a20·2020·2070·6163·6b61·6765··act:.····package | |||
| 0003b850:·5f6d·616e·6167·6572·5f72·6569·6e73·7461··_manager_reinsta | |||
| 0003b860:·6c6c·5f63·6d64·3a20·646e·6620·7265·696e··ll_cmd:·dnf·rein | |||
| 0003b870:·7374·616c·6c20·2d79·0a20·2077·6865·6e3a··stall·-y.··when: | |||
| 0003b880:·2061·6e73·6962·6c65·5f64·6973·7472·6962···ansible_distrib | |||
| 0003b890:·7574·696f·6e20·3d3d·2022·4665·646f·7261··ution·==·"Fedora | |||
| 0003b8a0:·220a·2020·7461·6773·3a0a·2020·2d20·434a··".··tags:.··-·CJ | |||
| 0003b8b0:·4953·2d35·2e31·302e·342e·310a·2020·2d20··IS-5.10.4.1.··-· | |||
| 0003b8c0:·4e49·5354·2d38·3030·2d31·3731·2d33·2e33··NIST-800-171-3.3 | |||
| 0003b8d0:·2e38·0a20·202d·204e·4953·542d·3830·302d··.8.··-·NIST-800- | |||
| 0003b8e0:·3137·312d·332e·342e·310a·2020·2d20·4e49··171-3.4.1.··-·NI | |||
| 0003b8f0:·5354·2d38·3030·2d35·332d·4155·2d39·2833··ST-800-53-AU-9(3 | |||
| 0003b900:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003b910:·332d·434d·2d36·2863·290a·2020·2d20·4e49··3-CM-6(c).··-·NI | |||
| 0003b920:·5354·2d38·3030·2d35·332d·434d·2d36·2864··ST-800-53-CM-6(d | |||
| 0003b930:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003b940:·332d·5349·2d37·0a20·202d·204e·4953·542d··3-SI-7.··-·NIST- | |||
| 0003b950:·3830·302d·3533·2d53·492d·3728·3129·0a20··800-53-SI-7(1).· | |||
| 0003b960:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| 0003b970:·492d·3728·3629·0a20·202d·2050·4349·2d44··I-7(6).··-·PCI-D | |||
| 0003b980:·5353·2d52·6571·2d31·312e·350a·2020·2d20··SS-Req-11.5.··-· | |||
| 0003b990:·6869·6768·5f63·6f6d·706c·6578·6974·790a··high_complexity. | |||
| 0003b9a0:·2020·2d20·6869·6768·5f73·6576·6572·6974····-·high_severit | |||
| 0003b9b0:·790a·2020·2d20·6d65·6469·756d·5f64·6973··y.··-·medium_dis | |||
| 0003b9c0:·7275·7074·696f·6e0a·2020·2d20·6e6f·5f72··ruption.··-·no_r | |||
| 0003b9d0:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 0003b9e0:·2072·6573·7472·6963·745f·7374·7261·7465···restrict_strate | |||
| 0003b9f0:·6779·0a20·202d·2072·706d·5f76·6572·6966··gy.··-·rpm_verif | |||
| 0003b | 0003b6e0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | ||
| 0003b6f0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003b700:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003b710:·6170·7365·2220·6964·3d22·6964·6d35·3632··apse"·id="idm562 | |||
| 0003b720:·3422·3e3c·7072·653e·3c63·6f64·653e·0a23··4"><pre><code>.# | |||
| 0003b730:·2046·696e·6420·7768·6963·6820·6669·6c65···Find·which·file | |||
| 0003b740:·7320·6861·7665·2069·6e63·6f72·7265·6374··s·have·incorrect | |||
| 0003b750:·2068·6173·6820·286e·6f74·2069·6e20·2f65···hash·(not·in·/e | |||
| 0003b760:·7463·2c20·6265·6361·7573·6520·6f66·2074··tc,·because·of·t | |||
| 0003b770:·6865·2073·7973·7465·6d20·7265·6c61·7465··he·system·relate | |||
| 0003b780:·6420·636f·6e66·6967·2066·696c·6573·2920··d·config·files)· | |||
| 0003b790:·616e·6420·7468·656e·2067·6574·2066·696c··and·then·get·fil | |||
| 0003b7a0:·6573·206e·616d·6573·0a66·696c·6573·5f77··es·names.files_w | |||
| 0003b7b0:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003b7c0:·7368·3d22·2428·7270·6d20·2d56·6120·2d2d··sh="$(rpm·-Va·-- | |||
| 0003b7d0:·6e6f·636f·6e66·6967·207c·2067·7265·7020··noconfig·|·grep· | |||
| 0003b7e0:·2d45·2027·5e2e·2e35·2720·7c20·6177·6b20··-E·'^..5'·|·awk· | |||
| 0003b7f0:·277b·7072·696e·7420·244e·467d·2720·2922··'{print·$NF}'·)" | |||
| 0003b800:·0a0a·2320·4672·6f6d·2066·696c·6573·206e··..#·From·files·n | |||
| 0003b810:·616d·6573·2067·6574·2070·6163·6b61·6765··ames·get·package | |||
| 0003b820:·206e·616d·6573·2061·6e64·2063·6861·6e67···names·and·chang | |||
| 0003b830:·6520·6e65·776c·696e·6520·746f·2073·7061··e·newline·to·spa | |||
| 0003b840:·6365·2c20·6265·6361·7573·6520·7270·6d20··ce,·because·rpm· | |||
| 0003b850:·7772·6974·6573·2065·6163·6820·7061·636b··writes·each·pack | |||
| 0003b860:·6167·6520·746f·206e·6577·206c·696e·650a··age·to·new·line. | |||
| 0003b870:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003b880:·7374·616c·6c3d·2224·2872·706d·202d·7166··stall="$(rpm·-qf | |||
| 0003b890:·2024·6669·6c65·735f·7769·7468·5f69·6e63···$files_with_inc | |||
| 0003b8a0:·6f72·7265·6374·5f68·6173·6820·7c20·7472··orrect_hash·|·tr | |||
| 0003b8b0:·2027·5c6e·2720·2720·2729·220a·0a0a·7975···'\n'·'·')"...yu | |||
| 0003b8c0:·6d20·7265·696e·7374·616c·6c20·2d79·2024··m·reinstall·-y·$ | |||
| 0003b8d0:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003b8e0:·7374·616c·6c0a·3c2f·636f·6465·3e3c·2f70··stall.</code></p | |||
| 0003b8f0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003b900:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003b910:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003b920:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003b930:·7461·7267·6574·3d22·2369·646d·3536·3235··target="#idm5625 | |||
| 0003b940:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003b950:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003b960:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003b970:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003b980:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003b990:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003b9a0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003b9b0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003b9c0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003b9d0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003b9e0:·7365·2220·6964·3d22·6964·6d35·3632·3522··se"·id="idm5625" | |||
| 0003b9f0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003ba00:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003ba10:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| Max diff block lines reached; 14561614/14606242 bytes (99.69%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·Draft·for·Oracle·Linux·8 | 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·Draft·for·Oracle·Linux·8 |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:oracle:linux:8 | 41 | ····*·cpe:/o:oracle:linux:8 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 80, 14 lines modified | Offset 80, 24 lines modified | ||
| 80 | $·sudo·yum·reinstall·PACKAGENAME | 80 | $·sudo·yum·reinstall·PACKAGENAME |
| 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 82 | $·sudo·rpm·-Uvh·PACKAGENAME | 82 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 84 | Severity: ················high | 84 | Severity: ················high |
| 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 86 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 87 | Remediation_Shell_script_⇲ | ||
| 88 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 89 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 90 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 91 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 92 | yum·reinstall·-y·$packages_to_reinstall | ||
| 87 | Remediation_Ansible_snippet_⇲ | 93 | Remediation_Ansible_snippet_⇲ |
| 88 | Complexity:·high | 94 | Complexity:·high |
| 89 | Disruption:·medium | 95 | Disruption:·medium |
| 90 | Strategy:···restrict | 96 | Strategy:···restrict |
| 91 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 97 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 92 | ··set_fact: | 98 | ··set_fact: |
| 93 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 99 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 231, 37 lines modified | Offset 241, 56 lines modified | ||
| 231 | ··-·PCI-DSS-Req-11.5 | 241 | ··-·PCI-DSS-Req-11.5 |
| 232 | ··-·high_complexity | 242 | ··-·high_complexity |
| 233 | ··-·high_severity | 243 | ··-·high_severity |
| 234 | ··-·medium_disruption | 244 | ··-·medium_disruption |
| 235 | ··-·no_reboot_needed | 245 | ··-·no_reboot_needed |
| 236 | ··-·restrict_strategy | 246 | ··-·restrict_strategy |
| 237 | ··-·rpm_verify_hashes | 247 | ··-·rpm_verify_hashes |
| 238 | Remediation_Shell_script_⇲ | ||
| 239 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 240 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 241 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 242 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 243 | yum·reinstall·-y·$packages_to_reinstall | ||
| 244 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 248 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 245 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 249 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 246 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 250 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 247 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 251 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 248 | $·rpm·-qf·FILENAME | 252 | $·rpm·-qf·FILENAME |
| 249 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 253 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 250 | $·sudo·rpm·--setperms·PACKAGENAME | 254 | $·sudo·rpm·--setperms·PACKAGENAME |
| 251 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 255 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 252 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 256 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 253 | Severity: ················high | 257 | Severity: ················high |
| 254 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 258 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 255 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 259 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 260 | Remediation_Shell_script_⇲ | ||
| 261 | Complexity:·high | ||
| 262 | Disruption:·medium | ||
| 263 | Strategy:···restrict | ||
| 264 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 265 | declare·-A·SETPERMS_RPM_DICT | ||
| 266 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 267 | #·is·expected·by·the·RPM·database | ||
| 268 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 269 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 270 | do | ||
| 271 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 272 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 273 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 274 | ········do | ||
| 275 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 276 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 277 | ········done | ||
| 278 | done | ||
| 279 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 280 | #·correct·values | ||
| 281 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 282 | do | ||
| 283 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 284 | done | ||
| 256 | Remediation_Ansible_snippet_⇲ | 285 | Remediation_Ansible_snippet_⇲ |
| 257 | Complexity:·high | 286 | Complexity:·high |
| 258 | Disruption:·medium | 287 | Disruption:·medium |
| 259 | Strategy:···restrict | 288 | Strategy:···restrict |
| 260 | -·name:·Read·list·of·files·with·incorrect·permissions | 289 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 261 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 290 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 262 | ····--nocaps·--nolinkto·--nouser·--nogroup | 291 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 335, 69 lines modified | Offset 364, 48 lines modified | ||
| 335 | ··-·PCI-DSS-Req-11.5 | 364 | ··-·PCI-DSS-Req-11.5 |
| 336 | ··-·high_complexity | 365 | ··-·high_complexity |
| 337 | ··-·high_severity | 366 | ··-·high_severity |
| 338 | ··-·medium_disruption | 367 | ··-·medium_disruption |
| 339 | ··-·no_reboot_needed | 368 | ··-·no_reboot_needed |
| 340 | ··-·restrict_strategy | 369 | ··-·restrict_strategy |
| 341 | ··-·rpm_verify_permissions | 370 | ··-·rpm_verify_permissions |
| 342 | Remediation_Shell_script_⇲ | ||
| 343 | Complexity:·high | ||
| 344 | Disruption:·medium | ||
| 345 | Strategy:···restrict | ||
| 346 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 347 | declare·-A·SETPERMS_RPM_DICT | ||
| 348 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 349 | #·is·expected·by·the·RPM·database | ||
| 350 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1008521/1016680 bytes (99.20%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037ce0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037ce0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037cf0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037cf0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037d00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037d00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d30:·7320·6f66·2032·3032·3 | 00037d30:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037da0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037da0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15193, 324 lines modified | Offset 15193, 324 lines modified | ||
| 0003b580:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003b580:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003b590:·2369·646d·3536·3234·2220·7461·6269·6e64··#idm5624"·tabind | 0003b590:·2369·646d·3536·3234·2220·7461·6269·6e64··#idm5624"·tabind | ||
| 0003b5a0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003b5a0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003b5b0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003b5b0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003b5c0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003b5c0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003b5d0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003b5d0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003b5e0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003b5e0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003b5f0:·5265·6d65·6469·6174·696f·6e20· | 0003b5f0:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003b600:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003b610:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003b6 | 0003b600:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | ||
| 0003b610:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b620:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b630:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b640:·3536·3234·223e·3c70·7265·3e3c·636f·6465··5624"><pre><code | |||
| 0003b650:·3e0a·2320·4669·6e64·2077·6869·6368·2066··>.#·Find·which·f | |||
| 0003b660:·696c·6573·2068·6176·6520·696e·636f·7272··iles·have·incorr | |||
| 0003b670:·6563·7420·6861·7368·2028·6e6f·7420·696e··ect·hash·(not·in | |||
| 0003b680:·202f·6574·632c·2062·6563·6175·7365·206f···/etc,·because·o | |||
| 0003b690:·6620·7468·6520·7379·7374·656d·2072·656c··f·the·system·rel | |||
| 0003b6a0:·6174·6564·2063·6f6e·6669·6720·6669·6c65··ated·config·file | |||
| 0003b6b0:·7329·2061·6e64·2074·6865·6e20·6765·7420··s)·and·then·get· | |||
| 0003b6c0:·6669·6c65·7320·6e61·6d65·730a·6669·6c65··files·names.file | |||
| 0003b6d0:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003b6e0:·5f68·6173·683d·2224·2872·706d·202d·5661··_hash="$(rpm·-Va | |||
| 0003b6f0:·202d·2d6e·6f63·6f6e·6669·6720·7c20·6772···--noconfig·|·gr | |||
| 0003b700:·6570·202d·4520·275e·2e2e·3527·207c·2061··ep·-E·'^..5'·|·a | |||
| 0003b710:·776b·2027·7b70·7269·6e74·2024·4e46·7d27··wk·'{print·$NF}' | |||
| 0003b720:·2029·220a·0a23·2046·726f·6d20·6669·6c65···)"..#·From·file | |||
| 0003b730:·7320·6e61·6d65·7320·6765·7420·7061·636b··s·names·get·pack | |||
| 0003b740:·6167·6520·6e61·6d65·7320·616e·6420·6368··age·names·and·ch | |||
| 0003b750:·616e·6765·206e·6577·6c69·6e65·2074·6f20··ange·newline·to· | |||
| 0003b760:·7370·6163·652c·2062·6563·6175·7365·2072··space,·because·r | |||
| 0003b770:·706d·2077·7269·7465·7320·6561·6368·2070··pm·writes·each·p | |||
| 0003b780:·6163·6b61·6765·2074·6f20·6e65·7720·6c69··ackage·to·new·li | |||
| 0003b790:·6e65·0a70·6163·6b61·6765·735f·746f·5f72··ne.packages_to_r | |||
| 0003b7a0:·6569·6e73·7461·6c6c·3d22·2428·7270·6d20··einstall="$(rpm· | |||
| 0003b7b0:·2d71·6620·2466·696c·6573·5f77·6974·685f··-qf·$files_with_ | |||
| 0003b7c0:·696e·636f·7272·6563·745f·6861·7368·207c··incorrect_hash·| | |||
| 0003b7d0:·2074·7220·275c·6e27·2027·2027·2922·0a0a···tr·'\n'·'·')".. | |||
| 0003b7e0:·0a79·756d·2072·6569·6e73·7461·6c6c·202d··.yum·reinstall·- | |||
| 0003b7f0:·7920·2470·6163·6b61·6765·735f·746f·5f72··y·$packages_to_r | |||
| 0003b800:·6569·6e73·7461·6c6c·0a3c·2f63·6f64·653e··einstall.</code> | |||
| 0003b810:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003b820:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003b830:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003b | 0003b840:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003b850:·7461·2d74·6172·6765·743d·2223·6964·6d35··ta-target="#idm5 | |||
| 0003b860:·3632·3522·2074·6162·696e·6465·783d·2230··625"·tabindex="0 | |||
| 0003b870:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003b880:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003b890:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003b8a0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003b8b0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003b8c0:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003b8d0:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003b8e0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003b8f0:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003b900:·6c61·7073·6522·2069·643d·2269·646d·3536··lapse"·id="idm56 | |||
| 0003b910:·3235·223e·3c74·6162·6c65·2063·6c61·7373··25"><table·class | |||
| 0003b920:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003b930:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003b940:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003b950:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003b960:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003b970:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003b980:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003b990:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003b9a0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003b9b0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003b9c0:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003b9d0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003b9e0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003b640:·6964·6d35·3632·3422·3e3c·7461·626c·6520··idm5624"><table· | |||
| 0003b650:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003b660:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003b670:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003b680:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003b690:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003b6a0:·7468·3e3c·7464·3e68·6967·683c·2f74·643e··th><td>high</td> | |||
| 0003b6b0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003b6c0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003b6d0:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003b6e0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003b6f0:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003b700:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003b710:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003b720:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003b730:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003b740:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003b750:·6d61·6e64·2028·646e·6629·270a·2020·7365··mand·(dnf)'.··se | |||
| 0003b760:·745f·6661·6374·3a0a·2020·2020·7061·636b··t_fact:.····pack | |||
| 0003b770:·6167·655f·6d61·6e61·6765·725f·7265·696e··age_manager_rein | |||
| 0003b780:·7374·616c·6c5f·636d·643a·2064·6e66·2072··stall_cmd:·dnf·r | |||
| 0003b790:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003b7a0:·656e·3a20·616e·7369·626c·655f·6469·7374··en:·ansible_dist | |||
| 0003b7b0:·7269·6275·7469·6f6e·203d·3d20·2246·6564··ribution·==·"Fed | |||
| 0003b7c0:·6f72·6122·0a20·2074·6167·733a·0a20·202d··ora".··tags:.··- | |||
| 0003b7d0:·2043·4a49·532d·352e·3130·2e34·2e31·0a20···CJIS-5.10.4.1.· | |||
| 0003b7e0:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003b7f0:·332e·332e·380a·2020·2d20·4e49·5354·2d38··3.3.8.··-·NIST-8 | |||
| 0003b800:·3030·2d31·3731·2d33·2e34·2e31·0a20·202d··00-171-3.4.1.··- | |||
| 0003b810:·204e·4953·542d·3830·302d·3533·2d41·552d···NIST-800-53-AU- | |||
| 0003b820:·3928·3329·0a20·202d·204e·4953·542d·3830··9(3).··-·NIST-80 | |||
| 0003b830:·302d·3533·2d43·4d2d·3628·6329·0a20·202d··0-53-CM-6(c).··- | |||
| 0003b840:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003b850:·3628·6429·0a20·202d·204e·4953·542d·3830··6(d).··-·NIST-80 | |||
| 0003b860:·302d·3533·2d53·492d·370a·2020·2d20·4e49··0-53-SI-7.··-·NI | |||
| 0003b870:·5354·2d38·3030·2d35·332d·5349·2d37·2831··ST-800-53-SI-7(1 | |||
| 0003b880:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003b890:·332d·5349·2d37·2836·290a·2020·2d20·5043··3-SI-7(6).··-·PC | |||
| Max diff block lines reached; 10359029/10388477 bytes (99.72%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Oracle·Linux·8 | 39 | Profile·Title·Standard·System·Security·Profile·for·Oracle·Linux·8 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:oracle:linux:8 | 42 | ····*·cpe:/o:oracle:linux:8 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 78, 14 lines modified | Offset 78, 24 lines modified | ||
| 78 | $·sudo·yum·reinstall·PACKAGENAME | 78 | $·sudo·yum·reinstall·PACKAGENAME |
| 79 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 79 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 80 | $·sudo·rpm·-Uvh·PACKAGENAME | 80 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 81 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 81 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 82 | Severity: ················high | 82 | Severity: ················high |
| 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 84 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 84 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 85 | Remediation_Shell_script_⇲ | ||
| 86 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 87 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 88 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 89 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 90 | yum·reinstall·-y·$packages_to_reinstall | ||
| 85 | Remediation_Ansible_snippet_⇲ | 91 | Remediation_Ansible_snippet_⇲ |
| 86 | Complexity:·high | 92 | Complexity:·high |
| 87 | Disruption:·medium | 93 | Disruption:·medium |
| 88 | Strategy:···restrict | 94 | Strategy:···restrict |
| 89 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 95 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 90 | ··set_fact: | 96 | ··set_fact: |
| 91 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 97 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 229, 37 lines modified | Offset 239, 56 lines modified | ||
| 229 | ··-·PCI-DSS-Req-11.5 | 239 | ··-·PCI-DSS-Req-11.5 |
| 230 | ··-·high_complexity | 240 | ··-·high_complexity |
| 231 | ··-·high_severity | 241 | ··-·high_severity |
| 232 | ··-·medium_disruption | 242 | ··-·medium_disruption |
| 233 | ··-·no_reboot_needed | 243 | ··-·no_reboot_needed |
| 234 | ··-·restrict_strategy | 244 | ··-·restrict_strategy |
| 235 | ··-·rpm_verify_hashes | 245 | ··-·rpm_verify_hashes |
| 236 | Remediation_Shell_script_⇲ | ||
| 237 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 238 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 239 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 240 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 241 | yum·reinstall·-y·$packages_to_reinstall | ||
| 242 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 246 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 243 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 247 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 244 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 248 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 245 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 249 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 246 | $·rpm·-qf·FILENAME | 250 | $·rpm·-qf·FILENAME |
| 247 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 251 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 248 | $·sudo·rpm·--setperms·PACKAGENAME | 252 | $·sudo·rpm·--setperms·PACKAGENAME |
| 249 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 253 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 250 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 254 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 251 | Severity: ················high | 255 | Severity: ················high |
| 252 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 256 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 253 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 257 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 258 | Remediation_Shell_script_⇲ | ||
| 259 | Complexity:·high | ||
| 260 | Disruption:·medium | ||
| 261 | Strategy:···restrict | ||
| 262 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 263 | declare·-A·SETPERMS_RPM_DICT | ||
| 264 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 265 | #·is·expected·by·the·RPM·database | ||
| 266 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 267 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 268 | do | ||
| 269 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 270 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 271 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 272 | ········do | ||
| 273 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 274 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 275 | ········done | ||
| 276 | done | ||
| 277 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 278 | #·correct·values | ||
| 279 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 280 | do | ||
| 281 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 282 | done | ||
| 254 | Remediation_Ansible_snippet_⇲ | 283 | Remediation_Ansible_snippet_⇲ |
| 255 | Complexity:·high | 284 | Complexity:·high |
| 256 | Disruption:·medium | 285 | Disruption:·medium |
| 257 | Strategy:···restrict | 286 | Strategy:···restrict |
| 258 | -·name:·Read·list·of·files·with·incorrect·permissions | 287 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 259 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 288 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 260 | ····--nocaps·--nolinkto·--nouser·--nogroup | 289 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 333, 43 lines modified | Offset 362, 14 lines modified | ||
| 333 | ··-·PCI-DSS-Req-11.5 | 362 | ··-·PCI-DSS-Req-11.5 |
| 334 | ··-·high_complexity | 363 | ··-·high_complexity |
| 335 | ··-·high_severity | 364 | ··-·high_severity |
| 336 | ··-·medium_disruption | 365 | ··-·medium_disruption |
| 337 | ··-·no_reboot_needed | 366 | ··-·no_reboot_needed |
| 338 | ··-·restrict_strategy | 367 | ··-·restrict_strategy |
| 339 | ··-·rpm_verify_permissions | 368 | ··-·rpm_verify_permissions |
| 340 | Remediation_Shell_script_⇲ | ||
| 341 | Complexity:·high | ||
| 342 | Disruption:·medium | ||
| 343 | Strategy:···restrict | ||
| 344 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 345 | declare·-A·SETPERMS_RPM_DICT | ||
| 346 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 347 | #·is·expected·by·the·RPM·database | ||
| 348 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 741654/749808 bytes (98.91%) of diff not shown. | |||
| Offset 14278, 15 lines modified | Offset 14278, 15 lines modified | ||
| 00037c50:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00037c50:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00037c60:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00037c60:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00037c70:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00037c70:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00037c80:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00037c80:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00037c90:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00037c90:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00037ca0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00037ca0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00037cb0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00037cb0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00037cc0:·6620·3230·323 | 00037cc0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00037cd0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00037cd0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00037ce0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00037ce0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00037cf0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00037cf0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00037d00:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00037d00:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00037d10:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00037d10:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00037d20:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00037d20:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00037d30:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00037d30:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15243, 192 lines modified | Offset 15243, 192 lines modified | ||
| 0003b8a0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003b8a0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003b8b0:·6964·6d35·3935·3722·2074·6162·696e·6465··idm5957"·tabinde | 0003b8b0:·6964·6d35·3935·3722·2074·6162·696e·6465··idm5957"·tabinde | ||
| 0003b8c0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003b8c0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003b8d0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003b8d0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003b8e0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003b8e0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003b8f0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003b8f0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003b900:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003b900:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003b910:·656d·6564·6961·7469·6f6e·20 | 0003b910:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | ||
| 0003b920:·6e64·6120·736e·6970·7065·7420·e287·b23c··nda·snippet·...< | |||
| 0003b930:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003b940:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003b950:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003b960:·6964·6d35·3935·3722·3e3c·7461·626c·6520··idm5957"><table· | |||
| 0003b970:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003b980:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003b990:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003b9a0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003b9b0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003b9c0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003b9d0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003b9e0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003b9f0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003ba00:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003ba10:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003ba20:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003ba30:·7072·653e·3c63·6f64·653e·0a70·6163·6b61··pre><code>.packa | |||
| 0003ba40:·6765·202d·2d61·6464·3d61·6964·650a·3c2f··ge·--add=aide.</ | |||
| 0003ba50:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003ba60:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003ba70:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003ba80:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003ba90:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003baa0:·2369·646d·3539·3538·2220·7461·6269·6e64··#idm5958"·tabind | |||
| 0003bab0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bac0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003bad0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bae0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003baf0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003bb00:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | |||
| 0003bb10:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | |||
| 0003bb20:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bb30:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bb40:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bb50:·646d·3539·3538·223e·3c74·6162·6c65·2063··dm5958"><table·c | |||
| 0003bb60:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bb70:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bb80:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bb90:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bba0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bbb0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bbc0:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bbd0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003bbe0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bbf0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003bc00:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003bc10:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bc20:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | |||
| 0003bc30:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003bc40:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003bc50:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003bc60:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003bc70:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003bc80:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003bc90:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bca0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bcb0:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bcc0:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003bcd0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003bce0:·646d·3539·3539·2220·7461·6269·6e64·6578··dm5959"·tabindex | |||
| 0003bcf0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003bd00:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003bd10:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003bd20:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003bd30:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003bd40:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003b | 0003b920:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | ||
| 0003b | 0003b930:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | ||
| 0003b | 0003b940:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | ||
| 0003b | 0003b950:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | ||
| 0003b | 0003b960:·6d35·3935·3722·3e3c·7461·626c·6520·636c··m5957"><table·cl | ||
| 0003b | 0003b970:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | ||
| 0003b | 0003b980:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | ||
| 0003b | 0003b990:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | ||
| 0003b | 0003b9a0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | ||
| 0003b | 0003b9b0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | ||
| 0003b | 0003b9c0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003b | 0003b9d0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | ||
| 0003b | 0003b9e0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | ||
| 0003b | 0003b9f0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003b | 0003ba00:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | ||
| 0003b | 0003ba10:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | ||
| 0003b | 0003ba20:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | ||
| 0003ba30:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003ba40:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003ba50:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003ba60:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003ba70:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003ba80:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003ba90:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003baa0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bab0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bac0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bad0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bae0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003baf0:·6d35·3935·3822·2074·6162·696e·6465·783d··m5958"·tabindex= | |||
| 0003bb00:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bb10:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bb20:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bb30:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bb40:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bb50:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | |||
| Max diff block lines reached; 25460957/25487231 bytes (99.90%) of diff not shown. | |||
| Offset 14301, 16 lines modified | Offset 14301, 16 lines modified | ||
| 00037dc0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00037dc0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00037dd0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00037dd0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 00037de0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 00037de0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00037df0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00037df0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00037e00:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00037e00:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00037e10:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00037e10:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00037e20:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e20:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e30:·2028·6173·206f·6620·3230·323 | 00037e30:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00037e40:·323 | 00037e40:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00037e50:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00037e50:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00037e60:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00037e60:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00037e70:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00037e70:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00037e80:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00037e80:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00037e90:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00037e90:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00037ea0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00037ea0:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00037eb0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 00037eb0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | ||
| Offset 15261, 192 lines modified | Offset 15261, 192 lines modified | ||
| 0003b9c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b9c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b9d0:·3d22·2369·646d·3539·3537·2220·7461·6269··="#idm5957"·tabi | 0003b9d0:·3d22·2369·646d·3539·3537·2220·7461·6269··="#idm5957"·tabi | ||
| 0003b9e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b9e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b9f0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b9f0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003ba00:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003ba00:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003ba10:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003ba10:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003ba20:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003ba20:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003ba30:·223e·5265·6d65·6469·6174·696f·6e20· | 0003ba30:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | ||
| 0003ba40:·6163·6f6e·6461·2073·6e69·7070·6574·20e2··aconda·snippet·. | |||
| 0003ba50:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003ba60:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003ba70:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003ba80:·643d·2269·646d·3539·3537·223e·3c74·6162··d="idm5957"><tab | |||
| 0003ba90:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003baa0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bab0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bac0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bad0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bae0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003baf0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bb00:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bb10:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bb20:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bb30:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003bb40:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bb50:·653e·3c70·7265·3e3c·636f·6465·3e0a·7061··e><pre><code>.pa | |||
| 0003bb60:·636b·6167·6520·2d2d·6164·643d·6169·6465··ckage·--add=aide | |||
| 0003bb70:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bb80:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bb90:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bba0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bbb0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bbc0:·743d·2223·6964·6d35·3935·3822·2074·6162··t="#idm5958"·tab | |||
| 0003bbd0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bbe0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bbf0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bc00:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bc10:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bc20:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | |||
| 0003bc30:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | |||
| 0003bc40:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003bc50:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003bc60:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003bc70:·3d22·6964·6d35·3935·3822·3e3c·7461·626c··="idm5958"><tabl | |||
| 0003bc80:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003bc90:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003bca0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003bcb0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003bcc0:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003bcd0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003bce0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003bcf0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003bd00:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003bd10:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003bd20:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003bd30:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003bd40:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003bd50:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003bd60:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003bd70:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003bd80:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003bd90:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003bda0:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003bdb0:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003bdc0:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003bdd0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bde0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bdf0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003be00:·2223·6964·6d35·3935·3922·2074·6162·696e··"#idm5959"·tabin | |||
| 0003be10:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003be20:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003be30:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003be40:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003be50:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003be60:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003b | 0003ba40:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | ||
| 0003b | 0003ba50:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 0003b | 0003ba60:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 0003b | 0003ba70:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 0003b | 0003ba80:·2269·646d·3539·3537·223e·3c74·6162·6c65··"idm5957"><table | ||
| 0003b | 0003ba90:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 0003b | 0003baa0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 0003b | 0003bab0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 0003b | 0003bac0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 0003b | 0003bad0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 0003b | 0003bae0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003b | 0003baf0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 0003b | 0003bb00:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 0003b | 0003bb10:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003b | 0003bb20:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 0003b | 0003bb30:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | ||
| 0003b | 0003bb40:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | ||
| 0003bb50:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003bb60:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003bb70:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003bb80:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003bb90:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003bba0:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003bbb0:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003bbc0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bbd0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003bbe0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003bbf0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003bc00:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003bc10:·2369·646d·3539·3538·2220·7461·6269·6e64··#idm5958"·tabind | |||
| 0003bc20:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bc30:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003bc40:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bc50:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003bc60:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| Max diff block lines reached; 25427087/25453499 bytes (99.90%) of diff not shown. | |||
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037dd0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037de0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037de0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037df0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037df0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037e00:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037e00:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037e10:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037e10:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037e20:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037e20:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037e30:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037e30:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037e40:·3032·3 | 00037e40:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037e50:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037e50:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037e60:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037e60:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037e70:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037e70:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037e80:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037e80:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037e90:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037e90:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037ea0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037ea0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037eb0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037eb0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15210, 190 lines modified | Offset 15210, 190 lines modified | ||
| 0003b690:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b690:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b6a0:·3d22·2369·646d·3534·3032·2220·7461·6269··="#idm5402"·tabi | 0003b6a0:·3d22·2369·646d·3534·3032·2220·7461·6269··="#idm5402"·tabi | ||
| 0003b6b0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b6b0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b6c0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b6c0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b6d0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b6d0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b6e0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b6e0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b6f0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b6f0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b700:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b700:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | ||
| 0003b710:·6163·6f6e·6461·2073·6e69·7070·6574·20e2··aconda·snippet·. | |||
| 0003b720:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b730:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b740:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003b750:·643d·2269·646d·3534·3032·223e·3c74·6162··d="idm5402"><tab | |||
| 0003b760:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003b770:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003b780:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003b790:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003b7a0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003b7b0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003b7c0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003b7d0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b7e0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003b7f0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003b800:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003b810:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003b820:·653e·3c70·7265·3e3c·636f·6465·3e0a·7061··e><pre><code>.pa | |||
| 0003b830:·636b·6167·6520·2d2d·6164·643d·6169·6465··ckage·--add=aide | |||
| 0003b840:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003b850:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003b860:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003b870:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003b880:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003b890:·743d·2223·6964·6d35·3430·3322·2074·6162··t="#idm5403"·tab | |||
| 0003b8a0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003b8b0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003b8c0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003b8d0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003b8e0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003b8f0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | |||
| 0003b900:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | |||
| 0003b910:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b920:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003b930:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003b940:·3d22·6964·6d35·3430·3322·3e3c·7461·626c··="idm5403"><tabl | |||
| 0003b950:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003b960:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003b970:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003b980:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003b990:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003b9a0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003b9b0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003b9c0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003b9d0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003b9e0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003b9f0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003ba00:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003ba10:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003ba20:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003ba30:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003ba40:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003ba50:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003ba60:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003ba70:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003ba80:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003ba90:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003baa0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bab0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bac0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003bad0:·2223·6964·6d35·3430·3422·2074·6162·696e··"#idm5404"·tabin | |||
| 0003bae0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003baf0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003bb00:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003bb10:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003bb20:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003bb30:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003b | 0003b710:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | ||
| 0003b | 0003b720:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 0003b | 0003b730:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 0003b | 0003b740:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 0003b | 0003b750:·2269·646d·3534·3032·223e·3c74·6162·6c65··"idm5402"><table | ||
| 0003b | 0003b760:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 0003b | 0003b770:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 0003b | 0003b780:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 0003b | 0003b790:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 0003b | 0003b7a0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 0003b | 0003b7b0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003b | 0003b7c0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 0003b | 0003b7d0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 0003b | 0003b7e0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003b | 0003b7f0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 0003b | 0003b800:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | ||
| 0003b | 0003b810:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | ||
| 0003b820:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003b830:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003b840:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003b850:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003b860:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003b870:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003b880:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003b890:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003b8a0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003b8b0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003b8c0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003b8d0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003b8e0:·2369·646d·3534·3033·2220·7461·6269·6e64··#idm5403"·tabind | |||
| 0003b8f0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003b900:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003b910:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003b920:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003b930:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003b940:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | |||
| Max diff block lines reached; 6035267/6061265 bytes (99.57%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(enhanced) | 44 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:9 | 47 | ····*·cpe:/o:oracle:linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 101, 31 lines modified | Offset 101, 39 lines modified | ||
| 101 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 101 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 108 | Remediation_Anaconda_snippet_⇲ | ||
| 109 | Complexity:·low | ||
| 110 | Disruption:·low | ||
| 111 | Strategy:···enable | ||
| 112 | package·--add=aide | ||
| 113 | Remediation_Puppet_snippet_⇲ | 108 | Remediation_Puppet_snippet_⇲ |
| 114 | Complexity:·low | 109 | Complexity:·low |
| 115 | Disruption:·low | 110 | Disruption:·low |
| 116 | Strategy:···enable | 111 | Strategy:···enable |
| 117 | include·install_aide | 112 | include·install_aide |
| 118 | class·install_aide·{ | 113 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 114 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 115 | ····ensure·=>·'installed', |
| 121 | ··} | 116 | ··} |
| 122 | } | 117 | } |
| 118 | Remediation_Shell_script_⇲ | ||
| 119 | Complexity:·low | ||
| 120 | Disruption:·low | ||
| 121 | Strategy:···enable | ||
| 122 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 123 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 124 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 125 | ····yum·install·-y·"aide" | ||
| 126 | fi | ||
| 127 | else | ||
| 128 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 129 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 130 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 131 | Complexity:·low |
| 125 | Disruption:·low | 132 | Disruption:·low |
| 126 | Strategy:···enable | 133 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 134 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 135 | ··package: |
| 129 | ····name:·aide | 136 | ····name:·aide |
| Offset 142, 28 lines modified | Offset 150, 20 lines modified | ||
| 142 | ··-·no_reboot_needed | 150 | ··-·no_reboot_needed |
| 143 | ··-·package_aide_installed | 151 | ··-·package_aide_installed |
| 144 | Remediation_OSBuild_Blueprint_snippet_⇲ | 152 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 145 | [[packages]] | 153 | [[packages]] |
| 146 | name·=·"aide" | 154 | name·=·"aide" |
| 147 | version·=·"*" | 155 | version·=·"*" |
| 148 | Remediation_ | 156 | Remediation_Anaconda_snippet_⇲ |
| 149 | Complexity:·low | 157 | Complexity:·low |
| 150 | Disruption:·low | 158 | Disruption:·low |
| 151 | Strategy:···enable | 159 | Strategy:···enable |
| 152 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 153 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 160 | package·--add=aide | ||
| 154 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 155 | ····yum·install·-y·"aide" | ||
| 156 | fi | ||
| 157 | else | ||
| 158 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 159 | fi | ||
| 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 161 | Run·the·following·command·to·generate·a·new·database: | 162 | Run·the·following·command·to·generate·a·new·database: |
| 162 | $·sudo·/usr/sbin/aide·--init | 163 | $·sudo·/usr/sbin/aide·--init |
| 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 164 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 165 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 165 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 166 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 166 | database·can·be·installed·as·follows: | 167 | database·can·be·installed·as·follows: |
| Offset 177, 14 lines modified | Offset 177, 28 lines modified | ||
| 177 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 177 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 178 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 178 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 179 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 179 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 180 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 180 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 181 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 181 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 182 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 182 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 183 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 183 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 184 | Remediation_Shell_script_⇲ | ||
| 185 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 186 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 187 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 188 | ····yum·install·-y·"aide" | ||
| 189 | fi | ||
| 190 | /usr/sbin/aide·--init | ||
| 191 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 192 | else | ||
| 193 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 194 | fi | ||
| 184 | Remediation_Ansible_snippet_⇲ | 195 | Remediation_Ansible_snippet_⇲ |
| 185 | Complexity:·low | 196 | Complexity:·low |
| 186 | Disruption:·low | 197 | Disruption:·low |
| 187 | Strategy:···restrict | 198 | Strategy:···restrict |
| 188 | -·name:·Ensure·AIDE·is·installed | 199 | -·name:·Ensure·AIDE·is·installed |
| 189 | ··package: | 200 | ··package: |
| 190 | ····name:·'{{·item·}}' | 201 | ····name:·'{{·item·}}' |
| Offset 249, 28 lines modified | Offset 263, 14 lines modified | ||
| 249 | ··-·PCI-DSS-Req-11.5 | 263 | ··-·PCI-DSS-Req-11.5 |
| 250 | ··-·aide_build_database | 264 | ··-·aide_build_database |
| 251 | ··-·low_complexity | 265 | ··-·low_complexity |
| 252 | ··-·low_disruption | 266 | ··-·low_disruption |
| 253 | ··-·medium_severity | 267 | ··-·medium_severity |
| 254 | ··-·no_reboot_needed | 268 | ··-·no_reboot_needed |
| Max diff block lines reached; 637549/642228 bytes (99.27%) of diff not shown. | |||
| Offset 14301, 15 lines modified | Offset 14301, 15 lines modified | ||
| 00037dc0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037dc0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037dd0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037dd0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037de0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037de0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037df0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037df0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037e00:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037e00:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037e10:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037e10:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037e20:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037e20:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037e30:·3032·3 | 00037e30:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037e40:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037e40:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037e50:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037e50:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037e60:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037e60:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037e70:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037e70:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037e80:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037e80:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037e90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037e90:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037ea0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037ea0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15209, 190 lines modified | Offset 15209, 190 lines modified | ||
| 0003b680:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b680:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b690:·3d22·2369·646d·3534·3032·2220·7461·6269··="#idm5402"·tabi | 0003b690:·3d22·2369·646d·3534·3032·2220·7461·6269··="#idm5402"·tabi | ||
| 0003b6a0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b6a0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b6b0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b6b0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b6c0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b6c0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b6d0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b6d0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b6e0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b6e0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b6f0:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b6f0:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | ||
| 0003b700:·6163·6f6e·6461·2073·6e69·7070·6574·20e2··aconda·snippet·. | |||
| 0003b710:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b720:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b730:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003b740:·643d·2269·646d·3534·3032·223e·3c74·6162··d="idm5402"><tab | |||
| 0003b750:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003b760:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003b770:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003b780:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003b790:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003b7a0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003b7b0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003b7c0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b7d0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003b7e0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003b7f0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003b800:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003b810:·653e·3c70·7265·3e3c·636f·6465·3e0a·7061··e><pre><code>.pa | |||
| 0003b820:·636b·6167·6520·2d2d·6164·643d·6169·6465··ckage·--add=aide | |||
| 0003b830:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003b840:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003b850:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003b860:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003b870:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003b880:·743d·2223·6964·6d35·3430·3322·2074·6162··t="#idm5403"·tab | |||
| 0003b890:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003b8a0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003b8b0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003b8c0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003b8d0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003b8e0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | |||
| 0003b8f0:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | |||
| 0003b900:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b910:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003b920:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003b930:·3d22·6964·6d35·3430·3322·3e3c·7461·626c··="idm5403"><tabl | |||
| 0003b940:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003b950:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003b960:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003b970:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003b980:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003b990:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003b9a0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003b9b0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003b9c0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003b9d0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003b9e0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003b9f0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003ba00:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003ba10:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003ba20:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003ba30:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003ba40:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003ba50:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003ba60:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003ba70:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003ba80:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003ba90:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003baa0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bab0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003bac0:·2223·6964·6d35·3430·3422·2074·6162·696e··"#idm5404"·tabin | |||
| 0003bad0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003bae0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003baf0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003bb00:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003bb10:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003bb20:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003b | 0003b700:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | ||
| 0003b | 0003b710:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 0003b | 0003b720:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 0003b | 0003b730:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 0003b | 0003b740:·2269·646d·3534·3032·223e·3c74·6162·6c65··"idm5402"><table | ||
| 0003b | 0003b750:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 0003b | 0003b760:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 0003b | 0003b770:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 0003b | 0003b780:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 0003b | 0003b790:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 0003b | 0003b7a0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003b | 0003b7b0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 0003b | 0003b7c0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 0003b | 0003b7d0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003b | 0003b7e0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 0003b | 0003b7f0:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | ||
| 0003b | 0003b800:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | ||
| 0003b810:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003b820:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003b830:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003b840:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003b850:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003b860:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003b870:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003b880:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003b890:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003b8a0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003b8b0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003b8c0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003b8d0:·2369·646d·3534·3033·2220·7461·6269·6e64··#idm5403"·tabind | |||
| 0003b8e0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003b8f0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003b900:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003b910:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003b920:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003b930:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | |||
| Max diff block lines reached; 6216636/6242634 bytes (99.58%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(high) | 44 | Profile·Title·ANSSI-BP-028·(high) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:9 | 47 | ····*·cpe:/o:oracle:linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 101, 31 lines modified | Offset 101, 39 lines modified | ||
| 101 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 101 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 102 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 103 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 104 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 105 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 106 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 107 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 108 | Remediation_Anaconda_snippet_⇲ | ||
| 109 | Complexity:·low | ||
| 110 | Disruption:·low | ||
| 111 | Strategy:···enable | ||
| 112 | package·--add=aide | ||
| 113 | Remediation_Puppet_snippet_⇲ | 108 | Remediation_Puppet_snippet_⇲ |
| 114 | Complexity:·low | 109 | Complexity:·low |
| 115 | Disruption:·low | 110 | Disruption:·low |
| 116 | Strategy:···enable | 111 | Strategy:···enable |
| 117 | include·install_aide | 112 | include·install_aide |
| 118 | class·install_aide·{ | 113 | class·install_aide·{ |
| 119 | ··package·{·'aide': | 114 | ··package·{·'aide': |
| 120 | ····ensure·=>·'installed', | 115 | ····ensure·=>·'installed', |
| 121 | ··} | 116 | ··} |
| 122 | } | 117 | } |
| 118 | Remediation_Shell_script_⇲ | ||
| 119 | Complexity:·low | ||
| 120 | Disruption:·low | ||
| 121 | Strategy:···enable | ||
| 122 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 123 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 124 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 125 | ····yum·install·-y·"aide" | ||
| 126 | fi | ||
| 127 | else | ||
| 128 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 129 | fi | ||
| 123 | Remediation_Ansible_snippet_⇲ | 130 | Remediation_Ansible_snippet_⇲ |
| 124 | Complexity:·low | 131 | Complexity:·low |
| 125 | Disruption:·low | 132 | Disruption:·low |
| 126 | Strategy:···enable | 133 | Strategy:···enable |
| 127 | -·name:·Ensure·aide·is·installed | 134 | -·name:·Ensure·aide·is·installed |
| 128 | ··package: | 135 | ··package: |
| 129 | ····name:·aide | 136 | ····name:·aide |
| Offset 142, 28 lines modified | Offset 150, 20 lines modified | ||
| 142 | ··-·no_reboot_needed | 150 | ··-·no_reboot_needed |
| 143 | ··-·package_aide_installed | 151 | ··-·package_aide_installed |
| 144 | Remediation_OSBuild_Blueprint_snippet_⇲ | 152 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 145 | [[packages]] | 153 | [[packages]] |
| 146 | name·=·"aide" | 154 | name·=·"aide" |
| 147 | version·=·"*" | 155 | version·=·"*" |
| 148 | Remediation_ | 156 | Remediation_Anaconda_snippet_⇲ |
| 149 | Complexity:·low | 157 | Complexity:·low |
| 150 | Disruption:·low | 158 | Disruption:·low |
| 151 | Strategy:···enable | 159 | Strategy:···enable |
| 152 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 153 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 160 | package·--add=aide | ||
| 154 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 155 | ····yum·install·-y·"aide" | ||
| 156 | fi | ||
| 157 | else | ||
| 158 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 159 | fi | ||
| 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 161 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 161 | Run·the·following·command·to·generate·a·new·database: | 162 | Run·the·following·command·to·generate·a·new·database: |
| 162 | $·sudo·/usr/sbin/aide·--init | 163 | $·sudo·/usr/sbin/aide·--init |
| 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 164 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 164 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 165 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 165 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 166 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 166 | database·can·be·installed·as·follows: | 167 | database·can·be·installed·as·follows: |
| Offset 177, 14 lines modified | Offset 177, 28 lines modified | ||
| 177 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 177 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 178 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 178 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 179 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 179 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 180 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 180 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 181 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 181 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 182 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 182 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 183 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 183 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 184 | Remediation_Shell_script_⇲ | ||
| 185 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 186 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 187 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 188 | ····yum·install·-y·"aide" | ||
| 189 | fi | ||
| 190 | /usr/sbin/aide·--init | ||
| 191 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 192 | else | ||
| 193 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 194 | fi | ||
| 184 | Remediation_Ansible_snippet_⇲ | 195 | Remediation_Ansible_snippet_⇲ |
| 185 | Complexity:·low | 196 | Complexity:·low |
| 186 | Disruption:·low | 197 | Disruption:·low |
| 187 | Strategy:···restrict | 198 | Strategy:···restrict |
| 188 | -·name:·Ensure·AIDE·is·installed | 199 | -·name:·Ensure·AIDE·is·installed |
| 189 | ··package: | 200 | ··package: |
| 190 | ····name:·'{{·item·}}' | 201 | ····name:·'{{·item·}}' |
| Offset 249, 28 lines modified | Offset 263, 14 lines modified | ||
| 249 | ··-·PCI-DSS-Req-11.5 | 263 | ··-·PCI-DSS-Req-11.5 |
| 250 | ··-·aide_build_database | 264 | ··-·aide_build_database |
| 251 | ··-·low_complexity | 265 | ··-·low_complexity |
| 252 | ··-·low_disruption | 266 | ··-·low_disruption |
| 253 | ··-·medium_severity | 267 | ··-·medium_severity |
| 254 | ··-·no_reboot_needed | 268 | ··-·no_reboot_needed |
| Max diff block lines reached; 656301/660972 bytes (99.29%) of diff not shown. | |||
| Offset 14303, 15 lines modified | Offset 14303, 15 lines modified | ||
| 00037de0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037de0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037df0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037df0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037e00:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037e00:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037e10:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037e10:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037e20:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037e20:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037e30:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037e30:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037e40:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037e40:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037e50:·3032·3 | 00037e50:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037e60:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037e60:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037e70:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037e70:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037e80:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037e80:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037e90:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037e90:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037ea0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037ea0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037eb0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037eb0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037ec0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037ec0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15205, 189 lines modified | Offset 15205, 189 lines modified | ||
| 0003b640:·7461·7267·6574·3d22·2369·646d·3534·3032··target="#idm5402 | 0003b640:·7461·7267·6574·3d22·2369·646d·3534·3032··target="#idm5402 | ||
| 0003b650:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003b650:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003b660:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003b660:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003b670:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003b670:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003b680:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003b680:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003b690:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003b690:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003b6a0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003b6a0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003b6b0:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003b6b0:·696f·6e20·416e·6163·6f6e·6461·2073·6e69··ion·Anaconda·sni | |||
| 0003b6c0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003b6d0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003b6e0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003b6f0:·7073·6522·2069·643d·2269·646d·3534·3032··pse"·id="idm5402 | |||
| 0003b700:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003b710:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003b720:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003b730:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003b740:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003b750:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003b760:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003b770:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003b780:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003b790:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003b7a0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003b7b0:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003b7c0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003b7d0:·6465·3e0a·7061·636b·6167·6520·2d2d·6164··de>.package·--ad | |||
| 0003b7e0:·643d·6169·6465·0a3c·2f63·6f64·653e·3c2f··d=aide.</code></ | |||
| 0003b7f0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003b800:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003b810:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003b820:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003b830:·2d74·6172·6765·743d·2223·6964·6d35·3430··-target="#idm540 | |||
| 0003b840:·3322·2074·6162·696e·6465·783d·2230·2220··3"·tabindex="0"· | |||
| 0003b850:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003b860:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003b870:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003b880:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003b890:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003b8a0:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003b8b0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003b8c0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003b8d0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003b8e0:·7365·2220·6964·3d22·6964·6d35·3430·3322··se"·id="idm5403" | |||
| 0003b8f0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003b900:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003b910:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003b920:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003b930:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003b940:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003b950:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003b960:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003b970:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003b980:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003b990:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003b9a0:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003b9b0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003b9c0:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003b9d0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003b9e0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003b9f0:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003ba00:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003ba10:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003ba20:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003ba30:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003ba40:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003ba50:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003ba60:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003ba70:·6172·6765·743d·2223·6964·6d35·3430·3422··arget="#idm5404" | |||
| 0003ba80:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003ba90:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003baa0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003bab0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003bac0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003bad0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003bae0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003b | 0003b6c0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 0003b | 0003b6d0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 0003b | 0003b6e0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 0003b | 0003b6f0:·6522·2069·643d·2269·646d·3534·3032·223e··e"·id="idm5402"> | ||
| 0003b | 0003b700:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003b | 0003b710:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 0003b | 0003b720:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003b | 0003b730:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003b | 0003b740:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 0003b | 0003b750:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003b | 0003b760:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003b | 0003b770:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003b | 0003b780:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003b | 0003b790:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | ||
| 0003b | 0003b7a0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | ||
| 0003b | 0003b7b0:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | ||
| 0003b | 0003b7c0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | ||
| 0003b7d0:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003b7e0:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003b7f0:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003b800:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003b810:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003b820:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003bc00:·3e2d·206e·616d·653a·2045·6e73·7572·6520··>-·name:·Ensure· | |||
| 0003bc10:·6169·6465·2069·7320·696e·7374·616c·6c65··aide·is·installe | |||
| 0003bc20:·640a·2020·7061·636b·6167·653a·0a20·2020··d.··package:.··· | |||
| 0003bc30:·206e·616d·653a·2061·6964·650a·2020·2020···name:·aide.···· | |||
| 0003bc40:·7374·6174·653a·2070·7265·7365·6e74·0a20··state:·present.· | |||
| 0003bc50:·2077·6865·6e3a·2061·6e73·6962·6c65·5f76···when:·ansible_v | |||
| 0003bc60:·6972·7475·616c·697a·6174·696f·6e5f·7479··irtualization_ty | |||
| 0003bc70:·7065·206e·6f74·2069·6e20·5b22·646f·636b··pe·not·in·["dock | |||
| 0003bc80:·6572·222c·2022·6c78·6322·2c20·226f·7065··er",·"lxc",·"ope | |||
| 0003bc90:·6e76·7a22·2c20·2270·6f64·6d61·6e22·2c20··nvz",·"podman",· | |||
| 0003bca0:·2263·6f6e·7461·696e·6572·225d·0a20·2074··"container"].··t | |||
| 0003bcb0:·6167·733a·0a20·202d·2043·4a49·532d·352e··ags:.··-·CJIS-5. | |||
| Max diff block lines reached; 5797182/5823042 bytes (99.56%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(intermediary) | 44 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:9 | 47 | ····*·cpe:/o:oracle:linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·Configure_Syslog | 56 | ·········4.·Configure_Syslog |
| 57 | ·········5.·Network_Configuration_and_Firewalls | 57 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 100, 31 lines modified | Offset 100, 39 lines modified | ||
| 100 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 100 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 101 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 101 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 102 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, | 102 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744, |
| 103 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, | 103 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034, |
| 104 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, | 104 | References··1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3, |
| 105 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 105 | ············A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 106 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 106 | ············PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 107 | Remediation_Anaconda_snippet_⇲ | ||
| 108 | Complexity:·low | ||
| 109 | Disruption:·low | ||
| 110 | Strategy:···enable | ||
| 111 | package·--add=aide | ||
| 112 | Remediation_Puppet_snippet_⇲ | 107 | Remediation_Puppet_snippet_⇲ |
| 113 | Complexity:·low | 108 | Complexity:·low |
| 114 | Disruption:·low | 109 | Disruption:·low |
| 115 | Strategy:···enable | 110 | Strategy:···enable |
| 116 | include·install_aide | 111 | include·install_aide |
| 117 | class·install_aide·{ | 112 | class·install_aide·{ |
| 118 | ··package·{·'aide': | 113 | ··package·{·'aide': |
| 119 | ····ensure·=>·'installed', | 114 | ····ensure·=>·'installed', |
| 120 | ··} | 115 | ··} |
| 121 | } | 116 | } |
| 117 | Remediation_Shell_script_⇲ | ||
| 118 | Complexity:·low | ||
| 119 | Disruption:·low | ||
| 120 | Strategy:···enable | ||
| 121 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 122 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 123 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 124 | ····yum·install·-y·"aide" | ||
| 125 | fi | ||
| 126 | else | ||
| 127 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 128 | fi | ||
| 122 | Remediation_Ansible_snippet_⇲ | 129 | Remediation_Ansible_snippet_⇲ |
| 123 | Complexity:·low | 130 | Complexity:·low |
| 124 | Disruption:·low | 131 | Disruption:·low |
| 125 | Strategy:···enable | 132 | Strategy:···enable |
| 126 | -·name:·Ensure·aide·is·installed | 133 | -·name:·Ensure·aide·is·installed |
| 127 | ··package: | 134 | ··package: |
| 128 | ····name:·aide | 135 | ····name:·aide |
| Offset 141, 28 lines modified | Offset 149, 20 lines modified | ||
| 141 | ··-·no_reboot_needed | 149 | ··-·no_reboot_needed |
| 142 | ··-·package_aide_installed | 150 | ··-·package_aide_installed |
| 143 | Remediation_OSBuild_Blueprint_snippet_⇲ | 151 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 144 | [[packages]] | 152 | [[packages]] |
| 145 | name·=·"aide" | 153 | name·=·"aide" |
| 146 | version·=·"*" | 154 | version·=·"*" |
| 147 | Remediation_ | 155 | Remediation_Anaconda_snippet_⇲ |
| 148 | Complexity:·low | 156 | Complexity:·low |
| 149 | Disruption:·low | 157 | Disruption:·low |
| 150 | Strategy:···enable | 158 | Strategy:···enable |
| 151 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 152 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | package·--add=aide | ||
| 153 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 154 | ····yum·install·-y·"aide" | ||
| 155 | fi | ||
| 156 | else | ||
| 157 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 158 | fi | ||
| 159 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 160 | Run·the·following·command·to·generate·a·new·database: | 161 | Run·the·following·command·to·generate·a·new·database: |
| 161 | $·sudo·/usr/sbin/aide·--init | 162 | $·sudo·/usr/sbin/aide·--init |
| 162 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the | 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the |
| 163 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure | 164 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure |
| 164 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 165 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 165 | database·can·be·installed·as·follows: | 166 | database·can·be·installed·as·follows: |
| Offset 176, 14 lines modified | Offset 176, 28 lines modified | ||
| 176 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 176 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 177 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 177 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 178 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 178 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 179 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 179 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 180 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 180 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 181 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 181 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 182 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 182 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 183 | Remediation_Shell_script_⇲ | ||
| 184 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 185 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 186 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 187 | ····yum·install·-y·"aide" | ||
| 188 | fi | ||
| 189 | /usr/sbin/aide·--init | ||
| 190 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 191 | else | ||
| 192 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 193 | fi | ||
| 183 | Remediation_Ansible_snippet_⇲ | 194 | Remediation_Ansible_snippet_⇲ |
| 184 | Complexity:·low | 195 | Complexity:·low |
| 185 | Disruption:·low | 196 | Disruption:·low |
| 186 | Strategy:···restrict | 197 | Strategy:···restrict |
| 187 | -·name:·Ensure·AIDE·is·installed | 198 | -·name:·Ensure·AIDE·is·installed |
| 188 | ··package: | 199 | ··package: |
| 189 | ····name:·'{{·item·}}' | 200 | ····name:·'{{·item·}}' |
| Offset 248, 28 lines modified | Offset 262, 14 lines modified | ||
| 248 | ··-·PCI-DSS-Req-11.5 | 262 | ··-·PCI-DSS-Req-11.5 |
| 249 | ··-·aide_build_database | 263 | ··-·aide_build_database |
| 250 | ··-·low_complexity | 264 | ··-·low_complexity |
| 251 | ··-·low_disruption | 265 | ··-·low_disruption |
| 252 | ··-·medium_severity | 266 | ··-·medium_severity |
| 253 | ··-·no_reboot_needed | 267 | ··-·no_reboot_needed |
| Max diff block lines reached; 613577/618269 bytes (99.24%) of diff not shown. | |||
| Offset 14301, 16 lines modified | Offset 14301, 16 lines modified | ||
| 00037dc0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00037dc0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00037dd0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00037dd0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00037de0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00037de0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00037df0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00037df0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00037e00:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00037e00:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00037e10:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00037e10:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00037e20:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e20:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e30:·2020·2020·2861·7320·6f66·2032·3032·3 | 00037e30:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00037e40:·303 | 00037e40:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00037e50:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00037e50:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00037e60:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00037e60:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00037e70:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00037e70:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00037e80:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00037e80:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00037e90:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00037e90:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00037ea0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00037ea0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00037eb0:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00037eb0:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 14977, 139 lines modified | Offset 14977, 139 lines modified | ||
| 0003a800:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003a800:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003a810:·6d37·3838·3022·2074·6162·696e·6465·783d··m7880"·tabindex= | 0003a810:·6d37·3838·3022·2074·6162·696e·6465·783d··m7880"·tabindex= | ||
| 0003a820:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003a820:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003a830:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003a830:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003a840:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003a840:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003a850:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003a850:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003a860:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003a860:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003a870:·6564·6961·7469·6f6e·20 | 0003a870:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0003a880:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | |||
| 0003a890:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003a8a0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003a8b0:·6170·7365·2220·6964·3d22·6964·6d37·3838··apse"·id="idm788 | |||
| 0003a8c0:·3022·3e3c·7461·626c·6520·636c·6173·733d··0"><table·class= | |||
| 0003a8d0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003a8e0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003a8f0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003a900:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003a910:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003a880:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003a890:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003a8a0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003a8b0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003a8c0:·3738·3830·223e·3c74·6162·6c65·2063·6c61··7880"><table·cla | |||
| 0003a8d0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003a8e0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003a8f0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003a900:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003a910:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003a920:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003a930:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003a940:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003a9 | 0003a920:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003a930:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003a940:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003a950:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003a960:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003a970:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003a980:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003a990:·3c63·6f64·653e·0a66·6f72·2066·2069·6e20··<code>.for·f·in· | |||
| 0003a9a0:·2f65·7463·2f73·7564·6f65·7273·202f·6574··/etc/sudoers·/et | |||
| 0003a9b0:·632f·7375·646f·6572·732e·642f·2a20·3b20··c/sudoers.d/*·;· | |||
| 0003a9c0:·646f·0a20·2069·6620·5b20·2120·2d65·2022··do.··if·[·!·-e·" | |||
| 0003a9d0:·2466·2220·5d20·3b20·7468·656e·0a20·2020··$f"·]·;·then.··· | |||
| 0003a9e0:·2063·6f6e·7469·6e75·650a·2020·6669·0a20···continue.··fi.· | |||
| 0003a9f0:·206d·6174·6368·696e·675f·6c69·7374·3d24···matching_list=$ | |||
| 0003aa00:·2867·7265·7020·2d50·2027·5e28·3f21·2329··(grep·-P·'^(?!#) | |||
| 0003a960:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003a970:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003a980:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003a990:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003a9a0:·2046·696e·6420·2f65·7463·2f73·7564·6f65···Find·/etc/sudoe | |||
| 0003a9b0:·7273·2e64·2f20·6669·6c65·730a·2020·6669··rs.d/·files.··fi | |||
| 0003a9c0:·6e64·3a0a·2020·2020·7061·7468·733a·0a20··nd:.····paths:.· | |||
| 0003a9d0:·2020·202d·202f·6574·632f·7375·646f·6572·····-·/etc/sudoer | |||
| 0003a9e0:·732e·642f·0a20·2072·6567·6973·7465·723a··s.d/.··register: | |||
| 0003a9f0:·2073·7564·6f65·7273·0a20·2074·6167·733a···sudoers.··tags: | |||
| 0003aa00:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003aa10:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 0003aa20:·542d·3830·302d·3533·2d49·412d·3131·0a20··T-800-53-IA-11.· | |||
| 0003aa30:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 0003aa40:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 0003aa50:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 0003aa60:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 0003aa70:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 0003aa80:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 0003aa90:·6567·790a·2020·2d20·7375·646f·5f72·656d··egy.··-·sudo_rem | |||
| 0003aaa0:·6f76·655f·6e6f·5f61·7574·6865·6e74·6963··ove_no_authentic | |||
| 0003aab0:·6174·650a·0a2d·206e·616d·653a·2052·656d··ate..-·name:·Rem | |||
| 0003aac0:·6f76·6520·6c69·6e65·7320·636f·6e74·6169··ove·lines·contai | |||
| 0003aad0:·6e69·6e67·2021·6175·7468·656e·7469·6361··ning·!authentica | |||
| 0003aae0:·7465·2066·726f·6d20·7375·646f·6572·7320··te·from·sudoers· | |||
| 0003aaf0:·6669·6c65·730a·2020·7265·706c·6163·653a··files.··replace: | |||
| 0003ab00:·0a20·2020·2072·6567·6578·703a·2028·5e28··.····regexp:·(^( | |||
| 0003a | 0003aa10:·2e2a·5b5c·735d·2b5c·2161·7574·6865·6e74··.*[\s]+\!authent | ||
| 0003aa20:·6963·6174·652e·2a24·2720·2466·207c·2075··icate.*$'·$f·|·u | |||
| 0003aa30:·6e69·7120·290a·2020·6966·2021·2074·6573··niq·).··if·!·tes | |||
| 0003aa40:·7420·2d7a·2022·246d·6174·6368·696e·675f··t·-z·"$matching_ | |||
| 0003aa50:·6c69·7374·223b·2074·6865·6e0a·2020·2020··list";·then.···· | |||
| 0003aa60:·7768·696c·6520·4946·533d·2072·6561·6420··while·IFS=·read· | |||
| 0003aa70:·2d72·2065·6e74·7279·3b20·646f·0a20·2020··-r·entry;·do.··· | |||
| 0003aa80:·2020·2023·2063·6f6d·6d65·6e74·206f·7574·····#·comment·out | |||
| 0003aa90:·2022·2161·7574·6865·6e74·6963·6174·6522···"!authenticate" | |||
| 0003aaa0:·206d·6174·6368·6573·2074·6f20·7072·6573···matches·to·pres | |||
| 0003aab0:·6572·7665·2075·7365·7220·6461·7461·0a20··erve·user·data.· | |||
| 0003aac0:·2020·2020·2073·6564·202d·6920·2273·2f5e·······sed·-i·"s/^ | |||
| 0003aad0:·247b·656e·7472·797d·242f·2320·2661·6d70··${entry}$/#·& | |||
| 0003aae0:·3b2f·6722·2024·660a·2020·2020·646f·6e65··;/g"·$f.····done | |||
| 0003aaf0:·2026·6c74·3b26·6c74·3b26·6c74·3b20·2224···<<<·"$ | |||
| 0003ab00:·6d61·7463·6869·6e67·5f6c·6973·7422·0a0a··matching_list".. | |||
| 0003ab10:·2020·2020·2f75·7372·2f73·6269·6e2f·7669······/usr/sbin/vi | |||
| 0003ab20:·7375·646f·202d·6366·2024·6620·2661·6d70··sudo·-cf·$f·& | |||
| 0003ab30:·3b26·6774·3b20·2f64·6576·2f6e·756c·6c20··;>·/dev/null· | |||
| 0003ab40:·7c7c·2065·6368·6f20·2246·6169·6c20·746f··||·echo·"Fail·to | |||
| 0003ab50:·2076·616c·6964·6174·6520·2466·2077·6974···validate·$f·wit | |||
| 0003ab60:·6820·7669·7375·646f·220a·2020·6669·0a64··h·visudo".··fi.d | |||
| 0003ab70:·6f6e·650a·3c2f·636f·6465·3e3c·2f70·7265··one.</code></pre | |||
| 0003ab80:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003ab90:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003aba0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003abb0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003abc0:·7267·6574·3d22·2369·646d·3738·3831·2220··rget="#idm7881"· | |||
| 0003abd0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003abe0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003abf0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003ac00:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003ac10:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003ac20:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003ac30:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003ab20:·6865·6e74·6963·6174·652e·2a24·290a·2020··henticate.*$).·· | |||
| 0003ab30:·2020·7265·706c·6163·653a·2027·2320·5c67····replace:·'#·\g | |||
| Max diff block lines reached; 2330152/2349250 bytes (99.19%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(minimal) | 44 | Profile·Title·ANSSI-BP-028·(minimal) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:oracle:linux:9 | 47 | ····*·cpe:/o:oracle:linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·Configure_Syslog | 55 | ·········3.·Configure_Syslog |
| 56 | ·········4.·File_Permissions_and_Masks | 56 | ·········4.·File_Permissions_and_Masks |
| 57 | ···2.·Services | 57 | ···2.·Services |
| Offset 88, 14 lines modified | Offset 88, 33 lines modified | ||
| 88 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 88 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 89 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 89 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 90 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 90 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 91 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 91 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 92 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 92 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 93 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 93 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 94 | ············000373-VMM-001490 | 94 | ············000373-VMM-001490 |
| 95 | Remediation_Shell_script_⇲ | ||
| 96 | Complexity:·low | ||
| 97 | Disruption:·low | ||
| 98 | Strategy:···restrict | ||
| 99 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 100 | ··if·[·!·-e·"$f"·]·;·then | ||
| 101 | ····continue | ||
| 102 | ··fi | ||
| 103 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 104 | ··if·!·test·-z·"$matching_list";·then | ||
| 105 | ····while·IFS=·read·-r·entry;·do | ||
| 106 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 107 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 108 | ····done·<<<·"$matching_list" | ||
| 109 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 110 | ··fi | ||
| 111 | done | ||
| 95 | Remediation_Ansible_snippet_⇲ | 112 | Remediation_Ansible_snippet_⇲ |
| 96 | Complexity:·low | 113 | Complexity:·low |
| 97 | Disruption:·low | 114 | Disruption:·low |
| 98 | Strategy:···restrict | 115 | Strategy:···restrict |
| 99 | -·name:·Find·/etc/sudoers.d/·files | 116 | -·name:·Find·/etc/sudoers.d/·files |
| 100 | ··find: | 117 | ··find: |
| 101 | ····paths: | 118 | ····paths: |
| Offset 125, 33 lines modified | Offset 144, 14 lines modified | ||
| 125 | ··-·NIST-800-53-IA-11 | 144 | ··-·NIST-800-53-IA-11 |
| 126 | ··-·low_complexity | 145 | ··-·low_complexity |
| 127 | ··-·low_disruption | 146 | ··-·low_disruption |
| 128 | ··-·medium_severity | 147 | ··-·medium_severity |
| 129 | ··-·no_reboot_needed | 148 | ··-·no_reboot_needed |
| 130 | ··-·restrict_strategy | 149 | ··-·restrict_strategy |
| 131 | ··-·sudo_remove_no_authenticate | 150 | ··-·sudo_remove_no_authenticate |
| 132 | Remediation_Shell_script_⇲ | ||
| 133 | Complexity:·low | ||
| 134 | Disruption:·low | ||
| 135 | Strategy:···restrict | ||
| 136 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 137 | ··if·[·!·-e·"$f"·]·;·then | ||
| 138 | ····continue | ||
| 139 | ··fi | ||
| 140 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 141 | ··if·!·test·-z·"$matching_list";·then | ||
| 142 | ····while·IFS=·read·-r·entry;·do | ||
| 143 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 144 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 145 | ····done·<<<·"$matching_list" | ||
| 146 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 147 | ··fi | ||
| 148 | done | ||
| 149 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 151 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 150 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 152 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 151 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 153 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 152 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 154 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 153 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 155 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 154 | ············have·authorization. | 156 | ············have·authorization. |
| 155 | Rationale: | 157 | Rationale: |
| Offset 162, 14 lines modified | Offset 162, 33 lines modified | ||
| 162 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 162 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 163 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 163 | ············CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 164 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 164 | Identifiers·4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 165 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 165 | and·········1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 166 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 166 | References··A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 167 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 167 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 168 | ············000373-VMM-001490 | 168 | ············000373-VMM-001490 |
| 169 | Remediation_Shell_script_⇲ | ||
| 170 | Complexity:·low | ||
| 171 | Disruption:·low | ||
| 172 | Strategy:···restrict | ||
| 173 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 174 | ··if·[·!·-e·"$f"·]·;·then | ||
| 175 | ····continue | ||
| 176 | ··fi | ||
| 177 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 178 | ··if·!·test·-z·"$matching_list";·then | ||
| 179 | ····while·IFS=·read·-r·entry;·do | ||
| 180 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 181 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 182 | ····done·<<<·"$matching_list" | ||
| 183 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 184 | ··fi | ||
| 185 | done | ||
| 169 | Remediation_Ansible_snippet_⇲ | 186 | Remediation_Ansible_snippet_⇲ |
| 170 | Complexity:·low | 187 | Complexity:·low |
| 171 | Disruption:·low | 188 | Disruption:·low |
| 172 | Strategy:···restrict | 189 | Strategy:···restrict |
| 173 | -·name:·Find·/etc/sudoers.d/·files | 190 | -·name:·Find·/etc/sudoers.d/·files |
| 174 | ··find: | 191 | ··find: |
| 175 | ····paths: | 192 | ····paths: |
| Offset 199, 33 lines modified | Offset 218, 14 lines modified | ||
| 199 | ··-·NIST-800-53-IA-11 | 218 | ··-·NIST-800-53-IA-11 |
| 200 | ··-·low_complexity | 219 | ··-·low_complexity |
| 201 | ··-·low_disruption | 220 | ··-·low_disruption |
| 202 | ··-·medium_severity | 221 | ··-·medium_severity |
| 203 | ··-·no_reboot_needed | 222 | ··-·no_reboot_needed |
| 204 | ··-·restrict_strategy | 223 | ··-·restrict_strategy |
| 205 | ··-·sudo_remove_nopasswd | 224 | ··-·sudo_remove_nopasswd |
| 206 | Remediation_Shell_script_⇲ | ||
| 207 | Complexity:·low | ||
| Max diff block lines reached; 159657/165015 bytes (96.75%) of diff not shown. | |||
| Offset 14330, 16 lines modified | Offset 14330, 16 lines modified | ||
| 00037f90:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037f90:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037fa0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037fa0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037fb0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037fb0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037fc0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037fc0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037fd0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037fd0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037fe0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037fe0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037ff0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037ff0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038000:·2861·7320·6f66·2032·3032·3 | 00038000:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00038010:·3 | 00038010:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00038020:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00038020:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00038030:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00038030:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00038040:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00038040:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00038050:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00038050:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00038060:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00038060:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038070:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038070:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038080:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038080:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15251, 189 lines modified | Offset 15251, 189 lines modified | ||
| 0003b920:·7461·7267·6574·3d22·2369·646d·3534·3032··target="#idm5402 | 0003b920:·7461·7267·6574·3d22·2369·646d·3534·3032··target="#idm5402 | ||
| 0003b930:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003b930:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003b940:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003b940:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003b950:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003b950:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003b960:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003b960:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003b970:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003b970:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003b980:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003b980:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003b990:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003b990:·696f·6e20·416e·6163·6f6e·6461·2073·6e69··ion·Anaconda·sni | |||
| 0003b9a0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003b9b0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003b9c0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003b9d0:·7073·6522·2069·643d·2269·646d·3534·3032··pse"·id="idm5402 | |||
| 0003b9e0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003b9f0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003ba00:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003ba10:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003ba20:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003ba30:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003ba40:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003ba50:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003ba60:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003ba70:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003ba80:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003ba90:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003baa0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003bab0:·6465·3e0a·7061·636b·6167·6520·2d2d·6164··de>.package·--ad | |||
| 0003bac0:·643d·6169·6465·0a3c·2f63·6f64·653e·3c2f··d=aide.</code></ | |||
| 0003bad0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003bae0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003baf0:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003bb00:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003bb10:·2d74·6172·6765·743d·2223·6964·6d35·3430··-target="#idm540 | |||
| 0003bb20:·3322·2074·6162·696e·6465·783d·2230·2220··3"·tabindex="0"· | |||
| 0003bb30:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003bb40:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003bb50:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003bb60:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003bb70:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003bb80:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003bb90:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003bba0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003bbb0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003bbc0:·7365·2220·6964·3d22·6964·6d35·3430·3322··se"·id="idm5403" | |||
| 0003bbd0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003bbe0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003bbf0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003bc00:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003bc10:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003bc20:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003bc30:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bc40:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003bc50:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bc60:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bc70:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003bc80:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003bc90:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003bca0:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003bcb0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003bcc0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003bcd0:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003bce0:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003bcf0:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003bd00:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003bd10:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003bd20:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003bd30:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003bd40:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003bd50:·6172·6765·743d·2223·6964·6d35·3430·3422··arget="#idm5404" | |||
| 0003bd60:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003bd70:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003bd80:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003bd90:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003bda0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003bdb0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003bdc0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003b | 0003b9a0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 0003b | 0003b9b0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 0003b | 0003b9c0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 0003b | 0003b9d0:·6522·2069·643d·2269·646d·3534·3032·223e··e"·id="idm5402"> | ||
| 0003b | 0003b9e0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003b | 0003b9f0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 0003b | 0003ba00:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003b | 0003ba10:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003b | 0003ba20:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 0003b | 0003ba30:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003b | 0003ba40:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003b | 0003ba50:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003b | 0003ba60:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003b | 0003ba70:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | ||
| 0003b | 0003ba80:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | ||
| 0003b | 0003ba90:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | ||
| 0003b | 0003baa0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | ||
| 0003bab0:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003bac0:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003bad0:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003bae0:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003baf0:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003bb00:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003bb10:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003bb20:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003bb30:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003bb40:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003bb50:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003bb60:·7267·6574·3d22·2369·646d·3534·3033·2220··rget="#idm5403"· | |||
| 0003bb70:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bb80:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bb90:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bba0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bbb0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| Max diff block lines reached; 6641225/6667223 bytes (99.61%) of diff not shown. | |||
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | Profile·Title·[DRAFT]·Unclassified·Information·in·Non-federal·Information | 50 | Profile·Title·[DRAFT]·Unclassified·Information·in·Non-federal·Information |
| 51 | ··············Systems·and·Organizations·(NIST·800-171) | 51 | ··············Systems·and·Organizations·(NIST·800-171) |
| 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui | 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui |
| 53 | ***·CPE·Platforms·*** | 53 | ***·CPE·Platforms·*** |
| 54 | ····*·cpe:/o:oracle:linux:9 | 54 | ····*·cpe:/o:oracle:linux:9 |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·System_Settings | 59 | ···1.·System_Settings |
| 60 | ·········1.·Installing_and_Maintaining_Software | 60 | ·········1.·Installing_and_Maintaining_Software |
| 61 | ·········2.·Account_and_Access_Control | 61 | ·········2.·Account_and_Access_Control |
| 62 | ·········3.·System_Accounting_with_auditd | 62 | ·········3.·System_Accounting_with_auditd |
| 63 | ·········4.·GRUB2_bootloader_configuration | 63 | ·········4.·GRUB2_bootloader_configuration |
| 64 | ·········5.·Configure_Syslog | 64 | ·········5.·Configure_Syslog |
| Offset 90, 31 lines modified | Offset 90, 39 lines modified | ||
| 90 | ***·Rule ·Install·AIDE· [ref]·*** | 90 | ***·Rule ·Install·AIDE· [ref]·*** |
| 91 | The·aide·package·can·be·installed·with·the·following·command: | 91 | The·aide·package·can·be·installed·with·the·following·command: |
| 92 | $·sudo·yum·install·aide | 92 | $·sudo·yum·install·aide |
| 93 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 93 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 94 | Severity: ················medium | 94 | Severity: ················medium |
| 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 96 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 96 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 97 | Remediation_Anaconda_snippet_⇲ | ||
| 98 | Complexity:·low | ||
| 99 | Disruption:·low | ||
| 100 | Strategy:···enable | ||
| 101 | package·--add=aide | ||
| 102 | Remediation_Puppet_snippet_⇲ | 97 | Remediation_Puppet_snippet_⇲ |
| 103 | Complexity:·low | 98 | Complexity:·low |
| 104 | Disruption:·low | 99 | Disruption:·low |
| 105 | Strategy:···enable | 100 | Strategy:···enable |
| 106 | include·install_aide | 101 | include·install_aide |
| 107 | class·install_aide·{ | 102 | class·install_aide·{ |
| 108 | ··package·{·'aide': | 103 | ··package·{·'aide': |
| 109 | ····ensure·=>·'installed', | 104 | ····ensure·=>·'installed', |
| 110 | ··} | 105 | ··} |
| 111 | } | 106 | } |
| 107 | Remediation_Shell_script_⇲ | ||
| 108 | Complexity:·low | ||
| 109 | Disruption:·low | ||
| 110 | Strategy:···enable | ||
| 111 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 112 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 113 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 114 | ····yum·install·-y·"aide" | ||
| 115 | fi | ||
| 116 | else | ||
| 117 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 118 | fi | ||
| 112 | Remediation_Ansible_snippet_⇲ | 119 | Remediation_Ansible_snippet_⇲ |
| 113 | Complexity:·low | 120 | Complexity:·low |
| 114 | Disruption:·low | 121 | Disruption:·low |
| 115 | Strategy:···enable | 122 | Strategy:···enable |
| 116 | -·name:·Ensure·aide·is·installed | 123 | -·name:·Ensure·aide·is·installed |
| 117 | ··package: | 124 | ··package: |
| 118 | ····name:·aide | 125 | ····name:·aide |
| Offset 131, 28 lines modified | Offset 139, 20 lines modified | ||
| 131 | ··-·no_reboot_needed | 139 | ··-·no_reboot_needed |
| 132 | ··-·package_aide_installed | 140 | ··-·package_aide_installed |
| 133 | Remediation_OSBuild_Blueprint_snippet_⇲ | 141 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 134 | [[packages]] | 142 | [[packages]] |
| 135 | name·=·"aide" | 143 | name·=·"aide" |
| 136 | version·=·"*" | 144 | version·=·"*" |
| 137 | Remediation_ | 145 | Remediation_Anaconda_snippet_⇲ |
| 138 | Complexity:·low | 146 | Complexity:·low |
| 139 | Disruption:·low | 147 | Disruption:·low |
| 140 | Strategy:···enable | 148 | Strategy:···enable |
| 141 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 142 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 143 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 144 | ····yum·install·-y·"aide" | ||
| 145 | fi | ||
| 149 | package·--add=aide | ||
| 146 | else | ||
| 147 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 148 | fi | ||
| 149 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 150 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 150 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 151 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 151 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·9. | 152 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·9. |
| 152 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 153 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 153 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 154 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 161, 14 lines modified | Offset 161, 27 lines modified | ||
| 161 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 161 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 162 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 162 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 163 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 163 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 164 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 164 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 165 | Severity: ················high | 165 | Severity: ················high |
| 166 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 166 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 167 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 167 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 168 | Remediation_Shell_script_⇲ | ||
| 169 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 170 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 171 | fips-mode-setup·--enable | ||
| 172 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 173 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 174 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 175 | fi | ||
| 176 | else | ||
| 177 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 178 | fi | ||
| 168 | Remediation_Ansible_snippet_⇲ | 179 | Remediation_Ansible_snippet_⇲ |
| 169 | Complexity:·medium | 180 | Complexity:·medium |
| 170 | Disruption:·medium | 181 | Disruption:·medium |
| 171 | Reboot:·····true | 182 | Reboot:·····true |
| 172 | Strategy:···restrict | 183 | Strategy:···restrict |
| 173 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 184 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 174 | ··command:·/usr/bin/fips-mode-setup·--check | 185 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 223, 27 lines modified | Offset 236, 14 lines modified | ||
| 223 | ··-·NIST-800-53-SC-13 | 236 | ··-·NIST-800-53-SC-13 |
| 224 | ··-·enable_dracut_fips_module | 237 | ··-·enable_dracut_fips_module |
| 225 | ··-·high_severity | 238 | ··-·high_severity |
| 226 | ··-·medium_complexity | 239 | ··-·medium_complexity |
| 227 | ··-·medium_disruption | 240 | ··-·medium_disruption |
| 228 | ··-·reboot_required | 241 | ··-·reboot_required |
| 229 | ··-·restrict_strategy | 242 | ··-·restrict_strategy |
| Max diff block lines reached; 857075/864285 bytes (99.17%) of diff not shown. | |||
| Offset 14296, 15 lines modified | Offset 14296, 15 lines modified | ||
| 00037d70:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00037d70:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00037d80:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00037d80:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00037d90:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00037d90:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00037da0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00037da0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00037db0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00037db0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00037dc0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00037dc0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00037dd0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00037dd0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00037de0:·6620·3230·323 | 00037de0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00037df0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00037df0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00037e00:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00037e00:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00037e10:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00037e10:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00037e20:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00037e20:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00037e30:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00037e30:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00037e40:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00037e40:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00037e50:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00037e50:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15230, 324 lines modified | Offset 15230, 324 lines modified | ||
| 0003b7d0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b7d0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b7e0:·3d22·2369·646d·3530·3731·2220·7461·6269··="#idm5071"·tabi | 0003b7e0:·3d22·2369·646d·3530·3731·2220·7461·6269··="#idm5071"·tabi | ||
| 0003b7f0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b7f0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b800:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b800:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b810:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b810:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b820:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b820:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b830:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b830:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b840:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b840:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003b850:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003b860:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b8 | 0003b850:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003b860:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003b870:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003b880:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003b890:·646d·3530·3731·223e·3c70·7265·3e3c·636f··dm5071"><pre><co | |||
| 0003b8a0:·6465·3e0a·2320·4669·6e64·2077·6869·6368··de>.#·Find·which | |||
| 0003b8b0:·2066·696c·6573·2068·6176·6520·696e·636f···files·have·inco | |||
| 0003b8c0:·7272·6563·7420·6861·7368·2028·6e6f·7420··rrect·hash·(not· | |||
| 0003b8d0:·696e·202f·6574·632c·2062·6563·6175·7365··in·/etc,·because | |||
| 0003b8e0:·206f·6620·7468·6520·7379·7374·656d·2072···of·the·system·r | |||
| 0003b8f0:·656c·6174·6564·2063·6f6e·6669·6720·6669··elated·config·fi | |||
| 0003b900:·6c65·7329·2061·6e64·2074·6865·6e20·6765··les)·and·then·ge | |||
| 0003b910:·7420·6669·6c65·7320·6e61·6d65·730a·6669··t·files·names.fi | |||
| 0003b920:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003b930:·6374·5f68·6173·683d·2224·2872·706d·202d··ct_hash="$(rpm·- | |||
| 0003b940:·5661·202d·2d6e·6f63·6f6e·6669·6720·7c20··Va·--noconfig·|· | |||
| 0003b950:·6772·6570·202d·4520·275e·2e2e·3527·207c··grep·-E·'^..5'·| | |||
| 0003b960:·2061·776b·2027·7b70·7269·6e74·2024·4e46···awk·'{print·$NF | |||
| 0003b970:·7d27·2029·220a·0a23·2046·726f·6d20·6669··}'·)"..#·From·fi | |||
| 0003b980:·6c65·7320·6e61·6d65·7320·6765·7420·7061··les·names·get·pa | |||
| 0003b990:·636b·6167·6520·6e61·6d65·7320·616e·6420··ckage·names·and· | |||
| 0003b9a0:·6368·616e·6765·206e·6577·6c69·6e65·2074··change·newline·t | |||
| 0003b9b0:·6f20·7370·6163·652c·2062·6563·6175·7365··o·space,·because | |||
| 0003b9c0:·2072·706d·2077·7269·7465·7320·6561·6368···rpm·writes·each | |||
| 0003b9d0:·2070·6163·6b61·6765·2074·6f20·6e65·7720···package·to·new· | |||
| 0003b9e0:·6c69·6e65·0a70·6163·6b61·6765·735f·746f··line.packages_to | |||
| 0003b9f0:·5f72·6569·6e73·7461·6c6c·3d22·2428·7270··_reinstall="$(rp | |||
| 0003ba00:·6d20·2d71·6620·2466·696c·6573·5f77·6974··m·-qf·$files_wit | |||
| 0003ba10:·685f·696e·636f·7272·6563·745f·6861·7368··h_incorrect_hash | |||
| 0003ba20:·207c·2074·7220·275c·6e27·2027·2027·2922···|·tr·'\n'·'·')" | |||
| 0003ba30:·0a0a·0a79·756d·2072·6569·6e73·7461·6c6c··...yum·reinstall | |||
| 0003ba40:·202d·7920·2470·6163·6b61·6765·735f·746f···-y·$packages_to | |||
| 0003ba50:·5f72·6569·6e73·7461·6c6c·0a3c·2f63·6f64··_reinstall.</cod | |||
| 0003ba60:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003ba70:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003ba80:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003b | 0003ba90:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003b890:·3d22·6964·6d35·3037·3122·3e3c·7461·626c··="idm5071"><tabl | |||
| 0003b8a0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003b8b0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003b8c0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003b8d0:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003b8e0:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003b8f0:·3c2f·7468·3e3c·7464·3e68·6967·683c·2f74··</th><td>high</t | |||
| 0003b900:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003b910:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b920:·7464·3e6d·6564·6975·6d3c·2f74·643e·3c2f··td>medium</td></ | |||
| 0003b930:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003b940:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 0003b950:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 0003b960:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003b970:·653e·2d20·6e61·6d65·3a20·2753·6574·2066··e>-·name:·'Set·f | |||
| 0003b980:·6163·743a·2050·6163·6b61·6765·206d·616e··act:·Package·man | |||
| 0003b990:·6167·6572·2072·6569·6e73·7461·6c6c·2063··ager·reinstall·c | |||
| 0003b9a0:·6f6d·6d61·6e64·2028·646e·6629·270a·2020··ommand·(dnf)'.·· | |||
| 0003b | 0003baa0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003bab0:·6d35·3037·3222·2074·6162·696e·6465·783d··m5072"·tabindex= | |||
| 0003bac0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bad0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bae0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003baf0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bb00:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bb10:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003bb20:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bb30:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bb40:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bb50:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bb60:·3530·3732·223e·3c74·6162·6c65·2063·6c61··5072"><table·cla | |||
| 0003bb70:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bb80:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bb90:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bba0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bbb0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bbc0:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003bbd0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bbe0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003bbf0:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003bc00:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bc10:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003bc20:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bc30:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003bc40:·616d·653a·2027·5365·7420·6661·6374·3a20··ame:·'Set·fact:· | |||
| 0003b | 0003bc50:·5061·636b·6167·6520·6d61·6e61·6765·7220··Package·manager· | ||
| 0003b9d0:·696e·7374·616c·6c5f·636d·643a·2064·6e66··install_cmd:·dnf | |||
| 0003b9e0:·2072·6569·6e73·7461·6c6c·202d·790a·2020···reinstall·-y.·· | |||
| 0003b9f0:·7768·656e·3a20·616e·7369·626c·655f·6469··when:·ansible_di | |||
| 0003ba00:·7374·7269·6275·7469·6f6e·203d·3d20·2246··stribution·==·"F | |||
| 0003ba10:·6564·6f72·6122·0a20·2074·6167·733a·0a20··edora".··tags:.· | |||
| 0003b | 0003bc60:·7265·696e·7374·616c·6c20·636f·6d6d·616e··reinstall·comman | ||
| 0003bc70:·6420·2864·6e66·2927·0a20·2073·6574·5f66··d·(dnf)'.··set_f | |||
| 0003bc80:·6163·743a·0a20·2020·2070·6163·6b61·6765··act:.····package | |||
| 0003bc90:·5f6d·616e·6167·6572·5f72·6569·6e73·7461··_manager_reinsta | |||
| 0003bca0:·6c6c·5f63·6d64·3a20·646e·6620·7265·696e··ll_cmd:·dnf·rein | |||
| 0003bcb0:·7374·616c·6c20·2d79·0a20·2077·6865·6e3a··stall·-y.··when: | |||
| 0003bcc0:·2061·6e73·6962·6c65·5f64·6973·7472·6962···ansible_distrib | |||
| 0003bcd0:·7574·696f·6e20·3d3d·2022·4665·646f·7261··ution·==·"Fedora | |||
| 0003bce0:·220a·2020·7461·6773·3a0a·2020·2d20·434a··".··tags:.··-·CJ | |||
| 0003bcf0:·4953·2d35·2e31·302e·342e·310a·2020·2d20··IS-5.10.4.1.··-· | |||
| 0003bd00:·4e49·5354·2d38·3030·2d31·3731·2d33·2e33··NIST-800-171-3.3 | |||
| 0003b | 0003bd10:·2e38·0a20·202d·204e·4953·542d·3830·302d··.8.··-·NIST-800- | ||
| 0003b | 0003bd20:·3137·312d·332e·342e·310a·2020·2d20·4e49··171-3.4.1.··-·NI | ||
| Max diff block lines reached; 5788767/5818215 bytes (99.49%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | *****·Profile·Information·***** | 40 | *****·Profile·Information·***** |
| 41 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight | 41 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:oracle:linux:9 | 44 | ····*·cpe:/o:oracle:linux:9 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·System_Accounting_with_auditd | 52 | ·········3.·System_Accounting_with_auditd |
| 53 | ·········4.·Configure_Syslog | 53 | ·········4.·Configure_Syslog |
| 54 | ·········5.·Network_Configuration_and_Firewalls | 54 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 85, 14 lines modified | Offset 85, 24 lines modified | ||
| 85 | $·sudo·yum·reinstall·PACKAGENAME | 85 | $·sudo·yum·reinstall·PACKAGENAME |
| 86 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 86 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 87 | $·sudo·rpm·-Uvh·PACKAGENAME | 87 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 88 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 88 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 89 | Severity: ················high | 89 | Severity: ················high |
| 90 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 90 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 91 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 91 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 92 | Remediation_Shell_script_⇲ | ||
| 93 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 94 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 95 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 96 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 97 | yum·reinstall·-y·$packages_to_reinstall | ||
| 92 | Remediation_Ansible_snippet_⇲ | 98 | Remediation_Ansible_snippet_⇲ |
| 93 | Complexity:·high | 99 | Complexity:·high |
| 94 | Disruption:·medium | 100 | Disruption:·medium |
| 95 | Strategy:···restrict | 101 | Strategy:···restrict |
| 96 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 102 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 97 | ··set_fact: | 103 | ··set_fact: |
| 98 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 104 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 236, 36 lines modified | Offset 246, 51 lines modified | ||
| 236 | ··-·PCI-DSS-Req-11.5 | 246 | ··-·PCI-DSS-Req-11.5 |
| 237 | ··-·high_complexity | 247 | ··-·high_complexity |
| 238 | ··-·high_severity | 248 | ··-·high_severity |
| 239 | ··-·medium_disruption | 249 | ··-·medium_disruption |
| 240 | ··-·no_reboot_needed | 250 | ··-·no_reboot_needed |
| 241 | ··-·restrict_strategy | 251 | ··-·restrict_strategy |
| 242 | ··-·rpm_verify_hashes | 252 | ··-·rpm_verify_hashes |
| 243 | Remediation_Shell_script_⇲ | ||
| 244 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 245 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 246 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 247 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 248 | yum·reinstall·-y·$packages_to_reinstall | ||
| 249 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 253 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 250 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 254 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 251 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 255 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 252 | run·the·following·command·to·determine·which·package·owns·it: | 256 | run·the·following·command·to·determine·which·package·owns·it: |
| 253 | $·rpm·-qf·FILENAME | 257 | $·rpm·-qf·FILENAME |
| 254 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 258 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 255 | $·sudo·rpm·--setugids·PACKAGENAME | 259 | $·sudo·rpm·--setugids·PACKAGENAME |
| 256 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 260 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 257 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 261 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 258 | Severity: ················high | 262 | Severity: ················high |
| 259 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 263 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 260 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 264 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 265 | Remediation_Shell_script_⇲ | ||
| 266 | Complexity:·high | ||
| 267 | Disruption:·medium | ||
| 268 | Strategy:···restrict | ||
| 269 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 270 | declare·-A·SETPERMS_RPM_DICT | ||
| 271 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 272 | #·is·expected·by·the·RPM·database | ||
| 273 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 274 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 275 | do | ||
| 276 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 277 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 278 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 279 | done | ||
| 280 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 281 | #·correct·values | ||
| 282 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 283 | do | ||
| 284 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 285 | done | ||
| 261 | Remediation_Ansible_snippet_⇲ | 286 | Remediation_Ansible_snippet_⇲ |
| 262 | Complexity:·high | 287 | Complexity:·high |
| 263 | Disruption:·medium | 288 | Disruption:·medium |
| 264 | Strategy:···restrict | 289 | Strategy:···restrict |
| 265 | -·name:·Read·list·of·files·with·incorrect·ownership | 290 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 266 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 291 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 267 | ····--nocaps·--nolinkto·--nomode | 292 | ····--nocaps·--nolinkto·--nomode |
| Offset 336, 52 lines modified | Offset 361, 56 lines modified | ||
| 336 | ··-·PCI-DSS-Req-11.5 | 361 | ··-·PCI-DSS-Req-11.5 |
| 337 | ··-·high_complexity | 362 | ··-·high_complexity |
| 338 | ··-·high_severity | 363 | ··-·high_severity |
| 339 | ··-·medium_disruption | 364 | ··-·medium_disruption |
| 340 | ··-·no_reboot_needed | 365 | ··-·no_reboot_needed |
| 341 | ··-·restrict_strategy | 366 | ··-·restrict_strategy |
| 342 | ··-·rpm_verify_ownership | 367 | ··-·rpm_verify_ownership |
| 368 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 369 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 370 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 371 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 372 | $·rpm·-qf·FILENAME | ||
| 373 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 374 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 375 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 376 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 377 | Severity: ················high | ||
| 378 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 379 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 343 | Remediation_Shell_script_⇲ | 380 | Remediation_Shell_script_⇲ |
| 344 | Complexity:·high | 381 | Complexity:·high |
| 345 | Disruption:·medium | 382 | Disruption:·medium |
| 346 | Strategy:···restrict | 383 | Strategy:···restrict |
| Max diff block lines reached; 662755/671902 bytes (98.64%) of diff not shown. | |||
| Offset 14315, 16 lines modified | Offset 14315, 16 lines modified | ||
| 00037ea0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00037ea0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00037eb0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00037eb0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00037ec0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00037ec0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00037ed0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00037ed0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00037ee0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00037ee0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00037ef0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00037ef0:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037f10:·2020·2020·2861·7320·6f66·2032·3032·3 | 00037f10:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00037f20:·303 | 00037f20:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00037f30:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00037f30:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00037f40:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00037f40:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00037f50:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00037f50:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00037f60:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00037f60:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00037f70:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00037f70:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00037f80:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00037f80:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00037f90:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00037f90:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15256, 324 lines modified | Offset 15256, 324 lines modified | ||
| 0003b970:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b970:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b980:·3d22·2369·646d·3530·3731·2220·7461·6269··="#idm5071"·tabi | 0003b980:·3d22·2369·646d·3530·3731·2220·7461·6269··="#idm5071"·tabi | ||
| 0003b990:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b990:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b9a0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b9a0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b9b0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b9b0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b9c0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b9c0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b9d0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b9d0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b9e0:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b9e0:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003b9f0:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003ba00:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b | 0003b9f0:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003ba00:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003ba10:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003ba20:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003ba30:·646d·3530·3731·223e·3c70·7265·3e3c·636f··dm5071"><pre><co | |||
| 0003ba40:·6465·3e0a·2320·4669·6e64·2077·6869·6368··de>.#·Find·which | |||
| 0003ba50:·2066·696c·6573·2068·6176·6520·696e·636f···files·have·inco | |||
| 0003ba60:·7272·6563·7420·6861·7368·2028·6e6f·7420··rrect·hash·(not· | |||
| 0003ba70:·696e·202f·6574·632c·2062·6563·6175·7365··in·/etc,·because | |||
| 0003ba80:·206f·6620·7468·6520·7379·7374·656d·2072···of·the·system·r | |||
| 0003ba90:·656c·6174·6564·2063·6f6e·6669·6720·6669··elated·config·fi | |||
| 0003baa0:·6c65·7329·2061·6e64·2074·6865·6e20·6765··les)·and·then·ge | |||
| 0003bab0:·7420·6669·6c65·7320·6e61·6d65·730a·6669··t·files·names.fi | |||
| 0003bac0:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003bad0:·6374·5f68·6173·683d·2224·2872·706d·202d··ct_hash="$(rpm·- | |||
| 0003bae0:·5661·202d·2d6e·6f63·6f6e·6669·6720·7c20··Va·--noconfig·|· | |||
| 0003baf0:·6772·6570·202d·4520·275e·2e2e·3527·207c··grep·-E·'^..5'·| | |||
| 0003bb00:·2061·776b·2027·7b70·7269·6e74·2024·4e46···awk·'{print·$NF | |||
| 0003bb10:·7d27·2029·220a·0a23·2046·726f·6d20·6669··}'·)"..#·From·fi | |||
| 0003bb20:·6c65·7320·6e61·6d65·7320·6765·7420·7061··les·names·get·pa | |||
| 0003bb30:·636b·6167·6520·6e61·6d65·7320·616e·6420··ckage·names·and· | |||
| 0003bb40:·6368·616e·6765·206e·6577·6c69·6e65·2074··change·newline·t | |||
| 0003bb50:·6f20·7370·6163·652c·2062·6563·6175·7365··o·space,·because | |||
| 0003bb60:·2072·706d·2077·7269·7465·7320·6561·6368···rpm·writes·each | |||
| 0003bb70:·2070·6163·6b61·6765·2074·6f20·6e65·7720···package·to·new· | |||
| 0003bb80:·6c69·6e65·0a70·6163·6b61·6765·735f·746f··line.packages_to | |||
| 0003bb90:·5f72·6569·6e73·7461·6c6c·3d22·2428·7270··_reinstall="$(rp | |||
| 0003bba0:·6d20·2d71·6620·2466·696c·6573·5f77·6974··m·-qf·$files_wit | |||
| 0003bbb0:·685f·696e·636f·7272·6563·745f·6861·7368··h_incorrect_hash | |||
| 0003bbc0:·207c·2074·7220·275c·6e27·2027·2027·2922···|·tr·'\n'·'·')" | |||
| 0003bbd0:·0a0a·0a79·756d·2072·6569·6e73·7461·6c6c··...yum·reinstall | |||
| 0003bbe0:·202d·7920·2470·6163·6b61·6765·735f·746f···-y·$packages_to | |||
| 0003bbf0:·5f72·6569·6e73·7461·6c6c·0a3c·2f63·6f64··_reinstall.</cod | |||
| 0003bc00:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bc10:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bc20:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003b | 0003bc30:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003ba30:·3d22·6964·6d35·3037·3122·3e3c·7461·626c··="idm5071"><tabl | |||
| 0003ba40:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003ba50:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003ba60:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003ba70:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003ba80:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003ba90:·3c2f·7468·3e3c·7464·3e68·6967·683c·2f74··</th><td>high</t | |||
| 0003baa0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bab0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bac0:·7464·3e6d·6564·6975·6d3c·2f74·643e·3c2f··td>medium</td></ | |||
| 0003bad0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003bae0:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 0003baf0:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 0003bb00:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003bb10:·653e·2d20·6e61·6d65·3a20·2753·6574·2066··e>-·name:·'Set·f | |||
| 0003bb20:·6163·743a·2050·6163·6b61·6765·206d·616e··act:·Package·man | |||
| 0003bb30:·6167·6572·2072·6569·6e73·7461·6c6c·2063··ager·reinstall·c | |||
| 0003bb40:·6f6d·6d61·6e64·2028·646e·6629·270a·2020··ommand·(dnf)'.·· | |||
| 0003b | 0003bc40:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003bc50:·6d35·3037·3222·2074·6162·696e·6465·783d··m5072"·tabindex= | |||
| 0003bc60:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bc70:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bc80:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bc90:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bca0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bcb0:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003bcc0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bcd0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bce0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bcf0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bd00:·3530·3732·223e·3c74·6162·6c65·2063·6c61··5072"><table·cla | |||
| 0003bd10:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bd20:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bd30:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bd40:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bd50:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bd60:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003bd70:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bd80:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003bd90:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003bda0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bdb0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003bdc0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bdd0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003bde0:·616d·653a·2027·5365·7420·6661·6374·3a20··ame:·'Set·fact:· | |||
| 0003b | 0003bdf0:·5061·636b·6167·6520·6d61·6e61·6765·7220··Package·manager· | ||
| 0003bb70:·696e·7374·616c·6c5f·636d·643a·2064·6e66··install_cmd:·dnf | |||
| 0003bb80:·2072·6569·6e73·7461·6c6c·202d·790a·2020···reinstall·-y.·· | |||
| 0003bb90:·7768·656e·3a20·616e·7369·626c·655f·6469··when:·ansible_di | |||
| 0003bba0:·7374·7269·6275·7469·6f6e·203d·3d20·2246··stribution·==·"F | |||
| 0003bbb0:·6564·6f72·6122·0a20·2074·6167·733a·0a20··edora".··tags:.· | |||
| 0003b | 0003be00:·7265·696e·7374·616c·6c20·636f·6d6d·616e··reinstall·comman | ||
| 0003be10:·6420·2864·6e66·2927·0a20·2073·6574·5f66··d·(dnf)'.··set_f | |||
| 0003be20:·6163·743a·0a20·2020·2070·6163·6b61·6765··act:.····package | |||
| 0003be30:·5f6d·616e·6167·6572·5f72·6569·6e73·7461··_manager_reinsta | |||
| 0003be40:·6c6c·5f63·6d64·3a20·646e·6620·7265·696e··ll_cmd:·dnf·rein | |||
| 0003be50:·7374·616c·6c20·2d79·0a20·2077·6865·6e3a··stall·-y.··when: | |||
| 0003be60:·2061·6e73·6962·6c65·5f64·6973·7472·6962···ansible_distrib | |||
| 0003be70:·7574·696f·6e20·3d3d·2022·4665·646f·7261··ution·==·"Fedora | |||
| 0003be80:·220a·2020·7461·6773·3a0a·2020·2d20·434a··".··tags:.··-·CJ | |||
| 0003be90:·4953·2d35·2e31·302e·342e·310a·2020·2d20··IS-5.10.4.1.··-· | |||
| 0003bea0:·4e49·5354·2d38·3030·2d31·3731·2d33·2e33··NIST-800-171-3.3 | |||
| 0003b | 0003beb0:·2e38·0a20·202d·204e·4953·542d·3830·302d··.8.··-·NIST-800- | ||
| Max diff block lines reached; 15323392/15352978 bytes (99.81%) of diff not shown. | |||
| Offset 46, 15 lines modified | Offset 46, 15 lines modified | ||
| 46 | *****·Profile·Information·***** | 46 | *****·Profile·Information·***** |
| 47 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) | 47 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) |
| 48 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa | 48 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa |
| 49 | ***·CPE·Platforms·*** | 49 | ***·CPE·Platforms·*** |
| 50 | ····*·cpe:/o:oracle:linux:9 | 50 | ····*·cpe:/o:oracle:linux:9 |
| 51 | *****·Revision·History·***** | 51 | *****·Revision·History·***** |
| 52 | Current·version:·0.1.65 | 52 | Current·version:·0.1.65 |
| 53 | ····*·draft·(as·of·202 | 53 | ····*·draft·(as·of·2025-02-23) |
| 54 | *****·Table·of·Contents·***** | 54 | *****·Table·of·Contents·***** |
| 55 | ···1.·System_Settings | 55 | ···1.·System_Settings |
| 56 | ·········1.·Installing_and_Maintaining_Software | 56 | ·········1.·Installing_and_Maintaining_Software |
| 57 | ·········2.·Account_and_Access_Control | 57 | ·········2.·Account_and_Access_Control |
| 58 | ·········3.·System_Accounting_with_auditd | 58 | ·········3.·System_Accounting_with_auditd |
| 59 | ·········4.·GRUB2_bootloader_configuration | 59 | ·········4.·GRUB2_bootloader_configuration |
| 60 | ·········5.·Configure_Syslog | 60 | ·········5.·Configure_Syslog |
| Offset 92, 14 lines modified | Offset 92, 24 lines modified | ||
| 92 | $·sudo·yum·reinstall·PACKAGENAME | 92 | $·sudo·yum·reinstall·PACKAGENAME |
| 93 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 93 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 94 | $·sudo·rpm·-Uvh·PACKAGENAME | 94 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 95 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 95 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 96 | Severity: ················high | 96 | Severity: ················high |
| 97 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 97 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 98 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 98 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 99 | Remediation_Shell_script_⇲ | ||
| 100 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 101 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 102 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 103 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 104 | yum·reinstall·-y·$packages_to_reinstall | ||
| 99 | Remediation_Ansible_snippet_⇲ | 105 | Remediation_Ansible_snippet_⇲ |
| 100 | Complexity:·high | 106 | Complexity:·high |
| 101 | Disruption:·medium | 107 | Disruption:·medium |
| 102 | Strategy:···restrict | 108 | Strategy:···restrict |
| 103 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 109 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 104 | ··set_fact: | 110 | ··set_fact: |
| 105 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 111 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 243, 37 lines modified | Offset 253, 56 lines modified | ||
| 243 | ··-·PCI-DSS-Req-11.5 | 253 | ··-·PCI-DSS-Req-11.5 |
| 244 | ··-·high_complexity | 254 | ··-·high_complexity |
| 245 | ··-·high_severity | 255 | ··-·high_severity |
| 246 | ··-·medium_disruption | 256 | ··-·medium_disruption |
| 247 | ··-·no_reboot_needed | 257 | ··-·no_reboot_needed |
| 248 | ··-·restrict_strategy | 258 | ··-·restrict_strategy |
| 249 | ··-·rpm_verify_hashes | 259 | ··-·rpm_verify_hashes |
| 250 | Remediation_Shell_script_⇲ | ||
| 251 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 252 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 253 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 254 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 255 | yum·reinstall·-y·$packages_to_reinstall | ||
| 256 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 260 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 257 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 261 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 258 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 262 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 259 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 263 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 260 | $·rpm·-qf·FILENAME | 264 | $·rpm·-qf·FILENAME |
| 261 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 265 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 262 | $·sudo·rpm·--setperms·PACKAGENAME | 266 | $·sudo·rpm·--setperms·PACKAGENAME |
| 263 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 267 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 264 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 268 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 265 | Severity: ················high | 269 | Severity: ················high |
| 266 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 270 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 267 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 271 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 272 | Remediation_Shell_script_⇲ | ||
| 273 | Complexity:·high | ||
| 274 | Disruption:·medium | ||
| 275 | Strategy:···restrict | ||
| 276 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 277 | declare·-A·SETPERMS_RPM_DICT | ||
| 278 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 279 | #·is·expected·by·the·RPM·database | ||
| 280 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 281 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 282 | do | ||
| 283 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 284 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 285 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 286 | ········do | ||
| 287 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 288 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 289 | ········done | ||
| 290 | done | ||
| 291 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 292 | #·correct·values | ||
| 293 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 294 | do | ||
| 295 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 296 | done | ||
| 268 | Remediation_Ansible_snippet_⇲ | 297 | Remediation_Ansible_snippet_⇲ |
| 269 | Complexity:·high | 298 | Complexity:·high |
| 270 | Disruption:·medium | 299 | Disruption:·medium |
| 271 | Strategy:···restrict | 300 | Strategy:···restrict |
| 272 | -·name:·Read·list·of·files·with·incorrect·permissions | 301 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 273 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 302 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 274 | ····--nocaps·--nolinkto·--nouser·--nogroup | 303 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 347, 43 lines modified | Offset 376, 14 lines modified | ||
| 347 | ··-·PCI-DSS-Req-11.5 | 376 | ··-·PCI-DSS-Req-11.5 |
| 348 | ··-·high_complexity | 377 | ··-·high_complexity |
| 349 | ··-·high_severity | 378 | ··-·high_severity |
| 350 | ··-·medium_disruption | 379 | ··-·medium_disruption |
| 351 | ··-·no_reboot_needed | 380 | ··-·no_reboot_needed |
| 352 | ··-·restrict_strategy | 381 | ··-·restrict_strategy |
| 353 | ··-·rpm_verify_permissions | 382 | ··-·rpm_verify_permissions |
| 354 | Remediation_Shell_script_⇲ | ||
| 355 | Complexity:·high | ||
| 356 | Disruption:·medium | ||
| 357 | Strategy:···restrict | ||
| 358 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 359 | declare·-A·SETPERMS_RPM_DICT | ||
| 360 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 361 | #·is·expected·by·the·RPM·database | ||
| 362 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1229414/1237577 bytes (99.34%) of diff not shown. | |||
| Offset 14299, 15 lines modified | Offset 14299, 15 lines modified | ||
| 00037da0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037da0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037db0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037db0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037dc0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037dc0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037dd0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037dd0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037de0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037de0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037df0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037df0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037e00:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037e00:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037e10:·3230·323 | 00037e10:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037e20:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037e20:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037e30:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037e30:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037e40:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037e40:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037e50:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037e50:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037e60:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037e60:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037e70:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037e70:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037e80:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037e80:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15219, 190 lines modified | Offset 15219, 190 lines modified | ||
| 0003b720:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003b720:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003b730:·2223·6964·6d35·3430·3222·2074·6162·696e··"#idm5402"·tabin | 0003b730:·2223·6964·6d35·3430·3222·2074·6162·696e··"#idm5402"·tabin | ||
| 0003b740:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003b740:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003b750:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003b750:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003b760:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003b760:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003b770:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003b770:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003b780:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003b780:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003b790:·3e52·656d·6564·6961·7469·6f6e·20 | 0003b790:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003b7a0:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003b7b0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b7c0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003b7d0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003b7e0:·3d22·6964·6d35·3430·3222·3e3c·7461·626c··="idm5402"><tabl | |||
| 0003b7f0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003b800:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003b810:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003b820:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003b830:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003b840:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003b850:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003b860:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003b870:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003b880:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003b890:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003b8a0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003b8b0:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003b8c0:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003b8d0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003b8e0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003b8f0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003b900:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003b910:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003b920:·3d22·2369·646d·3534·3033·2220·7461·6269··="#idm5403"·tabi | |||
| 0003b930:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003b940:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003b950:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003b960:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003b970:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003b980:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003b990:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003b9a0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003b9b0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003b9c0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003b9d0:·2269·646d·3534·3033·223e·3c74·6162·6c65··"idm5403"><table | |||
| 0003b9e0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003b9f0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003ba00:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003ba10:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003ba20:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003ba30:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003ba40:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003ba50:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003ba60:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003ba70:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003ba80:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003ba90:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003baa0:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003bab0:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003bac0:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003bad0:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003bae0:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003baf0:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003bb00:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003bb10:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bb20:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003bb30:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003bb40:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003bb50:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003bb60:·2369·646d·3534·3034·2220·7461·6269·6e64··#idm5404"·tabind | |||
| 0003bb70:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bb80:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003bb90:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bba0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003bbb0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003bbc0:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003b | 0003b7a0:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003b | 0003b7b0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003b | 0003b7c0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003b | 0003b7d0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003b | 0003b7e0:·6964·6d35·3430·3222·3e3c·7461·626c·6520··idm5402"><table· | ||
| 0003b | 0003b7f0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003b | 0003b800:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003b | 0003b810:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003b | 0003b820:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003b | 0003b830:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003b | 0003b840:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003b | 0003b850:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003b | 0003b860:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003b | 0003b870:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003b | 0003b880:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003b | 0003b890:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003b | 0003b8a0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003b8b0:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003b8c0:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003b8d0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003b8e0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003b8f0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003b900:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003b910:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003b920:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003b930:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003b940:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003b950:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003b960:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003b970:·6964·6d35·3430·3322·2074·6162·696e·6465··idm5403"·tabinde | |||
| 0003b980:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003b990:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003b9a0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003b9b0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003b9c0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003b9d0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| Max diff block lines reached; 6642055/6668053 bytes (99.61%) of diff not shown. | |||
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | *****·Profile·Information·***** | 42 | *****·Profile·Information·***** |
| 43 | Profile·Title·[DRAFT]·Protection·Profile·for·General·Purpose·Operating·Systems | 43 | Profile·Title·[DRAFT]·Protection·Profile·for·General·Purpose·Operating·Systems |
| 44 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp | 44 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp |
| 45 | ***·CPE·Platforms·*** | 45 | ***·CPE·Platforms·*** |
| 46 | ····*·cpe:/o:oracle:linux:9 | 46 | ····*·cpe:/o:oracle:linux:9 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·System_Accounting_with_auditd | 54 | ·········3.·System_Accounting_with_auditd |
| 55 | ·········4.·GRUB2_bootloader_configuration | 55 | ·········4.·GRUB2_bootloader_configuration |
| 56 | ·········5.·Configure_Syslog | 56 | ·········5.·Configure_Syslog |
| Offset 82, 31 lines modified | Offset 82, 39 lines modified | ||
| 82 | ***·Rule ·Install·AIDE· [ref]·*** | 82 | ***·Rule ·Install·AIDE· [ref]·*** |
| 83 | The·aide·package·can·be·installed·with·the·following·command: | 83 | The·aide·package·can·be·installed·with·the·following·command: |
| 84 | $·sudo·yum·install·aide | 84 | $·sudo·yum·install·aide |
| 85 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 85 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 86 | Severity: ················medium | 86 | Severity: ················medium |
| 87 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 87 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 88 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 88 | Identifiers·and·References·References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 89 | Remediation_Anaconda_snippet_⇲ | ||
| 90 | Complexity:·low | ||
| 91 | Disruption:·low | ||
| 92 | Strategy:···enable | ||
| 93 | package·--add=aide | ||
| 94 | Remediation_Puppet_snippet_⇲ | 89 | Remediation_Puppet_snippet_⇲ |
| 95 | Complexity:·low | 90 | Complexity:·low |
| 96 | Disruption:·low | 91 | Disruption:·low |
| 97 | Strategy:···enable | 92 | Strategy:···enable |
| 98 | include·install_aide | 93 | include·install_aide |
| 99 | class·install_aide·{ | 94 | class·install_aide·{ |
| 100 | ··package·{·'aide': | 95 | ··package·{·'aide': |
| 101 | ····ensure·=>·'installed', | 96 | ····ensure·=>·'installed', |
| 102 | ··} | 97 | ··} |
| 103 | } | 98 | } |
| 99 | Remediation_Shell_script_⇲ | ||
| 100 | Complexity:·low | ||
| 101 | Disruption:·low | ||
| 102 | Strategy:···enable | ||
| 103 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 104 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 105 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 106 | ····yum·install·-y·"aide" | ||
| 107 | fi | ||
| 108 | else | ||
| 109 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 110 | fi | ||
| 104 | Remediation_Ansible_snippet_⇲ | 111 | Remediation_Ansible_snippet_⇲ |
| 105 | Complexity:·low | 112 | Complexity:·low |
| 106 | Disruption:·low | 113 | Disruption:·low |
| 107 | Strategy:···enable | 114 | Strategy:···enable |
| 108 | -·name:·Ensure·aide·is·installed | 115 | -·name:·Ensure·aide·is·installed |
| 109 | ··package: | 116 | ··package: |
| 110 | ····name:·aide | 117 | ····name:·aide |
| Offset 123, 28 lines modified | Offset 131, 20 lines modified | ||
| 123 | ··-·no_reboot_needed | 131 | ··-·no_reboot_needed |
| 124 | ··-·package_aide_installed | 132 | ··-·package_aide_installed |
| 125 | Remediation_OSBuild_Blueprint_snippet_⇲ | 133 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 126 | [[packages]] | 134 | [[packages]] |
| 127 | name·=·"aide" | 135 | name·=·"aide" |
| 128 | version·=·"*" | 136 | version·=·"*" |
| 129 | Remediation_ | 137 | Remediation_Anaconda_snippet_⇲ |
| 130 | Complexity:·low | 138 | Complexity:·low |
| 131 | Disruption:·low | 139 | Disruption:·low |
| 132 | Strategy:···enable | 140 | Strategy:···enable |
| 133 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 134 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 135 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 136 | ····yum·install·-y·"aide" | ||
| 137 | fi | ||
| 141 | package·--add=aide | ||
| 138 | else | ||
| 139 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 140 | fi | ||
| 141 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 142 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 142 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 143 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 143 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·9. | 144 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Oracle·Linux·9. |
| 144 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 145 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 145 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 146 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 153, 14 lines modified | Offset 153, 27 lines modified | ||
| 153 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" | 153 | To·enable·FIPS,·the·system·requires·that·the·fips·module·is·added·in·dracut·configuration.·Check·if·/etc/dracut.conf.d/40-fips.conf·contain·add_dracutmodules+="·fips·" |
| 154 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 154 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 155 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 155 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 156 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 156 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 157 | Severity: ················high | 157 | Severity: ················high |
| 158 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 158 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 159 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 159 | Identifiers·and·References·References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 160 | Remediation_Shell_script_⇲ | ||
| 161 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 162 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 163 | fips-mode-setup·--enable | ||
| 164 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 165 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 166 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 167 | fi | ||
| 168 | else | ||
| 169 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 170 | fi | ||
| 160 | Remediation_Ansible_snippet_⇲ | 171 | Remediation_Ansible_snippet_⇲ |
| 161 | Complexity:·medium | 172 | Complexity:·medium |
| 162 | Disruption:·medium | 173 | Disruption:·medium |
| 163 | Reboot:·····true | 174 | Reboot:·····true |
| 164 | Strategy:···restrict | 175 | Strategy:···restrict |
| 165 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 176 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 166 | ··command:·/usr/bin/fips-mode-setup·--check | 177 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 215, 27 lines modified | Offset 228, 14 lines modified | ||
| 215 | ··-·NIST-800-53-SC-13 | 228 | ··-·NIST-800-53-SC-13 |
| 216 | ··-·enable_dracut_fips_module | 229 | ··-·enable_dracut_fips_module |
| 217 | ··-·high_severity | 230 | ··-·high_severity |
| 218 | ··-·medium_complexity | 231 | ··-·medium_complexity |
| 219 | ··-·medium_disruption | 232 | ··-·medium_disruption |
| 220 | ··-·reboot_required | 233 | ··-·reboot_required |
| 221 | ··-·restrict_strategy | 234 | ··-·restrict_strategy |
| Max diff block lines reached; 857075/864268 bytes (99.17%) of diff not shown. | |||
| Offset 14279, 15 lines modified | Offset 14279, 15 lines modified | ||
| 00037c60:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037c60:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037c70:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037c70:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037c80:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037c80:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037c90:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037c90:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037ca0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037ca0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037cb0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037cb0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037cc0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037cc0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037cd0:·7320·6f66·2032·3032·3 | 00037cd0:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037ce0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037ce0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037cf0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037cf0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d00:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d00:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d10:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d10:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d20:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d20:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d30:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d30:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037d40:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037d40:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15206, 323 lines modified | Offset 15206, 323 lines modified | ||
| 0003b650:·2d74·6172·6765·743d·2223·6964·6d35·3037··-target="#idm507 | 0003b650:·2d74·6172·6765·743d·2223·6964·6d35·3037··-target="#idm507 | ||
| 0003b660:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | 0003b660:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | ||
| 0003b670:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003b670:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003b680:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003b680:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003b690:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003b690:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003b6a0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003b6a0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003b6b0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003b6b0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003b6c0:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003b6d0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003b6e0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003b6f0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003b700:·7073·6522·2069·643d·2269·646d·3530·3731··pse"·id="idm5071 | |||
| 0003b710:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003b720:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003b730:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003b740:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003b750:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003b760:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003b770:·6869·6768·3c2f·7464·3e3c·2f74·723e·3c74··high</td></tr><t | |||
| 0003b780:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003b790:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003b7a0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003b7b0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003b7c0:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003b7d0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003b7e0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003b7f0:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003b800:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003b810:·7374·616c·6c20·636f·6d6d·616e·6420·2864··stall·command·(d | |||
| 0003b820:·6e66·2927·0a20·2073·6574·5f66·6163·743a··nf)'.··set_fact: | |||
| 0003b830:·0a20·2020·2070·6163·6b61·6765·5f6d·616e··.····package_man | |||
| 0003b840:·6167·6572·5f72·6569·6e73·7461·6c6c·5f63··ager_reinstall_c | |||
| 0003b850:·6d64·3a20·646e·6620·7265·696e·7374·616c··md:·dnf·reinstal | |||
| 0003b860:·6c20·2d79·0a20·2077·6865·6e3a·2061·6e73··l·-y.··when:·ans | |||
| 0003b870:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003b880:·6e20·3d3d·2022·4665·646f·7261·220a·2020··n·==·"Fedora".·· | |||
| 0003b890:·7461·6773·3a0a·2020·2d20·434a·4953·2d35··tags:.··-·CJIS-5 | |||
| 0003b8a0:·2e31·302e·342e·310a·2020·2d20·4e49·5354··.10.4.1.··-·NIST | |||
| 0003b8b0:·2d38·3030·2d31·3731·2d33·2e33·2e38·0a20··-800-171-3.3.8.· | |||
| 0003b8c0:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003b8d0:·332e·342e·310a·2020·2d20·4e49·5354·2d38··3.4.1.··-·NIST-8 | |||
| 0003b8e0:·3030·2d35·332d·4155·2d39·2833·290a·2020··00-53-AU-9(3).·· | |||
| 0003b8f0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003b900:·2d36·2863·290a·2020·2d20·4e49·5354·2d38··-6(c).··-·NIST-8 | |||
| 0003b910:·3030·2d35·332d·434d·2d36·2864·290a·2020··00-53-CM-6(d).·· | |||
| 0003b920:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003b930:·2d37·0a20·202d·204e·4953·542d·3830·302d··-7.··-·NIST-800- | |||
| 0003b940:·3533·2d53·492d·3728·3129·0a20·202d·204e··53-SI-7(1).··-·N | |||
| 0003b950:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003b960:·3629·0a20·202d·2050·4349·2d44·5353·2d52··6).··-·PCI-DSS-R | |||
| 0003b970:·6571·2d31·312e·350a·2020·2d20·6869·6768··eq-11.5.··-·high | |||
| 0003b980:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003b990:·6869·6768·5f73·6576·6572·6974·790a·2020··high_severity.·· | |||
| 0003b9a0:·2d20·6d65·6469·756d·5f64·6973·7275·7074··-·medium_disrupt | |||
| 0003b9b0:·696f·6e0a·2020·2d20·6e6f·5f72·6562·6f6f··ion.··-·no_reboo | |||
| 0003b9c0:·745f·6e65·6564·6564·0a20·202d·2072·6573··t_needed.··-·res | |||
| 0003b9d0:·7472·6963·745f·7374·7261·7465·6779·0a20··trict_strategy.· | |||
| 0003b | 0003b6c0:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003b6d0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003b6e0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003b6f0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003b700:·2220·6964·3d22·6964·6d35·3037·3122·3e3c··"·id="idm5071">< | |||
| 0003b710:·7072·653e·3c63·6f64·653e·0a23·2046·696e··pre><code>.#·Fin | |||
| 0003b720:·6420·7768·6963·6820·6669·6c65·7320·6861··d·which·files·ha | |||
| 0003b730:·7665·2069·6e63·6f72·7265·6374·2068·6173··ve·incorrect·has | |||
| 0003b740:·6820·286e·6f74·2069·6e20·2f65·7463·2c20··h·(not·in·/etc,· | |||
| 0003b750:·6265·6361·7573·6520·6f66·2074·6865·2073··because·of·the·s | |||
| 0003b760:·7973·7465·6d20·7265·6c61·7465·6420·636f··ystem·related·co | |||
| 0003b770:·6e66·6967·2066·696c·6573·2920·616e·6420··nfig·files)·and· | |||
| 0003b780:·7468·656e·2067·6574·2066·696c·6573·206e··then·get·files·n | |||
| 0003b790:·616d·6573·0a66·696c·6573·5f77·6974·685f··ames.files_with_ | |||
| 0003b7a0:·696e·636f·7272·6563·745f·6861·7368·3d22··incorrect_hash=" | |||
| 0003b7b0:·2428·7270·6d20·2d56·6120·2d2d·6e6f·636f··$(rpm·-Va·--noco | |||
| 0003b7c0:·6e66·6967·207c·2067·7265·7020·2d45·2027··nfig·|·grep·-E·' | |||
| 0003b7d0:·5e2e·2e35·2720·7c20·6177·6b20·277b·7072··^..5'·|·awk·'{pr | |||
| 0003b7e0:·696e·7420·244e·467d·2720·2922·0a0a·2320··int·$NF}'·)"..#· | |||
| 0003b7f0:·4672·6f6d·2066·696c·6573·206e·616d·6573··From·files·names | |||
| 0003b800:·2067·6574·2070·6163·6b61·6765·206e·616d···get·package·nam | |||
| 0003b810:·6573·2061·6e64·2063·6861·6e67·6520·6e65··es·and·change·ne | |||
| 0003b820:·776c·696e·6520·746f·2073·7061·6365·2c20··wline·to·space,· | |||
| 0003b830:·6265·6361·7573·6520·7270·6d20·7772·6974··because·rpm·writ | |||
| 0003b840:·6573·2065·6163·6820·7061·636b·6167·6520··es·each·package· | |||
| 0003b850:·746f·206e·6577·206c·696e·650a·7061·636b··to·new·line.pack | |||
| 0003b860:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003b870:·6c3d·2224·2872·706d·202d·7166·2024·6669··l="$(rpm·-qf·$fi | |||
| 0003b880:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003b890:·6374·5f68·6173·6820·7c20·7472·2027·5c6e··ct_hash·|·tr·'\n | |||
| 0003b8a0:·2720·2720·2729·220a·0a0a·7975·6d20·7265··'·'·')"...yum·re | |||
| 0003b8b0:·696e·7374·616c·6c20·2d79·2024·7061·636b··install·-y·$pack | |||
| 0003b8c0:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003b8d0:·6c0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··l.</code></pre>< | |||
| 0003b8e0:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003b8f0:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003b900:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003b910:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003b920:·6574·3d22·2369·646d·3530·3732·2220·7461··et="#idm5072"·ta | |||
| 0003b930:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003b940:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003b950:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003b960:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003b970:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003b980:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003b990:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b9a0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b9b0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b9c0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b9d0:·6964·3d22·6964·6d35·3037·3222·3e3c·7461··id="idm5072"><ta | |||
| 0003b9e0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003b9f0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003ba00:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003ba10:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| Max diff block lines reached; 13387177/13416349 bytes (99.78%) of diff not shown. | |||
| Offset 36, 15 lines modified | Offset 36, 15 lines modified | ||
| 36 | *****·Profile·Information·***** | 36 | *****·Profile·Information·***** |
| 37 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·Oracle·Linux·9 | 37 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·Oracle·Linux·9 |
| 38 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 38 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:oracle:linux:9 | 40 | ····*·cpe:/o:oracle:linux:9 |
| 41 | *****·Revision·History·***** | 41 | *****·Revision·History·***** |
| 42 | Current·version:·0.1.65 | 42 | Current·version:·0.1.65 |
| 43 | ····*·draft·(as·of·202 | 43 | ····*·draft·(as·of·2025-02-23) |
| 44 | *****·Table·of·Contents·***** | 44 | *****·Table·of·Contents·***** |
| 45 | ···1.·System_Settings | 45 | ···1.·System_Settings |
| 46 | ·········1.·Installing_and_Maintaining_Software | 46 | ·········1.·Installing_and_Maintaining_Software |
| 47 | ·········2.·Account_and_Access_Control | 47 | ·········2.·Account_and_Access_Control |
| 48 | ·········3.·System_Accounting_with_auditd | 48 | ·········3.·System_Accounting_with_auditd |
| 49 | ·········4.·GRUB2_bootloader_configuration | 49 | ·········4.·GRUB2_bootloader_configuration |
| 50 | ·········5.·Configure_Syslog | 50 | ·········5.·Configure_Syslog |
| Offset 79, 14 lines modified | Offset 79, 24 lines modified | ||
| 79 | $·sudo·yum·reinstall·PACKAGENAME | 79 | $·sudo·yum·reinstall·PACKAGENAME |
| 80 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 80 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 81 | $·sudo·rpm·-Uvh·PACKAGENAME | 81 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 82 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 82 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 83 | Severity: ················high | 83 | Severity: ················high |
| 84 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 84 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 85 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 85 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 86 | Remediation_Shell_script_⇲ | ||
| 87 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 88 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 89 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 90 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 91 | yum·reinstall·-y·$packages_to_reinstall | ||
| 86 | Remediation_Ansible_snippet_⇲ | 92 | Remediation_Ansible_snippet_⇲ |
| 87 | Complexity:·high | 93 | Complexity:·high |
| 88 | Disruption:·medium | 94 | Disruption:·medium |
| 89 | Strategy:···restrict | 95 | Strategy:···restrict |
| 90 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 96 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 91 | ··set_fact: | 97 | ··set_fact: |
| 92 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 98 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 230, 37 lines modified | Offset 240, 56 lines modified | ||
| 230 | ··-·PCI-DSS-Req-11.5 | 240 | ··-·PCI-DSS-Req-11.5 |
| 231 | ··-·high_complexity | 241 | ··-·high_complexity |
| 232 | ··-·high_severity | 242 | ··-·high_severity |
| 233 | ··-·medium_disruption | 243 | ··-·medium_disruption |
| 234 | ··-·no_reboot_needed | 244 | ··-·no_reboot_needed |
| 235 | ··-·restrict_strategy | 245 | ··-·restrict_strategy |
| 236 | ··-·rpm_verify_hashes | 246 | ··-·rpm_verify_hashes |
| 237 | Remediation_Shell_script_⇲ | ||
| 238 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 239 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 240 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 241 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 242 | yum·reinstall·-y·$packages_to_reinstall | ||
| 243 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 247 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 244 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 248 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 245 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 249 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 246 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 250 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 247 | $·rpm·-qf·FILENAME | 251 | $·rpm·-qf·FILENAME |
| 248 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 252 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 249 | $·sudo·rpm·--setperms·PACKAGENAME | 253 | $·sudo·rpm·--setperms·PACKAGENAME |
| 250 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 254 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 251 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 255 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 252 | Severity: ················high | 256 | Severity: ················high |
| 253 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 257 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 254 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 258 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 259 | Remediation_Shell_script_⇲ | ||
| 260 | Complexity:·high | ||
| 261 | Disruption:·medium | ||
| 262 | Strategy:···restrict | ||
| 263 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 264 | declare·-A·SETPERMS_RPM_DICT | ||
| 265 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 266 | #·is·expected·by·the·RPM·database | ||
| 267 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 268 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 269 | do | ||
| 270 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 271 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 272 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 273 | ········do | ||
| 274 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 275 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 276 | ········done | ||
| 277 | done | ||
| 278 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 279 | #·correct·values | ||
| 280 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 281 | do | ||
| 282 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 283 | done | ||
| 255 | Remediation_Ansible_snippet_⇲ | 284 | Remediation_Ansible_snippet_⇲ |
| 256 | Complexity:·high | 285 | Complexity:·high |
| 257 | Disruption:·medium | 286 | Disruption:·medium |
| 258 | Strategy:···restrict | 287 | Strategy:···restrict |
| 259 | -·name:·Read·list·of·files·with·incorrect·permissions | 288 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 260 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 289 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 261 | ····--nocaps·--nolinkto·--nouser·--nogroup | 290 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 334, 69 lines modified | Offset 363, 48 lines modified | ||
| 334 | ··-·PCI-DSS-Req-11.5 | 363 | ··-·PCI-DSS-Req-11.5 |
| 335 | ··-·high_complexity | 364 | ··-·high_complexity |
| 336 | ··-·high_severity | 365 | ··-·high_severity |
| 337 | ··-·medium_disruption | 366 | ··-·medium_disruption |
| 338 | ··-·no_reboot_needed | 367 | ··-·no_reboot_needed |
| 339 | ··-·restrict_strategy | 368 | ··-·restrict_strategy |
| 340 | ··-·rpm_verify_permissions | 369 | ··-·rpm_verify_permissions |
| 341 | Remediation_Shell_script_⇲ | ||
| 342 | Complexity:·high | ||
| 343 | Disruption:·medium | ||
| 344 | Strategy:···restrict | ||
| 345 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 346 | declare·-A·SETPERMS_RPM_DICT | ||
| 347 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 348 | #·is·expected·by·the·RPM·database | ||
| 349 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1090232/1098385 bytes (99.26%) of diff not shown. | |||
| Offset 14285, 15 lines modified | Offset 14285, 15 lines modified | ||
| 00037cc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037cc0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037cd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037cd0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037ce0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037ce0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037cf0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037cf0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037d00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037d00:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037d10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037d10:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037d20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037d20:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037d30:·7320·6f66·2032·3032·3 | 00037d30:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037d40:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037d50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037d50:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037d60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037d60:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037d70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037d70:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037d80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037d80:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037d90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037d90:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037da0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037da0:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15193, 324 lines modified | Offset 15193, 324 lines modified | ||
| 0003b580:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003b580:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003b590:·2369·646d·3530·3731·2220·7461·6269·6e64··#idm5071"·tabind | 0003b590:·2369·646d·3530·3731·2220·7461·6269·6e64··#idm5071"·tabind | ||
| 0003b5a0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003b5a0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003b5b0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003b5b0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003b5c0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003b5c0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003b5d0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003b5d0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003b5e0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003b5e0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003b5f0:·5265·6d65·6469·6174·696f·6e20· | 0003b5f0:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003b600:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003b610:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003b6 | 0003b600:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | ||
| 0003b610:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b620:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b630:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b640:·3530·3731·223e·3c70·7265·3e3c·636f·6465··5071"><pre><code | |||
| 0003b650:·3e0a·2320·4669·6e64·2077·6869·6368·2066··>.#·Find·which·f | |||
| 0003b660:·696c·6573·2068·6176·6520·696e·636f·7272··iles·have·incorr | |||
| 0003b670:·6563·7420·6861·7368·2028·6e6f·7420·696e··ect·hash·(not·in | |||
| 0003b680:·202f·6574·632c·2062·6563·6175·7365·206f···/etc,·because·o | |||
| 0003b690:·6620·7468·6520·7379·7374·656d·2072·656c··f·the·system·rel | |||
| 0003b6a0:·6174·6564·2063·6f6e·6669·6720·6669·6c65··ated·config·file | |||
| 0003b6b0:·7329·2061·6e64·2074·6865·6e20·6765·7420··s)·and·then·get· | |||
| 0003b6c0:·6669·6c65·7320·6e61·6d65·730a·6669·6c65··files·names.file | |||
| 0003b6d0:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003b6e0:·5f68·6173·683d·2224·2872·706d·202d·5661··_hash="$(rpm·-Va | |||
| 0003b6f0:·202d·2d6e·6f63·6f6e·6669·6720·7c20·6772···--noconfig·|·gr | |||
| 0003b700:·6570·202d·4520·275e·2e2e·3527·207c·2061··ep·-E·'^..5'·|·a | |||
| 0003b710:·776b·2027·7b70·7269·6e74·2024·4e46·7d27··wk·'{print·$NF}' | |||
| 0003b720:·2029·220a·0a23·2046·726f·6d20·6669·6c65···)"..#·From·file | |||
| 0003b730:·7320·6e61·6d65·7320·6765·7420·7061·636b··s·names·get·pack | |||
| 0003b740:·6167·6520·6e61·6d65·7320·616e·6420·6368··age·names·and·ch | |||
| 0003b750:·616e·6765·206e·6577·6c69·6e65·2074·6f20··ange·newline·to· | |||
| 0003b760:·7370·6163·652c·2062·6563·6175·7365·2072··space,·because·r | |||
| 0003b770:·706d·2077·7269·7465·7320·6561·6368·2070··pm·writes·each·p | |||
| 0003b780:·6163·6b61·6765·2074·6f20·6e65·7720·6c69··ackage·to·new·li | |||
| 0003b790:·6e65·0a70·6163·6b61·6765·735f·746f·5f72··ne.packages_to_r | |||
| 0003b7a0:·6569·6e73·7461·6c6c·3d22·2428·7270·6d20··einstall="$(rpm· | |||
| 0003b7b0:·2d71·6620·2466·696c·6573·5f77·6974·685f··-qf·$files_with_ | |||
| 0003b7c0:·696e·636f·7272·6563·745f·6861·7368·207c··incorrect_hash·| | |||
| 0003b7d0:·2074·7220·275c·6e27·2027·2027·2922·0a0a···tr·'\n'·'·')".. | |||
| 0003b7e0:·0a79·756d·2072·6569·6e73·7461·6c6c·202d··.yum·reinstall·- | |||
| 0003b7f0:·7920·2470·6163·6b61·6765·735f·746f·5f72··y·$packages_to_r | |||
| 0003b800:·6569·6e73·7461·6c6c·0a3c·2f63·6f64·653e··einstall.</code> | |||
| 0003b810:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003b820:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003b830:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003b | 0003b840:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003b850:·7461·2d74·6172·6765·743d·2223·6964·6d35··ta-target="#idm5 | |||
| 0003b860:·3037·3222·2074·6162·696e·6465·783d·2230··072"·tabindex="0 | |||
| 0003b870:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003b880:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003b890:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003b8a0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003b8b0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003b8c0:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003b8d0:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003b8e0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003b8f0:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003b900:·6c61·7073·6522·2069·643d·2269·646d·3530··lapse"·id="idm50 | |||
| 0003b910:·3732·223e·3c74·6162·6c65·2063·6c61·7373··72"><table·class | |||
| 0003b920:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003b930:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003b940:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003b950:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003b960:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003b970:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003b980:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003b990:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003b9a0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003b9b0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003b9c0:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003b9d0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003b9e0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003b640:·6964·6d35·3037·3122·3e3c·7461·626c·6520··idm5071"><table· | |||
| 0003b650:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003b660:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003b670:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003b680:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003b690:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003b6a0:·7468·3e3c·7464·3e68·6967·683c·2f74·643e··th><td>high</td> | |||
| 0003b6b0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003b6c0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003b6d0:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003b6e0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003b6f0:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003b700:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003b710:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003b720:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003b730:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003b740:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003b750:·6d61·6e64·2028·646e·6629·270a·2020·7365··mand·(dnf)'.··se | |||
| 0003b760:·745f·6661·6374·3a0a·2020·2020·7061·636b··t_fact:.····pack | |||
| 0003b770:·6167·655f·6d61·6e61·6765·725f·7265·696e··age_manager_rein | |||
| 0003b780:·7374·616c·6c5f·636d·643a·2064·6e66·2072··stall_cmd:·dnf·r | |||
| 0003b790:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003b7a0:·656e·3a20·616e·7369·626c·655f·6469·7374··en:·ansible_dist | |||
| 0003b7b0:·7269·6275·7469·6f6e·203d·3d20·2246·6564··ribution·==·"Fed | |||
| 0003b7c0:·6f72·6122·0a20·2074·6167·733a·0a20·202d··ora".··tags:.··- | |||
| 0003b7d0:·2043·4a49·532d·352e·3130·2e34·2e31·0a20···CJIS-5.10.4.1.· | |||
| 0003b7e0:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003b7f0:·332e·332e·380a·2020·2d20·4e49·5354·2d38··3.3.8.··-·NIST-8 | |||
| 0003b800:·3030·2d31·3731·2d33·2e34·2e31·0a20·202d··00-171-3.4.1.··- | |||
| 0003b810:·204e·4953·542d·3830·302d·3533·2d41·552d···NIST-800-53-AU- | |||
| 0003b820:·3928·3329·0a20·202d·204e·4953·542d·3830··9(3).··-·NIST-80 | |||
| 0003b830:·302d·3533·2d43·4d2d·3628·6329·0a20·202d··0-53-CM-6(c).··- | |||
| 0003b840:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003b850:·3628·6429·0a20·202d·204e·4953·542d·3830··6(d).··-·NIST-80 | |||
| 0003b860:·302d·3533·2d53·492d·370a·2020·2d20·4e49··0-53-SI-7.··-·NI | |||
| 0003b870:·5354·2d38·3030·2d35·332d·5349·2d37·2831··ST-800-53-SI-7(1 | |||
| 0003b880:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003b890:·332d·5349·2d37·2836·290a·2020·2d20·5043··3-SI-7(6).··-·PC | |||
| Max diff block lines reached; 9198862/9228310 bytes (99.68%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | *****·Profile·Information·***** | 38 | *****·Profile·Information·***** |
| 39 | Profile·Title·Standard·System·Security·Profile·for·Oracle·Linux·9 | 39 | Profile·Title·Standard·System·Security·Profile·for·Oracle·Linux·9 |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:oracle:linux:9 | 42 | ····*·cpe:/o:oracle:linux:9 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·Configure_Syslog | 51 | ·········4.·Configure_Syslog |
| 52 | ·········5.·File_Permissions_and_Masks | 52 | ·········5.·File_Permissions_and_Masks |
| Offset 78, 14 lines modified | Offset 78, 24 lines modified | ||
| 78 | $·sudo·yum·reinstall·PACKAGENAME | 78 | $·sudo·yum·reinstall·PACKAGENAME |
| 79 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 79 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 80 | $·sudo·rpm·-Uvh·PACKAGENAME | 80 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 81 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 81 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 82 | Severity: ················high | 82 | Severity: ················high |
| 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 84 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 84 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 85 | Remediation_Shell_script_⇲ | ||
| 86 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 87 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 88 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 89 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 90 | yum·reinstall·-y·$packages_to_reinstall | ||
| 85 | Remediation_Ansible_snippet_⇲ | 91 | Remediation_Ansible_snippet_⇲ |
| 86 | Complexity:·high | 92 | Complexity:·high |
| 87 | Disruption:·medium | 93 | Disruption:·medium |
| 88 | Strategy:···restrict | 94 | Strategy:···restrict |
| 89 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 95 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 90 | ··set_fact: | 96 | ··set_fact: |
| 91 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 97 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 229, 37 lines modified | Offset 239, 56 lines modified | ||
| 229 | ··-·PCI-DSS-Req-11.5 | 239 | ··-·PCI-DSS-Req-11.5 |
| 230 | ··-·high_complexity | 240 | ··-·high_complexity |
| 231 | ··-·high_severity | 241 | ··-·high_severity |
| 232 | ··-·medium_disruption | 242 | ··-·medium_disruption |
| 233 | ··-·no_reboot_needed | 243 | ··-·no_reboot_needed |
| 234 | ··-·restrict_strategy | 244 | ··-·restrict_strategy |
| 235 | ··-·rpm_verify_hashes | 245 | ··-·rpm_verify_hashes |
| 236 | Remediation_Shell_script_⇲ | ||
| 237 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 238 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 239 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 240 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 241 | yum·reinstall·-y·$packages_to_reinstall | ||
| 242 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 246 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 243 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 247 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 244 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 248 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 245 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 249 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 246 | $·rpm·-qf·FILENAME | 250 | $·rpm·-qf·FILENAME |
| 247 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 251 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 248 | $·sudo·rpm·--setperms·PACKAGENAME | 252 | $·sudo·rpm·--setperms·PACKAGENAME |
| 249 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 253 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 250 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 254 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 251 | Severity: ················high | 255 | Severity: ················high |
| 252 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 256 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 253 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 257 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 258 | Remediation_Shell_script_⇲ | ||
| 259 | Complexity:·high | ||
| 260 | Disruption:·medium | ||
| 261 | Strategy:···restrict | ||
| 262 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 263 | declare·-A·SETPERMS_RPM_DICT | ||
| 264 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 265 | #·is·expected·by·the·RPM·database | ||
| 266 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 267 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 268 | do | ||
| 269 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 270 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 271 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 272 | ········do | ||
| 273 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 274 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 275 | ········done | ||
| 276 | done | ||
| 277 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 278 | #·correct·values | ||
| 279 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 280 | do | ||
| 281 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 282 | done | ||
| 254 | Remediation_Ansible_snippet_⇲ | 283 | Remediation_Ansible_snippet_⇲ |
| 255 | Complexity:·high | 284 | Complexity:·high |
| 256 | Disruption:·medium | 285 | Disruption:·medium |
| 257 | Strategy:···restrict | 286 | Strategy:···restrict |
| 258 | -·name:·Read·list·of·files·with·incorrect·permissions | 287 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 259 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 288 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 260 | ····--nocaps·--nolinkto·--nouser·--nogroup | 289 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 333, 43 lines modified | Offset 362, 14 lines modified | ||
| 333 | ··-·PCI-DSS-Req-11.5 | 362 | ··-·PCI-DSS-Req-11.5 |
| 334 | ··-·high_complexity | 363 | ··-·high_complexity |
| 335 | ··-·high_severity | 364 | ··-·high_severity |
| 336 | ··-·medium_disruption | 365 | ··-·medium_disruption |
| 337 | ··-·no_reboot_needed | 366 | ··-·no_reboot_needed |
| 338 | ··-·restrict_strategy | 367 | ··-·restrict_strategy |
| 339 | ··-·rpm_verify_permissions | 368 | ··-·rpm_verify_permissions |
| 340 | Remediation_Shell_script_⇲ | ||
| 341 | Complexity:·high | ||
| 342 | Disruption:·medium | ||
| 343 | Strategy:···restrict | ||
| 344 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 345 | declare·-A·SETPERMS_RPM_DICT | ||
| 346 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 347 | #·is·expected·by·the·RPM·database | ||
| 348 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 762443/770597 bytes (98.94%) of diff not shown. | |||
| Offset 14284, 15 lines modified | Offset 14284, 15 lines modified | ||
| 00037cb0:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00037cb0:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00037cc0:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00037cc0:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00037cd0:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00037cd0:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00037ce0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00037ce0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00037cf0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00037cf0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 00037d00:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 00037d00:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 00037d10:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 00037d20:·6f66·2032·3032·3 | 00037d20:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 00037d30:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 00037d30:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 00037d40:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 00037d40:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00037d50:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00037d50:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00037d60:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00037d60:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00037d70:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00037d70:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00037d80:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00037d80:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00037d90:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00037d90:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15232, 189 lines modified | Offset 15232, 189 lines modified | ||
| 0003b7f0:·2d74·6172·6765·743d·2223·6964·6d35·3430··-target="#idm540 | 0003b7f0:·2d74·6172·6765·743d·2223·6964·6d35·3430··-target="#idm540 | ||
| 0003b800:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | 0003b800:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | ||
| 0003b810:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003b810:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003b820:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003b820:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003b830:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003b830:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003b840:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003b840:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003b850:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003b850:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003b860:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003b860:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003b870:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003b880:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003b890:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003b8a0:·6170·7365·2220·6964·3d22·6964·6d35·3430··apse"·id="idm540 | |||
| 0003b8b0:·3222·3e3c·7461·626c·6520·636c·6173·733d··2"><table·class= | |||
| 0003b8c0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003b8d0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003b8e0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003b8f0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003b900:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003b910:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003b920:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003b930:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003b940:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003b950:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003b960:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003b970:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003b980:·6f64·653e·0a70·6163·6b61·6765·202d·2d61··ode>.package·--a | |||
| 0003b990:·6464·3d61·6964·650a·3c2f·636f·6465·3e3c··dd=aide.</code>< | |||
| 0003b9a0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003b9b0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003b9c0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003b9d0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003b9e0:·612d·7461·7267·6574·3d22·2369·646d·3534··a-target="#idm54 | |||
| 0003b9f0:·3033·2220·7461·6269·6e64·6578·3d22·3022··03"·tabindex="0" | |||
| 0003ba00:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003ba10:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003ba20:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003ba30:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003ba40:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003ba50:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003ba60:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003ba70:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003ba80:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003ba90:·7073·6522·2069·643d·2269·646d·3534·3033··pse"·id="idm5403 | |||
| 0003baa0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bab0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003bac0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003bad0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003bae0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003baf0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003bb00:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003bb10:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003bb20:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003bb30:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003bb40:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003bb50:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003bb60:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003bb70:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003bb80:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003bb90:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003bba0:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003bbb0:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003bbc0:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003bbd0:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003bbe0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003bbf0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003bc00:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003bc10:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003bc20:·7461·7267·6574·3d22·2369·646d·3534·3034··target="#idm5404 | |||
| 0003bc30:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003bc40:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003bc50:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003bc60:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003bc70:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003bc80:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003bc90:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003b | 0003b870:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | ||
| 0003b | 0003b880:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | ||
| 0003b | 0003b890:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | ||
| 0003b | 0003b8a0:·7365·2220·6964·3d22·6964·6d35·3430·3222··se"·id="idm5402" | ||
| 0003b | 0003b8b0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | ||
| 0003b | 0003b8c0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | ||
| 0003b | 0003b8d0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003b | 0003b8e0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003b | 0003b8f0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | ||
| 0003b | 0003b900:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | ||
| 0003b | 0003b910:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003b | 0003b920:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | ||
| 0003b | 0003b930:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003b | 0003b940:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | ||
| 0003b | 0003b950:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | ||
| 0003b | 0003b960:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003b | 0003b970:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | ||
| 0003b980:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003b990:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003b9a0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003b9b0:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003b9c0:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003b9d0:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003b9e0:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003b9f0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003ba00:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003ba10:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003ba20:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003ba30:·6172·6765·743d·2223·6964·6d35·3430·3322··arget="#idm5403" | |||
| 0003ba40:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003ba50:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003ba60:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003ba70:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003ba80:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003ba90:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| Max diff block lines reached; 22150301/22176161 bytes (99.88%) of diff not shown. | |||
| Offset 14307, 15 lines modified | Offset 14307, 15 lines modified | ||
| 00037e20:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00037e20:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00037e30:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00037e30:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00037e40:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00037e40:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00037e50:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00037e50:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00037e60:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00037e60:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00037e70:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00037e70:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00037e80:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00037e80:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00037e90:·6620·3230·323 | 00037e90:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00037ea0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00037ea0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00037eb0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00037eb0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00037ec0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00037ec0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00037ed0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00037ed0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00037ee0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00037ee0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00037ef0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00037ef0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00037f00:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00037f00:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15250, 189 lines modified | Offset 15250, 189 lines modified | ||
| 0003b910:·6765·743d·2223·6964·6d35·3430·3222·2074··get="#idm5402"·t | 0003b910:·6765·743d·2223·6964·6d35·3430·3222·2074··get="#idm5402"·t | ||
| 0003b920:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003b920:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003b930:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003b930:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003b940:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003b940:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003b950:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003b950:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003b960:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003b960:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003b970:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003b970:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003b980:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003b980:·2041·6e61·636f·6e64·6120·736e·6970·7065···Anaconda·snippe | |||
| 0003b990:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003b9a0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003b9b0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003b9c0:·2220·6964·3d22·6964·6d35·3430·3222·3e3c··"·id="idm5402">< | |||
| 0003b9d0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003b9e0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003b9f0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003ba00:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003ba10:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003ba20:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003ba30:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003ba40:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003ba50:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003ba60:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003ba70:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003ba80:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003ba90:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003baa0:·0a70·6163·6b61·6765·202d·2d61·6464·3d61··.package·--add=a | |||
| 0003bab0:·6964·650a·3c2f·636f·6465·3e3c·2f70·7265··ide.</code></pre | |||
| 0003bac0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003bad0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003bae0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003baf0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003bb00:·7267·6574·3d22·2369·646d·3534·3033·2220··rget="#idm5403"· | |||
| 0003bb10:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bb20:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bb30:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bb40:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bb50:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003bb60:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003bb70:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003bb80:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bb90:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bba0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bbb0:·2069·643d·2269·646d·3534·3033·223e·3c74···id="idm5403"><t | |||
| 0003bbc0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bbd0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bbe0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bbf0:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003bc00:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003bc10:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003bc20:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bc30:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003bc40:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003bc50:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003bc60:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003bc70:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003bc80:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | |||
| 0003bc90:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003bca0:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003bcb0:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003bcc0:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003bcd0:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003bce0:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003bcf0:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003bd00:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003bd10:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003bd20:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003bd30:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003bd40:·6574·3d22·2369·646d·3534·3034·2220·7461··et="#idm5404"·ta | |||
| 0003bd50:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003bd60:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003bd70:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003bd80:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003bd90:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003bda0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003bdb0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b | 0003b990:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | ||
| 0003b | 0003b9a0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | ||
| 0003b | 0003b9b0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | ||
| 0003b | 0003b9c0:·6964·3d22·6964·6d35·3430·3222·3e3c·7461··id="idm5402"><ta | ||
| 0003b | 0003b9d0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | ||
| 0003b | 0003b9e0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | ||
| 0003b | 0003b9f0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | ||
| 0003b | 0003ba00:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | ||
| 0003b | 0003ba10:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | ||
| 0003b | 0003ba20:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | ||
| 0003b | 0003ba30:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003b | 0003ba40:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | ||
| 0003b | 0003ba50:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003b | 0003ba60:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | ||
| 0003b | 0003ba70:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | ||
| 0003b | 0003ba80:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | ||
| 0003b | 0003ba90:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | ||
| 0003baa0:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003bab0:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003bac0:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003bad0:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003bae0:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003baf0:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003bb00:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bb10:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bb20:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bb30:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bb40:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bb50:·743d·2223·6964·6d35·3430·3322·2074·6162··t="#idm5403"·tab | |||
| 0003bb60:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bb70:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bb80:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bb90:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bba0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bbb0:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | |||
| Max diff block lines reached; 22140335/22166195 bytes (99.88%) of diff not shown. | |||
| Offset 14317, 15 lines modified | Offset 14317, 15 lines modified | ||
| 00037ec0:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00037ec0:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00037ed0:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00037ed0:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00037ee0:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00037ee0:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00037ef0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00037ef0:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00037f00:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00037f00:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00037f10:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00037f10:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00037f20:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00037f20:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00037f30:·6620·3230·323 | 00037f30:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00037f40:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00037f40:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00037f50:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00037f50:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00037f60:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00037f60:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00037f70:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00037f70:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00037f80:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00037f80:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00037f90:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00037f90:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00037fa0:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00037fa0:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15062, 108 lines modified | Offset 15062, 108 lines modified | ||
| 0003ad50:·6172·6765·743d·2223·6964·6d31·3435·3137··arget="#idm14517 | 0003ad50:·6172·6765·743d·2223·6964·6d31·3435·3137··arget="#idm14517 | ||
| 0003ad60:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003ad60:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003ad70:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003ad70:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003ad80:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003ad80:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003ad90:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003ad90:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003ada0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003ada0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003adb0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003adb0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003adc0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003add0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003ade0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003adf0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003ae00:·7365·2220·6964·3d22·6964·6d31·3435·3137··se"·id="idm14517 | |||
| 0003ae10:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003ae20:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003ae30:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003ae40:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003ae50:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003ae60:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003ae70:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003ae80:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003ae90:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003aea0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003aeb0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003aec0:·636f·6e66·6967·7572·653c·2f74·643e·3c2f··configure</td></ | |||
| 0003aed0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003aee0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·5465··<code>-·name:·Te | |||
| 0003aef0:·7374·2066·6f72·2065·7869·7374·656e·6365··st·for·existence | |||
| 0003af00:·202f·6574·632f·7061·7373·7764·0a20·2073···/etc/passwd.··s | |||
| 0003af10:·7461·743a·0a20·2020·2070·6174·683a·202f··tat:.····path:·/ | |||
| 0003af20:·6574·632f·7061·7373·7764·0a20·2072·6567··etc/passwd.··reg | |||
| 0003af30:·6973·7465·723a·2066·696c·655f·6578·6973··ister:·file_exis | |||
| 0003af40:·7473·0a20·2074·6167·733a·0a20·202d·2043··ts.··tags:.··-·C | |||
| 0003af50:·4a49·532d·352e·352e·322e·320a·2020·2d20··JIS-5.5.2.2.··-· | |||
| 0003af60:·4e49·5354·2d38·3030·2d35·332d·4143·2d36··NIST-800-53-AC-6 | |||
| 0003af70:·2831·290a·2020·2d20·4e49·5354·2d38·3030··(1).··-·NIST-800 | |||
| 0003af80:·2d35·332d·434d·2d36·2861·290a·2020·2d20··-53-CM-6(a).··-· | |||
| 0003af90:·5043·492d·4453·532d·5265·712d·382e·372e··PCI-DSS-Req-8.7. | |||
| 0003afa0:·630a·2020·2d20·636f·6e66·6967·7572·655f··c.··-·configure_ | |||
| 0003afb0:·7374·7261·7465·6779·0a20·202d·2066·696c··strategy.··-·fil | |||
| 0003afc0:·655f·6772·6f75·706f·776e·6572·5f65·7463··e_groupowner_etc | |||
| 0003afd0:·5f70·6173·7377·640a·2020·2d20·6c6f·775f··_passwd.··-·low_ | |||
| 0003afe0:·636f·6d70·6c65·7869·7479·0a20·202d·206c··complexity.··-·l | |||
| 0003aff0:·6f77·5f64·6973·7275·7074·696f·6e0a·2020··ow_disruption.·· | |||
| 0003b000:·2d20·6d65·6469·756d·5f73·6576·6572·6974··-·medium_severit | |||
| 0003b010:·790a·2020·2d20·6e6f·5f72·6562·6f6f·745f··y.··-·no_reboot_ | |||
| 0003b020:·6e65·6564·6564·0a0a·2d20·6e61·6d65·3a20··needed..-·name:· | |||
| 0003b030:·456e·7375·7265·2067·726f·7570·206f·776e··Ensure·group·own | |||
| 0003b040:·6572·2030·206f·6e20·2f65·7463·2f70·6173··er·0·on·/etc/pas | |||
| 0003b050:·7377·640a·2020·6669·6c65·3a0a·2020·2020··swd.··file:.···· | |||
| 0003b060:·7061·7468·3a20·2f65·7463·2f70·6173·7377··path:·/etc/passw | |||
| 0003b070:·640a·2020·2020·6772·6f75·703a·2027·3027··d.····group:·'0' | |||
| 0003b080:·0a20·2077·6865·6e3a·2066·696c·655f·6578··.··when:·file_ex | |||
| 0003b090:·6973·7473·2e73·7461·7420·6973·2064·6566··ists.stat·is·def | |||
| 0003b0a0:·696e·6564·2061·6e64·2066·696c·655f·6578··ined·and·file_ex | |||
| 0003b0b0:·6973·7473·2e73·7461·742e·6578·6973·7473··ists.stat.exists | |||
| 0003b0c0:·0a20·2074·6167·733a·0a20·202d·2043·4a49··.··tags:.··-·CJI | |||
| 0003b0d0:·532d·352e·352e·322e·320a·2020·2d20·4e49··S-5.5.2.2.··-·NI | |||
| 0003b0e0:·5354·2d38·3030·2d35·332d·4143·2d36·2831··ST-800-53-AC-6(1 | |||
| 0003b0f0:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003b100:·332d·434d·2d36·2861·290a·2020·2d20·5043··3-CM-6(a).··-·PC | |||
| 0003b110:·492d·4453·532d·5265·712d·382e·372e·630a··I-DSS-Req-8.7.c. | |||
| 0003b120:·2020·2d20·636f·6e66·6967·7572·655f·7374····-·configure_st | |||
| 0003b130:·7261·7465·6779·0a20·202d·2066·696c·655f··rategy.··-·file_ | |||
| 0003b140:·6772·6f75·706f·776e·6572·5f65·7463·5f70··groupowner_etc_p | |||
| 0003b150:·6173·7377·640a·2020·2d20·6c6f·775f·636f··asswd.··-·low_co | |||
| 0003b160:·6d70·6c65·7869·7479·0a20·202d·206c·6f77··mplexity.··-·low | |||
| 0003b170:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | |||
| 0003b180:·6d65·6469·756d·5f73·6576·6572·6974·790a··medium_severity. | |||
| 0003b190:·2020·2d20·6e6f·5f72·6562·6f6f·745f·6e65····-·no_reboot_ne | |||
| 0003b1a0:·6564·6564·0a3c·2f63·6f64·653e·3c2f·7072··eded.</code></pr | |||
| 0003b1b0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003b1c0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003b1d0:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003b1e0:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003b1f0:·6172·6765·743d·2223·6964·6d31·3435·3138··arget="#idm14518 | |||
| 0003b200:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003b210:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003b220:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003b230:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003b240:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003b250:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003 | 0003adc0:·696f·6e20·5368·656c·6c20·7363·7269·7074··ion·Shell·script | ||
| 0003 | 0003add0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | ||
| 0003 | 0003ade0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | ||
| 0003 | 0003adf0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | ||
| 0003 | 0003ae00:·2069·643d·2269·646d·3134·3531·3722·3e3c···id="idm14517">< | ||
| 0003 | 0003ae10:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | ||
| 0003 | 0003ae20:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | ||
| 0003 | 0003ae30:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 0003 | 0003ae40:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | ||
| 0003 | 0003ae50:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | ||
| 0003 | 0003ae60:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | ||
| 0003 | 0003ae70:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003 | 0003ae80:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | ||
| 0003 | 0003ae90:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003 | 0003aea0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | ||
| 0003 | 0003aeb0:·6567·793a·3c2f·7468·3e3c·7464·3e63·6f6e··egy:</th><td>con | ||
| 0003 | 0003aec0:·6669·6775·7265·3c2f·7464·3e3c·2f74·723e··figure</td></tr> | ||
| 0003 | 0003aed0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | ||
| 0003 | 0003aee0:·6465·3e0a·0a0a·6368·6772·7020·3020·2f65··de>...chgrp·0·/e | ||
| 0003 | 0003aef0:·7463·2f70·6173·7377·640a·3c2f·636f·6465··tc/passwd.</code | ||
| 0003af00:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003af10:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003af20:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003af30:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003af40:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003af50:·3134·3531·3822·2074·6162·696e·6465·783d··14518"·tabindex= | |||
| 0003af60:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003af70:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003af80:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003af90:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| Max diff block lines reached; 28622/43304 bytes (66.10%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:opensuse:leap:15.0 | 42 | ····*·cpe:/o:opensuse:leap:15.0 |
| 43 | ····*·cpe:/o:opensuse:leap:42.1 | 43 | ····*·cpe:/o:opensuse:leap:42.1 |
| 44 | ····*·cpe:/o:opensuse:leap:42.2 | 44 | ····*·cpe:/o:opensuse:leap:42.2 |
| 45 | ····*·cpe:/o:opensuse:leap:42.3 | 45 | ····*·cpe:/o:opensuse:leap:42.3 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·File_Permissions_and_Masks | 51 | ·········1.·File_Permissions_and_Masks |
| 52 | *****·Checklist·***** | 52 | *****·Checklist·***** |
| 53 | Group ·Guide·to·the·Secure·Configuration·of·openSUSE· Group·contains·4·groups·and·3 | 53 | Group ·Guide·to·the·Secure·Configuration·of·openSUSE· Group·contains·4·groups·and·3 |
| 54 | rules | 54 | rules |
| 55 | Group ·System·Settings· Group·contains·3·groups·and·3·rules | 55 | Group ·System·Settings· Group·contains·3·groups·and·3·rules |
| Offset 93, 14 lines modified | Offset 93, 22 lines modified | ||
| 93 | ············References: ·12,·13,·14,·15,·16,·18,·3,·5,·5.5.2.2,·APO01.06,·DSS05.04,·DSS05.07, | 93 | ············References: ·12,·13,·14,·15,·16,·18,·3,·5,·5.5.2.2,·APO01.06,·DSS05.04,·DSS05.07, |
| 94 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 94 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 95 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, | 95 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, |
| 96 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, | 96 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, |
| 97 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- | 97 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- |
| 98 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- | 98 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- |
| 99 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227 | 99 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227 |
| 100 | Remediation_Shell_script_⇲ | ||
| 101 | Complexity:·low | ||
| 102 | Disruption:·low | ||
| 103 | Strategy:···configure | ||
| 104 | chgrp·0·/etc/passwd | ||
| 100 | Remediation_Ansible_snippet_⇲ | 105 | Remediation_Ansible_snippet_⇲ |
| 101 | Complexity:·low | 106 | Complexity:·low |
| 102 | Disruption:·low | 107 | Disruption:·low |
| 103 | Strategy:···configure | 108 | Strategy:···configure |
| 104 | -·name:·Test·for·existence·/etc/passwd | 109 | -·name:·Test·for·existence·/etc/passwd |
| 105 | ··stat: | 110 | ··stat: |
| 106 | ····path:·/etc/passwd | 111 | ····path:·/etc/passwd |
| Offset 129, 22 lines modified | Offset 137, 14 lines modified | ||
| 129 | ··-·PCI-DSS-Req-8.7.c | 137 | ··-·PCI-DSS-Req-8.7.c |
| 130 | ··-·configure_strategy | 138 | ··-·configure_strategy |
| 131 | ··-·file_groupowner_etc_passwd | 139 | ··-·file_groupowner_etc_passwd |
| 132 | ··-·low_complexity | 140 | ··-·low_complexity |
| 133 | ··-·low_disruption | 141 | ··-·low_disruption |
| 134 | ··-·medium_severity | 142 | ··-·medium_severity |
| 135 | ··-·no_reboot_needed | 143 | ··-·no_reboot_needed |
| 136 | Remediation_Shell_script_⇲ | ||
| 137 | Complexity:·low | ||
| 138 | Disruption:·low | ||
| 139 | Strategy:···configure | ||
| 140 | chgrp·0·/etc/passwd | ||
| 141 | ***·Rule ·Verify·User·Who·Owns·passwd·File· [ref]·*** | 144 | ***·Rule ·Verify·User·Who·Owns·passwd·File· [ref]·*** |
| 142 | To·properly·set·the·owner·of·/etc/passwd,·run·the·command: | 145 | To·properly·set·the·owner·of·/etc/passwd,·run·the·command: |
| 143 | $·sudo·chown·root·/etc/passwd | 146 | $·sudo·chown·root·/etc/passwd |
| 144 | Rationale:··The·/etc/passwd·file·contains·information·about·the·users·that·are·configured·on | 147 | Rationale:··The·/etc/passwd·file·contains·information·about·the·users·that·are·configured·on |
| 145 | ············the·system.·Protection·of·this·file·is·critical·for·system·security. | 148 | ············the·system.·Protection·of·this·file·is·critical·for·system·security. |
| 146 | Severity: ·medium | 149 | Severity: ·medium |
| 147 | Rule·ID:····xccdf_org.ssgproject.content_rule_file_owner_etc_passwd | 150 | Rule·ID:····xccdf_org.ssgproject.content_rule_file_owner_etc_passwd |
| Offset 152, 14 lines modified | Offset 152, 22 lines modified | ||
| 152 | ············DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5, | 152 | ············DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5, |
| 153 | Identifiers·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3, | 153 | Identifiers·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3, |
| 154 | and·········A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3, | 154 | and·········A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3, |
| 155 | References··A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP- | 155 | References··A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP- |
| 156 | ············007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP- | 156 | ············007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP- |
| 157 | ············007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS- | 157 | ············007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS- |
| 158 | ············00227 | 158 | ············00227 |
| 159 | Remediation_Shell_script_⇲ | ||
| 160 | Complexity:·low | ||
| 161 | Disruption:·low | ||
| 162 | Strategy:···configure | ||
| 163 | chown·0·/etc/passwd | ||
| 159 | Remediation_Ansible_snippet_⇲ | 164 | Remediation_Ansible_snippet_⇲ |
| 160 | Complexity:·low | 165 | Complexity:·low |
| 161 | Disruption:·low | 166 | Disruption:·low |
| 162 | Strategy:···configure | 167 | Strategy:···configure |
| 163 | -·name:·Test·for·existence·/etc/passwd | 168 | -·name:·Test·for·existence·/etc/passwd |
| 164 | ··stat: | 169 | ··stat: |
| 165 | ····path:·/etc/passwd | 170 | ····path:·/etc/passwd |
| Offset 188, 22 lines modified | Offset 196, 14 lines modified | ||
| 188 | ··-·PCI-DSS-Req-8.7.c | 196 | ··-·PCI-DSS-Req-8.7.c |
| 189 | ··-·configure_strategy | 197 | ··-·configure_strategy |
| 190 | ··-·file_owner_etc_passwd | 198 | ··-·file_owner_etc_passwd |
| 191 | ··-·low_complexity | 199 | ··-·low_complexity |
| 192 | ··-·low_disruption | 200 | ··-·low_disruption |
| 193 | ··-·medium_severity | 201 | ··-·medium_severity |
| 194 | ··-·no_reboot_needed | 202 | ··-·no_reboot_needed |
| 195 | Remediation_Shell_script_⇲ | ||
| 196 | Complexity:·low | ||
| 197 | Disruption:·low | ||
| 198 | Strategy:···configure | ||
| 199 | chown·0·/etc/passwd | ||
| 200 | ***·Rule ·Verify·Permissions·on·passwd·File· [ref]·*** | 203 | ***·Rule ·Verify·Permissions·on·passwd·File· [ref]·*** |
| 201 | To·properly·set·the·permissions·of·/etc/passwd,·run·the·command: | 204 | To·properly·set·the·permissions·of·/etc/passwd,·run·the·command: |
| 202 | $·sudo·chmod·0644·/etc/passwd | 205 | $·sudo·chmod·0644·/etc/passwd |
| 203 | ············If·the·/etc/passwd·file·is·writable·by·a·group-owner·or·the·world·the·risk·of·its | 206 | ············If·the·/etc/passwd·file·is·writable·by·a·group-owner·or·the·world·the·risk·of·its |
| 204 | Rationale:··compromise·is·increased.·The·file·contains·the·list·of·accounts·on·the·system·and | 207 | Rationale:··compromise·is·increased.·The·file·contains·the·list·of·accounts·on·the·system·and |
| 205 | ············associated·information,·and·protection·of·this·file·is·critical·for·system | 208 | ············associated·information,·and·protection·of·this·file·is·critical·for·system |
| 206 | ············security. | 209 | ············security. |
| Offset 213, 14 lines modified | Offset 213, 23 lines modified | ||
| 213 | ············DSS05.07,·DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4, | 213 | ············DSS05.07,·DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4, |
| 214 | Identifiers·A.11.1.5,·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2, | 214 | Identifiers·A.11.1.5,·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2, |
| 215 | and·········A.14.1.3,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2, | 215 | and·········A.14.1.3,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2, |
| 216 | References··A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004- | 216 | References··A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004- |
| 217 | ············6_R2.3,·CIP-007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007- | 217 | ············6_R2.3,·CIP-007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007- |
| 218 | ············3_R5.1.1,·CIP-007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS- | 218 | ············3_R5.1.1,·CIP-007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS- |
| 219 | ············000480-GPOS-00227 | 219 | ············000480-GPOS-00227 |
| 220 | Remediation_Shell_script_⇲ | ||
| 221 | Complexity:·low | ||
| 222 | Disruption:·low | ||
| 223 | Strategy:···configure | ||
| 224 | chmod·u-xs,g-xws,o-xwt·/etc/passwd | ||
| 220 | Remediation_Ansible_snippet_⇲ | 225 | Remediation_Ansible_snippet_⇲ |
| 221 | Complexity:·low | 226 | Complexity:·low |
| 222 | Disruption:·low | 227 | Disruption:·low |
| Max diff block lines reached; 651/5327 bytes (12.22%) of diff not shown. | |||
| Offset 14309, 15 lines modified | Offset 14309, 15 lines modified | ||
| 00037e40:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037e40:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037e50:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037e50:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037e60:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037e60:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037e70:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037e70:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037e80:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037e80:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037e90:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037e90:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037ea0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037ea0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037eb0:·3 | 00037eb0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037ec0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037ec0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037ed0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037ed0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037ee0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037ee0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037ef0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037ef0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037f00:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037f00:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037f10:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037f10:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037f20:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037f20:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> |
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | *****·Profile·Information·***** | 44 | *****·Profile·Information·***** |
| 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(enhanced) | 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(enhanced) |
| 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 47 | ***·CPE·Platforms·*** | 47 | ***·CPE·Platforms·*** |
| 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·System_Settings | 53 | ···1.·System_Settings |
| 54 | ·········1.·Installing_and_Maintaining_Software | 54 | ·········1.·Installing_and_Maintaining_Software |
| 55 | ·········2.·Account_and_Access_Control | 55 | ·········2.·Account_and_Access_Control |
| 56 | ·········3.·System_Accounting_with_auditd | 56 | ·········3.·System_Accounting_with_auditd |
| 57 | ·········4.·GRUB2_bootloader_configuration | 57 | ·········4.·GRUB2_bootloader_configuration |
| 58 | ·········5.·Configure_Syslog | 58 | ·········5.·Configure_Syslog |
| Offset 14308, 15 lines modified | Offset 14308, 15 lines modified | ||
| 00037e30:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037e30:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037e40:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037e40:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037e50:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037e50:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037e60:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037e60:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037e70:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037e70:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037e80:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037e80:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037e90:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037e90:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037ea0:·3 | 00037ea0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037eb0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037eb0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037ec0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037ec0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037ed0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037ed0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037ee0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037ee0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037ef0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037ef0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037f00:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037f00:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037f10:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037f10:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> |
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | *****·Profile·Information·***** | 44 | *****·Profile·Information·***** |
| 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(high) | 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(high) |
| 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 47 | ***·CPE·Platforms·*** | 47 | ***·CPE·Platforms·*** |
| 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·System_Settings | 53 | ···1.·System_Settings |
| 54 | ·········1.·Installing_and_Maintaining_Software | 54 | ·········1.·Installing_and_Maintaining_Software |
| 55 | ·········2.·Account_and_Access_Control | 55 | ·········2.·Account_and_Access_Control |
| 56 | ·········3.·System_Accounting_with_auditd | 56 | ·········3.·System_Accounting_with_auditd |
| 57 | ·········4.·GRUB2_bootloader_configuration | 57 | ·········4.·GRUB2_bootloader_configuration |
| 58 | ·········5.·Configure_Syslog | 58 | ·········5.·Configure_Syslog |
| Offset 14310, 15 lines modified | Offset 14310, 15 lines modified | ||
| 00037e50:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037e50:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037e60:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037e60:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037e70:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037e70:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037e80:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037e80:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037e90:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037e90:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037ea0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037ea0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037eb0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037eb0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037ec0:·3 | 00037ec0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037ed0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037ed0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037ee0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037ee0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037ef0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037ef0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037f00:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037f00:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037f10:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037f10:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037f20:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037f20:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037f30:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037f30:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> |
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | *****·Profile·Information·***** | 44 | *****·Profile·Information·***** |
| 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(intermediary) | 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(intermediary) |
| 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 47 | ***·CPE·Platforms·*** | 47 | ***·CPE·Platforms·*** |
| 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·System_Settings | 53 | ···1.·System_Settings |
| 54 | ·········1.·Installing_and_Maintaining_Software | 54 | ·········1.·Installing_and_Maintaining_Software |
| 55 | ·········2.·Account_and_Access_Control | 55 | ·········2.·Account_and_Access_Control |
| 56 | ·········3.·System_Accounting_with_auditd | 56 | ·········3.·System_Accounting_with_auditd |
| 57 | ·········4.·Configure_Syslog | 57 | ·········4.·Configure_Syslog |
| 58 | ·········5.·Network_Configuration_and_Firewalls | 58 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 14308, 16 lines modified | Offset 14308, 16 lines modified | ||
| 00037e30:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037e30:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037e40:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037e40:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037e50:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037e50:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037e60:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037e60:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037e70:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037e70:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037e80:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037e80:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037e90:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e90:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ea0:·2020·2861·7320·6f66·2032·3032·3 | 00037ea0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037eb0:·2d32·3 | 00037eb0:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037ec0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037ec0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037ed0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037ed0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037ee0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037ee0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037ef0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037ef0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037f00:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037f00:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037f10:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037f10:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037f20:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037f20:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst |
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | *****·Profile·Information·***** | 44 | *****·Profile·Information·***** |
| 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(minimal) | 45 | Profile·Title·DRAFT·-·ANSSI-BP-028·(minimal) |
| 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 46 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 47 | ***·CPE·Platforms·*** | 47 | ***·CPE·Platforms·*** |
| 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 48 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·System_Settings | 53 | ···1.·System_Settings |
| 54 | ·········1.·Installing_and_Maintaining_Software | 54 | ·········1.·Installing_and_Maintaining_Software |
| 55 | ·········2.·Account_and_Access_Control | 55 | ·········2.·Account_and_Access_Control |
| 56 | ·········3.·Configure_Syslog | 56 | ·········3.·Configure_Syslog |
| 57 | ···2.·Services | 57 | ···2.·Services |
| 58 | ·········1.·Mail_Server_Software | 58 | ·········1.·Mail_Server_Software |
| Offset 14303, 15 lines modified | Offset 14303, 15 lines modified | ||
| 00037de0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037de0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037df0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037df0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037e00:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037e00:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037e10:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037e10:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037e20:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037e20:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037e30:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037e30:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037e40:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037e40:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037e50:·3230·323 | 00037e50:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037e60:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037e60:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037e70:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037e70:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037e80:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037e80:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037e90:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037e90:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037ea0:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037ea0:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037eb0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037eb0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037ec0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037ec0:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste |
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | *****·Profile·Information·***** | 42 | *****·Profile·Information·***** |
| 43 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight | 43 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight |
| 44 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 | 44 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 |
| 45 | ***·CPE·Platforms·*** | 45 | ***·CPE·Platforms·*** |
| 46 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 46 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·System_Accounting_with_auditd | 54 | ·········3.·System_Accounting_with_auditd |
| 55 | ·········4.·File_Permissions_and_Masks | 55 | ·········4.·File_Permissions_and_Masks |
| 56 | ·········5.·SELinux | 56 | ·········5.·SELinux |
| Offset 14355, 16 lines modified | Offset 14355, 16 lines modified | ||
| 00038120:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00038120:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00038130:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00038130:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 00038140:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 00038140:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00038150:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00038150:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00038160:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00038160:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00038170:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00038170:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00038180:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038180:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038190:·2028·6173·206f·6620·3230·323 | 00038190:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 000381a0:·323 | 000381a0:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 000381b0:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 000381b0:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 000381c0:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 000381c0:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 000381d0:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 000381d0:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 000381e0:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 000381e0:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 000381f0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 000381f0:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00038200:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00038200:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00038210:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 00038210:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste |
| Offset 56, 15 lines modified | Offset 56, 15 lines modified | ||
| 56 | Profile·Title·NIST·800-53·High-Impact·Baseline·for·Red·Hat·Enterprise·Linux | 56 | Profile·Title·NIST·800-53·High-Impact·Baseline·for·Red·Hat·Enterprise·Linux |
| 57 | ··············CoreOS | 57 | ··············CoreOS |
| 58 | Profile·ID····xccdf_org.ssgproject.content_profile_high | 58 | Profile·ID····xccdf_org.ssgproject.content_profile_high |
| 59 | ***·CPE·Platforms·*** | 59 | ***·CPE·Platforms·*** |
| 60 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 60 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 61 | *****·Revision·History·***** | 61 | *****·Revision·History·***** |
| 62 | Current·version:·0.1.65 | 62 | Current·version:·0.1.65 |
| 63 | ····*·draft·(as·of·202 | 63 | ····*·draft·(as·of·2025-02-23) |
| 64 | *****·Table·of·Contents·***** | 64 | *****·Table·of·Contents·***** |
| 65 | ···1.·System_Settings | 65 | ···1.·System_Settings |
| 66 | ·········1.·Installing_and_Maintaining_Software | 66 | ·········1.·Installing_and_Maintaining_Software |
| 67 | ·········2.·Account_and_Access_Control | 67 | ·········2.·Account_and_Access_Control |
| 68 | ·········3.·System_Accounting_with_auditd | 68 | ·········3.·System_Accounting_with_auditd |
| 69 | ·········4.·GRUB2_bootloader_configuration | 69 | ·········4.·GRUB2_bootloader_configuration |
| 70 | ·········5.·Configure_Syslog | 70 | ·········5.·Configure_Syslog |
| Offset 14356, 16 lines modified | Offset 14356, 16 lines modified | ||
| 00038130:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00038130:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00038140:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00038140:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00038150:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00038150:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00038160:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00038160:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00038170:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00038170:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00038180:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00038180:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00038190:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038190:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 000381a0:·2020·2020·2028·6173·206f·6620·3230·323 | 000381a0:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 000381b0:·2d30·3 | 000381b0:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 000381c0:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 000381c0:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 000381d0:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 000381d0:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 000381e0:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 000381e0:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 000381f0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 000381f0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00038200:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00038200:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00038210:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00038210:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00038220:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00038220:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S |
| Offset 56, 15 lines modified | Offset 56, 15 lines modified | ||
| 56 | Profile·Title·NIST·800-53·Moderate-Impact·Baseline·for·Red·Hat·Enterprise·Linux | 56 | Profile·Title·NIST·800-53·Moderate-Impact·Baseline·for·Red·Hat·Enterprise·Linux |
| 57 | ··············CoreOS | 57 | ··············CoreOS |
| 58 | Profile·ID····xccdf_org.ssgproject.content_profile_moderate | 58 | Profile·ID····xccdf_org.ssgproject.content_profile_moderate |
| 59 | ***·CPE·Platforms·*** | 59 | ***·CPE·Platforms·*** |
| 60 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 60 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 61 | *****·Revision·History·***** | 61 | *****·Revision·History·***** |
| 62 | Current·version:·0.1.65 | 62 | Current·version:·0.1.65 |
| 63 | ····*·draft·(as·of·202 | 63 | ····*·draft·(as·of·2025-02-23) |
| 64 | *****·Table·of·Contents·***** | 64 | *****·Table·of·Contents·***** |
| 65 | ···1.·System_Settings | 65 | ···1.·System_Settings |
| 66 | ·········1.·Installing_and_Maintaining_Software | 66 | ·········1.·Installing_and_Maintaining_Software |
| 67 | ·········2.·Account_and_Access_Control | 67 | ·········2.·Account_and_Access_Control |
| 68 | ·········3.·System_Accounting_with_auditd | 68 | ·········3.·System_Accounting_with_auditd |
| 69 | ·········4.·GRUB2_bootloader_configuration | 69 | ·········4.·GRUB2_bootloader_configuration |
| 70 | ·········5.·Configure_Syslog | 70 | ·········5.·Configure_Syslog |
| Offset 14315, 15 lines modified | Offset 14315, 15 lines modified | ||
| 00037ea0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037ea0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037eb0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037eb0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037ec0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037ec0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037ed0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037ed0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037ee0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037ee0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037ef0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037ef0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037f00:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037f00:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037f10:·7320·6f66·2032·3032·3 | 00037f10:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037f20:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037f20:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037f30:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037f30:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037f40:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037f40:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037f50:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037f50:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037f60:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037f60:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037f70:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037f70:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037f80:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037f80:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ |
| Offset 45, 15 lines modified | Offset 45, 15 lines modified | ||
| 45 | Profile·Title·Infrastructure·Protection·(CIP)·cybersecurity·standards·profile | 45 | Profile·Title·Infrastructure·Protection·(CIP)·cybersecurity·standards·profile |
| 46 | ··············for·Red·Hat·Enterprise·Linux·CoreOS | 46 | ··············for·Red·Hat·Enterprise·Linux·CoreOS |
| 47 | Profile·ID····xccdf_org.ssgproject.content_profile_nerc-cip | 47 | Profile·ID····xccdf_org.ssgproject.content_profile_nerc-cip |
| 48 | ***·CPE·Platforms·*** | 48 | ***·CPE·Platforms·*** |
| 49 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 | 49 | ····*·cpe:/o:redhat:enterprise_linux_coreos:4 |
| 50 | *****·Revision·History·***** | 50 | *****·Revision·History·***** |
| 51 | Current·version:·0.1.65 | 51 | Current·version:·0.1.65 |
| 52 | ····*·draft·(as·of·202 | 52 | ····*·draft·(as·of·2025-02-23) |
| 53 | *****·Table·of·Contents·***** | 53 | *****·Table·of·Contents·***** |
| 54 | ···1.·System_Settings | 54 | ···1.·System_Settings |
| 55 | ·········1.·Installing_and_Maintaining_Software | 55 | ·········1.·Installing_and_Maintaining_Software |
| 56 | ·········2.·Account_and_Access_Control | 56 | ·········2.·Account_and_Access_Control |
| 57 | ·········3.·System_Accounting_with_auditd | 57 | ·········3.·System_Accounting_with_auditd |
| 58 | ·········4.·GRUB2_bootloader_configuration | 58 | ·········4.·GRUB2_bootloader_configuration |
| 59 | ·········5.·Configure_Syslog | 59 | ·········5.·Configure_Syslog |
| Offset 14360, 16 lines modified | Offset 14360, 16 lines modified | ||
| 00038170:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00038170:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00038180:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00038180:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00038190:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00038190:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 000381a0:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 000381a0:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 000381b0:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 000381b0:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 000381c0:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 000381c0:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 000381d0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 000381d0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 000381e0:·2020·2020·2028·6173·206f·6620·3230·323 | 000381e0:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 000381f0:·2d30·3 | 000381f0:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00038200:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00038200:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00038210:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00038210:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00038220:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00038220:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00038230:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00038230:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00038240:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00038240:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00038250:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00038250:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00038260:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00038260:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 15389, 192 lines modified | Offset 15389, 192 lines modified | ||
| 0003c1c0:·7461·7267·6574·3d22·2369·646d·3935·3636··target="#idm9566 | 0003c1c0:·7461·7267·6574·3d22·2369·646d·3935·3636··target="#idm9566 | ||
| 0003c1d0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003c1d0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003c1e0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003c1e0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003c1f0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003c1f0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003c200:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003c200:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003c210:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003c210:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003c220:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003c220:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003c230:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003c230:·696f·6e20·416e·6163·6f6e·6461·2073·6e69··ion·Anaconda·sni | |||
| 0003c240:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c250:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c260:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c270:·7073·6522·2069·643d·2269·646d·3935·3636··pse"·id="idm9566 | |||
| 0003c280:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c290:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c2a0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c2b0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c2c0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c2d0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c2e0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c2f0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c300:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c310:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c320:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c330:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c340:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c350:·6465·3e0a·7061·636b·6167·6520·2d2d·6164··de>.package·--ad | |||
| 0003c360:·643d·6169·6465·0a3c·2f63·6f64·653e·3c2f··d=aide.</code></ | |||
| 0003c370:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c380:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c390:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c3a0:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c3b0:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | |||
| 0003c3c0:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | |||
| 0003c3d0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c3e0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c3f0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c400:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c410:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c420:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003c430:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c440:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c450:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c460:·7365·2220·6964·3d22·6964·6d39·3536·3722··se"·id="idm9567" | |||
| 0003c470:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c480:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c490:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c4a0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c4b0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c4c0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c4d0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c4e0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c4f0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c500:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c510:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c520:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003c530:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c540:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003c550:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003c560:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003c570:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003c580:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003c590:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003c5a0:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003c5b0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c5c0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c5d0:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c5e0:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c5f0:·6172·6765·743d·2223·6964·6d39·3536·3822··arget="#idm9568" | |||
| 0003c600:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c610:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c620:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c630:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c640:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c650:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c660:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003c | 0003c240:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 0003c | 0003c250:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 0003c | 0003c260:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 0003c | 0003c270:·6522·2069·643d·2269·646d·3935·3636·223e··e"·id="idm9566"> | ||
| 0003c | 0003c280:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003c | 0003c290:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 0003c | 0003c2a0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003c | 0003c2b0:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003c | 0003c2c0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 0003c | 0003c2d0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003c | 0003c2e0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003c | 0003c2f0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003c | 0003c300:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003c310:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | ||
| 0003c | 0003c320:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | ||
| 0003c | 0003c330:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | ||
| 0003c | 0003c340:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | ||
| 0003c350:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003c360:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003c370:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003c380:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003c390:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003c3a0:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003c3b0:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003c3c0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c3d0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c3e0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c3f0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c400:·7267·6574·3d22·2369·646d·3935·3637·2220··rget="#idm9567"· | |||
| 0003c410:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c420:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c430:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c440:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c450:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| Max diff block lines reached; 16718039/16744451 bytes (99.84%) of diff not shown. | |||
| Offset 14359, 15 lines modified | Offset 14359, 15 lines modified | ||
| 00038160:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038160:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038170:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038170:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038180:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038180:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00038190:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00038190:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 000381a0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 000381a0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 000381b0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 000381b0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 000381c0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 000381c0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 000381d0:·6f66·2032·3032·3 | 000381d0:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 000381e0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 000381e0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 000381f0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 000381f0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00038200:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00038200:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00038210:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00038210:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038220:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038220:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038230:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038230:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038240:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038240:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15317, 192 lines modified | Offset 15317, 192 lines modified | ||
| 0003bd40:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | 0003bd40:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | ||
| 0003bd50:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | 0003bd50:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | ||
| 0003bd60:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003bd60:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003bd70:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003bd70:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bd80:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bd80:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003bd90:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003bd90:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003bda0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003bda0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bdb0:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003bdb0:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003bdc0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003bdd0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bde0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bdf0:·6170·7365·2220·6964·3d22·6964·6d39·3536··apse"·id="idm956 | |||
| 0003be00:·3622·3e3c·7461·626c·6520·636c·6173·733d··6"><table·class= | |||
| 0003be10:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003be20:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003be30:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003be40:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003be50:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003be60:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003be70:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003be80:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003be90:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003bea0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003beb0:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003bec0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bed0:·6f64·653e·0a70·6163·6b61·6765·202d·2d61··ode>.package·--a | |||
| 0003bee0:·6464·3d61·6964·650a·3c2f·636f·6465·3e3c··dd=aide.</code>< | |||
| 0003bef0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bf00:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bf10:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bf20:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bf30:·612d·7461·7267·6574·3d22·2369·646d·3935··a-target="#idm95 | |||
| 0003bf40:·3637·2220·7461·6269·6e64·6578·3d22·3022··67"·tabindex="0" | |||
| 0003bf50:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bf60:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bf70:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bf80:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003bf90:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003bfa0:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003bfb0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003bfc0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bfd0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bfe0:·7073·6522·2069·643d·2269·646d·3935·3637··pse"·id="idm9567 | |||
| 0003bff0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c000:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c010:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c020:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c030:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c040:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c050:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c060:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c070:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c080:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c090:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c0a0:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c0b0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c0c0:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003c0d0:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003c0e0:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003c0f0:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003c100:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003c110:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003c120:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003c130:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c140:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c150:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c160:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c170:·7461·7267·6574·3d22·2369·646d·3935·3638··target="#idm9568 | |||
| 0003c180:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c190:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c1a0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c1b0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c1c0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c1d0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c1e0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003 | 0003bdc0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | ||
| 0003 | 0003bdd0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | ||
| 0003 | 0003bde0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | ||
| 0003 | 0003bdf0:·7365·2220·6964·3d22·6964·6d39·3536·3622··se"·id="idm9566" | ||
| 0003 | 0003be00:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | ||
| 0003 | 0003be10:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | ||
| 0003 | 0003be20:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003 | 0003be30:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003 | 0003be40:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | ||
| 0003 | 0003be50:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | ||
| 0003 | 0003be60:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003 | 0003be70:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | ||
| 0003 | 0003be80:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003 | 0003be90:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | ||
| 0003 | 0003bea0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | ||
| 0003 | 0003beb0:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003 | 0003bec0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | ||
| 0003bed0:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003bee0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003bef0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003bf00:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003bf10:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003bf20:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003bf30:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003bf40:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003bf50:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003bf60:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003bf70:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003bf80:·6172·6765·743d·2223·6964·6d39·3536·3722··arget="#idm9567" | |||
| 0003bf90:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003bfa0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003bfb0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003bfc0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003bfd0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003bfe0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| Max diff block lines reached; 6709031/6735305 bytes (99.61%) of diff not shown. | |||
| Offset 47, 15 lines modified | Offset 47, 15 lines modified | ||
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:7 | 51 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 52 | *****·Revision·History·***** | 52 | *****·Revision·History·***** |
| 53 | Current·version:·0.1.65 | 53 | Current·version:·0.1.65 |
| 54 | ····*·draft·(as·of·202 | 54 | ····*·draft·(as·of·2025-02-23) |
| 55 | *****·Table·of·Contents·***** | 55 | *****·Table·of·Contents·***** |
| 56 | ···1.·System_Settings | 56 | ···1.·System_Settings |
| 57 | ·········1.·Installing_and_Maintaining_Software | 57 | ·········1.·Installing_and_Maintaining_Software |
| 58 | ·········2.·Account_and_Access_Control | 58 | ·········2.·Account_and_Access_Control |
| 59 | ·········3.·System_Accounting_with_auditd | 59 | ·········3.·System_Accounting_with_auditd |
| 60 | ·········4.·GRUB2_bootloader_configuration | 60 | ·········4.·GRUB2_bootloader_configuration |
| 61 | ·········5.·Configure_Syslog | 61 | ·········5.·Configure_Syslog |
| Offset 88, 31 lines modified | Offset 88, 39 lines modified | ||
| 88 | $·sudo·yum·install·aide | 88 | $·sudo·yum·install·aide |
| 89 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 89 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 90 | Severity: ·medium | 90 | Severity: ·medium |
| 91 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 91 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 92 | Identifiers·Identifiers: ·CCE-27096-7 | 92 | Identifiers·Identifiers: ·CCE-27096-7 |
| 93 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 93 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 94 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule | 94 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule |
| 95 | Remediation_Anaconda_snippet_⇲ | ||
| 96 | Complexity:·low | ||
| 97 | Disruption:·low | ||
| 98 | Strategy:···enable | ||
| 99 | package·--add=aide | ||
| 100 | Remediation_Puppet_snippet_⇲ | 95 | Remediation_Puppet_snippet_⇲ |
| 101 | Complexity:·low | 96 | Complexity:·low |
| 102 | Disruption:·low | 97 | Disruption:·low |
| 103 | Strategy:···enable | 98 | Strategy:···enable |
| 104 | include·install_aide | 99 | include·install_aide |
| 105 | class·install_aide·{ | 100 | class·install_aide·{ |
| 106 | ··package·{·'aide': | 101 | ··package·{·'aide': |
| 107 | ····ensure·=>·'installed', | 102 | ····ensure·=>·'installed', |
| 108 | ··} | 103 | ··} |
| 109 | } | 104 | } |
| 105 | Remediation_Shell_script_⇲ | ||
| 106 | Complexity:·low | ||
| 107 | Disruption:·low | ||
| 108 | Strategy:···enable | ||
| 109 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 110 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 111 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 112 | ····yum·install·-y·"aide" | ||
| 113 | fi | ||
| 114 | else | ||
| 115 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 116 | fi | ||
| 110 | Remediation_Ansible_snippet_⇲ | 117 | Remediation_Ansible_snippet_⇲ |
| 111 | Complexity:·low | 118 | Complexity:·low |
| 112 | Disruption:·low | 119 | Disruption:·low |
| 113 | Strategy:···enable | 120 | Strategy:···enable |
| 114 | -·name:·Ensure·aide·is·installed | 121 | -·name:·Ensure·aide·is·installed |
| 115 | ··package: | 122 | ··package: |
| 116 | ····name:·aide | 123 | ····name:·aide |
| Offset 131, 42 lines modified | Offset 139, 48 lines modified | ||
| 131 | ··-·no_reboot_needed | 139 | ··-·no_reboot_needed |
| 132 | ··-·package_aide_installed | 140 | ··-·package_aide_installed |
| 133 | Remediation_OSBuild_Blueprint_snippet_⇲ | 141 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 134 | [[packages]] | 142 | [[packages]] |
| 135 | name·=·"aide" | 143 | name·=·"aide" |
| 136 | version·=·"*" | 144 | version·=·"*" |
| 137 | Remediation_ | 145 | Remediation_Anaconda_snippet_⇲ |
| 138 | Complexity:·low | 146 | Complexity:·low |
| 139 | Disruption:·low | 147 | Disruption:·low |
| 140 | Strategy:···enable | 148 | Strategy:···enable |
| 141 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 142 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 149 | package·--add=aide | ||
| 143 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 144 | ····yum·install·-y·"aide" | ||
| 145 | fi | ||
| 146 | else | ||
| 147 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 148 | fi | ||
| 149 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 150 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 150 | Run·the·following·command·to·generate·a·new·database: | 151 | Run·the·following·command·to·generate·a·new·database: |
| 151 | $·sudo·/usr/sbin/aide·--init | 152 | $·sudo·/usr/sbin/aide·--init |
| 152 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 153 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 153 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 154 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 154 | To·initiate·a·manual·check,·run·the·following·command: | 155 | To·initiate·a·manual·check,·run·the·following·command: |
| 155 | $·sudo·/usr/sbin/aide·--check | 156 | $·sudo·/usr/sbin/aide·--check |
| 156 | If·this·check·produces·any·unexpected·output,·investigate. | 157 | If·this·check·produces·any·unexpected·output,·investigate. |
| 157 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 158 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 158 | Severity: ·medium | 159 | Severity: ·medium |
| 159 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 160 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 160 | Identifiers·Identifiers: ·CCE-27220-3 | 161 | Identifiers·Identifiers: ·CCE-27220-3 |
| 161 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 162 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 162 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 163 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 164 | Remediation_Shell_script_⇲ | ||
| 165 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 166 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 167 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 168 | ····yum·install·-y·"aide" | ||
| 169 | fi | ||
| 170 | /usr/sbin/aide·--init | ||
| 171 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 172 | else | ||
| 173 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 174 | fi | ||
| 163 | Remediation_Ansible_snippet_⇲ | 175 | Remediation_Ansible_snippet_⇲ |
| 164 | Complexity:·low | 176 | Complexity:·low |
| 165 | Disruption:·low | 177 | Disruption:·low |
| 166 | Strategy:···restrict | 178 | Strategy:···restrict |
| 167 | -·name:·Ensure·AIDE·is·installed | 179 | -·name:·Ensure·AIDE·is·installed |
| 168 | ··package: | 180 | ··package: |
| 169 | ····name:·'{{·item·}}' | 181 | ····name:·'{{·item·}}' |
| Offset 235, 243 lines modified | Offset 249, 237 lines modified | ||
| 235 | ··-·PCI-DSS-Req-11.5 | 249 | ··-·PCI-DSS-Req-11.5 |
| 236 | ··-·aide_build_database | 250 | ··-·aide_build_database |
| 237 | ··-·low_complexity | 251 | ··-·low_complexity |
| 238 | ··-·low_disruption | 252 | ··-·low_disruption |
| 239 | ··-·medium_severity | 253 | ··-·medium_severity |
| 240 | ··-·no_reboot_needed | 254 | ··-·no_reboot_needed |
| 241 | ··-·restrict_strategy | 255 | ··-·restrict_strategy |
| Max diff block lines reached; 763053/768824 bytes (99.25%) of diff not shown. | |||
| Offset 14358, 15 lines modified | Offset 14358, 15 lines modified | ||
| 00038150:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038150:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038160:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038160:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038170:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038170:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00038180:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00038180:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00038190:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00038190:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 000381a0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 000381a0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 000381b0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 000381b0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 000381c0:·6f66·2032·3032·3 | 000381c0:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 000381d0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 000381d0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 000381e0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 000381e0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 000381f0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 000381f0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00038200:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00038200:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038210:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038210:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038220:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038220:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038230:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038230:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15316, 192 lines modified | Offset 15316, 192 lines modified | ||
| 0003bd30:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | 0003bd30:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | ||
| 0003bd40:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | 0003bd40:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | ||
| 0003bd50:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003bd50:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003bd60:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003bd60:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bd70:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bd70:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003bd80:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003bd80:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003bd90:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003bd90:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bda0:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003bda0:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003bdb0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003bdc0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bdd0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bde0:·6170·7365·2220·6964·3d22·6964·6d39·3536··apse"·id="idm956 | |||
| 0003bdf0:·3622·3e3c·7461·626c·6520·636c·6173·733d··6"><table·class= | |||
| 0003be00:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003be10:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003be20:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003be30:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003be40:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003be50:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003be60:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003be70:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003be80:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003be90:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003bea0:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003beb0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003bec0:·6f64·653e·0a70·6163·6b61·6765·202d·2d61··ode>.package·--a | |||
| 0003bed0:·6464·3d61·6964·650a·3c2f·636f·6465·3e3c··dd=aide.</code>< | |||
| 0003bee0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bef0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bf00:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bf10:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bf20:·612d·7461·7267·6574·3d22·2369·646d·3935··a-target="#idm95 | |||
| 0003bf30:·3637·2220·7461·6269·6e64·6578·3d22·3022··67"·tabindex="0" | |||
| 0003bf40:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bf50:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bf60:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bf70:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003bf80:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003bf90:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003bfa0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003bfb0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bfc0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bfd0:·7073·6522·2069·643d·2269·646d·3935·3637··pse"·id="idm9567 | |||
| 0003bfe0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bff0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c000:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c010:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c020:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c030:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c040:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c050:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c060:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c070:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c080:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c090:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c0a0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c0b0:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003c0c0:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003c0d0:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003c0e0:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003c0f0:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003c100:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003c110:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003c120:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c130:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c140:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c150:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c160:·7461·7267·6574·3d22·2369·646d·3935·3638··target="#idm9568 | |||
| 0003c170:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c180:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c190:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c1a0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c1b0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c1c0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c1d0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003 | 0003bdb0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | ||
| 0003 | 0003bdc0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | ||
| 0003 | 0003bdd0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | ||
| 0003 | 0003bde0:·7365·2220·6964·3d22·6964·6d39·3536·3622··se"·id="idm9566" | ||
| 0003 | 0003bdf0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | ||
| 0003 | 0003be00:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | ||
| 0003 | 0003be10:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003 | 0003be20:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003 | 0003be30:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | ||
| 0003 | 0003be40:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | ||
| 0003be50:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003be60:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003be70:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003be80:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003be90:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003bea0:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003beb0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003bec0:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003bed0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003bee0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003bef0:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003bf00:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003bf10:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003bf20:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003bf30:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003bf40:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003bf50:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003bf60:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003bf70:·6172·6765·743d·2223·6964·6d39·3536·3722··arget="#idm9567" | |||
| 0003bf80:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003bf90:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003bfa0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003bfb0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003bfc0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003bfd0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| Max diff block lines reached; 6983705/7009979 bytes (99.63%) of diff not shown. | |||
| Offset 47, 15 lines modified | Offset 47, 15 lines modified | ||
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:7 | 51 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 52 | *****·Revision·History·***** | 52 | *****·Revision·History·***** |
| 53 | Current·version:·0.1.65 | 53 | Current·version:·0.1.65 |
| 54 | ····*·draft·(as·of·202 | 54 | ····*·draft·(as·of·2025-02-23) |
| 55 | *****·Table·of·Contents·***** | 55 | *****·Table·of·Contents·***** |
| 56 | ···1.·System_Settings | 56 | ···1.·System_Settings |
| 57 | ·········1.·Installing_and_Maintaining_Software | 57 | ·········1.·Installing_and_Maintaining_Software |
| 58 | ·········2.·Account_and_Access_Control | 58 | ·········2.·Account_and_Access_Control |
| 59 | ·········3.·System_Accounting_with_auditd | 59 | ·········3.·System_Accounting_with_auditd |
| 60 | ·········4.·GRUB2_bootloader_configuration | 60 | ·········4.·GRUB2_bootloader_configuration |
| 61 | ·········5.·Configure_Syslog | 61 | ·········5.·Configure_Syslog |
| Offset 88, 31 lines modified | Offset 88, 39 lines modified | ||
| 88 | $·sudo·yum·install·aide | 88 | $·sudo·yum·install·aide |
| 89 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 89 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 90 | Severity: ·medium | 90 | Severity: ·medium |
| 91 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 91 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 92 | Identifiers·Identifiers: ·CCE-27096-7 | 92 | Identifiers·Identifiers: ·CCE-27096-7 |
| 93 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 93 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 94 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule | 94 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule |
| 95 | Remediation_Anaconda_snippet_⇲ | ||
| 96 | Complexity:·low | ||
| 97 | Disruption:·low | ||
| 98 | Strategy:···enable | ||
| 99 | package·--add=aide | ||
| 100 | Remediation_Puppet_snippet_⇲ | 95 | Remediation_Puppet_snippet_⇲ |
| 101 | Complexity:·low | 96 | Complexity:·low |
| 102 | Disruption:·low | 97 | Disruption:·low |
| 103 | Strategy:···enable | 98 | Strategy:···enable |
| 104 | include·install_aide | 99 | include·install_aide |
| 105 | class·install_aide·{ | 100 | class·install_aide·{ |
| 106 | ··package·{·'aide': | 101 | ··package·{·'aide': |
| 107 | ····ensure·=>·'installed', | 102 | ····ensure·=>·'installed', |
| 108 | ··} | 103 | ··} |
| 109 | } | 104 | } |
| 105 | Remediation_Shell_script_⇲ | ||
| 106 | Complexity:·low | ||
| 107 | Disruption:·low | ||
| 108 | Strategy:···enable | ||
| 109 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 110 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 111 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 112 | ····yum·install·-y·"aide" | ||
| 113 | fi | ||
| 114 | else | ||
| 115 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 116 | fi | ||
| 110 | Remediation_Ansible_snippet_⇲ | 117 | Remediation_Ansible_snippet_⇲ |
| 111 | Complexity:·low | 118 | Complexity:·low |
| 112 | Disruption:·low | 119 | Disruption:·low |
| 113 | Strategy:···enable | 120 | Strategy:···enable |
| 114 | -·name:·Ensure·aide·is·installed | 121 | -·name:·Ensure·aide·is·installed |
| 115 | ··package: | 122 | ··package: |
| 116 | ····name:·aide | 123 | ····name:·aide |
| Offset 131, 42 lines modified | Offset 139, 48 lines modified | ||
| 131 | ··-·no_reboot_needed | 139 | ··-·no_reboot_needed |
| 132 | ··-·package_aide_installed | 140 | ··-·package_aide_installed |
| 133 | Remediation_OSBuild_Blueprint_snippet_⇲ | 141 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 134 | [[packages]] | 142 | [[packages]] |
| 135 | name·=·"aide" | 143 | name·=·"aide" |
| 136 | version·=·"*" | 144 | version·=·"*" |
| 137 | Remediation_ | 145 | Remediation_Anaconda_snippet_⇲ |
| 138 | Complexity:·low | 146 | Complexity:·low |
| 139 | Disruption:·low | 147 | Disruption:·low |
| 140 | Strategy:···enable | 148 | Strategy:···enable |
| 141 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 142 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 149 | package·--add=aide | ||
| 143 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 144 | ····yum·install·-y·"aide" | ||
| 145 | fi | ||
| 146 | else | ||
| 147 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 148 | fi | ||
| 149 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 150 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 150 | Run·the·following·command·to·generate·a·new·database: | 151 | Run·the·following·command·to·generate·a·new·database: |
| 151 | $·sudo·/usr/sbin/aide·--init | 152 | $·sudo·/usr/sbin/aide·--init |
| 152 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 153 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 153 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 154 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 154 | To·initiate·a·manual·check,·run·the·following·command: | 155 | To·initiate·a·manual·check,·run·the·following·command: |
| 155 | $·sudo·/usr/sbin/aide·--check | 156 | $·sudo·/usr/sbin/aide·--check |
| 156 | If·this·check·produces·any·unexpected·output,·investigate. | 157 | If·this·check·produces·any·unexpected·output,·investigate. |
| 157 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 158 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 158 | Severity: ·medium | 159 | Severity: ·medium |
| 159 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 160 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 160 | Identifiers·Identifiers: ·CCE-27220-3 | 161 | Identifiers·Identifiers: ·CCE-27220-3 |
| 161 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 162 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 162 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 163 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 164 | Remediation_Shell_script_⇲ | ||
| 165 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 166 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 167 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 168 | ····yum·install·-y·"aide" | ||
| 169 | fi | ||
| 170 | /usr/sbin/aide·--init | ||
| 171 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 172 | else | ||
| 173 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 174 | fi | ||
| 163 | Remediation_Ansible_snippet_⇲ | 175 | Remediation_Ansible_snippet_⇲ |
| 164 | Complexity:·low | 176 | Complexity:·low |
| 165 | Disruption:·low | 177 | Disruption:·low |
| 166 | Strategy:···restrict | 178 | Strategy:···restrict |
| 167 | -·name:·Ensure·AIDE·is·installed | 179 | -·name:·Ensure·AIDE·is·installed |
| 168 | ··package: | 180 | ··package: |
| 169 | ····name:·'{{·item·}}' | 181 | ····name:·'{{·item·}}' |
| Offset 235, 28 lines modified | Offset 249, 14 lines modified | ||
| 235 | ··-·PCI-DSS-Req-11.5 | 249 | ··-·PCI-DSS-Req-11.5 |
| 236 | ··-·aide_build_database | 250 | ··-·aide_build_database |
| 237 | ··-·low_complexity | 251 | ··-·low_complexity |
| 238 | ··-·low_disruption | 252 | ··-·low_disruption |
| 239 | ··-·medium_severity | 253 | ··-·medium_severity |
| 240 | ··-·no_reboot_needed | 254 | ··-·no_reboot_needed |
| 241 | ··-·restrict_strategy | 255 | ··-·restrict_strategy |
| Max diff block lines reached; 798701/804478 bytes (99.28%) of diff not shown. | |||
| Offset 14360, 15 lines modified | Offset 14360, 15 lines modified | ||
| 00038170:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038170:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038180:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038180:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038190:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038190:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 000381a0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 000381a0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 000381b0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 000381b0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 000381c0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 000381c0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 000381d0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 000381d0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 000381e0:·6f66·2032·3032·3 | 000381e0:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 000381f0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 000381f0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 00038200:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 00038200:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00038210:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00038210:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00038220:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00038220:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038230:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038230:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038240:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038240:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038250:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038250:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15311, 193 lines modified | Offset 15311, 193 lines modified | ||
| 0003bce0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003bce0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003bcf0:·6964·6d39·3536·3622·2074·6162·696e·6465··idm9566"·tabinde | 0003bcf0:·6964·6d39·3536·3622·2074·6162·696e·6465··idm9566"·tabinde | ||
| 0003bd00:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003bd00:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003bd10:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003bd10:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003bd20:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003bd20:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003bd30:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003bd30:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003bd40:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003bd40:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003bd50:·656d·6564·6961·7469·6f6e·20 | 0003bd50:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | ||
| 0003bd60:·6e64·6120·736e·6970·7065·7420·e287·b23c··nda·snippet·...< | |||
| 0003bd70:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bd80:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bd90:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bda0:·6964·6d39·3536·3622·3e3c·7461·626c·6520··idm9566"><table· | |||
| 0003bdb0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bdc0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bdd0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bde0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bdf0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003be00:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003be10:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003be20:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003be30:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003be40:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003be50:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003be60:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003be70:·7072·653e·3c63·6f64·653e·0a70·6163·6b61··pre><code>.packa | |||
| 0003be80:·6765·202d·2d61·6464·3d61·6964·650a·3c2f··ge·--add=aide.</ | |||
| 0003be90:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bea0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003beb0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003bec0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003bed0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003bee0:·2369·646d·3935·3637·2220·7461·6269·6e64··#idm9567"·tabind | |||
| 0003bef0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bf00:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003bf10:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bf20:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003bf30:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003bf40:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | |||
| 0003bf50:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | |||
| 0003bf60:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003bf70:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003bf80:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003bf90:·646d·3935·3637·223e·3c74·6162·6c65·2063··dm9567"><table·c | |||
| 0003bfa0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003bfb0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003bfc0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003bfd0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003bfe0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003bff0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c000:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c010:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003c020:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c030:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c040:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003c050:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003c060:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | |||
| 0003c070:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003c080:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003c090:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003c0a0:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003c0b0:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003c0c0:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003c0d0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003c0e0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003c0f0:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003c100:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003c110:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003c120:·646d·3935·3638·2220·7461·6269·6e64·6578··dm9568"·tabindex | |||
| 0003c130:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003c140:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003c150:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003c160:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003c170:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003c180:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003 | 0003bd60:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | ||
| 0003 | 0003bd70:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | ||
| 0003 | 0003bd80:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | ||
| 0003 | 0003bd90:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | ||
| 0003 | 0003bda0:·6d39·3536·3622·3e3c·7461·626c·6520·636c··m9566"><table·cl | ||
| 0003 | 0003bdb0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | ||
| 0003 | 0003bdc0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | ||
| 0003 | 0003bdd0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | ||
| 0003 | 0003bde0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | ||
| 0003 | 0003bdf0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | ||
| 0003 | 0003be00:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003 | 0003be10:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | ||
| 0003 | 0003be20:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | ||
| 0003 | 0003be30:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003 | 0003be40:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | ||
| 0003 | 0003be50:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | ||
| 0003 | 0003be60:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | ||
| 0003be70:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003be80:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003be90:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003bea0:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003beb0:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003bec0:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003bed0:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003bee0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bef0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bf00:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003c2a0:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003c2b0:·456e·7375·7265·2061·6964·6520·6973·2069··Ensure·aide·is·i | |||
| 0003c2c0:·6e73·7461·6c6c·6564·0a20·2070·6163·6b61··nstalled.··packa | |||
| 0003c2d0:·6765·3a0a·2020·2020·6e61·6d65·3a20·6169··ge:.····name:·ai | |||
| 0003c2e0:·6465·0a20·2020·2073·7461·7465·3a20·7072··de.····state:·pr | |||
| 0003c2f0:·6573·656e·740a·2020·7768·656e·3a20·616e··esent.··when:·an | |||
| 0003c300:·7369·626c·655f·7669·7274·7561·6c69·7a61··sible_virtualiza | |||
| 0003c310:·7469·6f6e·5f74·7970·6520·6e6f·7420·696e··tion_type·not·in | |||
| 0003c320:·205b·2264·6f63·6b65·7222·2c20·226c·7863···["docker",·"lxc | |||
| Max diff block lines reached; 6487879/6514291 bytes (99.59%) of diff not shown. | |||
| Offset 47, 15 lines modified | Offset 47, 15 lines modified | ||
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:7 | 51 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 52 | *****·Revision·History·***** | 52 | *****·Revision·History·***** |
| 53 | Current·version:·0.1.65 | 53 | Current·version:·0.1.65 |
| 54 | ····*·draft·(as·of·202 | 54 | ····*·draft·(as·of·2025-02-23) |
| 55 | *****·Table·of·Contents·***** | 55 | *****·Table·of·Contents·***** |
| 56 | ···1.·System_Settings | 56 | ···1.·System_Settings |
| 57 | ·········1.·Installing_and_Maintaining_Software | 57 | ·········1.·Installing_and_Maintaining_Software |
| 58 | ·········2.·Account_and_Access_Control | 58 | ·········2.·Account_and_Access_Control |
| 59 | ·········3.·System_Accounting_with_auditd | 59 | ·········3.·System_Accounting_with_auditd |
| 60 | ·········4.·Configure_Syslog | 60 | ·········4.·Configure_Syslog |
| 61 | ·········5.·Network_Configuration_and_Firewalls | 61 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 87, 31 lines modified | Offset 87, 39 lines modified | ||
| 87 | $·sudo·yum·install·aide | 87 | $·sudo·yum·install·aide |
| 88 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 88 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 89 | Severity: ·medium | 89 | Severity: ·medium |
| 90 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 90 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 91 | Identifiers·Identifiers: ·CCE-27096-7 | 91 | Identifiers·Identifiers: ·CCE-27096-7 |
| 92 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 92 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 93 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule | 93 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule |
| 94 | Remediation_Anaconda_snippet_⇲ | ||
| 95 | Complexity:·low | ||
| 96 | Disruption:·low | ||
| 97 | Strategy:···enable | ||
| 98 | package·--add=aide | ||
| 99 | Remediation_Puppet_snippet_⇲ | 94 | Remediation_Puppet_snippet_⇲ |
| 100 | Complexity:·low | 95 | Complexity:·low |
| 101 | Disruption:·low | 96 | Disruption:·low |
| 102 | Strategy:···enable | 97 | Strategy:···enable |
| 103 | include·install_aide | 98 | include·install_aide |
| 104 | class·install_aide·{ | 99 | class·install_aide·{ |
| 105 | ··package·{·'aide': | 100 | ··package·{·'aide': |
| 106 | ····ensure·=>·'installed', | 101 | ····ensure·=>·'installed', |
| 107 | ··} | 102 | ··} |
| 108 | } | 103 | } |
| 104 | Remediation_Shell_script_⇲ | ||
| 105 | Complexity:·low | ||
| 106 | Disruption:·low | ||
| 107 | Strategy:···enable | ||
| 108 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 109 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 110 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 111 | ····yum·install·-y·"aide" | ||
| 112 | fi | ||
| 113 | else | ||
| 114 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 115 | fi | ||
| 109 | Remediation_Ansible_snippet_⇲ | 116 | Remediation_Ansible_snippet_⇲ |
| 110 | Complexity:·low | 117 | Complexity:·low |
| 111 | Disruption:·low | 118 | Disruption:·low |
| 112 | Strategy:···enable | 119 | Strategy:···enable |
| 113 | -·name:·Ensure·aide·is·installed | 120 | -·name:·Ensure·aide·is·installed |
| 114 | ··package: | 121 | ··package: |
| 115 | ····name:·aide | 122 | ····name:·aide |
| Offset 130, 42 lines modified | Offset 138, 48 lines modified | ||
| 130 | ··-·no_reboot_needed | 138 | ··-·no_reboot_needed |
| 131 | ··-·package_aide_installed | 139 | ··-·package_aide_installed |
| 132 | Remediation_OSBuild_Blueprint_snippet_⇲ | 140 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 133 | [[packages]] | 141 | [[packages]] |
| 134 | name·=·"aide" | 142 | name·=·"aide" |
| 135 | version·=·"*" | 143 | version·=·"*" |
| 136 | Remediation_ | 144 | Remediation_Anaconda_snippet_⇲ |
| 137 | Complexity:·low | 145 | Complexity:·low |
| 138 | Disruption:·low | 146 | Disruption:·low |
| 139 | Strategy:···enable | 147 | Strategy:···enable |
| 140 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 141 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 148 | package·--add=aide | ||
| 142 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 143 | ····yum·install·-y·"aide" | ||
| 144 | fi | ||
| 145 | else | ||
| 146 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 147 | fi | ||
| 148 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 149 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 149 | Run·the·following·command·to·generate·a·new·database: | 150 | Run·the·following·command·to·generate·a·new·database: |
| 150 | $·sudo·/usr/sbin/aide·--init | 151 | $·sudo·/usr/sbin/aide·--init |
| 151 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 152 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 152 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 153 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 153 | To·initiate·a·manual·check,·run·the·following·command: | 154 | To·initiate·a·manual·check,·run·the·following·command: |
| 154 | $·sudo·/usr/sbin/aide·--check | 155 | $·sudo·/usr/sbin/aide·--check |
| 155 | If·this·check·produces·any·unexpected·output,·investigate. | 156 | If·this·check·produces·any·unexpected·output,·investigate. |
| 156 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 157 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 157 | Severity: ·medium | 158 | Severity: ·medium |
| 158 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 159 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 159 | Identifiers·Identifiers: ·CCE-27220-3 | 160 | Identifiers·Identifiers: ·CCE-27220-3 |
| 160 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 161 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 161 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 162 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 163 | Remediation_Shell_script_⇲ | ||
| 164 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 165 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 166 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 167 | ····yum·install·-y·"aide" | ||
| 168 | fi | ||
| 169 | /usr/sbin/aide·--init | ||
| 170 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 171 | else | ||
| 172 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 173 | fi | ||
| 162 | Remediation_Ansible_snippet_⇲ | 174 | Remediation_Ansible_snippet_⇲ |
| 163 | Complexity:·low | 175 | Complexity:·low |
| 164 | Disruption:·low | 176 | Disruption:·low |
| 165 | Strategy:···restrict | 177 | Strategy:···restrict |
| 166 | -·name:·Ensure·AIDE·is·installed | 178 | -·name:·Ensure·AIDE·is·installed |
| 167 | ··package: | 179 | ··package: |
| 168 | ····name:·'{{·item·}}' | 180 | ····name:·'{{·item·}}' |
| Offset 234, 243 lines modified | Offset 248, 237 lines modified | ||
| 234 | ··-·PCI-DSS-Req-11.5 | 248 | ··-·PCI-DSS-Req-11.5 |
| 235 | ··-·aide_build_database | 249 | ··-·aide_build_database |
| 236 | ··-·low_complexity | 250 | ··-·low_complexity |
| 237 | ··-·low_disruption | 251 | ··-·low_disruption |
| 238 | ··-·medium_severity | 252 | ··-·medium_severity |
| 239 | ··-·no_reboot_needed | 253 | ··-·no_reboot_needed |
| 240 | ··-·restrict_strategy | 254 | ··-·restrict_strategy |
| Max diff block lines reached; 730107/735883 bytes (99.22%) of diff not shown. | |||
| Offset 14359, 15 lines modified | Offset 14359, 15 lines modified | ||
| 00038160:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00038160:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00038170:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00038170:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00038180:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00038180:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00038190:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00038190:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 000381a0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 000381a0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 000381b0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 000381b0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 000381c0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 000381c0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 000381d0:·3032·3 | 000381d0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 000381e0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 000381e0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 000381f0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 000381f0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038200:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038200:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00038210:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00038210:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00038220:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00038220:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00038230:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00038230:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00038240:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00038240:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15079, 145 lines modified | Offset 15079, 145 lines modified | ||
| 0003ae60:·7461·2d74·6172·6765·743d·2223·6964·6d31··ta-target="#idm1 | 0003ae60:·7461·2d74·6172·6765·743d·2223·6964·6d31··ta-target="#idm1 | ||
| 0003ae70:·3334·3534·2220·7461·6269·6e64·6578·3d22··3454"·tabindex=" | 0003ae70:·3334·3534·2220·7461·6269·6e64·6578·3d22··3454"·tabindex=" | ||
| 0003ae80:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003ae80:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003ae90:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003ae90:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003aea0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003aea0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003aeb0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003aeb0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003aec0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003aec0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003aed0:·6469·6174·696f·6e20·5368·656c·6c20·7363··diation·Shell·sc | |||
| 0003aee0:·7269·7074·20e2·87b2·3c2f·613e·3c62·723e··ript·...</a><br> | |||
| 0003aef0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003af00:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003af10:·7073·6522·2069·643d·2269·646d·3133·3435··pse"·id="idm1345 | |||
| 0003af20:·3422·3e3c·7461·626c·6520·636c·6173·733d··4"><table·class= | |||
| 0003af30:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003af40:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003af50:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003af60:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003af70:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003aed0:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003aee0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003aef0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003af00:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003af10:·6c6c·6170·7365·2220·6964·3d22·6964·6d31··llapse"·id="idm1 | |||
| 0003af20:·3334·3534·223e·3c74·6162·6c65·2063·6c61··3454"><table·cla | |||
| 0003af30:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003af40:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003af50:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003af60:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003af70:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003af80:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003af90:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003afa0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003af | 0003af80:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003af90:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003afa0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003afb0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003afc0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003afd0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003afe0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003aff0:·3c63·6f64·653e·0a66·6f72·2066·2069·6e20··<code>.for·f·in· | |||
| 0003b000:·2f65·7463·2f73·7564·6f65·7273·202f·6574··/etc/sudoers·/et | |||
| 0003b010:·632f·7375·646f·6572·732e·642f·2a20·3b20··c/sudoers.d/*·;· | |||
| 0003b020:·646f·0a20·2069·6620·5b20·2120·2d65·2022··do.··if·[·!·-e·" | |||
| 0003b030:·2466·2220·5d20·3b20·7468·656e·0a20·2020··$f"·]·;·then.··· | |||
| 0003b040:·2063·6f6e·7469·6e75·650a·2020·6669·0a20···continue.··fi.· | |||
| 0003b050:·206d·6174·6368·696e·675f·6c69·7374·3d24···matching_list=$ | |||
| 0003b060:·2867·7265·7020·2d50·2027·5e28·3f21·2329··(grep·-P·'^(?!#) | |||
| 0003b070:·2e2a·5b5c·735d·2b5c·2161·7574·6865·6e74··.*[\s]+\!authent | |||
| 0003b080:·6963·6174·652e·2a24·2720·2466·207c·2075··icate.*$'·$f·|·u | |||
| 0003b090:·6e69·7120·290a·2020·6966·2021·2074·6573··niq·).··if·!·tes | |||
| 0003b0a0:·7420·2d7a·2022·246d·6174·6368·696e·675f··t·-z·"$matching_ | |||
| 0003b0b0:·6c69·7374·223b·2074·6865·6e0a·2020·2020··list";·then.···· | |||
| 0003b0c0:·7768·696c·6520·4946·533d·2072·6561·6420··while·IFS=·read· | |||
| 0003b0d0:·2d72·2065·6e74·7279·3b20·646f·0a20·2020··-r·entry;·do.··· | |||
| 0003b0e0:·2020·2023·2063·6f6d·6d65·6e74·206f·7574·····#·comment·out | |||
| 0003afc0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003afd0:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003afe0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003aff0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003b000:·2046·696e·6420·2f65·7463·2f73·7564·6f65···Find·/etc/sudoe | |||
| 0003b010:·7273·2e64·2f20·6669·6c65·730a·2020·6669··rs.d/·files.··fi | |||
| 0003b020:·6e64·3a0a·2020·2020·7061·7468·733a·0a20··nd:.····paths:.· | |||
| 0003b030:·2020·202d·202f·6574·632f·7375·646f·6572·····-·/etc/sudoer | |||
| 0003b040:·732e·642f·0a20·2072·6567·6973·7465·723a··s.d/.··register: | |||
| 0003b050:·2073·7564·6f65·7273·0a20·2074·6167·733a···sudoers.··tags: | |||
| 0003b060:·0a20·202d·2043·4345·2d38·3033·3530·2d32··.··-·CCE-80350-2 | |||
| 0003b070:·0a20·202d·2044·4953·412d·5354·4947·2d52··.··-·DISA-STIG-R | |||
| 0003b080:·4845·4c2d·3037·2d30·3130·3335·300a·2020··HEL-07-010350.·· | |||
| 0003b090:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003b0a0:·2d36·2861·290a·2020·2d20·4e49·5354·2d38··-6(a).··-·NIST-8 | |||
| 0003b0b0:·3030·2d35·332d·4941·2d31·310a·2020·2d20··00-53-IA-11.··-· | |||
| 0003b0c0:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 0003b0d0:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 0003b0e0:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | |||
| 0003b0f0:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 0003b100:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 0003b110:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 0003b120:·0a20·202d·2073·7564·6f5f·7265·6d6f·7665··.··-·sudo_remove | |||
| 0003b130:·5f6e·6f5f·6175·7468·656e·7469·6361·7465··_no_authenticate | |||
| 0003b140:·0a0a·2d20·6e61·6d65·3a20·5265·6d6f·7665··..-·name:·Remove | |||
| 0003b150:·206c·696e·6573·2063·6f6e·7461·696e·696e···lines·containin | |||
| 0003b | 0003b0f0:·2022·2161·7574·6865·6e74·6963·6174·6522···"!authenticate" | ||
| 0003b100:·206d·6174·6368·6573·2074·6f20·7072·6573···matches·to·pres | |||
| 0003b110:·6572·7665·2075·7365·7220·6461·7461·0a20··erve·user·data.· | |||
| 0003b120:·2020·2020·2073·6564·202d·6920·2273·2f5e·······sed·-i·"s/^ | |||
| 0003b130:·247b·656e·7472·797d·242f·2320·2661·6d70··${entry}$/#·& | |||
| 0003b140:·3b2f·6722·2024·660a·2020·2020·646f·6e65··;/g"·$f.····done | |||
| 0003b150:·2026·6c74·3b26·6c74·3b26·6c74·3b20·2224···<<<·"$ | |||
| 0003b160:·6d61·7463·6869·6e67·5f6c·6973·7422·0a0a··matching_list".. | |||
| 0003b170:·6672·6f6d·2073·7564·6f65·7273·2066·696c··from·sudoers·fil | |||
| 0003b180:·6573·0a20·2072·6570·6c61·6365·3a0a·2020··es.··replace:.·· | |||
| 0003b190:·2020·7265·6765·7870·3a20·285e·283f·2123····regexp:·(^(?!# | |||
| 0003b1a0:·292e·2a5b·5c73·5d2b·5c21·6175·7468·656e··).*[\s]+\!authen | |||
| 0003b1b0:·7469·6361·7465·2e2a·2429·0a20·2020·2072··ticate.*$).····r | |||
| 0003b1c0:·6570·6c61·6365·3a20·2723·205c·6726·6c74··eplace:·'#·\g< | |||
| 0003b1d0:·3b31·2667·743b·270a·2020·2020·7061·7468··;1>'.····path | |||
| 0003b1e0:·3a20·277b·7b20·6974·656d·2e70·6174·6820··:·'{{·item.path· | |||
| 0003b1f0:·7d7d·270a·2020·2020·7661·6c69·6461·7465··}}'.····validate | |||
| 0003b20 | 0003b170:·2020·2020·2f75·7372·2f73·6269·6e2f·7669······/usr/sbin/vi | ||
| 0003b210:·646f·202d·6366·2025·730a·2020·7769·7468··do·-cf·%s.··with | |||
| 0003b | 0003b180:·7375·646f·202d·6366·2024·6620·2661·6d70··sudo·-cf·$f·& | ||
| 0003b190:·3b26·6774·3b20·2f64·6576·2f6e·756c·6c20··;>·/dev/null· | |||
| 0003b1a0:·7c7c·2065·6368·6f20·2246·6169·6c20·746f··||·echo·"Fail·to | |||
| 0003b1b0:·2076·616c·6964·6174·6520·2466·2077·6974···validate·$f·wit | |||
| 0003b1c0:·6820·7669·7375·646f·220a·2020·6669·0a64··h·visudo".··fi.d | |||
| 0003b1d0:·6f6e·650a·3c2f·636f·6465·3e3c·2f70·7265··one.</code></pre | |||
| 0003b1e0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003b1f0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003b200:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003b210:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003b220:·7267·6574·3d22·2369·646d·3133·3435·3522··rget="#idm13455" | |||
| Max diff block lines reached; 2387491/2407279 bytes (99.18%) of diff not shown. | |||
| Offset 47, 15 lines modified | Offset 47, 15 lines modified | ||
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 49 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 50 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:7 | 51 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 52 | *****·Revision·History·***** | 52 | *****·Revision·History·***** |
| 53 | Current·version:·0.1.65 | 53 | Current·version:·0.1.65 |
| 54 | ····*·draft·(as·of·202 | 54 | ····*·draft·(as·of·2025-02-23) |
| 55 | *****·Table·of·Contents·***** | 55 | *****·Table·of·Contents·***** |
| 56 | ···1.·System_Settings | 56 | ···1.·System_Settings |
| 57 | ·········1.·Installing_and_Maintaining_Software | 57 | ·········1.·Installing_and_Maintaining_Software |
| 58 | ·········2.·Account_and_Access_Control | 58 | ·········2.·Account_and_Access_Control |
| 59 | ·········3.·Configure_Syslog | 59 | ·········3.·Configure_Syslog |
| 60 | ·········4.·File_Permissions_and_Masks | 60 | ·········4.·File_Permissions_and_Masks |
| 61 | ···2.·Services | 61 | ···2.·Services |
| Offset 93, 14 lines modified | Offset 93, 33 lines modified | ||
| 93 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 93 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 94 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 94 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 95 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 95 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 96 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 96 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 97 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 97 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 98 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 98 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 99 | ············000373-VMM-001490,·RHEL-07-010350,·SV-204430r853885_rule | 99 | ············000373-VMM-001490,·RHEL-07-010350,·SV-204430r853885_rule |
| 100 | Remediation_Shell_script_⇲ | ||
| 101 | Complexity:·low | ||
| 102 | Disruption:·low | ||
| 103 | Strategy:···restrict | ||
| 104 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 105 | ··if·[·!·-e·"$f"·]·;·then | ||
| 106 | ····continue | ||
| 107 | ··fi | ||
| 108 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 109 | ··if·!·test·-z·"$matching_list";·then | ||
| 110 | ····while·IFS=·read·-r·entry;·do | ||
| 111 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 112 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 113 | ····done·<<<·"$matching_list" | ||
| 114 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 115 | ··fi | ||
| 116 | done | ||
| 100 | Remediation_Ansible_snippet_⇲ | 117 | Remediation_Ansible_snippet_⇲ |
| 101 | Complexity:·low | 118 | Complexity:·low |
| 102 | Disruption:·low | 119 | Disruption:·low |
| 103 | Strategy:···restrict | 120 | Strategy:···restrict |
| 104 | -·name:·Find·/etc/sudoers.d/·files | 121 | -·name:·Find·/etc/sudoers.d/·files |
| 105 | ··find: | 122 | ··find: |
| 106 | ····paths: | 123 | ····paths: |
| Offset 134, 33 lines modified | Offset 153, 14 lines modified | ||
| 134 | ··-·NIST-800-53-IA-11 | 153 | ··-·NIST-800-53-IA-11 |
| 135 | ··-·low_complexity | 154 | ··-·low_complexity |
| 136 | ··-·low_disruption | 155 | ··-·low_disruption |
| 137 | ··-·medium_severity | 156 | ··-·medium_severity |
| 138 | ··-·no_reboot_needed | 157 | ··-·no_reboot_needed |
| 139 | ··-·restrict_strategy | 158 | ··-·restrict_strategy |
| 140 | ··-·sudo_remove_no_authenticate | 159 | ··-·sudo_remove_no_authenticate |
| 141 | Remediation_Shell_script_⇲ | ||
| 142 | Complexity:·low | ||
| 143 | Disruption:·low | ||
| 144 | Strategy:···restrict | ||
| 145 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 146 | ··if·[·!·-e·"$f"·]·;·then | ||
| 147 | ····continue | ||
| 148 | ··fi | ||
| 149 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 150 | ··if·!·test·-z·"$matching_list";·then | ||
| 151 | ····while·IFS=·read·-r·entry;·do | ||
| 152 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 153 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 154 | ····done·<<<·"$matching_list" | ||
| 155 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 156 | ··fi | ||
| 157 | done | ||
| 158 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 160 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 159 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 161 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 160 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 162 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 161 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 163 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 162 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 164 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 163 | ············have·authorization. | 165 | ············have·authorization. |
| 164 | Rationale: | 166 | Rationale: |
| Offset 172, 14 lines modified | Offset 172, 33 lines modified | ||
| 172 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 172 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 173 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 173 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 174 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 174 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 175 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 175 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 176 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 176 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 177 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 177 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 178 | ············000373-VMM-001490,·RHEL-07-010340,·SV-204429r861003_rule | 178 | ············000373-VMM-001490,·RHEL-07-010340,·SV-204429r861003_rule |
| 179 | Remediation_Shell_script_⇲ | ||
| 180 | Complexity:·low | ||
| 181 | Disruption:·low | ||
| 182 | Strategy:···restrict | ||
| 183 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 184 | ··if·[·!·-e·"$f"·]·;·then | ||
| 185 | ····continue | ||
| 186 | ··fi | ||
| 187 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 188 | ··if·!·test·-z·"$matching_list";·then | ||
| 189 | ····while·IFS=·read·-r·entry;·do | ||
| 190 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 191 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 192 | ····done·<<<·"$matching_list" | ||
| 193 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 194 | ··fi | ||
| 195 | done | ||
| 179 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 180 | Complexity:·low | 197 | Complexity:·low |
| 181 | Disruption:·low | 198 | Disruption:·low |
| 182 | Strategy:···restrict | 199 | Strategy:···restrict |
| 183 | -·name:·Find·/etc/sudoers.d/·files | 200 | -·name:·Find·/etc/sudoers.d/·files |
| 184 | ··find: | 201 | ··find: |
| 185 | ····paths: | 202 | ····paths: |
| Offset 213, 33 lines modified | Offset 232, 14 lines modified | ||
| 213 | ··-·NIST-800-53-IA-11 | 232 | ··-·NIST-800-53-IA-11 |
| 214 | ··-·low_complexity | 233 | ··-·low_complexity |
| 215 | ··-·low_disruption | 234 | ··-·low_disruption |
| 216 | ··-·medium_severity | 235 | ··-·medium_severity |
| 217 | ··-·no_reboot_needed | 236 | ··-·no_reboot_needed |
| 218 | ··-·restrict_strategy | 237 | ··-·restrict_strategy |
| 219 | ··-·sudo_remove_nopasswd | 238 | ··-·sudo_remove_nopasswd |
| 220 | Remediation_Shell_script_⇲ | ||
| 221 | Complexity:·low | ||
| Max diff block lines reached; 166114/171598 bytes (96.80%) of diff not shown. | |||
| Offset 14352, 15 lines modified | Offset 14352, 15 lines modified | ||
| 000380f0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 000380f0:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00038100:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00038100:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00038110:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00038110:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00038120:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00038120:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00038130:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00038130:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00038140:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00038140:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00038150:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00038150:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00038160:·3032·3 | 00038160:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00038170:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00038170:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00038180:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00038180:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038190:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038190:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 000381a0:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 000381a0:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 000381b0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 000381b0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 000381c0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 000381c0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 000381d0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 000381d0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15370, 192 lines modified | Offset 15370, 192 lines modified | ||
| 0003c090:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003c090:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c0a0:·6d39·3536·3622·2074·6162·696e·6465·783d··m9566"·tabindex= | 0003c0a0:·6d39·3536·3622·2074·6162·696e·6465·783d··m9566"·tabindex= | ||
| 0003c0b0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003c0b0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003c0c0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003c0c0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003c0d0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003c0d0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003c0e0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003c0e0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003c0f0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003c0f0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003c100:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003c100:·6564·6961·7469·6f6e·2041·6e61·636f·6e64··ediation·Anacond | |||
| 0003c110:·6120·736e·6970·7065·7420·e287·b23c·2f61··a·snippet·...</a | |||
| 0003c120:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c130:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c140:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c150:·6d39·3536·3622·3e3c·7461·626c·6520·636c··m9566"><table·cl | |||
| 0003c160:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c170:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c180:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c190:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c1a0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c1b0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c1c0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003c1d0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003c1e0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c1f0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003c200:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003c210:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c220:·653e·3c63·6f64·653e·0a70·6163·6b61·6765··e><code>.package | |||
| 0003c230:·202d·2d61·6464·3d61·6964·650a·3c2f·636f···--add=aide.</co | |||
| 0003c240:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003c250:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003c260:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003c270:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003c280:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003c290:·646d·3935·3637·2220·7461·6269·6e64·6578··dm9567"·tabindex | |||
| 0003c2a0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003c2b0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003c2c0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003c2d0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003c2e0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003c2f0:·6d65·6469·6174·696f·6e20·5075·7070·6574··mediation·Puppet | |||
| 0003c300:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003c310:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c320:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c330:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c340:·3935·3637·223e·3c74·6162·6c65·2063·6c61··9567"><table·cla | |||
| 0003c350:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003c360:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003c370:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003c380:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003c390:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003c3a0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c3b0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c3c0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003c3d0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c3e0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c3f0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003c400:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c410:·3e3c·636f·6465·3e69·6e63·6c75·6465·2069··><code>include·i | |||
| 0003c420:·6e73·7461·6c6c·5f61·6964·650a·0a63·6c61··nstall_aide..cla | |||
| 0003c430:·7373·2069·6e73·7461·6c6c·5f61·6964·6520··ss·install_aide· | |||
| 0003c440:·7b0a·2020·7061·636b·6167·6520·7b20·2761··{.··package·{·'a | |||
| 0003c450:·6964·6527·3a0a·2020·2020·656e·7375·7265··ide':.····ensure | |||
| 0003c460:·203d·2667·743b·2027·696e·7374·616c·6c65···=>·'installe | |||
| 0003c470:·6427·2c0a·2020·7d0a·7d0a·3c2f·636f·6465··d',.··}.}.</code | |||
| 0003c480:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c490:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c4a0:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c4b0:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003c4c0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003c4d0:·3935·3638·2220·7461·6269·6e64·6578·3d22··9568"·tabindex=" | |||
| 0003c4e0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003c4f0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003c500:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003c510:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003c520:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003c530:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003c | 0003c110:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | ||
| 0003c | 0003c120:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | ||
| 0003c | 0003c130:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | ||
| 0003c | 0003c140:·6c6c·6170·7365·2220·6964·3d22·6964·6d39··llapse"·id="idm9 | ||
| 0003c | 0003c150:·3536·3622·3e3c·7461·626c·6520·636c·6173··566"><table·clas | ||
| 0003c | 0003c160:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | ||
| 0003c | 0003c170:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | ||
| 0003c | 0003c180:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | ||
| 0003c | 0003c190:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | ||
| 0003c | 0003c1a0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | ||
| 0003c | 0003c1b0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003c | 0003c1c0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | ||
| 0003c | 0003c1d0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | ||
| 0003c | 0003c1e0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | ||
| 0003c | 0003c1f0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | ||
| 0003c | 0003c200:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | ||
| 0003c | 0003c210:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | ||
| 0003c220:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003c230:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003c240:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003c250:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003c260:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003c270:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003c280:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003c290:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c2a0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c2b0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c650:·3c63·6f64·653e·2d20·6e61·6d65·3a20·456e··<code>-·name:·En | |||
| 0003c660:·7375·7265·2061·6964·6520·6973·2069·6e73··sure·aide·is·ins | |||
| 0003c670:·7461·6c6c·6564·0a20·2070·6163·6b61·6765··talled.··package | |||
| 0003c680:·3a0a·2020·2020·6e61·6d65·3a20·6169·6465··:.····name:·aide | |||
| 0003c690:·0a20·2020·2073·7461·7465·3a20·7072·6573··.····state:·pres | |||
| 0003c6a0:·656e·740a·2020·7768·656e·3a20·616e·7369··ent.··when:·ansi | |||
| 0003c6b0:·626c·655f·7669·7274·7561·6c69·7a61·7469··ble_virtualizati | |||
| 0003c6c0:·6f6e·5f74·7970·6520·6e6f·7420·696e·205b··on_type·not·in·[ | |||
| Max diff block lines reached; 16737641/16763915 bytes (99.84%) of diff not shown. | |||
| Offset 14352, 16 lines modified | Offset 14352, 16 lines modified | ||
| 000380f0:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 000380f0:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038100:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038100:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00038110:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00038110:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00038120:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00038120:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00038130:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00038130:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00038140:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00038140:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00038150:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038150:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038160:·2020·2861·7320·6f66·2032·3032·3 | 00038160:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00038170:·2d32·3 | 00038170:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038180:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038180:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038190:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038190:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 000381a0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 000381a0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 000381b0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 000381b0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 000381c0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 000381c0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 000381d0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 000381d0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 000381e0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 000381e0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15365, 192 lines modified | Offset 15365, 192 lines modified | ||
| 0003c040:·6765·743d·2223·6964·6d39·3536·3622·2074··get="#idm9566"·t | 0003c040:·6765·743d·2223·6964·6d39·3536·3622·2074··get="#idm9566"·t | ||
| 0003c050:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003c050:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003c060:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003c060:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003c070:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003c070:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003c080:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003c080:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003c090:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003c090:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003c0a0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003c0a0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003c0b0:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003c0b0:·2041·6e61·636f·6e64·6120·736e·6970·7065···Anaconda·snippe | |||
| 0003c0c0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c0d0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c0e0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c0f0:·2220·6964·3d22·6964·6d39·3536·3622·3e3c··"·id="idm9566">< | |||
| 0003c100:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c110:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c120:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c130:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c140:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c150:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003c160:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c170:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c180:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c190:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003c1a0:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003c1b0:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003c1c0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c1d0:·0a70·6163·6b61·6765·202d·2d61·6464·3d61··.package·--add=a | |||
| 0003c1e0:·6964·650a·3c2f·636f·6465·3e3c·2f70·7265··ide.</code></pre | |||
| 0003c1f0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c200:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c210:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c220:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c230:·7267·6574·3d22·2369·646d·3935·3637·2220··rget="#idm9567"· | |||
| 0003c240:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c250:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c260:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c270:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c280:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c290:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003c2a0:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003c2b0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003c2c0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003c2d0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003c2e0:·2069·643d·2269·646d·3935·3637·223e·3c74···id="idm9567"><t | |||
| 0003c2f0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003c300:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003c310:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003c320:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c330:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c340:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003c350:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c360:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003c370:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c380:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c390:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003c3a0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003c3b0:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | |||
| 0003c3c0:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003c3d0:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003c3e0:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003c3f0:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003c400:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003c410:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003c420:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003c430:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c440:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c450:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c460:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c470:·6574·3d22·2369·646d·3935·3638·2220·7461··et="#idm9568"·ta | |||
| 0003c480:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c490:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c4a0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c4b0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c4c0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c4d0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003c4e0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003c | 0003c0c0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | ||
| 0003c | 0003c0d0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | ||
| 0003c | 0003c0e0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | ||
| 0003c | 0003c0f0:·6964·3d22·6964·6d39·3536·3622·3e3c·7461··id="idm9566"><ta | ||
| 0003c | 0003c100:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | ||
| 0003c | 0003c110:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | ||
| 0003c | 0003c120:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | ||
| 0003c | 0003c130:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | ||
| 0003c | 0003c140:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | ||
| 0003c | 0003c150:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | ||
| 0003c | 0003c160:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003c | 0003c170:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | ||
| 0003c | 0003c180:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003c | 0003c190:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | ||
| 0003c | 0003c1a0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | ||
| 0003c | 0003c1b0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | ||
| 0003c | 0003c1c0:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | ||
| 0003c1d0:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003c1e0:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003c1f0:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003c200:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003c210:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003c220:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003c230:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c240:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c250:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c260:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c270:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003c280:·743d·2223·6964·6d39·3536·3722·2074·6162··t="#idm9567"·tab | |||
| 0003c290:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003c2a0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003c2b0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003c2c0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003c2d0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| Max diff block lines reached; 6307848/6334260 bytes (99.58%) of diff not shown. | |||
| Offset 45, 15 lines modified | Offset 45, 15 lines modified | ||
| 45 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 45 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 46 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 46 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7 | 49 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 50 | *****·Revision·History·***** | 50 | *****·Revision·History·***** |
| 51 | Current·version:·0.1.65 | 51 | Current·version:·0.1.65 |
| 52 | ····*·draft·(as·of·202 | 52 | ····*·draft·(as·of·2025-02-23) |
| 53 | *****·Table·of·Contents·***** | 53 | *****·Table·of·Contents·***** |
| 54 | ···1.·System_Settings | 54 | ···1.·System_Settings |
| 55 | ·········1.·Installing_and_Maintaining_Software | 55 | ·········1.·Installing_and_Maintaining_Software |
| 56 | ·········2.·Account_and_Access_Control | 56 | ·········2.·Account_and_Access_Control |
| 57 | ·········3.·GRUB2_bootloader_configuration | 57 | ·········3.·GRUB2_bootloader_configuration |
| 58 | ·········4.·Configure_Syslog | 58 | ·········4.·Configure_Syslog |
| 59 | ·········5.·Network_Configuration_and_Firewalls | 59 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 95, 31 lines modified | Offset 95, 39 lines modified | ||
| 95 | The·aide·package·can·be·installed·with·the·following·command: | 95 | The·aide·package·can·be·installed·with·the·following·command: |
| 96 | $·sudo·yum·install·aide | 96 | $·sudo·yum·install·aide |
| 97 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 97 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 98 | Severity: ················medium | 98 | Severity: ················medium |
| 99 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 99 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 100 | Identifiers·and·References·Identifiers: ·CCE-27096-7 | 100 | Identifiers·and·References·Identifiers: ·CCE-27096-7 |
| 101 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule | 101 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule |
| 102 | Remediation_Anaconda_snippet_⇲ | ||
| 103 | Complexity:·low | ||
| 104 | Disruption:·low | ||
| 105 | Strategy:···enable | ||
| 106 | package·--add=aide | ||
| 107 | Remediation_Puppet_snippet_⇲ | 102 | Remediation_Puppet_snippet_⇲ |
| 108 | Complexity:·low | 103 | Complexity:·low |
| 109 | Disruption:·low | 104 | Disruption:·low |
| 110 | Strategy:···enable | 105 | Strategy:···enable |
| 111 | include·install_aide | 106 | include·install_aide |
| 112 | class·install_aide·{ | 107 | class·install_aide·{ |
| 113 | ··package·{·'aide': | 108 | ··package·{·'aide': |
| 114 | ····ensure·=>·'installed', | 109 | ····ensure·=>·'installed', |
| 115 | ··} | 110 | ··} |
| 116 | } | 111 | } |
| 112 | Remediation_Shell_script_⇲ | ||
| 113 | Complexity:·low | ||
| 114 | Disruption:·low | ||
| 115 | Strategy:···enable | ||
| 116 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 117 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 118 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 119 | ····yum·install·-y·"aide" | ||
| 120 | fi | ||
| 121 | else | ||
| 122 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 123 | fi | ||
| 117 | Remediation_Ansible_snippet_⇲ | 124 | Remediation_Ansible_snippet_⇲ |
| 118 | Complexity:·low | 125 | Complexity:·low |
| 119 | Disruption:·low | 126 | Disruption:·low |
| 120 | Strategy:···enable | 127 | Strategy:···enable |
| 121 | -·name:·Ensure·aide·is·installed | 128 | -·name:·Ensure·aide·is·installed |
| 122 | ··package: | 129 | ··package: |
| 123 | ····name:·aide | 130 | ····name:·aide |
| Offset 138, 41 lines modified | Offset 146, 47 lines modified | ||
| 138 | ··-·no_reboot_needed | 146 | ··-·no_reboot_needed |
| 139 | ··-·package_aide_installed | 147 | ··-·package_aide_installed |
| 140 | Remediation_OSBuild_Blueprint_snippet_⇲ | 148 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 141 | [[packages]] | 149 | [[packages]] |
| 142 | name·=·"aide" | 150 | name·=·"aide" |
| 143 | version·=·"*" | 151 | version·=·"*" |
| 144 | Remediation_ | 152 | Remediation_Anaconda_snippet_⇲ |
| 145 | Complexity:·low | 153 | Complexity:·low |
| 146 | Disruption:·low | 154 | Disruption:·low |
| 147 | Strategy:···enable | 155 | Strategy:···enable |
| 148 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 149 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 156 | package·--add=aide | ||
| 150 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 151 | ····yum·install·-y·"aide" | ||
| 152 | fi | ||
| 153 | else | ||
| 154 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 155 | fi | ||
| 156 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 157 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 157 | Run·the·following·command·to·generate·a·new·database: | 158 | Run·the·following·command·to·generate·a·new·database: |
| 158 | $·sudo·/usr/sbin/aide·--init | 159 | $·sudo·/usr/sbin/aide·--init |
| 159 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 160 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 160 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 161 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 161 | To·initiate·a·manual·check,·run·the·following·command: | 162 | To·initiate·a·manual·check,·run·the·following·command: |
| 162 | $·sudo·/usr/sbin/aide·--check | 163 | $·sudo·/usr/sbin/aide·--check |
| 163 | If·this·check·produces·any·unexpected·output,·investigate. | 164 | If·this·check·produces·any·unexpected·output,·investigate. |
| 164 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 165 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 165 | Severity: ················medium | 166 | Severity: ················medium |
| 166 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 167 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 167 | Identifiers·and·References·Identifiers: ·CCE-27220-3 | 168 | Identifiers·and·References·Identifiers: ·CCE-27220-3 |
| 168 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 169 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 170 | Remediation_Shell_script_⇲ | ||
| 171 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 172 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 173 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 174 | ····yum·install·-y·"aide" | ||
| 175 | fi | ||
| 176 | /usr/sbin/aide·--init | ||
| 177 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 178 | else | ||
| 179 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 180 | fi | ||
| 169 | Remediation_Ansible_snippet_⇲ | 181 | Remediation_Ansible_snippet_⇲ |
| 170 | Complexity:·low | 182 | Complexity:·low |
| 171 | Disruption:·low | 183 | Disruption:·low |
| 172 | Strategy:···restrict | 184 | Strategy:···restrict |
| 173 | -·name:·Ensure·AIDE·is·installed | 185 | -·name:·Ensure·AIDE·is·installed |
| 174 | ··package: | 186 | ··package: |
| 175 | ····name:·'{{·item·}}' | 187 | ····name:·'{{·item·}}' |
| Offset 241, 28 lines modified | Offset 255, 14 lines modified | ||
| 241 | ··-·PCI-DSS-Req-11.5 | 255 | ··-·PCI-DSS-Req-11.5 |
| 242 | ··-·aide_build_database | 256 | ··-·aide_build_database |
| 243 | ··-·low_complexity | 257 | ··-·low_complexity |
| 244 | ··-·low_disruption | 258 | ··-·low_disruption |
| 245 | ··-·medium_severity | 259 | ··-·medium_severity |
| 246 | ··-·no_reboot_needed | 260 | ··-·no_reboot_needed |
| 247 | ··-·restrict_strategy | 261 | ··-·restrict_strategy |
| 248 | Remediation_Shell_script_⇲ | ||
| Max diff block lines reached; 912179/918149 bytes (99.35%) of diff not shown. | |||
| Offset 14354, 15 lines modified | Offset 14354, 15 lines modified | ||
| 00038110:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038110:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038120:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038120:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038130:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038130:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038140:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038140:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038150:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038150:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038160:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038160:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038170:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038170:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038180:·3 | 00038180:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038190:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038190:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 000381a0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 000381a0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 000381b0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 000381b0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 000381c0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 000381c0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 000381d0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 000381d0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 000381e0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 000381e0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 000381f0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 000381f0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15356, 192 lines modified | Offset 15356, 192 lines modified | ||
| 0003bfb0:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | 0003bfb0:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | ||
| 0003bfc0:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | 0003bfc0:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | ||
| 0003bfd0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003bfd0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003bfe0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003bfe0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bff0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bff0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003c000:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003c000:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003c010:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003c010:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003c020:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003c020:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003c030:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c040:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c050:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c060:·6170·7365·2220·6964·3d22·6964·6d39·3536··apse"·id="idm956 | |||
| 0003c070:·3622·3e3c·7461·626c·6520·636c·6173·733d··6"><table·class= | |||
| 0003c080:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003c090:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003c0a0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003c0b0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003c0c0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003c0d0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003c0e0:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003c0f0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c100:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003c110:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003c120:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003c130:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003c140:·6f64·653e·0a70·6163·6b61·6765·202d·2d61··ode>.package·--a | |||
| 0003c150:·6464·3d61·6964·650a·3c2f·636f·6465·3e3c··dd=aide.</code>< | |||
| 0003c160:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c170:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c180:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c190:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c1a0:·612d·7461·7267·6574·3d22·2369·646d·3935··a-target="#idm95 | |||
| 0003c1b0:·3637·2220·7461·6269·6e64·6578·3d22·3022··67"·tabindex="0" | |||
| 0003c1c0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c1d0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c1e0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c1f0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c200:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c210:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003c220:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c230:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c240:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c250:·7073·6522·2069·643d·2269·646d·3935·3637··pse"·id="idm9567 | |||
| 0003c260:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c270:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c280:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c290:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c2a0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c2b0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c2c0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c2d0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c2e0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c2f0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c300:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c310:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c320:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c330:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003c340:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003c350:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003c360:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003c370:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003c380:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003c390:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003c3a0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c3b0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c3c0:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c3d0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c3e0:·7461·7267·6574·3d22·2369·646d·3935·3638··target="#idm9568 | |||
| 0003c3f0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c400:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c410:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c420:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c430:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c440:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c450:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003c | 0003c030:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | ||
| 0003c | 0003c040:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | ||
| 0003c | 0003c050:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | ||
| 0003c | 0003c060:·7365·2220·6964·3d22·6964·6d39·3536·3622··se"·id="idm9566" | ||
| 0003c | 0003c070:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | ||
| 0003c | 0003c080:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | ||
| 0003c | 0003c090:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003c | 0003c0a0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003c | 0003c0b0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | ||
| 0003c | 0003c0c0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | ||
| 0003c | 0003c0d0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003c | 0003c0e0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | ||
| 0003c | 0003c0f0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003c | 0003c100:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | ||
| 0003c | 0003c110:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | ||
| 0003c | 0003c120:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003c | 0003c130:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | ||
| 0003c140:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003c150:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003c160:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003c170:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003c180:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003c190:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003c1a0:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003c1b0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c1c0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c570:·653e·2d20·6e61·6d65·3a20·456e·7375·7265··e>-·name:·Ensure | |||
| 0003c580:·2061·6964·6520·6973·2069·6e73·7461·6c6c···aide·is·install | |||
| 0003c590:·6564·0a20·2070·6163·6b61·6765·3a0a·2020··ed.··package:.·· | |||
| 0003c5a0:·2020·6e61·6d65·3a20·6169·6465·0a20·2020····name:·aide.··· | |||
| 0003c5b0:·2073·7461·7465·3a20·7072·6573·656e·740a···state:·present. | |||
| 0003c5c0:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003c5d0:·7669·7274·7561·6c69·7a61·7469·6f6e·5f74··virtualization_t | |||
| 0003c5e0:·7970·6520·6e6f·7420·696e·205b·2264·6f63··ype·not·in·["doc | |||
| 0003c5f0:·6b65·7222·2c20·226c·7863·222c·2022·6f70··ker",·"lxc",·"op | |||
| Max diff block lines reached; 6148791/6175065 bytes (99.57%) of diff not shown. | |||
| Offset 46, 15 lines modified | Offset 46, 15 lines modified | ||
| 46 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 46 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 49 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:7 | 50 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 51 | *****·Revision·History·***** | 51 | *****·Revision·History·***** |
| 52 | Current·version:·0.1.65 | 52 | Current·version:·0.1.65 |
| 53 | ····*·draft·(as·of·202 | 53 | ····*·draft·(as·of·2025-02-23) |
| 54 | *****·Table·of·Contents·***** | 54 | *****·Table·of·Contents·***** |
| 55 | ···1.·System_Settings | 55 | ···1.·System_Settings |
| 56 | ·········1.·Installing_and_Maintaining_Software | 56 | ·········1.·Installing_and_Maintaining_Software |
| 57 | ·········2.·Account_and_Access_Control | 57 | ·········2.·Account_and_Access_Control |
| 58 | ·········3.·GRUB2_bootloader_configuration | 58 | ·········3.·GRUB2_bootloader_configuration |
| 59 | ·········4.·Configure_Syslog | 59 | ·········4.·Configure_Syslog |
| 60 | ·········5.·Network_Configuration_and_Firewalls | 60 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 94, 31 lines modified | Offset 94, 39 lines modified | ||
| 94 | The·aide·package·can·be·installed·with·the·following·command: | 94 | The·aide·package·can·be·installed·with·the·following·command: |
| 95 | $·sudo·yum·install·aide | 95 | $·sudo·yum·install·aide |
| 96 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 96 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 97 | Severity: ················medium | 97 | Severity: ················medium |
| 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 99 | Identifiers·and·References·Identifiers: ·CCE-27096-7 | 99 | Identifiers·and·References·Identifiers: ·CCE-27096-7 |
| 100 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule | 100 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule |
| 101 | Remediation_Anaconda_snippet_⇲ | ||
| 102 | Complexity:·low | ||
| 103 | Disruption:·low | ||
| 104 | Strategy:···enable | ||
| 105 | package·--add=aide | ||
| 106 | Remediation_Puppet_snippet_⇲ | 101 | Remediation_Puppet_snippet_⇲ |
| 107 | Complexity:·low | 102 | Complexity:·low |
| 108 | Disruption:·low | 103 | Disruption:·low |
| 109 | Strategy:···enable | 104 | Strategy:···enable |
| 110 | include·install_aide | 105 | include·install_aide |
| 111 | class·install_aide·{ | 106 | class·install_aide·{ |
| 112 | ··package·{·'aide': | 107 | ··package·{·'aide': |
| 113 | ····ensure·=>·'installed', | 108 | ····ensure·=>·'installed', |
| 114 | ··} | 109 | ··} |
| 115 | } | 110 | } |
| 111 | Remediation_Shell_script_⇲ | ||
| 112 | Complexity:·low | ||
| 113 | Disruption:·low | ||
| 114 | Strategy:···enable | ||
| 115 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 116 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 117 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 118 | ····yum·install·-y·"aide" | ||
| 119 | fi | ||
| 120 | else | ||
| 121 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 122 | fi | ||
| 116 | Remediation_Ansible_snippet_⇲ | 123 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·low | 124 | Complexity:·low |
| 118 | Disruption:·low | 125 | Disruption:·low |
| 119 | Strategy:···enable | 126 | Strategy:···enable |
| 120 | -·name:·Ensure·aide·is·installed | 127 | -·name:·Ensure·aide·is·installed |
| 121 | ··package: | 128 | ··package: |
| 122 | ····name:·aide | 129 | ····name:·aide |
| Offset 137, 41 lines modified | Offset 145, 47 lines modified | ||
| 137 | ··-·no_reboot_needed | 145 | ··-·no_reboot_needed |
| 138 | ··-·package_aide_installed | 146 | ··-·package_aide_installed |
| 139 | Remediation_OSBuild_Blueprint_snippet_⇲ | 147 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 140 | [[packages]] | 148 | [[packages]] |
| 141 | name·=·"aide" | 149 | name·=·"aide" |
| 142 | version·=·"*" | 150 | version·=·"*" |
| 143 | Remediation_ | 151 | Remediation_Anaconda_snippet_⇲ |
| 144 | Complexity:·low | 152 | Complexity:·low |
| 145 | Disruption:·low | 153 | Disruption:·low |
| 146 | Strategy:···enable | 154 | Strategy:···enable |
| 147 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 148 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 155 | package·--add=aide | ||
| 149 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 150 | ····yum·install·-y·"aide" | ||
| 151 | fi | ||
| 152 | else | ||
| 153 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 154 | fi | ||
| 155 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 156 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 156 | Run·the·following·command·to·generate·a·new·database: | 157 | Run·the·following·command·to·generate·a·new·database: |
| 157 | $·sudo·/usr/sbin/aide·--init | 158 | $·sudo·/usr/sbin/aide·--init |
| 158 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 159 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 159 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 160 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 160 | To·initiate·a·manual·check,·run·the·following·command: | 161 | To·initiate·a·manual·check,·run·the·following·command: |
| 161 | $·sudo·/usr/sbin/aide·--check | 162 | $·sudo·/usr/sbin/aide·--check |
| 162 | If·this·check·produces·any·unexpected·output,·investigate. | 163 | If·this·check·produces·any·unexpected·output,·investigate. |
| 163 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 164 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 164 | Severity: ················medium | 165 | Severity: ················medium |
| 165 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 166 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 166 | Identifiers·and·References·Identifiers: ·CCE-27220-3 | 167 | Identifiers·and·References·Identifiers: ·CCE-27220-3 |
| 167 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 168 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 169 | Remediation_Shell_script_⇲ | ||
| 170 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 171 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 172 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 173 | ····yum·install·-y·"aide" | ||
| 174 | fi | ||
| 175 | /usr/sbin/aide·--init | ||
| 176 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 177 | else | ||
| 178 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 179 | fi | ||
| 168 | Remediation_Ansible_snippet_⇲ | 180 | Remediation_Ansible_snippet_⇲ |
| 169 | Complexity:·low | 181 | Complexity:·low |
| 170 | Disruption:·low | 182 | Disruption:·low |
| 171 | Strategy:···restrict | 183 | Strategy:···restrict |
| 172 | -·name:·Ensure·AIDE·is·installed | 184 | -·name:·Ensure·AIDE·is·installed |
| 173 | ··package: | 185 | ··package: |
| 174 | ····name:·'{{·item·}}' | 186 | ····name:·'{{·item·}}' |
| Offset 240, 28 lines modified | Offset 254, 14 lines modified | ||
| 240 | ··-·PCI-DSS-Req-11.5 | 254 | ··-·PCI-DSS-Req-11.5 |
| 241 | ··-·aide_build_database | 255 | ··-·aide_build_database |
| 242 | ··-·low_complexity | 256 | ··-·low_complexity |
| 243 | ··-·low_disruption | 257 | ··-·low_disruption |
| 244 | ··-·medium_severity | 258 | ··-·medium_severity |
| 245 | ··-·no_reboot_needed | 259 | ··-·no_reboot_needed |
| 246 | ··-·restrict_strategy | 260 | ··-·restrict_strategy |
| 247 | Remediation_Shell_script_⇲ | ||
| Max diff block lines reached; 890438/896408 bytes (99.33%) of diff not shown. | |||
| Offset 14354, 15 lines modified | Offset 14354, 15 lines modified | ||
| 00038110:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038110:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038120:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038120:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038130:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038130:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038140:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038140:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038150:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038150:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038160:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038160:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038170:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038170:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038180:·3 | 00038180:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038190:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038190:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 000381a0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 000381a0:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 000381b0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 000381b0:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 000381c0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 000381c0:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 000381d0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 000381d0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 000381e0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 000381e0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 000381f0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 000381f0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15367, 192 lines modified | Offset 15367, 192 lines modified | ||
| 0003c060:·7461·7267·6574·3d22·2369·646d·3935·3636··target="#idm9566 | 0003c060:·7461·7267·6574·3d22·2369·646d·3935·3636··target="#idm9566 | ||
| 0003c070:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003c070:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003c080:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003c080:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003c090:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003c090:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003c0a0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003c0a0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003c0b0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003c0b0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003c0c0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003c0c0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003c0d0:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003c0d0:·696f·6e20·416e·6163·6f6e·6461·2073·6e69··ion·Anaconda·sni | |||
| 0003c0e0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c0f0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c100:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c110:·7073·6522·2069·643d·2269·646d·3935·3636··pse"·id="idm9566 | |||
| 0003c120:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c130:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c140:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c150:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c160:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c170:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c180:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c190:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c1a0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c1b0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c1c0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c1d0:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c1e0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c1f0:·6465·3e0a·7061·636b·6167·6520·2d2d·6164··de>.package·--ad | |||
| 0003c200:·643d·6169·6465·0a3c·2f63·6f64·653e·3c2f··d=aide.</code></ | |||
| 0003c210:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c220:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c230:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c240:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c250:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | |||
| 0003c260:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | |||
| 0003c270:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c280:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c290:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c2a0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c2b0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c2c0:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003c2d0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c2e0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c2f0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c300:·7365·2220·6964·3d22·6964·6d39·3536·3722··se"·id="idm9567" | |||
| 0003c310:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c320:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c330:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c340:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c350:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c360:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c370:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c380:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c390:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c3a0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c3b0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c3c0:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003c3d0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c3e0:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003c3f0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003c400:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003c410:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003c420:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003c430:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003c440:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003c450:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c460:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c470:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c480:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c490:·6172·6765·743d·2223·6964·6d39·3536·3822··arget="#idm9568" | |||
| 0003c4a0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c4b0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c4c0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c4d0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c4e0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c4f0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c500:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003c | 0003c0e0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 0003c | 0003c0f0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 0003c | 0003c100:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 0003c | 0003c110:·6522·2069·643d·2269·646d·3935·3636·223e··e"·id="idm9566"> | ||
| 0003c | 0003c120:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003c | 0003c130:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 0003c | 0003c140:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003c | 0003c150:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003c | 0003c160:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 0003c | 0003c170:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003c | 0003c180:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003c | 0003c190:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003c | 0003c1a0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003c1b0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | ||
| 0003c | 0003c1c0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | ||
| 0003c | 0003c1d0:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | ||
| 0003c | 0003c1e0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | ||
| 0003c1f0:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003c200:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003c210:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003c220:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003c230:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003c240:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003c250:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003c260:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c270:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c280:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c290:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c2a0:·7267·6574·3d22·2369·646d·3935·3637·2220··rget="#idm9567"· | |||
| 0003c2b0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c2c0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c2d0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c2e0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c2f0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c300:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| Max diff block lines reached; 16693423/16719697 bytes (99.84%) of diff not shown. | |||
| Offset 14346, 15 lines modified | Offset 14346, 15 lines modified | ||
| 00038090:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00038090:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 000380a0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 000380a0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 000380b0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 000380b0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 000380c0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 000380c0:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 000380d0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 000380d0:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 000380e0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 000380e0:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 000380f0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 000380f0:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038100:·6173·206f·6620·3230·323 | 00038100:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00038110:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00038110:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00038120:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00038120:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00038130:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00038130:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00038140:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00038140:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00038150:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00038150:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00038160:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00038160:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038170:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038170:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15306, 340 lines modified | Offset 15306, 340 lines modified | ||
| 0003bc90:·6765·743d·2223·6964·6d39·3230·3122·2074··get="#idm9201"·t | 0003bc90:·6765·743d·2223·6964·6d39·3230·3122·2074··get="#idm9201"·t | ||
| 0003bca0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003bca0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003bcb0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003bcb0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003bcc0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003bcc0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003bcd0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003bcd0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003bce0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003bce0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003bcf0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003bcf0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003bd00:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 0003bd10:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003bd20:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003bd30:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003bd40:·3d22·6964·6d39·3230·3122·3e3c·7072·653e··="idm9201"><pre> | |||
| 0003bd50:·3c63·6f64·653e·0a23·2046·696e·6420·7768··<code>.#·Find·wh | |||
| 0003bd60:·6963·6820·6669·6c65·7320·6861·7665·2069··ich·files·have·i | |||
| 0003bd70:·6e63·6f72·7265·6374·2068·6173·6820·286e··ncorrect·hash·(n | |||
| 0003bd80:·6f74·2069·6e20·2f65·7463·2c20·6265·6361··ot·in·/etc,·beca | |||
| 0003bd90:·7573·6520·6f66·2074·6865·2073·7973·7465··use·of·the·syste | |||
| 0003bda0:·6d20·7265·6c61·7465·6420·636f·6e66·6967··m·related·config | |||
| 0003bdb0:·2066·696c·6573·2920·616e·6420·7468·656e···files)·and·then | |||
| 0003bdc0:·2067·6574·2066·696c·6573·206e·616d·6573···get·files·names | |||
| 0003bdd0:·0a66·696c·6573·5f77·6974·685f·696e·636f··.files_with_inco | |||
| 0003bde0:·7272·6563·745f·6861·7368·3d22·2428·7270··rrect_hash="$(rp | |||
| 0003bdf0:·6d20·2d56·6120·2d2d·6e6f·636f·6e66·6967··m·-Va·--noconfig | |||
| 0003be00:·207c·2067·7265·7020·2d45·2027·5e2e·2e35···|·grep·-E·'^..5 | |||
| 0003be10:·2720·7c20·6177·6b20·277b·7072·696e·7420··'·|·awk·'{print· | |||
| 0003be20:·244e·467d·2720·2922·0a0a·2320·4672·6f6d··$NF}'·)"..#·From | |||
| 0003be30:·2066·696c·6573·206e·616d·6573·2067·6574···files·names·get | |||
| 0003bd00:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003bd10:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bd20:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bd30:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bd40:·2069·643d·2269·646d·3932·3031·223e·3c74···id="idm9201"><t | |||
| 0003bd50:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bd60:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bd70:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bd80:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003bd90:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003bda0:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003bdb0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bdc0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bdd0:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003bde0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003bdf0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003be00:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003be10:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003be20:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003be30:·7420·6661·6374·3a20·5061·636b·6167·6520··t·fact:·Package· | |||
| 0003be40:·6d61·6e61·6765·7220·7265·696e·7374·616c··manager·reinstal | |||
| 0003be50:·6c20·636f·6d6d·616e·6420·2864·6e66·2927··l·command·(dnf)' | |||
| 0003be60:·0a20·2073·6574·5f66·6163·743a·0a20·2020··.··set_fact:.··· | |||
| 0003be | 0003be40:·2070·6163·6b61·6765·206e·616d·6573·2061···package·names·a | ||
| 0003be50:·6e64·2063·6861·6e67·6520·6e65·776c·696e··nd·change·newlin | |||
| 0003be60:·6520·746f·2073·7061·6365·2c20·6265·6361··e·to·space,·beca | |||
| 0003be70:·7573·6520·7270·6d20·7772·6974·6573·2065··use·rpm·writes·e | |||
| 0003be80:·6163·6820·7061·636b·6167·6520·746f·206e··ach·package·to·n | |||
| 0003be90:·6577·206c·696e·650a·7061·636b·6167·6573··ew·line.packages | |||
| 0003bea0:·5f74·6f5f·7265·696e·7374·616c·6c3d·2224··_to_reinstall="$ | |||
| 0003beb0:·2872·706d·202d·7166·2024·6669·6c65·735f··(rpm·-qf·$files_ | |||
| 0003be80:·5f72·6569·6e73·7461·6c6c·5f63·6d64·3a20··_reinstall_cmd:· | |||
| 0003be90:·646e·6620·7265·696e·7374·616c·6c20·2d79··dnf·reinstall·-y | |||
| 0003bea0:·0a20·2077·6865·6e3a·2061·6e73·6962·6c65··.··when:·ansible | |||
| 0003beb0:·5f64·6973·7472·6962·7574·696f·6e20·3d3d··_distribution·== | |||
| 0003bec0:·2022·4665·646f·7261·220a·2020·7461·6773···"Fedora".··tags | |||
| 0003bed0:·3a0a·2020·2d20·4343·452d·3237·3135·372d··:.··-·CCE-27157- | |||
| 0003bee0:·370a·2020·2d20·434a·4953·2d35·2e31·302e··7.··-·CJIS-5.10. | |||
| 0003bef0:·342e·310a·2020·2d20·4449·5341·2d53·5449··4.1.··-·DISA-STI | |||
| 0003bf00:·472d·5248·454c·2d30·372d·3031·3030·3230··G-RHEL-07-010020 | |||
| 0003bf10:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | |||
| 0003bf20:·312d·332e·332e·380a·2020·2d20·4e49·5354··1-3.3.8.··-·NIST | |||
| 0003bf30:·2d38·3030·2d31·3731·2d33·2e34·2e31·0a20··-800-171-3.4.1.· | |||
| 0003bf40:·202d·204e·4953·542d·3830·302d·3533·2d41···-·NIST-800-53-A | |||
| 0003bf50:·552d·3928·3329·0a20·202d·204e·4953·542d··U-9(3).··-·NIST- | |||
| 0003bf60:·3830·302d·3533·2d43·4d2d·3628·6329·0a20··800-53-CM-6(c).· | |||
| 0003bf70:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003bf80:·4d2d·3628·6429·0a20·202d·204e·4953·542d··M-6(d).··-·NIST- | |||
| 0003bf90:·3830·302d·3533·2d53·492d·370a·2020·2d20··800-53-SI-7.··-· | |||
| 0003bfa0:·4e49·5354·2d38·3030·2d35·332d·5349·2d37··NIST-800-53-SI-7 | |||
| 0003bfb0:·2831·290a·2020·2d20·4e49·5354·2d38·3030··(1).··-·NIST-800 | |||
| 0003bfc0:·2d35·332d·5349·2d37·2836·290a·2020·2d20··-53-SI-7(6).··-· | |||
| 0003bfd0:·5043·492d·4453·532d·5265·712d·3131·2e35··PCI-DSS-Req-11.5 | |||
| 0003bfe0:·0a20·202d·2068·6967·685f·636f·6d70·6c65··.··-·high_comple | |||
| 0003bff0:·7869·7479·0a20·202d·2068·6967·685f·7365··xity.··-·high_se | |||
| 0003c000:·7665·7269·7479·0a20·202d·206d·6564·6975··verity.··-·mediu | |||
| 0003c010:·6d5f·6469·7372·7570·7469·6f6e·0a20·202d··m_disruption.··- | |||
| 0003c020:·206e·6f5f·7265·626f·6f74·5f6e·6565·6465···no_reboot_neede | |||
| 0003c030:·640a·2020·2d20·7265·7374·7269·6374·5f73··d.··-·restrict_s | |||
| 0003c040:·7472·6174·6567·790a·2020·2d20·7270·6d5f··trategy.··-·rpm_ | |||
| 0003c050:·7665·7269·6679·5f68·6173·6865·730a·0a2d··verify_hashes..- | |||
| 0003c060:·206e·616d·653a·2027·5365·7420·6661·6374···name:·'Set·fact | |||
| 0003c070:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003c080:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003c090:·616e·6420·2879·756d·2927·0a20·2073·6574··and·(yum)'.··set | |||
| 0003c0a0:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003c0b0:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003c0c0:·7461·6c6c·5f63·6d64·3a20·7975·6d20·7265··tall_cmd:·yum·re | |||
| 0003c0d0:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003c0e0:·6e3a·2028·616e·7369·626c·655f·6469·7374··n:·(ansible_dist | |||
| 0003c0f0:·7269·6275·7469·6f6e·203d·3d20·2252·6564··ribution·==·"Red | |||
| 0003c100:·4861·7422·206f·7220·616e·7369·626c·655f··Hat"·or·ansible_ | |||
| 0003c110:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003c120:·2243·656e·744f·5322·206f·7220·616e·7369··"CentOS"·or·ansi | |||
| 0003c130:·626c·655f·6469·7374·7269·6275·7469·6f6e··ble_distribution | |||
| 0003c140:·0a20·2020·203d·3d20·224f·7261·636c·654c··.····==·"OracleL | |||
| 0003c150:·696e·7578·2229·0a20·2074·6167·733a·0a20··inux").··tags:.· | |||
| 0003c160:·202d·2043·4345·2d32·3731·3537·2d37·0a20···-·CCE-27157-7.· | |||
| 0003c170:·202d·2043·4a49·532d·352e·3130·2e34·2e31···-·CJIS-5.10.4.1 | |||
| 0003c180:·0a20·202d·2044·4953·412d·5354·4947·2d52··.··-·DISA-STIG-R | |||
| 0003c190:·4845·4c2d·3037·2d30·3130·3032·300a·2020··HEL-07-010020.·· | |||
| 0003c1a0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c1b0:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c1c0:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| Max diff block lines reached; 8460519/8507217 bytes (99.45%) of diff not shown. | |||
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 44 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 45 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 45 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 46 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 46 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7 | 48 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·System_Settings | 53 | ···1.·System_Settings |
| 54 | ·········1.·Installing_and_Maintaining_Software | 54 | ·········1.·Installing_and_Maintaining_Software |
| 55 | ·········2.·Account_and_Access_Control | 55 | ·········2.·Account_and_Access_Control |
| 56 | ·········3.·System_Accounting_with_auditd | 56 | ·········3.·System_Accounting_with_auditd |
| 57 | ·········4.·GRUB2_bootloader_configuration | 57 | ·········4.·GRUB2_bootloader_configuration |
| 58 | ·········5.·Network_Configuration_and_Firewalls | 58 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 85, 14 lines modified | Offset 85, 24 lines modified | ||
| 85 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 85 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 86 | $·sudo·rpm·-Uvh·PACKAGENAME | 86 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 87 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 87 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 88 | Severity: ················high | 88 | Severity: ················high |
| 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 90 | Identifiers·and·References·Identifiers: ·CCE-27157-7 | 90 | Identifiers·and·References·Identifiers: ·CCE-27157-7 |
| 91 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule | 91 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule |
| 92 | Remediation_Shell_script_⇲ | ||
| 93 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 94 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 95 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 96 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 97 | yum·reinstall·-y·$packages_to_reinstall | ||
| 92 | Remediation_Ansible_snippet_⇲ | 98 | Remediation_Ansible_snippet_⇲ |
| 93 | Complexity:·high | 99 | Complexity:·high |
| 94 | Disruption:·medium | 100 | Disruption:·medium |
| 95 | Strategy:···restrict | 101 | Strategy:···restrict |
| 96 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 102 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 97 | ··set_fact: | 103 | ··set_fact: |
| 98 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 104 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 248, 38 lines modified | Offset 258, 57 lines modified | ||
| 248 | ··-·PCI-DSS-Req-11.5 | 258 | ··-·PCI-DSS-Req-11.5 |
| 249 | ··-·high_complexity | 259 | ··-·high_complexity |
| 250 | ··-·high_severity | 260 | ··-·high_severity |
| 251 | ··-·medium_disruption | 261 | ··-·medium_disruption |
| 252 | ··-·no_reboot_needed | 262 | ··-·no_reboot_needed |
| 253 | ··-·restrict_strategy | 263 | ··-·restrict_strategy |
| 254 | ··-·rpm_verify_hashes | 264 | ··-·rpm_verify_hashes |
| 255 | Remediation_Shell_script_⇲ | ||
| 256 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 257 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 258 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 259 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 260 | yum·reinstall·-y·$packages_to_reinstall | ||
| 261 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 265 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 262 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 266 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 263 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 267 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 264 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 268 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 265 | $·rpm·-qf·FILENAME | 269 | $·rpm·-qf·FILENAME |
| 266 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 270 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 267 | $·sudo·rpm·--setperms·PACKAGENAME | 271 | $·sudo·rpm·--setperms·PACKAGENAME |
| 268 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 272 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 269 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 273 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 270 | Severity: ················high | 274 | Severity: ················high |
| 271 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 275 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 272 | Identifiers·and·References·Identifiers: ·CCE-27209-6 | 276 | Identifiers·and·References·Identifiers: ·CCE-27209-6 |
| 273 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 277 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 278 | Remediation_Shell_script_⇲ | ||
| 279 | Complexity:·high | ||
| 280 | Disruption:·medium | ||
| 281 | Strategy:···restrict | ||
| 282 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 283 | declare·-A·SETPERMS_RPM_DICT | ||
| 284 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 285 | #·is·expected·by·the·RPM·database | ||
| 286 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 287 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 288 | do | ||
| 289 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 290 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 291 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 292 | ········do | ||
| 293 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 294 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 295 | ········done | ||
| 296 | done | ||
| 297 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 298 | #·correct·values | ||
| 299 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 300 | do | ||
| 301 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 302 | done | ||
| 274 | Remediation_Ansible_snippet_⇲ | 303 | Remediation_Ansible_snippet_⇲ |
| 275 | Complexity:·high | 304 | Complexity:·high |
| 276 | Disruption:·medium | 305 | Disruption:·medium |
| 277 | Strategy:···restrict | 306 | Strategy:···restrict |
| 278 | -·name:·Read·list·of·files·with·incorrect·permissions | 307 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 279 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 308 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 280 | ····--nocaps·--nolinkto·--nouser·--nogroup | 309 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 359, 70 lines modified | Offset 388, 49 lines modified | ||
| 359 | ··-·PCI-DSS-Req-11.5 | 388 | ··-·PCI-DSS-Req-11.5 |
| 360 | ··-·high_complexity | 389 | ··-·high_complexity |
| 361 | ··-·high_severity | 390 | ··-·high_severity |
| 362 | ··-·medium_disruption | 391 | ··-·medium_disruption |
| 363 | ··-·no_reboot_needed | 392 | ··-·no_reboot_needed |
| 364 | ··-·restrict_strategy | 393 | ··-·restrict_strategy |
| 365 | ··-·rpm_verify_permissions | 394 | ··-·rpm_verify_permissions |
| 366 | Remediation_Shell_script_⇲ | ||
| 367 | Complexity:·high | ||
| 368 | Disruption:·medium | ||
| 369 | Strategy:···restrict | ||
| 370 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 371 | declare·-A·SETPERMS_RPM_DICT | ||
| 372 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 373 | #·is·expected·by·the·RPM·database | ||
| 374 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 920599/929051 bytes (99.09%) of diff not shown. | |||
| Offset 14387, 15 lines modified | Offset 14387, 15 lines modified | ||
| 00038320:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00038320:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00038330:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00038330:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00038340:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00038340:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00038350:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00038350:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00038360:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00038360:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00038370:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00038370:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 00038380:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 00038380:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00038390:·2032·3032·3 | 00038390:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 000383a0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 000383a0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 000383b0:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 000383b0:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 000383c0:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 000383c0:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 000383d0:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 000383d0:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 000383e0:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 000383e0:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 000383f0:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 000383f0:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00038400:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00038400:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 15291, 124 lines modified | Offset 15291, 124 lines modified | ||
| 0003bba0:·7461·7267·6574·3d22·2369·646d·3130·3130··target="#idm1010 | 0003bba0:·7461·7267·6574·3d22·2369·646d·3130·3130··target="#idm1010 | ||
| 0003bbb0:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | 0003bbb0:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | ||
| 0003bbc0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003bbc0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003bbd0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003bbd0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bbe0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bbe0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003bbf0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003bbf0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003bc00:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003bc00:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bc10:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003bc20:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003bc30:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bc40:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bc50:·6170·7365·2220·6964·3d22·6964·6d31·3031··apse"·id="idm101 | |||
| 0003bc60:·3032·223e·3c70·7265·3e3c·636f·6465·3e0a··02"><pre><code>. | |||
| 0003bc70:·7061·636b·6167·6520·2d2d·6164·643d·6472··package·--add=dr | |||
| 0003bc80:·6163·7574·2d66·6970·730a·3c2f·636f·6465··acut-fips.</code | |||
| 0003bc90:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003bca0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003bcb0:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003bcc0:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003bcd0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003bce0:·3130·3130·3322·2074·6162·696e·6465·783d··10103"·tabindex= | |||
| 0003bcf0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bd00:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bd10:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bd20:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bd30:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bd40:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003bd50:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bd60:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bd70:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bd80:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bd90:·3130·3130·3322·3e3c·7461·626c·6520·636c··10103"><table·cl | |||
| 0003bda0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003bdb0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003bdc0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003bdd0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003bde0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003bdf0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003be00:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003be10:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003be20:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003be30:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003be40:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003be50:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003be60:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003be70:·456e·7375·7265·2064·7261·6375·742d·6669··Ensure·dracut-fi | |||
| 0003be80:·7073·2069·7320·696e·7374·616c·6c65·640a··ps·is·installed. | |||
| 0003be90:·2020·7061·636b·6167·653a·0a20·2020·206e····package:.····n | |||
| 0003bea0:·616d·653a·2064·7261·6375·742d·6669·7073··ame:·dracut-fips | |||
| 0003beb0:·0a20·2020·2073·7461·7465·3a20·7072·6573··.····state:·pres | |||
| 0003bec0:·656e·740a·2020·7768·656e·3a0a·2020·2d20··ent.··when:.··-· | |||
| 0003bed0:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003bee0:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003bef0:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003bf00:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003bf10:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003bf20:·6e65·7222·5d0a·2020·2d20·616e·7369·626c··ner"].··-·ansibl | |||
| 0003bf30:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003bf40:·3d20·2752·6564·4861·7427·0a20·2074·6167··=·'RedHat'.··tag | |||
| 0003bf50:·733a·0a20·202d·2043·4345·2d38·3033·3538··s:.··-·CCE-80358 | |||
| 0003bf60:·2d35·0a20·202d·2043·4a49·532d·352e·3130··-5.··-·CJIS-5.10 | |||
| 0003bf70:·2e31·2e32·0a20·202d·204e·4953·542d·3830··.1.2.··-·NIST-80 | |||
| 0003bf80:·302d·3137·312d·332e·3133·2e31·310a·2020··0-171-3.13.11.·· | |||
| 0003bf90:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003bfa0:·2e31·332e·380a·2020·2d20·4e49·5354·2d38··.13.8.··-·NIST-8 | |||
| 0003bfb0:·3030·2d35·332d·434d·2d36·2861·290a·2020··00-53-CM-6(a).·· | |||
| 0003bfc0:·2d20·4e49·5354·2d38·3030·2d35·332d·4941··-·NIST-800-53-IA | |||
| 0003bfd0:·2d37·0a20·202d·204e·4953·542d·3830·302d··-7.··-·NIST-800- | |||
| 0003bfe0:·3533·2d53·432d·3132·0a20·202d·204e·4953··53-SC-12.··-·NIS | |||
| 0003bff0:·542d·3830·302d·3533·2d53·432d·3132·2832··T-800-53-SC-12(2 | |||
| 0003c000:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003c010:·332d·5343·2d31·3228·3329·0a20·202d·204e··3-SC-12(3).··-·N | |||
| 0003c020:·4953·542d·3830·302d·3533·2d53·432d·3133··IST-800-53-SC-13 | |||
| 0003c030:·0a20·202d·2065·6e61·626c·655f·7374·7261··.··-·enable_stra | |||
| 0003c040:·7465·6779·0a20·202d·206c·6f77·5f63·6f6d··tegy.··-·low_com | |||
| 0003c050:·706c·6578·6974·790a·2020·2d20·6c6f·775f··plexity.··-·low_ | |||
| 0003c060:·6469·7372·7570·7469·6f6e·0a20·202d·206d··disruption.··-·m | |||
| 0003c070:·6564·6975·6d5f·7365·7665·7269·7479·0a20··edium_severity.· | |||
| 0003c080:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 0003c090:·6465·640a·2020·2d20·7061·636b·6167·655f··ded.··-·package_ | |||
| 0003c0a0:·6472·6163·7574·2d66·6970·735f·696e·7374··dracut-fips_inst | |||
| 0003c0b0:·616c·6c65·640a·3c2f·636f·6465·3e3c·2f70··alled.</code></p | |||
| 0003c0c0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c0d0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c0e0:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c0f0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c100:·7461·7267·6574·3d22·2369·646d·3130·3130··target="#idm1010 | |||
| 0003c110:·3422·2074·6162·696e·6465·783d·2230·2220··4"·tabindex="0"· | |||
| 0003c120:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c130:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c140:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c150:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c160:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c1 | 0003bc10:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003 | 0003bc20:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 0003 | 0003bc30:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 0003 | 0003bc40:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 0003 | 0003bc50:·2220·6964·3d22·6964·6d31·3031·3032·223e··"·id="idm10102"> | ||
| 0003 | 0003bc60:·3c70·7265·3e3c·636f·6465·3e23·2052·656d··<pre><code>#·Rem | ||
| 0003 | 0003bc70:·6564·6961·7469·6f6e·2069·7320·6170·706c··ediation·is·appl | ||
| 0003 | 0003bc80:·6963·6162·6c65·206f·6e6c·7920·696e·2063··icable·only·in·c | ||
| 0003 | 0003bc90:·6572·7461·696e·2070·6c61·7466·6f72·6d73··ertain·platforms | ||
| 0003 | 0003bca0:·0a69·6620·5b20·2120·2d66·202f·2e64·6f63··.if·[·!·-f·/.doc | ||
| 0003 | 0003bcb0:·6b65·7265·6e76·205d·2026·616d·703b·2661··kerenv·]·&&a | ||
| 0003 | 0003bcc0:·6d70·3b20·5b20·2120·2d66·202f·7275·6e2f··mp;·[·!·-f·/run/ | ||
| 0003 | 0003bcd0:·2e63·6f6e·7461·696e·6572·656e·7620·5d3b··.containerenv·]; | ||
| 0003 | 0003bce0:·2074·6865·6e0a·0a69·6620·2120·7270·6d20···then..if·!·rpm· | ||
| 0003 | 0003bcf0:·2d71·202d·2d71·7569·6574·2022·6472·6163··-q·--quiet·"drac | ||
| 0003 | 0003bd00:·7574·2d66·6970·7322·203b·2074·6865·6e0a··ut-fips"·;·then. | ||
| 0003 | 0003bd10:·2020·2020·7975·6d20·696e·7374·616c·6c20······yum·install· | ||
| 0003 | 0003bd20:·2d79·2022·6472·6163·7574·2d66·6970·7322··-y·"dracut-fips" | ||
| Max diff block lines reached; 5205649/5222539 bytes (99.68%) of diff not shown. | |||
| Offset 54, 15 lines modified | Offset 54, 15 lines modified | ||
| 54 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 54 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 55 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 56 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 57 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:7 | 58 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 59 | *****·Revision·History·***** | 59 | *****·Revision·History·***** |
| 60 | Current·version:·0.1.65 | 60 | Current·version:·0.1.65 |
| 61 | ····*·draft·(as·of·202 | 61 | ····*·draft·(as·of·2025-02-23) |
| 62 | *****·Table·of·Contents·***** | 62 | *****·Table·of·Contents·***** |
| 63 | ···1.·System_Settings | 63 | ···1.·System_Settings |
| 64 | ·········1.·Installing_and_Maintaining_Software | 64 | ·········1.·Installing_and_Maintaining_Software |
| 65 | ·········2.·Account_and_Access_Control | 65 | ·········2.·Account_and_Access_Control |
| 66 | ·········3.·System_Accounting_with_auditd | 66 | ·········3.·System_Accounting_with_auditd |
| 67 | ·········4.·GRUB2_bootloader_configuration | 67 | ·········4.·GRUB2_bootloader_configuration |
| 68 | ·········5.·Network_Configuration_and_Firewalls | 68 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 91, 17 lines modified | Offset 91, 25 lines modified | ||
| 91 | $·sudo·yum·install·dracut-fips | 91 | $·sudo·yum·install·dracut-fips |
| 92 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 92 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 93 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 93 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 94 | Severity: ················medium | 94 | Severity: ················medium |
| 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed | 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed |
| 96 | Identifiers·and·References·Identifiers: ·CCE-80358-5 | 96 | Identifiers·and·References·Identifiers: ·CCE-80358-5 |
| 97 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 97 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 98 | Remediation_ | 98 | Remediation_Shell_script_⇲ |
| 99 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 100 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 99 | 101 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | |
| 102 | ····yum·install·-y·"dracut-fips" | ||
| 103 | fi | ||
| 104 | else | ||
| 105 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 106 | fi | ||
| 100 | Remediation_Ansible_snippet_⇲ | 107 | Remediation_Ansible_snippet_⇲ |
| 101 | Complexity:·low | 108 | Complexity:·low |
| 102 | Disruption:·low | 109 | Disruption:·low |
| 103 | Strategy:···enable | 110 | Strategy:···enable |
| 104 | -·name:·Ensure·dracut-fips·is·installed | 111 | -·name:·Ensure·dracut-fips·is·installed |
| 105 | ··package: | 112 | ··package: |
| 106 | ····name:·dracut-fips | 113 | ····name:·dracut-fips |
| Offset 122, 25 lines modified | Offset 130, 17 lines modified | ||
| 122 | ··-·NIST-800-53-SC-13 | 130 | ··-·NIST-800-53-SC-13 |
| 123 | ··-·enable_strategy | 131 | ··-·enable_strategy |
| 124 | ··-·low_complexity | 132 | ··-·low_complexity |
| 125 | ··-·low_disruption | 133 | ··-·low_disruption |
| 126 | ··-·medium_severity | 134 | ··-·medium_severity |
| 127 | ··-·no_reboot_needed | 135 | ··-·no_reboot_needed |
| 128 | ··-·package_dracut-fips_installed | 136 | ··-·package_dracut-fips_installed |
| 137 | Remediation_Anaconda_snippet_⇲ | ||
| 129 | Remediation_Shell_script_⇲ | ||
| 130 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 131 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 132 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 133 | ····yum·install·-y·"dracut-fips" | ||
| 134 | fi | ||
| 138 | package·--add=dracut-fips | ||
| 135 | else | ||
| 136 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 137 | fi | ||
| 138 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** | 139 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** |
| 139 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: | 140 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: |
| 140 | $·sudo·yum·install·dracut-fips | 141 | $·sudo·yum·install·dracut-fips |
| 141 | dracut·-f | 142 | dracut·-f |
| 142 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: | 143 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: |
| 143 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" | 144 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" |
| 144 | Finally,·rebuild·the·grub.cfg·file·by·using·the | 145 | Finally,·rebuild·the·grub.cfg·file·by·using·the |
| Offset 156, 17 lines modified | Offset 156, 80 lines modified | ||
| 156 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 156 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 157 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 157 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 158 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 158 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 159 | Severity: ················high | 159 | Severity: ················high |
| 160 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode | 160 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode |
| 161 | Identifiers·and·References·Identifiers: ·CCE-80359-3 | 161 | Identifiers·and·References·Identifiers: ·CCE-80359-3 |
| 162 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-07-021350,·SV-204497r863227_rule | 162 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-07-021350,·SV-204497r863227_rule |
| 163 | Remediation_ | 163 | Remediation_Shell_script_⇲ |
| 164 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 165 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·rpm·--quiet·-q·grub2-common;·};·then | ||
| 164 | 166 | #·prelink·not·installed | |
| 167 | if·test·-e·/etc/sysconfig/prelink·-o·-e·/usr/sbin/prelink;·then | ||
| 168 | ····if·grep·-q·^PRELINKING·/etc/sysconfig/prelink | ||
| 169 | ····then | ||
| 170 | ········sed·-i·'s/^PRELINKING[:blank:]*=[:blank:]*[:alpha:]*/PRELINKING=no/'·/etc/sysconfig/prelink | ||
| 171 | ····else | ||
| 172 | ········printf·'\n'·>>·/etc/sysconfig/prelink | ||
| 173 | ········printf·'%s\n'·'#·Set·PRELINKING=no·per·security·requirements'·'PRELINKING=no'·>>·/etc/sysconfig/prelink | ||
| 174 | ····fi | ||
| 175 | ····#·Undo·previous·prelink·changes·to·binaries·if·prelink·is·available. | ||
| 176 | ····if·test·-x·/usr/sbin/prelink;·then | ||
| 177 | ········/usr/sbin/prelink·-ua | ||
| 178 | ····fi | ||
| 179 | fi | ||
| 180 | if·grep·-q·-m1·-o·aes·/proc/cpuinfo;·then | ||
| 181 | » if·!·rpm·-q·--quiet·"dracut-fips-aesni"·;·then | ||
| 182 | ····yum·install·-y·"dracut-fips-aesni" | ||
| 183 | fi | ||
| 184 | fi | ||
| 185 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 186 | ····yum·install·-y·"dracut-fips" | ||
| 187 | fi | ||
| 188 | dracut·-f | ||
| 189 | #·Correct·the·form·of·default·kernel·command·line·in··grub | ||
| 190 | if·grep·-q·'^GRUB_CMDLINE_LINUX=.*fips=.*"'··/etc/default/grub;·then | ||
| 191 | » #·modify·the·GRUB·command-line·if·a·fips=·arg·already·exists | ||
| 192 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)fips=[^[:space:]]*\(.*"\)/\1·fips=1·\2/'··/etc/default/grub | ||
| 193 | else | ||
| 194 | » #·no·existing·fips=arg·is·present,·append·it | ||
| 195 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)"/\1·fips=1"/'··/etc/default/grub | ||
| 196 | fi | ||
| 197 | #·Get·the·UUID·of·the·device·mounted·at·root·(/). | ||
| 198 | ROOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/) | ||
| 199 | #·Get·the·UUID·of·the·device·mounted·at·/boot. | ||
| 200 | BOOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/boot) | ||
| 201 | if·[·"${ROOT_UUID}"·==·"${BOOT_UUID}"·];·then | ||
| 202 | » #·root·UUID·same·as·boot·UUID,·so·do·not·modify·the·GRUB·command-line·or·add·boot·arg·to·kernel·command·line | ||
| 203 | » #·Correct·the·form·of·kernel·command·line·for·each·installed·kernel·in·the·bootloader | ||
| 204 | » /sbin/grubby·--update-kernel=ALL·--args="fips=1" | ||
| Max diff block lines reached; 675036/684599 bytes (98.60%) of diff not shown. | |||
| Offset 14353, 16 lines modified | Offset 14353, 16 lines modified | ||
| 00038100:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00038100:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00038110:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00038110:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00038120:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00038120:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00038130:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00038130:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00038140:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00038140:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00038150:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00038150:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00038160:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038160:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038170:·2020·2020·2028·6173·206f·6620·3230·323 | 00038170:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00038180:·2d30·3 | 00038180:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00038190:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00038190:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 000381a0:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 000381a0:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 000381b0:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 000381b0:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 000381c0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 000381c0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 000381d0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 000381d0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 000381e0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 000381e0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 000381f0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 000381f0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 15336, 340 lines modified | Offset 15336, 340 lines modified | ||
| 0003be70:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003be70:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003be80:·6d39·3230·3122·2074·6162·696e·6465·783d··m9201"·tabindex= | 0003be80:·6d39·3230·3122·2074·6162·696e·6465·783d··m9201"·tabindex= | ||
| 0003be90:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003be90:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003bea0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003bea0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003beb0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003beb0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003bec0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003bec0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003bed0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003bed0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003bee0:·6564·6961·7469·6f6e·20 | 0003bee0:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0003bef0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bf00:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bf10:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bf20:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bf30:·3932·3031·223e·3c74·6162·6c65·2063·6c61··9201"><table·cla | |||
| 0003bf40:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bf50:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bf60:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bf70:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bf80:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bf90:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003bfa0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bfb0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003bfc0:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003bfd0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bfe0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003bff0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c000:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003c010:·616d·653a·2027·5365·7420·6661·6374·3a20··ame:·'Set·fact:· | |||
| 0003c020:·5061·636b·6167·6520·6d61·6e61·6765·7220··Package·manager· | |||
| 0003c030:·7265·696e·7374·616c·6c20·636f·6d6d·616e··reinstall·comman | |||
| 0003c040:·6420·2864·6e66·2927·0a20·2073·6574·5f66··d·(dnf)'.··set_f | |||
| 0003 | 0003bef0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | ||
| 0003bf00:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bf10:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bf20:·6170·7365·2220·6964·3d22·6964·6d39·3230··apse"·id="idm920 | |||
| 0003bf30:·3122·3e3c·7072·653e·3c63·6f64·653e·0a23··1"><pre><code>.# | |||
| 0003bf40:·2046·696e·6420·7768·6963·6820·6669·6c65···Find·which·file | |||
| 0003bf50:·7320·6861·7665·2069·6e63·6f72·7265·6374··s·have·incorrect | |||
| 0003bf60:·2068·6173·6820·286e·6f74·2069·6e20·2f65···hash·(not·in·/e | |||
| 0003bf70:·7463·2c20·6265·6361·7573·6520·6f66·2074··tc,·because·of·t | |||
| 0003bf80:·6865·2073·7973·7465·6d20·7265·6c61·7465··he·system·relate | |||
| 0003bf90:·6420·636f·6e66·6967·2066·696c·6573·2920··d·config·files)· | |||
| 0003bfa0:·616e·6420·7468·656e·2067·6574·2066·696c··and·then·get·fil | |||
| 0003bfb0:·6573·206e·616d·6573·0a66·696c·6573·5f77··es·names.files_w | |||
| 0003bfc0:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003bfd0:·7368·3d22·2428·7270·6d20·2d56·6120·2d2d··sh="$(rpm·-Va·-- | |||
| 0003bfe0:·6e6f·636f·6e66·6967·207c·2067·7265·7020··noconfig·|·grep· | |||
| 0003bff0:·2d45·2027·5e2e·2e35·2720·7c20·6177·6b20··-E·'^..5'·|·awk· | |||
| 0003c000:·277b·7072·696e·7420·244e·467d·2720·2922··'{print·$NF}'·)" | |||
| 0003c010:·0a0a·2320·4672·6f6d·2066·696c·6573·206e··..#·From·files·n | |||
| 0003c020:·616d·6573·2067·6574·2070·6163·6b61·6765··ames·get·package | |||
| 0003c030:·206e·616d·6573·2061·6e64·2063·6861·6e67···names·and·chang | |||
| 0003c040:·6520·6e65·776c·696e·6520·746f·2073·7061··e·newline·to·spa | |||
| 0003c050:·6365·2c20·6265·6361·7573·6520·7270·6d20··ce,·because·rpm· | |||
| 0003c060:·7772·6974·6573·2065·6163·6820·7061·636b··writes·each·pack | |||
| 0003c070:·6167·6520·746f·206e·6577·206c·696e·650a··age·to·new·line. | |||
| 0003c080:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003c090:·7374·616c·6c3d·2224·2872·706d·202d·7166··stall="$(rpm·-qf | |||
| 0003c0a0:·2024·6669·6c65·735f·7769·7468·5f69·6e63···$files_with_inc | |||
| 0003c0b0:·6f72·7265·6374·5f68·6173·6820·7c20·7472··orrect_hash·|·tr | |||
| 0003c0c0:·2027·5c6e·2720·2720·2729·220a·0a0a·7975···'\n'·'·')"...yu | |||
| 0003c0d0:·6d20·7265·696e·7374·616c·6c20·2d79·2024··m·reinstall·-y·$ | |||
| 0003c0e0:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003c0f0:·7374·616c·6c0a·3c2f·636f·6465·3e3c·2f70··stall.</code></p | |||
| 0003c100:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c110:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c120:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c130:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c140:·7461·7267·6574·3d22·2369·646d·3932·3032··target="#idm9202 | |||
| 0003c150:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c160:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c170:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c180:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c190:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c1a0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c1b0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003c1c0:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c1d0:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c1e0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c1f0:·7365·2220·6964·3d22·6964·6d39·3230·3222··se"·id="idm9202" | |||
| 0003c200:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c210:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c220:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c230:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c240:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c250:·6578·6974·793a·3c2f·7468·3e3c·7464·3e68··exity:</th><td>h | |||
| 0003c260:·6967·683c·2f74·643e·3c2f·7472·3e3c·7472··igh</td></tr><tr | |||
| 0003c270:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c280:·3c2f·7468·3e3c·7464·3e6d·6564·6975·6d3c··</th><td>medium< | |||
| 0003c290:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c2a0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c2b0:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 0003c2c0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c2d0:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003c2e0:·2753·6574·2066·6163·743a·2050·6163·6b61··'Set·fact:·Packa | |||
| 0003c | 0003c2f0:·6765·206d·616e·6167·6572·2072·6569·6e73··ge·manager·reins | ||
| 0003c300:·7461·6c6c·2063·6f6d·6d61·6e64·2028·646e··tall·command·(dn | |||
| 0003c310:·6629·270a·2020·7365·745f·6661·6374·3a0a··f)'.··set_fact:. | |||
| 0003c320:·2020·2020·7061·636b·6167·655f·6d61·6e61······package_mana | |||
| 0003c330:·6765·725f·7265·696e·7374·616c·6c5f·636d··ger_reinstall_cm | |||
| 0003c340:·643a·2064·6e66·2072·6569·6e73·7461·6c6c··d:·dnf·reinstall | |||
| 0003c350:·202d·790a·2020·7768·656e·3a20·616e·7369···-y.··when:·ansi | |||
| 0003c070:·6c6c·5f63·6d64·3a20·646e·6620·7265·696e··ll_cmd:·dnf·rein | |||
| 0003c080:·7374·616c·6c20·2d79·0a20·2077·6865·6e3a··stall·-y.··when: | |||
| 0003c090:·2061·6e73·6962·6c65·5f64·6973·7472·6962···ansible_distrib | |||
| 0003c0a0:·7574·696f·6e20·3d3d·2022·4665·646f·7261··ution·==·"Fedora | |||
| 0003c0b0:·220a·2020·7461·6773·3a0a·2020·2d20·4343··".··tags:.··-·CC | |||
| 0003c0c0:·452d·3237·3135·372d·370a·2020·2d20·434a··E-27157-7.··-·CJ | |||
| 0003c0d0:·4953·2d35·2e31·302e·342e·310a·2020·2d20··IS-5.10.4.1.··-· | |||
| 0003c0e0:·4449·5341·2d53·5449·472d·5248·454c·2d30··DISA-STIG-RHEL-0 | |||
| 0003c0f0:·372d·3031·3030·3230·0a20·202d·204e·4953··7-010020.··-·NIS | |||
| Max diff block lines reached; 6089276/6136112 bytes (99.24%) of diff not shown. | |||
| Offset 45, 15 lines modified | Offset 45, 15 lines modified | ||
| 45 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 45 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 46 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 46 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 47 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7 | 49 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 50 | *****·Revision·History·***** | 50 | *****·Revision·History·***** |
| 51 | Current·version:·0.1.65 | 51 | Current·version:·0.1.65 |
| 52 | ····*·draft·(as·of·202 | 52 | ····*·draft·(as·of·2025-02-23) |
| 53 | *****·Table·of·Contents·***** | 53 | *****·Table·of·Contents·***** |
| 54 | ···1.·System_Settings | 54 | ···1.·System_Settings |
| 55 | ·········1.·Installing_and_Maintaining_Software | 55 | ·········1.·Installing_and_Maintaining_Software |
| 56 | ·········2.·Account_and_Access_Control | 56 | ·········2.·Account_and_Access_Control |
| 57 | ·········3.·System_Accounting_with_auditd | 57 | ·········3.·System_Accounting_with_auditd |
| 58 | ·········4.·Configure_Syslog | 58 | ·········4.·Configure_Syslog |
| 59 | ·········5.·Network_Configuration_and_Firewalls | 59 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 91, 14 lines modified | Offset 91, 24 lines modified | ||
| 91 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 91 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 92 | $·sudo·rpm·-Uvh·PACKAGENAME | 92 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 93 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 93 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 94 | Severity: ················high | 94 | Severity: ················high |
| 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 96 | Identifiers·and·References·Identifiers: ·CCE-27157-7 | 96 | Identifiers·and·References·Identifiers: ·CCE-27157-7 |
| 97 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule | 97 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule |
| 98 | Remediation_Shell_script_⇲ | ||
| 99 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 100 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 101 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 102 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 103 | yum·reinstall·-y·$packages_to_reinstall | ||
| 98 | Remediation_Ansible_snippet_⇲ | 104 | Remediation_Ansible_snippet_⇲ |
| 99 | Complexity:·high | 105 | Complexity:·high |
| 100 | Disruption:·medium | 106 | Disruption:·medium |
| 101 | Strategy:···restrict | 107 | Strategy:···restrict |
| 102 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 108 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 103 | ··set_fact: | 109 | ··set_fact: |
| 104 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 110 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 254, 37 lines modified | Offset 264, 52 lines modified | ||
| 254 | ··-·PCI-DSS-Req-11.5 | 264 | ··-·PCI-DSS-Req-11.5 |
| 255 | ··-·high_complexity | 265 | ··-·high_complexity |
| 256 | ··-·high_severity | 266 | ··-·high_severity |
| 257 | ··-·medium_disruption | 267 | ··-·medium_disruption |
| 258 | ··-·no_reboot_needed | 268 | ··-·no_reboot_needed |
| 259 | ··-·restrict_strategy | 269 | ··-·restrict_strategy |
| 260 | ··-·rpm_verify_hashes | 270 | ··-·rpm_verify_hashes |
| 261 | Remediation_Shell_script_⇲ | ||
| 262 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 263 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 264 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 265 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 266 | yum·reinstall·-y·$packages_to_reinstall | ||
| 267 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 271 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 268 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 272 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 269 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 273 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 270 | run·the·following·command·to·determine·which·package·owns·it: | 274 | run·the·following·command·to·determine·which·package·owns·it: |
| 271 | $·rpm·-qf·FILENAME | 275 | $·rpm·-qf·FILENAME |
| 272 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 276 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 273 | $·sudo·rpm·--setugids·PACKAGENAME | 277 | $·sudo·rpm·--setugids·PACKAGENAME |
| 274 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 278 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 275 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 279 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 276 | Severity: ················high | 280 | Severity: ················high |
| 277 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 281 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 278 | Identifiers·and·References·Identifiers: ·CCE-80545-7 | 282 | Identifiers·and·References·Identifiers: ·CCE-80545-7 |
| 279 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 283 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 284 | Remediation_Shell_script_⇲ | ||
| 285 | Complexity:·high | ||
| 286 | Disruption:·medium | ||
| 287 | Strategy:···restrict | ||
| 288 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 289 | declare·-A·SETPERMS_RPM_DICT | ||
| 290 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 291 | #·is·expected·by·the·RPM·database | ||
| 292 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 293 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 294 | do | ||
| 295 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 296 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 297 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 298 | done | ||
| 299 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 300 | #·correct·values | ||
| 301 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 302 | do | ||
| 303 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 304 | done | ||
| 280 | Remediation_Ansible_snippet_⇲ | 305 | Remediation_Ansible_snippet_⇲ |
| 281 | Complexity:·high | 306 | Complexity:·high |
| 282 | Disruption:·medium | 307 | Disruption:·medium |
| 283 | Strategy:···restrict | 308 | Strategy:···restrict |
| 284 | -·name:·Read·list·of·files·with·incorrect·ownership | 309 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 285 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 310 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 286 | ····--nocaps·--nolinkto·--nomode | 311 | ····--nocaps·--nolinkto·--nomode |
| Offset 361, 53 lines modified | Offset 386, 57 lines modified | ||
| 361 | ··-·PCI-DSS-Req-11.5 | 386 | ··-·PCI-DSS-Req-11.5 |
| 362 | ··-·high_complexity | 387 | ··-·high_complexity |
| 363 | ··-·high_severity | 388 | ··-·high_severity |
| 364 | ··-·medium_disruption | 389 | ··-·medium_disruption |
| 365 | ··-·no_reboot_needed | 390 | ··-·no_reboot_needed |
| 366 | ··-·restrict_strategy | 391 | ··-·restrict_strategy |
| 367 | ··-·rpm_verify_ownership | 392 | ··-·rpm_verify_ownership |
| 393 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 394 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 395 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 396 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 397 | $·rpm·-qf·FILENAME | ||
| 398 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 399 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 400 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 401 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 402 | Severity: ················high | ||
| 403 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 404 | Identifiers·and·References·Identifiers: ·CCE-27209-6 | ||
| 405 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | ||
| 368 | Remediation_Shell_script_⇲ | 406 | Remediation_Shell_script_⇲ |
| 369 | Complexity:·high | 407 | Complexity:·high |
| Max diff block lines reached; 710280/719866 bytes (98.67%) of diff not shown. | |||
| Offset 14373, 15 lines modified | Offset 14373, 15 lines modified | ||
| 00038240:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00038240:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00038250:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00038250:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00038260:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00038260:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00038270:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00038270:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00038280:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00038280:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00038290:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00038290:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 000382a0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 000382a0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 000382b0:·7320·6f66·2032·3032·3 | 000382b0:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 000382c0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 000382c0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 000382d0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 000382d0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 000382e0:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 000382e0:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 000382f0:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 000382f0:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00038300:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00038300:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00038310:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00038310:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00038320:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00038320:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15368, 341 lines modified | Offset 15368, 341 lines modified | ||
| 0003c070:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003c070:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003c080:·2223·6964·6d39·3230·3122·2074·6162·696e··"#idm9201"·tabin | 0003c080:·2223·6964·6d39·3230·3122·2074·6162·696e··"#idm9201"·tabin | ||
| 0003c090:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003c090:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c0a0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c0a0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c0b0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c0b0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c0c0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c0c0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c0d0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c0d0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c0e0:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c0e0:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 0003c0f0:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003c100:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c | 0003c0f0:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | ||
| 0003c100:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c110:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c120:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c130:·6d39·3230·3122·3e3c·7072·653e·3c63·6f64··m9201"><pre><cod | |||
| 0003c140:·653e·0a23·2046·696e·6420·7768·6963·6820··e>.#·Find·which· | |||
| 0003c150:·6669·6c65·7320·6861·7665·2069·6e63·6f72··files·have·incor | |||
| 0003c160:·7265·6374·2068·6173·6820·286e·6f74·2069··rect·hash·(not·i | |||
| 0003c170:·6e20·2f65·7463·2c20·6265·6361·7573·6520··n·/etc,·because· | |||
| 0003c180:·6f66·2074·6865·2073·7973·7465·6d20·7265··of·the·system·re | |||
| 0003c190:·6c61·7465·6420·636f·6e66·6967·2066·696c··lated·config·fil | |||
| 0003c1a0:·6573·2920·616e·6420·7468·656e·2067·6574··es)·and·then·get | |||
| 0003c1b0:·2066·696c·6573·206e·616d·6573·0a66·696c···files·names.fil | |||
| 0003c1c0:·6573·5f77·6974·685f·696e·636f·7272·6563··es_with_incorrec | |||
| 0003c1d0:·745f·6861·7368·3d22·2428·7270·6d20·2d56··t_hash="$(rpm·-V | |||
| 0003c1e0:·6120·2d2d·6e6f·636f·6e66·6967·207c·2067··a·--noconfig·|·g | |||
| 0003c1f0:·7265·7020·2d45·2027·5e2e·2e35·2720·7c20··rep·-E·'^..5'·|· | |||
| 0003c200:·6177·6b20·277b·7072·696e·7420·244e·467d··awk·'{print·$NF} | |||
| 0003c210:·2720·2922·0a0a·2320·4672·6f6d·2066·696c··'·)"..#·From·fil | |||
| 0003c220:·6573·206e·616d·6573·2067·6574·2070·6163··es·names·get·pac | |||
| 0003c230:·6b61·6765·206e·616d·6573·2061·6e64·2063··kage·names·and·c | |||
| 0003c240:·6861·6e67·6520·6e65·776c·696e·6520·746f··hange·newline·to | |||
| 0003c250:·2073·7061·6365·2c20·6265·6361·7573·6520···space,·because· | |||
| 0003c260:·7270·6d20·7772·6974·6573·2065·6163·6820··rpm·writes·each· | |||
| 0003c270:·7061·636b·6167·6520·746f·206e·6577·206c··package·to·new·l | |||
| 0003c280:·696e·650a·7061·636b·6167·6573·5f74·6f5f··ine.packages_to_ | |||
| 0003c290:·7265·696e·7374·616c·6c3d·2224·2872·706d··reinstall="$(rpm | |||
| 0003c2a0:·202d·7166·2024·6669·6c65·735f·7769·7468···-qf·$files_with | |||
| 0003c2b0:·5f69·6e63·6f72·7265·6374·5f68·6173·6820··_incorrect_hash· | |||
| 0003c2c0:·7c20·7472·2027·5c6e·2720·2720·2729·220a··|·tr·'\n'·'·')". | |||
| 0003c2d0:·0a0a·7975·6d20·7265·696e·7374·616c·6c20··..yum·reinstall· | |||
| 0003c2e0:·2d79·2024·7061·636b·6167·6573·5f74·6f5f··-y·$packages_to_ | |||
| 0003c2f0:·7265·696e·7374·616c·6c0a·3c2f·636f·6465··reinstall.</code | |||
| 0003c300:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c310:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c320:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c | 0003c330:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | ||
| 0003c130:·2269·646d·3932·3031·223e·3c74·6162·6c65··"idm9201"><table | |||
| 0003c140:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c150:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c160:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c170:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c180:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c190:·2f74·683e·3c74·643e·6869·6768·3c2f·7464··/th><td>high</td | |||
| 0003c1a0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c1b0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c1c0:·643e·6d65·6469·756d·3c2f·7464·3e3c·2f74··d>medium</td></t | |||
| 0003c1d0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c1e0:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003c1f0:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 0003c200:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c210:·3e2d·206e·616d·653a·2027·5365·7420·6661··>-·name:·'Set·fa | |||
| 0003c220:·6374·3a20·5061·636b·6167·6520·6d61·6e61··ct:·Package·mana | |||
| 0003c230:·6765·7220·7265·696e·7374·616c·6c20·636f··ger·reinstall·co | |||
| 0003c240:·6d6d·616e·6420·2864·6e66·2927·0a20·2073··mmand·(dnf)'.··s | |||
| 0003c | 0003c340:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003c350:·3932·3032·2220·7461·6269·6e64·6578·3d22··9202"·tabindex=" | |||
| 0003c360:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003c370:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003c380:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003c390:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003c3a0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003c3b0:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003c3c0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003c3d0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c3e0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c3f0:·6c6c·6170·7365·2220·6964·3d22·6964·6d39··llapse"·id="idm9 | |||
| 0003c400:·3230·3222·3e3c·7461·626c·6520·636c·6173··202"><table·clas | |||
| 0003c410:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c420:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c430:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c440:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c450:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c460:·7464·3e68·6967·683c·2f74·643e·3c2f·7472··td>high</td></tr | |||
| 0003c470:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c480:·696f·6e3a·3c2f·7468·3e3c·7464·3e6d·6564··ion:</th><td>med | |||
| 0003c490:·6975·6d3c·2f74·643e·3c2f·7472·3e3c·7472··ium</td></tr><tr | |||
| 0003c4a0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c4b0:·7468·3e3c·7464·3e72·6573·7472·6963·743c··th><td>restrict< | |||
| 0003c4c0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c4d0:·3e3c·7072·653e·3c63·6f64·653e·2d20·6e61··><pre><code>-·na | |||
| 0003c4e0:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| 0003c | 0003c4f0:·6163·6b61·6765·206d·616e·6167·6572·2072··ackage·manager·r | ||
| 0003c270:·6e73·7461·6c6c·5f63·6d64·3a20·646e·6620··nstall_cmd:·dnf· | |||
| 0003c280:·7265·696e·7374·616c·6c20·2d79·0a20·2077··reinstall·-y.··w | |||
| 0003c290:·6865·6e3a·2061·6e73·6962·6c65·5f64·6973··hen:·ansible_dis | |||
| 0003c2a0:·7472·6962·7574·696f·6e20·3d3d·2022·4665··tribution·==·"Fe | |||
| 0003c2b0:·646f·7261·220a·2020·7461·6773·3a0a·2020··dora".··tags:.·· | |||
| 0003c2c0:·2d20·4343·452d·3237·3135·372d·370a·2020··-·CCE-27157-7.·· | |||
| 0003c2d0:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| 0003c2e0:·2020·2d20·4449·5341·2d53·5449·472d·5248····-·DISA-STIG-RH | |||
| 0003c2f0:·454c·2d30·372d·3031·3030·3230·0a20·202d··EL-07-010020.··- | |||
| 0003c300:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003c310:·332e·380a·2020·2d20·4e49·5354·2d38·3030··3.8.··-·NIST-800 | |||
| 0003c320:·2d31·3731·2d33·2e34·2e31·0a20·202d·204e··-171-3.4.1.··-·N | |||
| 0003c330:·4953·542d·3830·302d·3533·2d41·552d·3928··IST-800-53-AU-9( | |||
| 0003c340:·3329·0a20·202d·204e·4953·542d·3830·302d··3).··-·NIST-800- | |||
| 0003c350:·3533·2d43·4d2d·3628·6329·0a20·202d·204e··53-CM-6(c).··-·N | |||
| 0003c360:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003c370:·6429·0a20·202d·204e·4953·542d·3830·302d··d).··-·NIST-800- | |||
| 0003c380:·3533·2d53·492d·370a·2020·2d20·4e49·5354··53-SI-7.··-·NIST | |||
| Max diff block lines reached; 16118537/16165373 bytes (99.71%) of diff not shown. | |||
| Offset 14425, 16 lines modified | Offset 14425, 16 lines modified | ||
| 00038580:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038580:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038590:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038590:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 000385a0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 000385a0:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 000385b0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 000385b0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 000385c0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 000385c0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 000385d0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 000385d0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 000385e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000385e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000385f0:·2020·2861·7320·6f66·2032·3032·3 | 000385f0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00038600:·2d32·3 | 00038600:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038610:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038610:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038620:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038620:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00038630:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00038630:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00038640:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00038640:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00038650:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00038650:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00038660:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00038660:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00038670:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00038670:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15436, 341 lines modified | Offset 15436, 341 lines modified | ||
| 0003c4b0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003c4b0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003c4c0:·2369·646d·3932·3031·2220·7461·6269·6e64··#idm9201"·tabind | 0003c4c0:·2369·646d·3932·3031·2220·7461·6269·6e64··#idm9201"·tabind | ||
| 0003c4d0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003c4d0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003c4e0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003c4e0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003c4f0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003c4f0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003c500:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003c500:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003c510:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003c510:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003c520:·5265·6d65·6469·6174·696f·6e20· | 0003c520:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003c530:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003c540:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003c5 | 0003c530:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | ||
| 0003c540:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c550:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c560:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c570:·3932·3031·223e·3c70·7265·3e3c·636f·6465··9201"><pre><code | |||
| 0003c580:·3e0a·2320·4669·6e64·2077·6869·6368·2066··>.#·Find·which·f | |||
| 0003c590:·696c·6573·2068·6176·6520·696e·636f·7272··iles·have·incorr | |||
| 0003c5a0:·6563·7420·6861·7368·2028·6e6f·7420·696e··ect·hash·(not·in | |||
| 0003c5b0:·202f·6574·632c·2062·6563·6175·7365·206f···/etc,·because·o | |||
| 0003c5c0:·6620·7468·6520·7379·7374·656d·2072·656c··f·the·system·rel | |||
| 0003c5d0:·6174·6564·2063·6f6e·6669·6720·6669·6c65··ated·config·file | |||
| 0003c5e0:·7329·2061·6e64·2074·6865·6e20·6765·7420··s)·and·then·get· | |||
| 0003c5f0:·6669·6c65·7320·6e61·6d65·730a·6669·6c65··files·names.file | |||
| 0003c600:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003c610:·5f68·6173·683d·2224·2872·706d·202d·5661··_hash="$(rpm·-Va | |||
| 0003c620:·202d·2d6e·6f63·6f6e·6669·6720·7c20·6772···--noconfig·|·gr | |||
| 0003c630:·6570·202d·4520·275e·2e2e·3527·207c·2061··ep·-E·'^..5'·|·a | |||
| 0003c640:·776b·2027·7b70·7269·6e74·2024·4e46·7d27··wk·'{print·$NF}' | |||
| 0003c650:·2029·220a·0a23·2046·726f·6d20·6669·6c65···)"..#·From·file | |||
| 0003c660:·7320·6e61·6d65·7320·6765·7420·7061·636b··s·names·get·pack | |||
| 0003c670:·6167·6520·6e61·6d65·7320·616e·6420·6368··age·names·and·ch | |||
| 0003c680:·616e·6765·206e·6577·6c69·6e65·2074·6f20··ange·newline·to· | |||
| 0003c690:·7370·6163·652c·2062·6563·6175·7365·2072··space,·because·r | |||
| 0003c6a0:·706d·2077·7269·7465·7320·6561·6368·2070··pm·writes·each·p | |||
| 0003c6b0:·6163·6b61·6765·2074·6f20·6e65·7720·6c69··ackage·to·new·li | |||
| 0003c6c0:·6e65·0a70·6163·6b61·6765·735f·746f·5f72··ne.packages_to_r | |||
| 0003c6d0:·6569·6e73·7461·6c6c·3d22·2428·7270·6d20··einstall="$(rpm· | |||
| 0003c6e0:·2d71·6620·2466·696c·6573·5f77·6974·685f··-qf·$files_with_ | |||
| 0003c6f0:·696e·636f·7272·6563·745f·6861·7368·207c··incorrect_hash·| | |||
| 0003c700:·2074·7220·275c·6e27·2027·2027·2922·0a0a···tr·'\n'·'·')".. | |||
| 0003c710:·0a79·756d·2072·6569·6e73·7461·6c6c·202d··.yum·reinstall·- | |||
| 0003c720:·7920·2470·6163·6b61·6765·735f·746f·5f72··y·$packages_to_r | |||
| 0003c730:·6569·6e73·7461·6c6c·0a3c·2f63·6f64·653e··einstall.</code> | |||
| 0003c740:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c750:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c760:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c | 0003c770:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003c570:·6964·6d39·3230·3122·3e3c·7461·626c·6520··idm9201"><table· | |||
| 0003c580:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003c590:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003c5a0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003c5b0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003c5c0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003c5d0:·7468·3e3c·7464·3e68·6967·683c·2f74·643e··th><td>high</td> | |||
| 0003c5e0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003c5f0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003c600:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003c610:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003c620:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003c630:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003c640:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c650:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003c660:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003c670:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003c680:·6d61·6e64·2028·646e·6629·270a·2020·7365··mand·(dnf)'.··se | |||
| 0003c | 0003c780:·7461·2d74·6172·6765·743d·2223·6964·6d39··ta-target="#idm9 | ||
| 0003c790:·3230·3222·2074·6162·696e·6465·783d·2230··202"·tabindex="0 | |||
| 0003c7a0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c7b0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c7c0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c7d0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003c7e0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003c7f0:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003c800:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c810:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c820:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c830:·6c61·7073·6522·2069·643d·2269·646d·3932··lapse"·id="idm92 | |||
| 0003c840:·3032·223e·3c74·6162·6c65·2063·6c61·7373··02"><table·class | |||
| 0003c850:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c860:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c870:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003c880:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c890:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003c8a0:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003c8b0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c8c0:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003c8d0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003c8e0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c8f0:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003c900:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003c910:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003c920:·653a·2027·5365·7420·6661·6374·3a20·5061··e:·'Set·fact:·Pa | |||
| 0003c | 0003c930:·636b·6167·6520·6d61·6e61·6765·7220·7265··ckage·manager·re | ||
| 0003c6b0:·7374·616c·6c5f·636d·643a·2064·6e66·2072··stall_cmd:·dnf·r | |||
| 0003c6c0:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003c6d0:·656e·3a20·616e·7369·626c·655f·6469·7374··en:·ansible_dist | |||
| 0003c6e0:·7269·6275·7469·6f6e·203d·3d20·2246·6564··ribution·==·"Fed | |||
| 0003c6f0:·6f72·6122·0a20·2074·6167·733a·0a20·202d··ora".··tags:.··- | |||
| 0003c700:·2043·4345·2d32·3731·3537·2d37·0a20·202d···CCE-27157-7.··- | |||
| 0003c710:·2043·4a49·532d·352e·3130·2e34·2e31·0a20···CJIS-5.10.4.1.· | |||
| 0003c720:·202d·2044·4953·412d·5354·4947·2d52·4845···-·DISA-STIG-RHE | |||
| 0003c730:·4c2d·3037·2d30·3130·3032·300a·2020·2d20··L-07-010020.··-· | |||
| 0003c740:·4e49·5354·2d38·3030·2d31·3731·2d33·2e33··NIST-800-171-3.3 | |||
| 0003c750:·2e38·0a20·202d·204e·4953·542d·3830·302d··.8.··-·NIST-800- | |||
| 0003c760:·3137·312d·332e·342e·310a·2020·2d20·4e49··171-3.4.1.··-·NI | |||
| 0003c770:·5354·2d38·3030·2d35·332d·4155·2d39·2833··ST-800-53-AU-9(3 | |||
| 0003c780:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003c790:·332d·434d·2d36·2863·290a·2020·2d20·4e49··3-CM-6(c).··-·NI | |||
| 0003c7a0:·5354·2d38·3030·2d35·332d·434d·2d36·2864··ST-800-53-CM-6(d | |||
| 0003c7b0:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| Max diff block lines reached; 25170464/25217438 bytes (99.81%) of diff not shown. | |||
| Offset 14362, 15 lines modified | Offset 14362, 15 lines modified | ||
| 00038190:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00038190:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 000381a0:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 000381a0:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 000381b0:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 000381b0:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 000381c0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 000381c0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 000381d0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 000381d0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 000381e0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 000381e0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 000381f0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 000381f0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00038200:·2032·3032·3 | 00038200:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 00038210:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 00038210:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 00038220:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 00038220:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 00038230:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 00038230:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 00038240:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 00038240:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00038250:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00038250:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00038260:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00038260:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00038270:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00038270:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 15266, 124 lines modified | Offset 15266, 124 lines modified | ||
| 0003ba10:·7461·7267·6574·3d22·2369·646d·3130·3130··target="#idm1010 | 0003ba10:·7461·7267·6574·3d22·2369·646d·3130·3130··target="#idm1010 | ||
| 0003ba20:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | 0003ba20:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | ||
| 0003ba30:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003ba30:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003ba40:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003ba40:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003ba50:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003ba50:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003ba60:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003ba60:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003ba70:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003ba70:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003ba80:·7469·6f6e·20 | 0003ba80:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003ba90:· | 0003ba90:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 0003baa0:· | 0003baa0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 0003bab0:·6 | 0003bab0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 0003bac0:· | 0003bac0:·2220·6964·3d22·6964·6d31·3031·3032·223e··"·id="idm10102"> | ||
| 0003bad0:·3 | 0003bad0:·3c70·7265·3e3c·636f·6465·3e23·2052·656d··<pre><code>#·Rem | ||
| 0003bae0:·7061·636b·6167·6520·2d2d·6164·643d·6472··package·--add=dr | |||
| 0003baf0:·6163·7574·2d66·6970·730a·3c2f·636f·6465··acut-fips.</code | |||
| 0003bb00:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003bb10:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003bb20:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003bb30:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003bb40:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003bb50:·3130·3130·3322·2074·6162·696e·6465·783d··10103"·tabindex= | |||
| 0003bb60:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bb70:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bb80:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bb90:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bba0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bbb0:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b | 0003bae0:·6564·6961·7469·6f6e·2069·7320·6170·706c··ediation·is·appl | ||
| 0003baf0:·6963·6162·6c65·206f·6e6c·7920·696e·2063··icable·only·in·c | |||
| 0003bb00:·6572·7461·696e·2070·6c61·7466·6f72·6d73··ertain·platforms | |||
| 0003bb10:·0a69·6620·5b20·2120·2d66·202f·2e64·6f63··.if·[·!·-f·/.doc | |||
| 0003bb20:·6b65·7265·6e76·205d·2026·616d·703b·2661··kerenv·]·&&a | |||
| 0003bb30:·6d70·3b20·5b20·2120·2d66·202f·7275·6e2f··mp;·[·!·-f·/run/ | |||
| 0003bb40:·2e63·6f6e·7461·696e·6572·656e·7620·5d3b··.containerenv·]; | |||
| 0003bb50:·2074·6865·6e0a·0a69·6620·2120·7270·6d20···then..if·!·rpm· | |||
| 0003bb60:·2d71·202d·2d71·7569·6574·2022·6472·6163··-q·--quiet·"drac | |||
| 0003bb70:·7574·2d66·6970·7322·203b·2074·6865·6e0a··ut-fips"·;·then. | |||
| 0003bb80:·2020·2020·7975·6d20·696e·7374·616c·6c20······yum·install· | |||
| 0003bb90:·2d79·2022·6472·6163·7574·2d66·6970·7322··-y·"dracut-fips" | |||
| 0003bba0:·0a66·690a·0a65·6c73·650a·2020·2020·2667··.fi..else.····&g | |||
| 0003bbb0:·743b·2661·6d70·3b32·2065·6368·6f20·2752··t;&2·echo·'R | |||
| 0003bbc0:·656d·6564·6961·7469·6f6e·2069·7320·6e6f··emediation·is·no | |||
| 0003bbd0:·7420·6170·706c·6963·6162·6c65·2c20·6e6f··t·applicable,·no | |||
| 0003bbe0:·7468·696e·6720·7761·7320·646f·6e65·270a··thing·was·done'. | |||
| 0003bbf0:·6669·0a3c·2f63·6f64·653e·3c2f·7072·653e··fi.</code></pre> | |||
| 0003b | 0003bc00:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | ||
| 0003bbe0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bbf0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bc00:·3130·3130·3322·3e3c·7461·626c·6520·636c··10103"><table·cl | |||
| 0003bc10:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003bc20:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003bc30:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003bc40:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003bc50:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003bc60:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003bc | 0003bc10:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | ||
| 0003bc20:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003bc30:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003bc40:·6765·743d·2223·6964·6d31·3031·3033·2220··get="#idm10103"· | |||
| 0003bc50:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bc60:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bc70:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bc80:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bc90:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003bca0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003bcb0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bcc0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bcd0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bce0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bcf0:·2220·6964·3d22·6964·6d31·3031·3033·223e··"·id="idm10103"> | |||
| 0003bd00:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003bd10:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003bd20:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003bd30:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003bd40:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003b | 0003bd50:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003b | 0003bd60:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003bca0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bcb0:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003bcc0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003bcd0:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003bce0:·456e·7375·7265·2064·7261·6375·742d·6669··Ensure·dracut-fi | |||
| 0003bcf0:·7073·2069·7320·696e·7374·616c·6c65·640a··ps·is·installed. | |||
| 0003bd00:·2020·7061·636b·6167·653a·0a20·2020·206e····package:.····n | |||
| 0003bd10:·616d·653a·2064·7261·6375·742d·6669·7073··ame:·dracut-fips | |||
| 0003bd20:·0a20·2020·2073·7461·7465·3a20·7072·6573··.····state:·pres | |||
| 0003bd30:·656e·740a·2020·7768·656e·3a0a·2020·2d20··ent.··when:.··-· | |||
| 0003bd40:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003bd50:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003bd60:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003bd70:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003bd80:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003bd90:·6e65·7222·5d0a·2020·2d20·616e·7369·626c··ner"].··-·ansibl | |||
| 0003bda0:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003bdb0:·3d20·2752·6564·4861·7427·0a20·2074·6167··=·'RedHat'.··tag | |||
| 0003bdc0:·733a·0a20·202d·2043·4345·2d38·3033·3538··s:.··-·CCE-80358 | |||
| 0003bdd0:·2d35·0a20·202d·2043·4a49·532d·352e·3130··-5.··-·CJIS-5.10 | |||
| 0003bde0:·2e31·2e32·0a20·202d·204e·4953·542d·3830··.1.2.··-·NIST-80 | |||
| 0003bd | 0003bd70:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003bd80:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bd90:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003bda0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003bdb0:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003bdc0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003bdd0:·3e2d·206e·616d·653a·2045·6e73·7572·6520··>-·name:·Ensure· | |||
| 0003bde0:·6472·6163·7574·2d66·6970·7320·6973·2069··dracut-fips·is·i | |||
| 0003bdf0:·6e73·7461·6c6c·6564·0a20·2070·6163·6b61··nstalled.··packa | |||
| 0003be00:·6765·3a0a·2020·2020·6e61·6d65·3a20·6472··ge:.····name:·dr | |||
| 0003be10:·6163·7574·2d66·6970·730a·2020·2020·7374··acut-fips.····st | |||
| 0003be20:·6174·653a·2070·7265·7365·6e74·0a20·2077··ate:·present.··w | |||
| 0003be30:·6865·6e3a·0a20·202d·2061·6e73·6962·6c65··hen:.··-·ansible | |||
| Max diff block lines reached; 5205649/5222539 bytes (99.68%) of diff not shown. | |||
| Offset 48, 15 lines modified | Offset 48, 15 lines modified | ||
| 48 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 48 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 49 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 50 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 51 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 52 | ····*·cpe:/o:redhat:enterprise_linux:7 | 52 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 53 | *****·Revision·History·***** | 53 | *****·Revision·History·***** |
| 54 | Current·version:·0.1.65 | 54 | Current·version:·0.1.65 |
| 55 | ····*·draft·(as·of·202 | 55 | ····*·draft·(as·of·2025-02-23) |
| 56 | *****·Table·of·Contents·***** | 56 | *****·Table·of·Contents·***** |
| 57 | ···1.·System_Settings | 57 | ···1.·System_Settings |
| 58 | ·········1.·Installing_and_Maintaining_Software | 58 | ·········1.·Installing_and_Maintaining_Software |
| 59 | ·········2.·Account_and_Access_Control | 59 | ·········2.·Account_and_Access_Control |
| 60 | ·········3.·System_Accounting_with_auditd | 60 | ·········3.·System_Accounting_with_auditd |
| 61 | ·········4.·GRUB2_bootloader_configuration | 61 | ·········4.·GRUB2_bootloader_configuration |
| 62 | ·········5.·Network_Configuration_and_Firewalls | 62 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 85, 17 lines modified | Offset 85, 25 lines modified | ||
| 85 | $·sudo·yum·install·dracut-fips | 85 | $·sudo·yum·install·dracut-fips |
| 86 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 86 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 87 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 87 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 88 | Severity: ················medium | 88 | Severity: ················medium |
| 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed | 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_dracut-fips_installed |
| 90 | Identifiers·and·References·Identifiers: ·CCE-80358-5 | 90 | Identifiers·and·References·Identifiers: ·CCE-80358-5 |
| 91 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 91 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.11,·3.13.8,·CCI-000068,·CCI-000803,·CCI-002450,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000396-GPOS-00176,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 92 | Remediation_ | 92 | Remediation_Shell_script_⇲ |
| 93 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 94 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 93 | 95 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | |
| 96 | ····yum·install·-y·"dracut-fips" | ||
| 97 | fi | ||
| 98 | else | ||
| 99 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 100 | fi | ||
| 94 | Remediation_Ansible_snippet_⇲ | 101 | Remediation_Ansible_snippet_⇲ |
| 95 | Complexity:·low | 102 | Complexity:·low |
| 96 | Disruption:·low | 103 | Disruption:·low |
| 97 | Strategy:···enable | 104 | Strategy:···enable |
| 98 | -·name:·Ensure·dracut-fips·is·installed | 105 | -·name:·Ensure·dracut-fips·is·installed |
| 99 | ··package: | 106 | ··package: |
| 100 | ····name:·dracut-fips | 107 | ····name:·dracut-fips |
| Offset 116, 25 lines modified | Offset 124, 17 lines modified | ||
| 116 | ··-·NIST-800-53-SC-13 | 124 | ··-·NIST-800-53-SC-13 |
| 117 | ··-·enable_strategy | 125 | ··-·enable_strategy |
| 118 | ··-·low_complexity | 126 | ··-·low_complexity |
| 119 | ··-·low_disruption | 127 | ··-·low_disruption |
| 120 | ··-·medium_severity | 128 | ··-·medium_severity |
| 121 | ··-·no_reboot_needed | 129 | ··-·no_reboot_needed |
| 122 | ··-·package_dracut-fips_installed | 130 | ··-·package_dracut-fips_installed |
| 131 | Remediation_Anaconda_snippet_⇲ | ||
| 123 | Remediation_Shell_script_⇲ | ||
| 124 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 125 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 126 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 127 | ····yum·install·-y·"dracut-fips" | ||
| 128 | fi | ||
| 132 | package·--add=dracut-fips | ||
| 129 | else | ||
| 130 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 131 | fi | ||
| 132 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** | 133 | ***·Rule ·Enable·FIPS·Mode·in·GRUB2· [ref]·*** |
| 133 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: | 134 | To·ensure·FIPS·mode·is·enabled,·install·package·dracut-fips,·and·rebuild·initramfs·by·running·the·following·commands: |
| 134 | $·sudo·yum·install·dracut-fips | 135 | $·sudo·yum·install·dracut-fips |
| 135 | dracut·-f | 136 | dracut·-f |
| 136 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: | 137 | After·the·dracut·command·has·been·run,·add·the·argument·fips=1·to·the·default·GRUB·2·command·line·for·the·Linux·operating·system·in·/etc/default/grub,·in·the·manner·below: |
| 137 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" | 138 | GRUB_CMDLINE_LINUX="crashkernel=auto·rd.lvm.lv=VolGroup/LogVol06·rd.lvm.lv=VolGroup/lv_swap·rhgb·quiet·rd.shell=0·fips=1" |
| 138 | Finally,·rebuild·the·grub.cfg·file·by·using·the | 139 | Finally,·rebuild·the·grub.cfg·file·by·using·the |
| Offset 150, 17 lines modified | Offset 150, 80 lines modified | ||
| 150 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 150 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 151 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 151 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 152 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 152 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 153 | Severity: ················high | 153 | Severity: ················high |
| 154 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode | 154 | Rule·ID:···················xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode |
| 155 | Identifiers·and·References·Identifiers: ·CCE-80359-3 | 155 | Identifiers·and·References·Identifiers: ·CCE-80359-3 |
| 156 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-07-021350,·SV-204497r863227_rule | 156 | ···························References: ·12,·15,·8,·5.10.1.2,·APO13.01,·DSS01.04,·DSS05.02,·DSS05.03,·3.13.8,·3.13.11,·CCI-000068,·CCI-000803,·CCI-001199,·CCI-002450,·CCI-002476,·4.3.3.6.6,·SR_1.13,·SR_2.6,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.11.2.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·A.6.2.1,·A.6.2.2,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·PR.AC-3,·PR.PT-4,·SRG-OS-000033-GPOS-00014,·SRG-OS-000185-GPOS-00079,·SRG-OS-000396-GPOS-00176,·SRG-OS-000405-GPOS-00184,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-07-021350,·SV-204497r863227_rule |
| 157 | Remediation_ | 157 | Remediation_Shell_script_⇲ |
| 158 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 159 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·]·&&·{·rpm·--quiet·-q·grub2-common;·};·then | ||
| 158 | 160 | #·prelink·not·installed | |
| 161 | if·test·-e·/etc/sysconfig/prelink·-o·-e·/usr/sbin/prelink;·then | ||
| 162 | ····if·grep·-q·^PRELINKING·/etc/sysconfig/prelink | ||
| 163 | ····then | ||
| 164 | ········sed·-i·'s/^PRELINKING[:blank:]*=[:blank:]*[:alpha:]*/PRELINKING=no/'·/etc/sysconfig/prelink | ||
| 165 | ····else | ||
| 166 | ········printf·'\n'·>>·/etc/sysconfig/prelink | ||
| 167 | ········printf·'%s\n'·'#·Set·PRELINKING=no·per·security·requirements'·'PRELINKING=no'·>>·/etc/sysconfig/prelink | ||
| 168 | ····fi | ||
| 169 | ····#·Undo·previous·prelink·changes·to·binaries·if·prelink·is·available. | ||
| 170 | ····if·test·-x·/usr/sbin/prelink;·then | ||
| 171 | ········/usr/sbin/prelink·-ua | ||
| 172 | ····fi | ||
| 173 | fi | ||
| 174 | if·grep·-q·-m1·-o·aes·/proc/cpuinfo;·then | ||
| 175 | » if·!·rpm·-q·--quiet·"dracut-fips-aesni"·;·then | ||
| 176 | ····yum·install·-y·"dracut-fips-aesni" | ||
| 177 | fi | ||
| 178 | fi | ||
| 179 | if·!·rpm·-q·--quiet·"dracut-fips"·;·then | ||
| 180 | ····yum·install·-y·"dracut-fips" | ||
| 181 | fi | ||
| 182 | dracut·-f | ||
| 183 | #·Correct·the·form·of·default·kernel·command·line·in··grub | ||
| 184 | if·grep·-q·'^GRUB_CMDLINE_LINUX=.*fips=.*"'··/etc/default/grub;·then | ||
| 185 | » #·modify·the·GRUB·command-line·if·a·fips=·arg·already·exists | ||
| 186 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)fips=[^[:space:]]*\(.*"\)/\1·fips=1·\2/'··/etc/default/grub | ||
| 187 | else | ||
| 188 | » #·no·existing·fips=arg·is·present,·append·it | ||
| 189 | » sed·-i·'s/\(^GRUB_CMDLINE_LINUX=".*\)"/\1·fips=1"/'··/etc/default/grub | ||
| 190 | fi | ||
| 191 | #·Get·the·UUID·of·the·device·mounted·at·root·(/). | ||
| 192 | ROOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/) | ||
| 193 | #·Get·the·UUID·of·the·device·mounted·at·/boot. | ||
| 194 | BOOT_UUID=$(findmnt·--noheadings·--output·uuid·--target·/boot) | ||
| 195 | if·[·"${ROOT_UUID}"·==·"${BOOT_UUID}"·];·then | ||
| 196 | » #·root·UUID·same·as·boot·UUID,·so·do·not·modify·the·GRUB·command-line·or·add·boot·arg·to·kernel·command·line | ||
| 197 | » #·Correct·the·form·of·kernel·command·line·for·each·installed·kernel·in·the·bootloader | ||
| 198 | » /sbin/grubby·--update-kernel=ALL·--args="fips=1" | ||
| Max diff block lines reached; 675036/684599 bytes (98.60%) of diff not shown. | |||
| Offset 14337, 16 lines modified | Offset 14337, 16 lines modified | ||
| 00038000:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00038000:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00038010:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00038010:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00038020:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00038020:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00038030:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00038030:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00038040:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00038040:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00038050:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00038050:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00038060:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038060:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038070:·2020·2020·2861·7320·6f66·2032·3032·3 | 00038070:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00038080:·303 | 00038080:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00038090:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00038090:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 000380a0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 000380a0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 000380b0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 000380b0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 000380c0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 000380c0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 000380d0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 000380d0:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 000380e0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 000380e0:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 000380f0:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 000380f0:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15307, 341 lines modified | Offset 15307, 341 lines modified | ||
| 0003bca0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003bca0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003bcb0:·2369·646d·3932·3031·2220·7461·6269·6e64··#idm9201"·tabind | 0003bcb0:·2369·646d·3932·3031·2220·7461·6269·6e64··#idm9201"·tabind | ||
| 0003bcc0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003bcc0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003bcd0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003bcd0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003bce0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003bce0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003bcf0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003bcf0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003bd00:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003bd00:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003bd10:·5265·6d65·6469·6174·696f·6e20· | 0003bd10:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003bd20:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003bd30:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bd | 0003bd20:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | ||
| 0003bd30:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bd40:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bd50:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bd60:·3932·3031·223e·3c70·7265·3e3c·636f·6465··9201"><pre><code | |||
| 0003bd70:·3e0a·2320·4669·6e64·2077·6869·6368·2066··>.#·Find·which·f | |||
| 0003bd80:·696c·6573·2068·6176·6520·696e·636f·7272··iles·have·incorr | |||
| 0003bd90:·6563·7420·6861·7368·2028·6e6f·7420·696e··ect·hash·(not·in | |||
| 0003bda0:·202f·6574·632c·2062·6563·6175·7365·206f···/etc,·because·o | |||
| 0003bdb0:·6620·7468·6520·7379·7374·656d·2072·656c··f·the·system·rel | |||
| 0003bdc0:·6174·6564·2063·6f6e·6669·6720·6669·6c65··ated·config·file | |||
| 0003bdd0:·7329·2061·6e64·2074·6865·6e20·6765·7420··s)·and·then·get· | |||
| 0003bde0:·6669·6c65·7320·6e61·6d65·730a·6669·6c65··files·names.file | |||
| 0003bdf0:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003be00:·5f68·6173·683d·2224·2872·706d·202d·5661··_hash="$(rpm·-Va | |||
| 0003be10:·202d·2d6e·6f63·6f6e·6669·6720·7c20·6772···--noconfig·|·gr | |||
| 0003be20:·6570·202d·4520·275e·2e2e·3527·207c·2061··ep·-E·'^..5'·|·a | |||
| 0003be30:·776b·2027·7b70·7269·6e74·2024·4e46·7d27··wk·'{print·$NF}' | |||
| 0003be40:·2029·220a·0a23·2046·726f·6d20·6669·6c65···)"..#·From·file | |||
| 0003be50:·7320·6e61·6d65·7320·6765·7420·7061·636b··s·names·get·pack | |||
| 0003be60:·6167·6520·6e61·6d65·7320·616e·6420·6368··age·names·and·ch | |||
| 0003be70:·616e·6765·206e·6577·6c69·6e65·2074·6f20··ange·newline·to· | |||
| 0003be80:·7370·6163·652c·2062·6563·6175·7365·2072··space,·because·r | |||
| 0003be90:·706d·2077·7269·7465·7320·6561·6368·2070··pm·writes·each·p | |||
| 0003bea0:·6163·6b61·6765·2074·6f20·6e65·7720·6c69··ackage·to·new·li | |||
| 0003beb0:·6e65·0a70·6163·6b61·6765·735f·746f·5f72··ne.packages_to_r | |||
| 0003bec0:·6569·6e73·7461·6c6c·3d22·2428·7270·6d20··einstall="$(rpm· | |||
| 0003bed0:·2d71·6620·2466·696c·6573·5f77·6974·685f··-qf·$files_with_ | |||
| 0003bee0:·696e·636f·7272·6563·745f·6861·7368·207c··incorrect_hash·| | |||
| 0003bef0:·2074·7220·275c·6e27·2027·2027·2922·0a0a···tr·'\n'·'·')".. | |||
| 0003bf00:·0a79·756d·2072·6569·6e73·7461·6c6c·202d··.yum·reinstall·- | |||
| 0003bf10:·7920·2470·6163·6b61·6765·735f·746f·5f72··y·$packages_to_r | |||
| 0003bf20:·6569·6e73·7461·6c6c·0a3c·2f63·6f64·653e··einstall.</code> | |||
| 0003bf30:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003bf40:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003bf50:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003b | 0003bf60:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003bd60:·6964·6d39·3230·3122·3e3c·7461·626c·6520··idm9201"><table· | |||
| 0003bd70:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bd80:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bd90:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bda0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bdb0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bdc0:·7468·3e3c·7464·3e68·6967·683c·2f74·643e··th><td>high</td> | |||
| 0003bdd0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003bde0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003bdf0:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003be00:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003be10:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003be20:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003be30:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003be40:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003be50:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003be60:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003be70:·6d61·6e64·2028·646e·6629·270a·2020·7365··mand·(dnf)'.··se | |||
| 0003b | 0003bf70:·7461·2d74·6172·6765·743d·2223·6964·6d39··ta-target="#idm9 | ||
| 0003bf80:·3230·3222·2074·6162·696e·6465·783d·2230··202"·tabindex="0 | |||
| 0003bf90:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003bfa0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003bfb0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003bfc0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003bfd0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003bfe0:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003bff0:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c000:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c010:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c020:·6c61·7073·6522·2069·643d·2269·646d·3932··lapse"·id="idm92 | |||
| 0003c030:·3032·223e·3c74·6162·6c65·2063·6c61·7373··02"><table·class | |||
| 0003c040:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c050:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c060:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003c070:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c080:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003c090:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003c0a0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c0b0:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003c0c0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003c0d0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c0e0:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003c0f0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003c100:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003c110:·653a·2027·5365·7420·6661·6374·3a20·5061··e:·'Set·fact:·Pa | |||
| 0003 | 0003c120:·636b·6167·6520·6d61·6e61·6765·7220·7265··ckage·manager·re | ||
| 0003bea0:·7374·616c·6c5f·636d·643a·2064·6e66·2072··stall_cmd:·dnf·r | |||
| 0003beb0:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003bec0:·656e·3a20·616e·7369·626c·655f·6469·7374··en:·ansible_dist | |||
| 0003bed0:·7269·6275·7469·6f6e·203d·3d20·2246·6564··ribution·==·"Fed | |||
| 0003bee0:·6f72·6122·0a20·2074·6167·733a·0a20·202d··ora".··tags:.··- | |||
| 0003bef0:·2043·4345·2d32·3731·3537·2d37·0a20·202d···CCE-27157-7.··- | |||
| 0003bf00:·2043·4a49·532d·352e·3130·2e34·2e31·0a20···CJIS-5.10.4.1.· | |||
| 0003bf10:·202d·2044·4953·412d·5354·4947·2d52·4845···-·DISA-STIG-RHE | |||
| 0003bf20:·4c2d·3037·2d30·3130·3032·300a·2020·2d20··L-07-010020.··-· | |||
| 0003bf30:·4e49·5354·2d38·3030·2d31·3731·2d33·2e33··NIST-800-171-3.3 | |||
| 0003bf40:·2e38·0a20·202d·204e·4953·542d·3830·302d··.8.··-·NIST-800- | |||
| 0003bf50:·3137·312d·332e·342e·310a·2020·2d20·4e49··171-3.4.1.··-·NI | |||
| 0003bf60:·5354·2d38·3030·2d35·332d·4155·2d39·2833··ST-800-53-AU-9(3 | |||
| 0003bf70:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003bf80:·332d·434d·2d36·2863·290a·2020·2d20·4e49··3-CM-6(c).··-·NI | |||
| 0003bf90:·5354·2d38·3030·2d35·332d·434d·2d36·2864··ST-800-53-CM-6(d | |||
| 0003bfa0:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| Max diff block lines reached; 8742260/8789234 bytes (99.47%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 41 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 42 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 42 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 43 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 43 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 44 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 44 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 45 | ····*·cpe:/o:redhat:enterprise_linux:7 | 45 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·GRUB2_bootloader_configuration | 54 | ·········4.·GRUB2_bootloader_configuration |
| 55 | ·········5.·Configure_Syslog | 55 | ·········5.·Configure_Syslog |
| Offset 84, 14 lines modified | Offset 84, 24 lines modified | ||
| 84 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 84 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 85 | $·sudo·rpm·-Uvh·PACKAGENAME | 85 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 86 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 86 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 87 | Severity: ················high | 87 | Severity: ················high |
| 88 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 88 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 89 | Identifiers·and·References·Identifiers: ·CCE-27157-7 | 89 | Identifiers·and·References·Identifiers: ·CCE-27157-7 |
| 90 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule | 90 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule |
| 91 | Remediation_Shell_script_⇲ | ||
| 92 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 93 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 94 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 95 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 96 | yum·reinstall·-y·$packages_to_reinstall | ||
| 91 | Remediation_Ansible_snippet_⇲ | 97 | Remediation_Ansible_snippet_⇲ |
| 92 | Complexity:·high | 98 | Complexity:·high |
| 93 | Disruption:·medium | 99 | Disruption:·medium |
| 94 | Strategy:···restrict | 100 | Strategy:···restrict |
| 95 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 101 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 96 | ··set_fact: | 102 | ··set_fact: |
| 97 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 103 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 247, 38 lines modified | Offset 257, 57 lines modified | ||
| 247 | ··-·PCI-DSS-Req-11.5 | 257 | ··-·PCI-DSS-Req-11.5 |
| 248 | ··-·high_complexity | 258 | ··-·high_complexity |
| 249 | ··-·high_severity | 259 | ··-·high_severity |
| 250 | ··-·medium_disruption | 260 | ··-·medium_disruption |
| 251 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 252 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| 253 | ··-·rpm_verify_hashes | 263 | ··-·rpm_verify_hashes |
| 254 | Remediation_Shell_script_⇲ | ||
| 255 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 256 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 257 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 258 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 259 | yum·reinstall·-y·$packages_to_reinstall | ||
| 260 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 264 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 261 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 265 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 262 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 266 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 263 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 267 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 264 | $·rpm·-qf·FILENAME | 268 | $·rpm·-qf·FILENAME |
| 265 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 269 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 266 | $·sudo·rpm·--setperms·PACKAGENAME | 270 | $·sudo·rpm·--setperms·PACKAGENAME |
| 267 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 271 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 268 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 272 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 269 | Severity: ················high | 273 | Severity: ················high |
| 270 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 274 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 271 | Identifiers·and·References·Identifiers: ·CCE-27209-6 | 275 | Identifiers·and·References·Identifiers: ·CCE-27209-6 |
| 272 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 276 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 277 | Remediation_Shell_script_⇲ | ||
| 278 | Complexity:·high | ||
| 279 | Disruption:·medium | ||
| 280 | Strategy:···restrict | ||
| 281 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 282 | declare·-A·SETPERMS_RPM_DICT | ||
| 283 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 284 | #·is·expected·by·the·RPM·database | ||
| 285 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 286 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 287 | do | ||
| 288 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 289 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 290 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 291 | ········do | ||
| 292 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 293 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 294 | ········done | ||
| 295 | done | ||
| 296 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 297 | #·correct·values | ||
| 298 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 299 | do | ||
| 300 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 301 | done | ||
| 273 | Remediation_Ansible_snippet_⇲ | 302 | Remediation_Ansible_snippet_⇲ |
| 274 | Complexity:·high | 303 | Complexity:·high |
| 275 | Disruption:·medium | 304 | Disruption:·medium |
| 276 | Strategy:···restrict | 305 | Strategy:···restrict |
| 277 | -·name:·Read·list·of·files·with·incorrect·permissions | 306 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 278 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 307 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 279 | ····--nocaps·--nolinkto·--nouser·--nogroup | 308 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 358, 70 lines modified | Offset 387, 49 lines modified | ||
| 358 | ··-·PCI-DSS-Req-11.5 | 387 | ··-·PCI-DSS-Req-11.5 |
| 359 | ··-·high_complexity | 388 | ··-·high_complexity |
| 360 | ··-·high_severity | 389 | ··-·high_severity |
| 361 | ··-·medium_disruption | 390 | ··-·medium_disruption |
| 362 | ··-·no_reboot_needed | 391 | ··-·no_reboot_needed |
| 363 | ··-·restrict_strategy | 392 | ··-·restrict_strategy |
| 364 | ··-·rpm_verify_permissions | 393 | ··-·rpm_verify_permissions |
| 365 | Remediation_Shell_script_⇲ | ||
| 366 | Complexity:·high | ||
| 367 | Disruption:·medium | ||
| 368 | Strategy:···restrict | ||
| 369 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 370 | declare·-A·SETPERMS_RPM_DICT | ||
| 371 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 372 | #·is·expected·by·the·RPM·database | ||
| 373 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 868312/876745 bytes (99.04%) of diff not shown. | |||
| Offset 14341, 15 lines modified | Offset 14341, 15 lines modified | ||
| 00038040:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038040:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038050:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038050:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038060:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038060:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00038070:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00038070:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00038080:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00038080:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 00038090:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 00038090:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 000380a0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 000380a0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 000380b0:·6f66·2032·3032·3 | 000380b0:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 000380c0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 000380c0:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 000380d0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 000380d0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 000380e0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 000380e0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 000380f0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 000380f0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038100:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038100:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038110:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038110:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038120:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038120:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15362, 340 lines modified | Offset 15362, 340 lines modified | ||
| 0003c010:·6172·6765·743d·2223·6964·6d39·3230·3122··arget="#idm9201" | 0003c010:·6172·6765·743d·2223·6964·6d39·3230·3122··arget="#idm9201" | ||
| 0003c020:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003c020:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003c030:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003c030:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003c040:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003c040:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003c050:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003c050:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003c060:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003c060:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003c070:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003c070:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003c080:·6f6e·2053·6865·6c6c·2073·6372·6970·7420··on·Shell·script· | |||
| 0003c090:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c0a0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c0b0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c0c0:·6964·3d22·6964·6d39·3230·3122·3e3c·7072··id="idm9201"><pr | |||
| 0003c0d0:·653e·3c63·6f64·653e·0a23·2046·696e·6420··e><code>.#·Find· | |||
| 0003c0e0:·7768·6963·6820·6669·6c65·7320·6861·7665··which·files·have | |||
| 0003c0f0:·2069·6e63·6f72·7265·6374·2068·6173·6820···incorrect·hash· | |||
| 0003c100:·286e·6f74·2069·6e20·2f65·7463·2c20·6265··(not·in·/etc,·be | |||
| 0003c110:·6361·7573·6520·6f66·2074·6865·2073·7973··cause·of·the·sys | |||
| 0003c120:·7465·6d20·7265·6c61·7465·6420·636f·6e66··tem·related·conf | |||
| 0003c130:·6967·2066·696c·6573·2920·616e·6420·7468··ig·files)·and·th | |||
| 0003c140:·656e·2067·6574·2066·696c·6573·206e·616d··en·get·files·nam | |||
| 0003c150:·6573·0a66·696c·6573·5f77·6974·685f·696e··es.files_with_in | |||
| 0003c160:·636f·7272·6563·745f·6861·7368·3d22·2428··correct_hash="$( | |||
| 0003c170:·7270·6d20·2d56·6120·2d2d·6e6f·636f·6e66··rpm·-Va·--noconf | |||
| 0003c180:·6967·207c·2067·7265·7020·2d45·2027·5e2e··ig·|·grep·-E·'^. | |||
| 0003c190:·2e35·2720·7c20·6177·6b20·277b·7072·696e··.5'·|·awk·'{prin | |||
| 0003c1a0:·7420·244e·467d·2720·2922·0a0a·2320·4672··t·$NF}'·)"..#·Fr | |||
| 0003c1b0:·6f6d·2066·696c·6573·206e·616d·6573·2067··om·files·names·g | |||
| 0003c080:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003c090:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c0a0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c0b0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c0c0:·6522·2069·643d·2269·646d·3932·3031·223e··e"·id="idm9201"> | |||
| 0003c0d0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c0e0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c0f0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c100:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c110:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c120:·7869·7479·3a3c·2f74·683e·3c74·643e·6869··xity:</th><td>hi | |||
| 0003c130:·6768·3c2f·7464·3e3c·2f74·723e·3c74·723e··gh</td></tr><tr> | |||
| 0003c140:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c150:·2f74·683e·3c74·643e·6d65·6469·756d·3c2f··/th><td>medium</ | |||
| 0003c160:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c170:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003c180:·643e·7265·7374·7269·6374·3c2f·7464·3e3c··d>restrict</td>< | |||
| 0003c190:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c1a0:·3e3c·636f·6465·3e2d·206e·616d·653a·2027··><code>-·name:·' | |||
| 0003c1b0:·5365·7420·6661·6374·3a20·5061·636b·6167··Set·fact:·Packag | |||
| 0003c1c0:·6520·6d61·6e61·6765·7220·7265·696e·7374··e·manager·reinst | |||
| 0003c1d0:·616c·6c20·636f·6d6d·616e·6420·2864·6e66··all·command·(dnf | |||
| 0003c1e0:·2927·0a20·2073·6574·5f66·6163·743a·0a20··)'.··set_fact:.· | |||
| 0003c1f0:·2020·2070·6163·6b61·6765·5f6d·616e·6167·····package_manag | |||
| 0003c200:·6572·5f72·6569·6e73·7461·6c6c·5f63·6d64··er_reinstall_cmd | |||
| 0003c210:·3a20·646e·6620·7265·696e·7374·616c·6c20··:·dnf·reinstall· | |||
| 0003c220:·2d79·0a20·2077·6865·6e3a·2061·6e73·6962··-y.··when:·ansib | |||
| 0003c230:·6c65·5f64·6973·7472·6962·7574·696f·6e20··le_distribution· | |||
| 0003c240:·3d3d·2022·4665·646f·7261·220a·2020·7461··==·"Fedora".··ta | |||
| 0003c250:·6773·3a0a·2020·2d20·4343·452d·3237·3135··gs:.··-·CCE-2715 | |||
| 0003c260:·372d·370a·2020·2d20·434a·4953·2d35·2e31··7-7.··-·CJIS-5.1 | |||
| 0003c270:·302e·342e·310a·2020·2d20·4449·5341·2d53··0.4.1.··-·DISA-S | |||
| 0003c280:·5449·472d·5248·454c·2d30·372d·3031·3030··TIG-RHEL-07-0100 | |||
| 0003c290:·3230·0a20·202d·204e·4953·542d·3830·302d··20.··-·NIST-800- | |||
| 0003c2a0:·3137·312d·332e·332e·380a·2020·2d20·4e49··171-3.3.8.··-·NI | |||
| 0003c2b0:·5354·2d38·3030·2d31·3731·2d33·2e34·2e31··ST-800-171-3.4.1 | |||
| 0003c2c0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c2d0:·2d41·552d·3928·3329·0a20·202d·204e·4953··-AU-9(3).··-·NIS | |||
| 0003c2e0:·542d·3830·302d·3533·2d43·4d2d·3628·6329··T-800-53-CM-6(c) | |||
| 0003c2f0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c300:·2d43·4d2d·3628·6429·0a20·202d·204e·4953··-CM-6(d).··-·NIS | |||
| 0003c310:·542d·3830·302d·3533·2d53·492d·370a·2020··T-800-53-SI-7.·· | |||
| 0003c320:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003c330:·2d37·2831·290a·2020·2d20·4e49·5354·2d38··-7(1).··-·NIST-8 | |||
| 0003c340:·3030·2d35·332d·5349·2d37·2836·290a·2020··00-53-SI-7(6).·· | |||
| 0003c350:·2d20·5043·492d·4453·532d·5265·712d·3131··-·PCI-DSS-Req-11 | |||
| 0003c360:·2e35·0a20·202d·2068·6967·685f·636f·6d70··.5.··-·high_comp | |||
| 0003c370:·6c65·7869·7479·0a20·202d·2068·6967·685f··lexity.··-·high_ | |||
| 0003c380:·7365·7665·7269·7479·0a20·202d·206d·6564··severity.··-·med | |||
| 0003c390:·6975·6d5f·6469·7372·7570·7469·6f6e·0a20··ium_disruption.· | |||
| 0003c3a0:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 0003c3b0:·6465·640a·2020·2d20·7265·7374·7269·6374··ded.··-·restrict | |||
| 0003c3c0:·5f73·7472·6174·6567·790a·2020·2d20·7270··_strategy.··-·rp | |||
| 0003c3d0:·6d5f·7665·7269·6679·5f68·6173·6865·730a··m_verify_hashes. | |||
| 0003c3e0:·0a2d·206e·616d·653a·2027·5365·7420·6661··.-·name:·'Set·fa | |||
| 0003c3f0:·6374·3a20·5061·636b·6167·6520·6d61·6e61··ct:·Package·mana | |||
| 0003c400:·6765·7220·7265·696e·7374·616c·6c20·636f··ger·reinstall·co | |||
| 0003c410:·6d6d·616e·6420·2879·756d·2927·0a20·2073··mmand·(yum)'.··s | |||
| 0003c420:·6574·5f66·6163·743a·0a20·2020·2070·6163··et_fact:.····pac | |||
| 0003c430:·6b61·6765·5f6d·616e·6167·6572·5f72·6569··kage_manager_rei | |||
| 0003c440:·6e73·7461·6c6c·5f63·6d64·3a20·7975·6d20··nstall_cmd:·yum· | |||
| 0003c450:·7265·696e·7374·616c·6c20·2d79·0a20·2077··reinstall·-y.··w | |||
| 0003c460:·6865·6e3a·2028·616e·7369·626c·655f·6469··hen:·(ansible_di | |||
| 0003c470:·7374·7269·6275·7469·6f6e·203d·3d20·2252··stribution·==·"R | |||
| 0003c480:·6564·4861·7422·206f·7220·616e·7369·626c··edHat"·or·ansibl | |||
| 0003c490:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003c4a0:·3d20·2243·656e·744f·5322·206f·7220·616e··=·"CentOS"·or·an | |||
| 0003c4b0:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003c4c0:·6f6e·0a20·2020·203d·3d20·224f·7261·636c··on.····==·"Oracl | |||
| 0003c4d0:·654c·696e·7578·2229·0a20·2074·6167·733a··eLinux").··tags: | |||
| 0003c4e0:·0a20·202d·2043·4345·2d32·3731·3537·2d37··.··-·CCE-27157-7 | |||
| 0003c4f0:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003c500:·2e31·0a20·202d·2044·4953·412d·5354·4947··.1.··-·DISA-STIG | |||
| 0003c510:·2d52·4845·4c2d·3037·2d30·3130·3032·300a··-RHEL-07-010020. | |||
| 0003c520:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003c530:·2d33·2e33·2e38·0a20·202d·204e·4953·542d··-3.3.8.··-·NIST- | |||
| 0003c540:·3830·302d·3137·312d·332e·342e·310a·2020··800-171-3.4.1.·· | |||
| 0003c550:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003c560:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003c570:·3030·2d35·332d·434d·2d36·2863·290a·2020··00-53-CM-6(c).·· | |||
| 0003c580:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003c590:·2d36·2864·290a·2020·2d20·4e49·5354·2d38··-6(d).··-·NIST-8 | |||
| 0003c5a0:·3030·2d35·332d·5349·2d37·0a20·202d·204e··00-53-SI-7.··-·N | |||
| 0003c5b0:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| Max diff block lines reached; 24161383/24208081 bytes (99.81%) of diff not shown. | |||
| Offset 14420, 15 lines modified | Offset 14420, 15 lines modified | ||
| 00038530:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00038530:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00038540:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00038540:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00038550:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00038550:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00038560:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00038560:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00038570:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00038570:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00038580:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00038580:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00038590:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00038590:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 000385a0:·6173·206f·6620·3230·323 | 000385a0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 000385b0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 000385b0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 000385c0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 000385c0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 000385d0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 000385d0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 000385e0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 000385e0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 000385f0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 000385f0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00038600:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00038600:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038610:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038610:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15390, 340 lines modified | Offset 15390, 340 lines modified | ||
| 0003c1d0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003c1d0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003c1e0:·646d·3932·3031·2220·7461·6269·6e64·6578··dm9201"·tabindex | 0003c1e0:·646d·3932·3031·2220·7461·6269·6e64·6578··dm9201"·tabindex | ||
| 0003c1f0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003c1f0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003c200:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003c200:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003c210:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003c210:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003c220:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003c220:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003c230:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003c230:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003c240:·6d65·6469·6174·696f·6e20· | 0003c240:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | ||
| 0003c250:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | |||
| 0003c260:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c270:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c280:·6c61·7073·6522·2069·643d·2269·646d·3932··lapse"·id="idm92 | |||
| 0003c290:·3031·223e·3c70·7265·3e3c·636f·6465·3e0a··01"><pre><code>. | |||
| 0003c2a0:·2320·4669·6e64·2077·6869·6368·2066·696c··#·Find·which·fil | |||
| 0003c2b0:·6573·2068·6176·6520·696e·636f·7272·6563··es·have·incorrec | |||
| 0003c2c0:·7420·6861·7368·2028·6e6f·7420·696e·202f··t·hash·(not·in·/ | |||
| 0003c2d0:·6574·632c·2062·6563·6175·7365·206f·6620··etc,·because·of· | |||
| 0003c2e0:·7468·6520·7379·7374·656d·2072·656c·6174··the·system·relat | |||
| 0003c2f0:·6564·2063·6f6e·6669·6720·6669·6c65·7329··ed·config·files) | |||
| 0003c300:·2061·6e64·2074·6865·6e20·6765·7420·6669···and·then·get·fi | |||
| 0003c310:·6c65·7320·6e61·6d65·730a·6669·6c65·735f··les·names.files_ | |||
| 0003c320:·7769·7468·5f69·6e63·6f72·7265·6374·5f68··with_incorrect_h | |||
| 0003c330:·6173·683d·2224·2872·706d·202d·5661·202d··ash="$(rpm·-Va·- | |||
| 0003c340:·2d6e·6f63·6f6e·6669·6720·7c20·6772·6570··-noconfig·|·grep | |||
| 0003c350:·202d·4520·275e·2e2e·3527·207c·2061·776b···-E·'^..5'·|·awk | |||
| 0003c360:·2027·7b70·7269·6e74·2024·4e46·7d27·2029···'{print·$NF}'·) | |||
| 0003c370:·220a·0a23·2046·726f·6d20·6669·6c65·7320··"..#·From·files· | |||
| 0003c380:·6e61·6d65·7320·6765·7420·7061·636b·6167··names·get·packag | |||
| 0003c390:·6520·6e61·6d65·7320·616e·6420·6368·616e··e·names·and·chan | |||
| 0003c3a0:·6765·206e·6577·6c69·6e65·2074·6f20·7370··ge·newline·to·sp | |||
| 0003c3b0:·6163·652c·2062·6563·6175·7365·2072·706d··ace,·because·rpm | |||
| 0003c3c0:·2077·7269·7465·7320·6561·6368·2070·6163···writes·each·pac | |||
| 0003c3d0:·6b61·6765·2074·6f20·6e65·7720·6c69·6e65··kage·to·new·line | |||
| 0003c3e0:·0a70·6163·6b61·6765·735f·746f·5f72·6569··.packages_to_rei | |||
| 0003c3f0:·6e73·7461·6c6c·3d22·2428·7270·6d20·2d71··nstall="$(rpm·-q | |||
| 0003c400:·6620·2466·696c·6573·5f77·6974·685f·696e··f·$files_with_in | |||
| 0003c410:·636f·7272·6563·745f·6861·7368·207c·2074··correct_hash·|·t | |||
| 0003c420:·7220·275c·6e27·2027·2027·2922·0a0a·0a79··r·'\n'·'·')"...y | |||
| 0003c250:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003c260:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c270:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c280:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c290:·6d39·3230·3122·3e3c·7461·626c·6520·636c··m9201"><table·cl | |||
| 0003c2a0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c2b0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c2c0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c2d0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c2e0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c2f0:·3e3c·7464·3e68·6967·683c·2f74·643e·3c2f··><td>high</td></ | |||
| 0003c300:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c310:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6d··ption:</th><td>m | |||
| 0003c320:·6564·6975·6d3c·2f74·643e·3c2f·7472·3e3c··edium</td></tr>< | |||
| 0003c330:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c340:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003c350:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003c360:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003c370:·6e61·6d65·3a20·2753·6574·2066·6163·743a··name:·'Set·fact: | |||
| 0003c380:·2050·6163·6b61·6765·206d·616e·6167·6572···Package·manager | |||
| 0003c390:·2072·6569·6e73·7461·6c6c·2063·6f6d·6d61···reinstall·comma | |||
| 0003c3a0:·6e64·2028·646e·6629·270a·2020·7365·745f··nd·(dnf)'.··set_ | |||
| 0003c3b0:·6661·6374·3a0a·2020·2020·7061·636b·6167··fact:.····packag | |||
| 0003c3c0:·655f·6d61·6e61·6765·725f·7265·696e·7374··e_manager_reinst | |||
| 0003c3d0:·616c·6c5f·636d·643a·2064·6e66·2072·6569··all_cmd:·dnf·rei | |||
| 0003c3e0:·6e73·7461·6c6c·202d·790a·2020·7768·656e··nstall·-y.··when | |||
| 0003c3f0:·3a20·616e·7369·626c·655f·6469·7374·7269··:·ansible_distri | |||
| 0003c400:·6275·7469·6f6e·203d·3d20·2246·6564·6f72··bution·==·"Fedor | |||
| 0003c410:·6122·0a20·2074·6167·733a·0a20·202d·2043··a".··tags:.··-·C | |||
| 0003c420:·4345·2d32·3731·3537·2d37·0a20·202d·2043··CE-27157-7.··-·C | |||
| 0003c430:·4a49·532d·352e·3130·2e34·2e31·0a20·202d··JIS-5.10.4.1.··- | |||
| 0003c440:·2044·4953·412d·5354·4947·2d52·4845·4c2d···DISA-STIG-RHEL- | |||
| 0003c450:·3037·2d30·3130·3032·300a·2020·2d20·4e49··07-010020.··-·NI | |||
| 0003c460:·5354·2d38·3030·2d31·3731·2d33·2e33·2e38··ST-800-171-3.3.8 | |||
| 0003c470:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | |||
| 0003c480:·312d·332e·342e·310a·2020·2d20·4e49·5354··1-3.4.1.··-·NIST | |||
| 0003c490:·2d38·3030·2d35·332d·4155·2d39·2833·290a··-800-53-AU-9(3). | |||
| 0003c4a0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c4b0:·434d·2d36·2863·290a·2020·2d20·4e49·5354··CM-6(c).··-·NIST | |||
| 0003c4c0:·2d38·3030·2d35·332d·434d·2d36·2864·290a··-800-53-CM-6(d). | |||
| 0003c4d0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c4e0:·5349·2d37·0a20·202d·204e·4953·542d·3830··SI-7.··-·NIST-80 | |||
| 0003c4f0:·302d·3533·2d53·492d·3728·3129·0a20·202d··0-53-SI-7(1).··- | |||
| 0003c500:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003c510:·3728·3629·0a20·202d·2050·4349·2d44·5353··7(6).··-·PCI-DSS | |||
| 0003c520:·2d52·6571·2d31·312e·350a·2020·2d20·6869··-Req-11.5.··-·hi | |||
| 0003c530:·6768·5f63·6f6d·706c·6578·6974·790a·2020··gh_complexity.·· | |||
| 0003c540:·2d20·6869·6768·5f73·6576·6572·6974·790a··-·high_severity. | |||
| 0003c550:·2020·2d20·6d65·6469·756d·5f64·6973·7275····-·medium_disru | |||
| 0003c560:·7074·696f·6e0a·2020·2d20·6e6f·5f72·6562··ption.··-·no_reb | |||
| 0003c570:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 0003c580:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 0003c590:·0a20·202d·2072·706d·5f76·6572·6966·795f··.··-·rpm_verify_ | |||
| 0003c5a0:·6861·7368·6573·0a0a·2d20·6e61·6d65·3a20··hashes..-·name:· | |||
| 0003c5b0:·2753·6574·2066·6163·743a·2050·6163·6b61··'Set·fact:·Packa | |||
| 0003c5c0:·6765·206d·616e·6167·6572·2072·6569·6e73··ge·manager·reins | |||
| 0003c5d0:·7461·6c6c·2063·6f6d·6d61·6e64·2028·7975··tall·command·(yu | |||
| 0003c5e0:·6d29·270a·2020·7365·745f·6661·6374·3a0a··m)'.··set_fact:. | |||
| 0003c5f0:·2020·2020·7061·636b·6167·655f·6d61·6e61······package_mana | |||
| 0003c600:·6765·725f·7265·696e·7374·616c·6c5f·636d··ger_reinstall_cm | |||
| 0003c | 0003c430:·756d·2072·6569·6e73·7461·6c6c·202d·7920··um·reinstall·-y· | ||
| 0003c | 0003c440:·2470·6163·6b61·6765·735f·746f·5f72·6569··$packages_to_rei | ||
| 0003c450:·6e73·7461·6c6c·0a3c·2f63·6f64·653e·3c2f··nstall.</code></ | |||
| 0003c460:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c470:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c480:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c490:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c4a0:·2d74·6172·6765·743d·2223·6964·6d39·3230··-target="#idm920 | |||
| 0003c4b0:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | |||
| 0003c4c0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c4d0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c4e0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c4f0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| Max diff block lines reached; 15795721/15842419 bytes (99.71%) of diff not shown. | |||
| Offset 62, 15 lines modified | Offset 62, 15 lines modified | ||
| 62 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 62 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 63 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 63 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 64 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 65 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 65 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 66 | ····*·cpe:/o:redhat:enterprise_linux:7 | 66 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 67 | *****·Revision·History·***** | 67 | *****·Revision·History·***** |
| 68 | Current·version:·0.1.65 | 68 | Current·version:·0.1.65 |
| 69 | ····*·draft·(as·of·202 | 69 | ····*·draft·(as·of·2025-02-23) |
| 70 | *****·Table·of·Contents·***** | 70 | *****·Table·of·Contents·***** |
| 71 | ···1.·System_Settings | 71 | ···1.·System_Settings |
| 72 | ·········1.·Installing_and_Maintaining_Software | 72 | ·········1.·Installing_and_Maintaining_Software |
| 73 | ·········2.·Account_and_Access_Control | 73 | ·········2.·Account_and_Access_Control |
| 74 | ·········3.·System_Accounting_with_auditd | 74 | ·········3.·System_Accounting_with_auditd |
| 75 | ·········4.·GRUB2_bootloader_configuration | 75 | ·········4.·GRUB2_bootloader_configuration |
| 76 | ·········5.·Network_Configuration_and_Firewalls | 76 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 105, 14 lines modified | Offset 105, 24 lines modified | ||
| 105 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 105 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 106 | $·sudo·rpm·-Uvh·PACKAGENAME | 106 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 107 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 107 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 108 | Severity: ················high | 108 | Severity: ················high |
| 109 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 109 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 110 | Identifiers·and·References·Identifiers: ·CCE-27157-7 | 110 | Identifiers·and·References·Identifiers: ·CCE-27157-7 |
| 111 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule | 111 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule |
| 112 | Remediation_Shell_script_⇲ | ||
| 113 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 114 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 115 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 116 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 117 | yum·reinstall·-y·$packages_to_reinstall | ||
| 112 | Remediation_Ansible_snippet_⇲ | 118 | Remediation_Ansible_snippet_⇲ |
| 113 | Complexity:·high | 119 | Complexity:·high |
| 114 | Disruption:·medium | 120 | Disruption:·medium |
| 115 | Strategy:···restrict | 121 | Strategy:···restrict |
| 116 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 122 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 117 | ··set_fact: | 123 | ··set_fact: |
| 118 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 124 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 268, 37 lines modified | Offset 278, 52 lines modified | ||
| 268 | ··-·PCI-DSS-Req-11.5 | 278 | ··-·PCI-DSS-Req-11.5 |
| 269 | ··-·high_complexity | 279 | ··-·high_complexity |
| 270 | ··-·high_severity | 280 | ··-·high_severity |
| 271 | ··-·medium_disruption | 281 | ··-·medium_disruption |
| 272 | ··-·no_reboot_needed | 282 | ··-·no_reboot_needed |
| 273 | ··-·restrict_strategy | 283 | ··-·restrict_strategy |
| 274 | ··-·rpm_verify_hashes | 284 | ··-·rpm_verify_hashes |
| 275 | Remediation_Shell_script_⇲ | ||
| 276 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 277 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 278 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 279 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 280 | yum·reinstall·-y·$packages_to_reinstall | ||
| 281 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 285 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 282 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 286 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 283 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 287 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 284 | run·the·following·command·to·determine·which·package·owns·it: | 288 | run·the·following·command·to·determine·which·package·owns·it: |
| 285 | $·rpm·-qf·FILENAME | 289 | $·rpm·-qf·FILENAME |
| 286 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 290 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 287 | $·sudo·rpm·--setugids·PACKAGENAME | 291 | $·sudo·rpm·--setugids·PACKAGENAME |
| 288 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 292 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 289 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 293 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 290 | Severity: ················high | 294 | Severity: ················high |
| 291 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 295 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 292 | Identifiers·and·References·Identifiers: ·CCE-80545-7 | 296 | Identifiers·and·References·Identifiers: ·CCE-80545-7 |
| 293 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 297 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 298 | Remediation_Shell_script_⇲ | ||
| 299 | Complexity:·high | ||
| 300 | Disruption:·medium | ||
| 301 | Strategy:···restrict | ||
| 302 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 303 | declare·-A·SETPERMS_RPM_DICT | ||
| 304 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 305 | #·is·expected·by·the·RPM·database | ||
| 306 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 307 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 308 | do | ||
| 309 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 310 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 311 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 312 | done | ||
| 313 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 314 | #·correct·values | ||
| 315 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 316 | do | ||
| 317 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 318 | done | ||
| 294 | Remediation_Ansible_snippet_⇲ | 319 | Remediation_Ansible_snippet_⇲ |
| 295 | Complexity:·high | 320 | Complexity:·high |
| 296 | Disruption:·medium | 321 | Disruption:·medium |
| 297 | Strategy:···restrict | 322 | Strategy:···restrict |
| 298 | -·name:·Read·list·of·files·with·incorrect·ownership | 323 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 299 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 324 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 300 | ····--nocaps·--nolinkto·--nomode | 325 | ····--nocaps·--nolinkto·--nomode |
| Offset 375, 53 lines modified | Offset 400, 57 lines modified | ||
| 375 | ··-·PCI-DSS-Req-11.5 | 400 | ··-·PCI-DSS-Req-11.5 |
| 376 | ··-·high_complexity | 401 | ··-·high_complexity |
| 377 | ··-·high_severity | 402 | ··-·high_severity |
| 378 | ··-·medium_disruption | 403 | ··-·medium_disruption |
| 379 | ··-·no_reboot_needed | 404 | ··-·no_reboot_needed |
| 380 | ··-·restrict_strategy | 405 | ··-·restrict_strategy |
| 381 | ··-·rpm_verify_ownership | 406 | ··-·rpm_verify_ownership |
| 407 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 408 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 409 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 410 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 411 | $·rpm·-qf·FILENAME | ||
| 412 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 413 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 414 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 415 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 416 | Severity: ················high | ||
| 417 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 418 | Identifiers·and·References·Identifiers: ·CCE-27209-6 | ||
| 419 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | ||
| 382 | Remediation_Shell_script_⇲ | 420 | Remediation_Shell_script_⇲ |
| 383 | Complexity:·high | 421 | Complexity:·high |
| Max diff block lines reached; 1184921/1194523 bytes (99.20%) of diff not shown. | |||
| Offset 14345, 16 lines modified | Offset 14345, 16 lines modified | ||
| 00038080:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038080:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00038090:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00038090:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 000380a0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 000380a0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 000380b0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 000380b0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 000380c0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 000380c0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 000380d0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 000380d0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 000380e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000380e0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000380f0:·2020·2028·6173·206f·6620·3230·323 | 000380f0:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00038100:·3 | 00038100:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00038110:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00038110:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00038120:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00038120:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00038130:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00038130:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00038140:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00038140:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00038150:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00038150:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00038160:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00038160:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00038170:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00038170:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15288, 192 lines modified | Offset 15288, 192 lines modified | ||
| 0003bb70:·7461·2d74·6172·6765·743d·2223·6964·6d39··ta-target="#idm9 | 0003bb70:·7461·2d74·6172·6765·743d·2223·6964·6d39··ta-target="#idm9 | ||
| 0003bb80:·3536·3622·2074·6162·696e·6465·783d·2230··566"·tabindex="0 | 0003bb80:·3536·3622·2074·6162·696e·6465·783d·2230··566"·tabindex="0 | ||
| 0003bb90:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 0003bb90:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 0003bba0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 0003bba0:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 0003bbb0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 0003bbb0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 0003bbc0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 0003bbc0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 0003bbd0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 0003bbd0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 0003bbe0:·6961·7469·6f6e·2050·7570·7065·7420·736e··iation·Puppet·sn | |||
| 0003bbe0:·6961·7469·6f6e·2041·6e61·636f·6e64·6120··iation·Anaconda· | |||
| 0003bbf0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bc00:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bc10:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bc20:·6c6c·6170·7365·2220·6964·3d22·6964·6d39··llapse"·id="idm9 | |||
| 0003bc30:·3536·3622·3e3c·7461·626c·6520·636c·6173··566"><table·clas | |||
| 0003bc40:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bc50:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bc60:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bc70:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bc80:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bc90:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bca0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bcb0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bcc0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bcd0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bce0:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003bcf0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bd00:·3c63·6f64·653e·0a70·6163·6b61·6765·202d··<code>.package·- | |||
| 0003bd10:·2d61·6464·3d61·6964·650a·3c2f·636f·6465··-add=aide.</code | |||
| 0003bd20:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003bd30:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003bd40:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003bd50:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003bd60:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003bd70:·3935·3637·2220·7461·6269·6e64·6578·3d22··9567"·tabindex=" | |||
| 0003bd80:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003bd90:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003bda0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003bdb0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003bdc0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003bdd0:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003bde0:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003bdf0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003be00:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003be10:·6c61·7073·6522·2069·643d·2269·646d·3935··lapse"·id="idm95 | |||
| 0003be20:·3637·223e·3c74·6162·6c65·2063·6c61·7373··67"><table·class | |||
| 0003be30:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003be40:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003be50:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003be60:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003be70:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003be80:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003be90:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003bea0:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003beb0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003bec0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003bed0:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003bee0:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003bef0:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003bf00:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003bf10:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003bf20:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003bf30:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003bf40:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003bf50:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003bf60:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bf70:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bf80:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bf90:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bfa0:·612d·7461·7267·6574·3d22·2369·646d·3935··a-target="#idm95 | |||
| 0003bfb0:·3638·2220·7461·6269·6e64·6578·3d22·3022··68"·tabindex="0" | |||
| 0003bfc0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bfd0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bfe0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bff0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c000:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c010:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003 | 0003bbf0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | ||
| 0003c0 | 0003bc00:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | ||
| 0003 | 0003bc10:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | ||
| 0003 | 0003bc20:·6170·7365·2220·6964·3d22·6964·6d39·3536··apse"·id="idm956 | ||
| 0003 | 0003bc30:·3622·3e3c·7461·626c·6520·636c·6173·733d··6"><table·class= | ||
| 0003 | 0003bc40:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | ||
| 0003 | 0003bc50:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | ||
| 0003 | 0003bc60:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | ||
| 0003 | 0003bc70:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | ||
| 0003 | 0003bc80:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | ||
| 0003 | 0003bc90:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003 | 0003bca0:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | ||
| 0003 | 0003bcb0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | ||
| 0003 | 0003bcc0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | ||
| 0003 | 0003bcd0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | ||
| 0003 | 0003bce0:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | ||
| 0003 | 0003bcf0:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | ||
| 0003bd00:·6f64·653e·696e·636c·7564·6520·696e·7374··ode>include·inst | |||
| 0003bd10:·616c·6c5f·6169·6465·0a0a·636c·6173·7320··all_aide..class· | |||
| 0003bd20:·696e·7374·616c·6c5f·6169·6465·207b·0a20··install_aide·{.· | |||
| 0003bd30:·2070·6163·6b61·6765·207b·2027·6169·6465···package·{·'aide | |||
| 0003bd40:·273a·0a20·2020·2065·6e73·7572·6520·3d26··':.····ensure·=& | |||
| 0003bd50:·6774·3b20·2769·6e73·7461·6c6c·6564·272c··gt;·'installed', | |||
| 0003bd60:·0a20·207d·0a7d·0a3c·2f63·6f64·653e·3c2f··.··}.}.</code></ | |||
| 0003bd70:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003bd80:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003bd90:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003bda0:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003bdb0:·2d74·6172·6765·743d·2223·6964·6d39·3536··-target="#idm956 | |||
| 0003bdc0:·3722·2074·6162·696e·6465·783d·2230·2220··7"·tabindex="0"· | |||
| 0003bdd0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003bde0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003bdf0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003be00:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| Max diff block lines reached; 2298904/2325316 bytes (98.86%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 43 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 44 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 44 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 45 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 45 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 46 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 46 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7 | 47 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Network_Configuration_and_Firewalls | 57 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 79, 31 lines modified | Offset 79, 39 lines modified | ||
| 79 | The·aide·package·can·be·installed·with·the·following·command: | 79 | The·aide·package·can·be·installed·with·the·following·command: |
| 80 | $·sudo·yum·install·aide | 80 | $·sudo·yum·install·aide |
| 81 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 81 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 82 | Severity: ················medium | 82 | Severity: ················medium |
| 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 83 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 84 | Identifiers·and·References·Identifiers: ·CCE-27096-7 | 84 | Identifiers·and·References·Identifiers: ·CCE-27096-7 |
| 85 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule | 85 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-07-020029,·1.3.1,·SV-251705r861078_rule |
| 86 | Remediation_Anaconda_snippet_⇲ | ||
| 87 | Complexity:·low | ||
| 88 | Disruption:·low | ||
| 89 | Strategy:···enable | ||
| 90 | package·--add=aide | ||
| 91 | Remediation_Puppet_snippet_⇲ | 86 | Remediation_Puppet_snippet_⇲ |
| 92 | Complexity:·low | 87 | Complexity:·low |
| 93 | Disruption:·low | 88 | Disruption:·low |
| 94 | Strategy:···enable | 89 | Strategy:···enable |
| 95 | include·install_aide | 90 | include·install_aide |
| 96 | class·install_aide·{ | 91 | class·install_aide·{ |
| 97 | ··package·{·'aide': | 92 | ··package·{·'aide': |
| 98 | ····ensure·=>·'installed', | 93 | ····ensure·=>·'installed', |
| 99 | ··} | 94 | ··} |
| 100 | } | 95 | } |
| 96 | Remediation_Shell_script_⇲ | ||
| 97 | Complexity:·low | ||
| 98 | Disruption:·low | ||
| 99 | Strategy:···enable | ||
| 100 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 101 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 102 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 103 | ····yum·install·-y·"aide" | ||
| 104 | fi | ||
| 105 | else | ||
| 106 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 107 | fi | ||
| 101 | Remediation_Ansible_snippet_⇲ | 108 | Remediation_Ansible_snippet_⇲ |
| 102 | Complexity:·low | 109 | Complexity:·low |
| 103 | Disruption:·low | 110 | Disruption:·low |
| 104 | Strategy:···enable | 111 | Strategy:···enable |
| 105 | -·name:·Ensure·aide·is·installed | 112 | -·name:·Ensure·aide·is·installed |
| 106 | ··package: | 113 | ··package: |
| 107 | ····name:·aide | 114 | ····name:·aide |
| Offset 122, 105 lines modified | Offset 130, 97 lines modified | ||
| 122 | ··-·no_reboot_needed | 130 | ··-·no_reboot_needed |
| 123 | ··-·package_aide_installed | 131 | ··-·package_aide_installed |
| 124 | Remediation_OSBuild_Blueprint_snippet_⇲ | 132 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 125 | [[packages]] | 133 | [[packages]] |
| 126 | name·=·"aide" | 134 | name·=·"aide" |
| 127 | version·=·"*" | 135 | version·=·"*" |
| 128 | Remediation_ | 136 | Remediation_Anaconda_snippet_⇲ |
| 129 | Complexity:·low | 137 | Complexity:·low |
| 130 | Disruption:·low | 138 | Disruption:·low |
| 131 | Strategy:···enable | 139 | Strategy:···enable |
| 132 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 133 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 134 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 135 | ····yum·install·-y·"aide" | ||
| 136 | fi | ||
| 140 | package·--add=aide | ||
| 137 | else | ||
| 138 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 139 | fi | ||
| 140 | Group ·Disk·Partitioning· Group·contains·4·rules | 141 | Group ·Disk·Partitioning· Group·contains·4·rules |
| 141 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which·should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default·partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 142 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which·should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default·partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 142 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify·partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the·volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create·space.·In·general,·using·logical·volumes·is·preferable·to·using·partitions·because·they·can·be·more·easily·adjusted·later. | 143 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify·partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the·volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create·space.·In·general,·using·logical·volumes·is·preferable·to·using·partitions·because·they·can·be·more·easily·adjusted·later. |
| 143 | ····*·If·creating·a·custom·layout,·create·the·partitions·mentioned·in·the·previous·paragraph·(which·the·installer·will·require·anyway),·as·well·as·separate·ones·described·in·the·following·sections. | 144 | ····*·If·creating·a·custom·layout,·create·the·partitions·mentioned·in·the·previous·paragraph·(which·the·installer·will·require·anyway),·as·well·as·separate·ones·described·in·the·following·sections. |
| 144 | If·a·system·has·already·been·installed,·and·the·default·partitioning·scheme·was·used,·it·is·possible·but·nontrivial·to·modify·it·to·create·separate·logical·volumes·for·the·directories·listed·above.·The·Logical·Volume·Manager·(LVM)·makes·this·possible.·See·the·LVM·HOWTO·at·http://tldp.org/HOWTO/LVM-HOWTO/·for·more·detailed·information·on·LVM. | 145 | If·a·system·has·already·been·installed,·and·the·default·partitioning·scheme·was·used,·it·is·possible·but·nontrivial·to·modify·it·to·create·separate·logical·volumes·for·the·directories·listed·above.·The·Logical·Volume·Manager·(LVM)·makes·this·possible.·See·the·LVM·HOWTO·at·http://tldp.org/HOWTO/LVM-HOWTO/·for·more·detailed·information·on·LVM. |
| 145 | ***·Rule ·Ensure·/tmp·Located·On·Separate·Partition· [ref]·*** | 146 | ***·Rule ·Ensure·/tmp·Located·On·Separate·Partition· [ref]·*** |
| 146 | The·/tmp·directory·is·a·world-writable·directory·used·for·temporary·file·storage.·Ensure·it·has·its·own·partition·or·logical·volume·at·installation·time,·or·migrate·it·using·LVM. | 147 | The·/tmp·directory·is·a·world-writable·directory·used·for·temporary·file·storage.·Ensure·it·has·its·own·partition·or·logical·volume·at·installation·time,·or·migrate·it·using·LVM. |
| 147 | Rationale:·················The·/tmp·partition·is·used·as·temporary·storage·by·many·programs.·Placing·/tmp·in·its·own·partition·enables·the·setting·of·more·restrictive·mount·options,·which·can·help·protect·programs·which·use·it. | 148 | Rationale:·················The·/tmp·partition·is·used·as·temporary·storage·by·many·programs.·Placing·/tmp·in·its·own·partition·enables·the·setting·of·more·restrictive·mount·options,·which·can·help·protect·programs·which·use·it. |
| 148 | Severity: ················low | 149 | Severity: ················low |
| 149 | Rule·ID:···················xccdf_org.ssgproject.content_rule_partition_for_tmp | 150 | Rule·ID:···················xccdf_org.ssgproject.content_rule_partition_for_tmp |
| 150 | Identifiers·and·References·Identifiers: ·CCE-82053-0 | 151 | Identifiers·and·References·Identifiers: ·CCE-82053-0 |
| 151 | ···························References: ·BP28(R12),·12,·15,·8,·APO13.01,·DSS05.02,·CCI-000366,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·CM-6(a),·SC-5(2),·PR.PT-4,·SRG-OS-000480-GPOS-00227,·RHEL-07-021340,·1.1.2,·SV-204496r603261_rule | 152 | ···························References: ·BP28(R12),·12,·15,·8,·APO13.01,·DSS05.02,·CCI-000366,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·CM-6(a),·SC-5(2),·PR.PT-4,·SRG-OS-000480-GPOS-00227,·RHEL-07-021340,·1.1.2,·SV-204496r603261_rule |
| 153 | Remediation_OSBuild_Blueprint_snippet_⇲ | ||
| 154 | [[customizations.filesystem]] | ||
| 155 | mountpoint·=·"/tmp" | ||
| 156 | size·=·1073741824 | ||
| 152 | Remediation_Anaconda_snippet_⇲ | 157 | Remediation_Anaconda_snippet_⇲ |
| 153 | Complexity:·low | 158 | Complexity:·low |
| 154 | Disruption:·high | 159 | Disruption:·high |
| 155 | Strategy:···enable | 160 | Strategy:···enable |
| 156 | part·/tmp | 161 | part·/tmp |
| 157 | Remediation_OSBuild_Blueprint_snippet_⇲ | ||
| 158 | [[customizations.filesystem]] | ||
| 159 | mountpoint·=·"/tmp" | ||
| 160 | size·=·1073741824 | ||
| 161 | ***·Rule ·Ensure·/var·Located·On·Separate·Partition· [ref]·*** | 162 | ***·Rule ·Ensure·/var·Located·On·Separate·Partition· [ref]·*** |
| 162 | The·/var·directory·is·used·by·daemons·and·other·system·services·to·store·frequently-changing·data.·Ensure·that·/var·has·its·own·partition·or·logical·volume·at·installation·time,·or·migrate·it·using·LVM. | 163 | The·/var·directory·is·used·by·daemons·and·other·system·services·to·store·frequently-changing·data.·Ensure·that·/var·has·its·own·partition·or·logical·volume·at·installation·time,·or·migrate·it·using·LVM. |
| 163 | Rationale:·················Ensuring·that·/var·is·mounted·on·its·own·partition·enables·the·setting·of·more·restrictive·mount·options.·This·helps·protect·system·services·such·as·daemons·or·other·programs·which·use·it.·It·is·not·uncommon·for·the·/var·directory·to·contain·world-writable·directories·installed·by·other·software·packages. | 164 | Rationale:·················Ensuring·that·/var·is·mounted·on·its·own·partition·enables·the·setting·of·more·restrictive·mount·options.·This·helps·protect·system·services·such·as·daemons·or·other·programs·which·use·it.·It·is·not·uncommon·for·the·/var·directory·to·contain·world-writable·directories·installed·by·other·software·packages. |
| 164 | Severity: ················low | 165 | Severity: ················low |
| 165 | Rule·ID:···················xccdf_org.ssgproject.content_rule_partition_for_var | 166 | Rule·ID:···················xccdf_org.ssgproject.content_rule_partition_for_var |
| 166 | Identifiers·and·References·Identifiers: ·CCE-82014-2 | 167 | Identifiers·and·References·Identifiers: ·CCE-82014-2 |
| 167 | ···························References: ·BP28(R12),·12,·15,·8,·APO13.01,·DSS05.02,·CCI-000366,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·CM-6(a),·SC-5(2),·PR.PT-4,·SRG-OS-000480-GPOS-00227,·SRG-OS-000341-VMM-001220,·RHEL-07-021320,·1.1.10,·SV-204494r603261_rule | 168 | ···························References: ·BP28(R12),·12,·15,·8,·APO13.01,·DSS05.02,·CCI-000366,·SR_3.1,·SR_3.5,·SR_3.8,·SR_4.1,·SR_4.3,·SR_5.1,·SR_5.2,·SR_5.3,·SR_7.1,·SR_7.6,·A.13.1.1,·A.13.2.1,·A.14.1.3,·CM-6(a),·SC-5(2),·PR.PT-4,·SRG-OS-000480-GPOS-00227,·SRG-OS-000341-VMM-001220,·RHEL-07-021320,·1.1.10,·SV-204494r603261_rule |
| 169 | Remediation_OSBuild_Blueprint_snippet_⇲ | ||
| 170 | [[customizations.filesystem]] | ||
| 171 | mountpoint·=·"/var" | ||
| 172 | size·=·3221225472 | ||
| 168 | Remediation_Anaconda_snippet_⇲ | 173 | Remediation_Anaconda_snippet_⇲ |
| 169 | Complexity:·low | 174 | Complexity:·low |
| 170 | Disruption:·high | 175 | Disruption:·high |
| Max diff block lines reached; 309413/316395 bytes (97.79%) of diff not shown. | |||
| Offset 14344, 16 lines modified | Offset 14344, 16 lines modified | ||
| 00038070:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038070:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038080:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038080:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00038090:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00038090:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 000380a0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 000380a0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 000380b0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 000380b0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 000380c0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 000380c0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 000380d0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000380d0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000380e0:·2020·2861·7320·6f66·2032·3032·3 | 000380e0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 000380f0:·2d32·3 | 000380f0:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038100:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038100:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038110:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038110:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00038120:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00038120:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00038130:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00038130:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00038140:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00038140:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00038150:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00038150:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00038160:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00038160:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15302, 340 lines modified | Offset 15302, 340 lines modified | ||
| 0003bc50:·7267·6574·3d22·2369·646d·3932·3031·2220··rget="#idm9201"· | 0003bc50:·7267·6574·3d22·2369·646d·3932·3031·2220··rget="#idm9201"· | ||
| 0003bc60:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003bc60:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003bc70:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003bc70:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003bc80:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003bc80:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003bc90:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003bc90:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003bca0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003bca0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003bcb0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003bcb0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003bcc0:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003bcd0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bce0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bcf0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bd00:·643d·2269·646d·3932·3031·223e·3c70·7265··d="idm9201"><pre | |||
| 0003bd10:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003bd20:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003bd30:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003bd40:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003bd50:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003bd60:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003bd70:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003bd80:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003bd90:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003bda0:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003bdb0:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003bdc0:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003bdd0:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003bde0:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003bdf0:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003bcc0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bcd0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bce0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bcf0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bd00:·2220·6964·3d22·6964·6d39·3230·3122·3e3c··"·id="idm9201">< | |||
| 0003bd10:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bd20:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bd30:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bd40:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bd50:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bd60:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003bd70:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003bd80:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003bd90:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003bda0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003bdb0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003bdc0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003bdd0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bde0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003bdf0:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003be00:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003be10:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003be20:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003be | 0003be00:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003be10:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | |||
| 0003be20:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003be30:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003be40:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003be50:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003be60:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003be70:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003be40:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003be50:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003be60:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003be70:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003be80:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003be90:·733a·0a20·202d·2043·4345·2d32·3731·3537··s:.··-·CCE-27157 | |||
| 0003bea0:·2d37·0a20·202d·2043·4a49·532d·352e·3130··-7.··-·CJIS-5.10 | |||
| 0003beb0:·2e34·2e31·0a20·202d·2044·4953·412d·5354··.4.1.··-·DISA-ST | |||
| 0003bec0:·4947·2d52·4845·4c2d·3037·2d30·3130·3032··IG-RHEL-07-01002 | |||
| 0003bed0:·300a·2020·2d20·4e49·5354·2d38·3030·2d31··0.··-·NIST-800-1 | |||
| 0003bee0:·3731·2d33·2e33·2e38·0a20·202d·204e·4953··71-3.3.8.··-·NIS | |||
| 0003bef0:·542d·3830·302d·3137·312d·332e·342e·310a··T-800-171-3.4.1. | |||
| 0003bf00:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bf10:·4155·2d39·2833·290a·2020·2d20·4e49·5354··AU-9(3).··-·NIST | |||
| 0003bf20:·2d38·3030·2d35·332d·434d·2d36·2863·290a··-800-53-CM-6(c). | |||
| 0003bf30:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bf40:·434d·2d36·2864·290a·2020·2d20·4e49·5354··CM-6(d).··-·NIST | |||
| 0003bf50:·2d38·3030·2d35·332d·5349·2d37·0a20·202d··-800-53-SI-7.··- | |||
| 0003bf60:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003bf70:·3728·3129·0a20·202d·204e·4953·542d·3830··7(1).··-·NIST-80 | |||
| 0003bf80:·302d·3533·2d53·492d·3728·3629·0a20·202d··0-53-SI-7(6).··- | |||
| 0003bf90:·2050·4349·2d44·5353·2d52·6571·2d31·312e···PCI-DSS-Req-11. | |||
| 0003bfa0:·350a·2020·2d20·6869·6768·5f63·6f6d·706c··5.··-·high_compl | |||
| 0003bfb0:·6578·6974·790a·2020·2d20·6869·6768·5f73··exity.··-·high_s | |||
| 0003bfc0:·6576·6572·6974·790a·2020·2d20·6d65·6469··everity.··-·medi | |||
| 0003bfd0:·756d·5f64·6973·7275·7074·696f·6e0a·2020··um_disruption.·· | |||
| 0003bfe0:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003bff0:·6564·0a20·202d·2072·6573·7472·6963·745f··ed.··-·restrict_ | |||
| 0003c000:·7374·7261·7465·6779·0a20·202d·2072·706d··strategy.··-·rpm | |||
| 0003c010:·5f76·6572·6966·795f·6861·7368·6573·0a0a··_verify_hashes.. | |||
| 0003c020:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003c030:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003c040:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003c050:·6d61·6e64·2028·7975·6d29·270a·2020·7365··mand·(yum)'.··se | |||
| 0003c060:·745f·6661·6374·3a0a·2020·2020·7061·636b··t_fact:.····pack | |||
| 0003c070:·6167·655f·6d61·6e61·6765·725f·7265·696e··age_manager_rein | |||
| 0003c080:·7374·616c·6c5f·636d·643a·2079·756d·2072··stall_cmd:·yum·r | |||
| 0003c090:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003c0a0:·656e·3a20·2861·6e73·6962·6c65·5f64·6973··en:·(ansible_dis | |||
| 0003c0b0:·7472·6962·7574·696f·6e20·3d3d·2022·5265··tribution·==·"Re | |||
| 0003c0c0:·6448·6174·2220·6f72·2061·6e73·6962·6c65··dHat"·or·ansible | |||
| 0003c0d0:·5f64·6973·7472·6962·7574·696f·6e20·3d3d··_distribution·== | |||
| 0003c0e0:·2022·4365·6e74·4f53·2220·6f72·2061·6e73···"CentOS"·or·ans | |||
| 0003c0f0:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003c100:·6e0a·2020·2020·3d3d·2022·4f72·6163·6c65··n.····==·"Oracle | |||
| 0003c110:·4c69·6e75·7822·290a·2020·7461·6773·3a0a··Linux").··tags:. | |||
| 0003c120:·2020·2d20·4343·452d·3237·3135·372d·370a····-·CCE-27157-7. | |||
| 0003c130:·2020·2d20·434a·4953·2d35·2e31·302e·342e····-·CJIS-5.10.4. | |||
| 0003c140:·310a·2020·2d20·4449·5341·2d53·5449·472d··1.··-·DISA-STIG- | |||
| 0003c150:·5248·454c·2d30·372d·3031·3030·3230·0a20··RHEL-07-010020.· | |||
| 0003c160:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003c170:·332e·332e·380a·2020·2d20·4e49·5354·2d38··3.3.8.··-·NIST-8 | |||
| Max diff block lines reached; 6204156/6250992 bytes (99.25%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | ····*·cpe:/o:redhat:enterprise_linux:7::client | 43 | ····*·cpe:/o:redhat:enterprise_linux:7::client |
| 44 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 44 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 45 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 45 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 46 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 46 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:7 | 47 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·Configure_Syslog | 56 | ·········4.·Configure_Syslog |
| 57 | ·········5.·File_Permissions_and_Masks | 57 | ·········5.·File_Permissions_and_Masks |
| Offset 84, 14 lines modified | Offset 84, 24 lines modified | ||
| 84 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 84 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 85 | $·sudo·rpm·-Uvh·PACKAGENAME | 85 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 86 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 86 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 87 | Severity: ················high | 87 | Severity: ················high |
| 88 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 88 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 89 | Identifiers·and·References·Identifiers: ·CCE-27157-7 | 89 | Identifiers·and·References·Identifiers: ·CCE-27157-7 |
| 90 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule | 90 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·RHEL-07-010020,·6.1.1,·SV-214799r854001_rule |
| 91 | Remediation_Shell_script_⇲ | ||
| 92 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 93 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 94 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 95 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 96 | yum·reinstall·-y·$packages_to_reinstall | ||
| 91 | Remediation_Ansible_snippet_⇲ | 97 | Remediation_Ansible_snippet_⇲ |
| 92 | Complexity:·high | 98 | Complexity:·high |
| 93 | Disruption:·medium | 99 | Disruption:·medium |
| 94 | Strategy:···restrict | 100 | Strategy:···restrict |
| 95 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 101 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 96 | ··set_fact: | 102 | ··set_fact: |
| 97 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 103 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 247, 38 lines modified | Offset 257, 57 lines modified | ||
| 247 | ··-·PCI-DSS-Req-11.5 | 257 | ··-·PCI-DSS-Req-11.5 |
| 248 | ··-·high_complexity | 258 | ··-·high_complexity |
| 249 | ··-·high_severity | 259 | ··-·high_severity |
| 250 | ··-·medium_disruption | 260 | ··-·medium_disruption |
| 251 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 252 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| 253 | ··-·rpm_verify_hashes | 263 | ··-·rpm_verify_hashes |
| 254 | Remediation_Shell_script_⇲ | ||
| 255 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 256 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 257 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 258 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 259 | yum·reinstall·-y·$packages_to_reinstall | ||
| 260 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 264 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 261 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 265 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 262 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 266 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 263 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 267 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 264 | $·rpm·-qf·FILENAME | 268 | $·rpm·-qf·FILENAME |
| 265 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 269 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 266 | $·sudo·rpm·--setperms·PACKAGENAME | 270 | $·sudo·rpm·--setperms·PACKAGENAME |
| 267 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 271 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 268 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 272 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 269 | Severity: ················high | 273 | Severity: ················high |
| 270 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 274 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 271 | Identifiers·and·References·Identifiers: ·CCE-27209-6 | 275 | Identifiers·and·References·Identifiers: ·CCE-27209-6 |
| 272 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 276 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·RHEL-07-010010,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 277 | Remediation_Shell_script_⇲ | ||
| 278 | Complexity:·high | ||
| 279 | Disruption:·medium | ||
| 280 | Strategy:···restrict | ||
| 281 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 282 | declare·-A·SETPERMS_RPM_DICT | ||
| 283 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 284 | #·is·expected·by·the·RPM·database | ||
| 285 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 286 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 287 | do | ||
| 288 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 289 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 290 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 291 | ········do | ||
| 292 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 293 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 294 | ········done | ||
| 295 | done | ||
| 296 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 297 | #·correct·values | ||
| 298 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 299 | do | ||
| 300 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 301 | done | ||
| 273 | Remediation_Ansible_snippet_⇲ | 302 | Remediation_Ansible_snippet_⇲ |
| 274 | Complexity:·high | 303 | Complexity:·high |
| 275 | Disruption:·medium | 304 | Disruption:·medium |
| 276 | Strategy:···restrict | 305 | Strategy:···restrict |
| 277 | -·name:·Read·list·of·files·with·incorrect·permissions | 306 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 278 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 307 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 279 | ····--nocaps·--nolinkto·--nouser·--nogroup | 308 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 358, 84 lines modified | Offset 387, 55 lines modified | ||
| 358 | ··-·PCI-DSS-Req-11.5 | 387 | ··-·PCI-DSS-Req-11.5 |
| 359 | ··-·high_complexity | 388 | ··-·high_complexity |
| 360 | ··-·high_severity | 389 | ··-·high_severity |
| 361 | ··-·medium_disruption | 390 | ··-·medium_disruption |
| 362 | ··-·no_reboot_needed | 391 | ··-·no_reboot_needed |
| 363 | ··-·restrict_strategy | 392 | ··-·restrict_strategy |
| 364 | ··-·rpm_verify_permissions | 393 | ··-·rpm_verify_permissions |
| 365 | Remediation_Shell_script_⇲ | ||
| 366 | Complexity:·high | ||
| 367 | Disruption:·medium | ||
| 368 | Strategy:···restrict | ||
| 369 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 370 | declare·-A·SETPERMS_RPM_DICT | ||
| 371 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 372 | #·is·expected·by·the·RPM·database | ||
| 373 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 579675/588095 bytes (98.57%) of diff not shown. | |||
| Offset 14364, 15 lines modified | Offset 14364, 15 lines modified | ||
| 000381b0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 000381b0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 000381c0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 000381c0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 000381d0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 000381d0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 000381e0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 000381e0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 000381f0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 000381f0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00038200:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00038200:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00038210:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00038210:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00038220:·3230·323 | 00038220:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00038230:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00038230:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00038240:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00038240:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00038250:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00038250:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00038260:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00038260:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00038270:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00038270:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00038280:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00038280:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00038290:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00038290:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15385, 340 lines modified | Offset 15385, 340 lines modified | ||
| 0003c180:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003c180:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003c190:·3932·3031·2220·7461·6269·6e64·6578·3d22··9201"·tabindex=" | 0003c190:·3932·3031·2220·7461·6269·6e64·6578·3d22··9201"·tabindex=" | ||
| 0003c1a0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003c1a0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003c1b0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003c1b0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003c1c0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003c1c0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003c1d0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003c1d0:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003c1e0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003c1e0:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003c1f0:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003c200:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003c210:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c220:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c230:·6c6c·6170·7365·2220·6964·3d22·6964·6d39··llapse"·id="idm9 | |||
| 0003c240:·3230·3122·3e3c·7461·626c·6520·636c·6173··201"><table·clas | |||
| 0003c250:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c260:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c270:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c280:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c290:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c2a0:·7464·3e68·6967·683c·2f74·643e·3c2f·7472··td>high</td></tr | |||
| 0003c2b0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c2c0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6d·6564··ion:</th><td>med | |||
| 0003c2d0:·6975·6d3c·2f74·643e·3c2f·7472·3e3c·7472··ium</td></tr><tr | |||
| 0003c2e0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c2f0:·7468·3e3c·7464·3e72·6573·7472·6963·743c··th><td>restrict< | |||
| 0003c300:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c310:·3e3c·7072·653e·3c63·6f64·653e·2d20·6e61··><pre><code>-·na | |||
| 0003c320:·6d65·3a20·2753·6574·2066·6163·743a·2050··me:·'Set·fact:·P | |||
| 0003c330:·6163·6b61·6765·206d·616e·6167·6572·2072··ackage·manager·r | |||
| 0003c340:·6569·6e73·7461·6c6c·2063·6f6d·6d61·6e64··einstall·command | |||
| 0003c350:·2028·646e·6629·270a·2020·7365·745f·6661···(dnf)'.··set_fa | |||
| 0003c | 0003c1f0:·6469·6174·696f·6e20·5368·656c·6c20·7363··diation·Shell·sc | ||
| 0003c200:·7269·7074·20e2·87b2·3c2f·613e·3c62·723e··ript·...</a><br> | |||
| 0003c210:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c220:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c230:·7073·6522·2069·643d·2269·646d·3932·3031··pse"·id="idm9201 | |||
| 0003c240:·223e·3c70·7265·3e3c·636f·6465·3e0a·2320··"><pre><code>.#· | |||
| 0003c250:·4669·6e64·2077·6869·6368·2066·696c·6573··Find·which·files | |||
| 0003c260:·2068·6176·6520·696e·636f·7272·6563·7420···have·incorrect· | |||
| 0003c270:·6861·7368·2028·6e6f·7420·696e·202f·6574··hash·(not·in·/et | |||
| 0003c280:·632c·2062·6563·6175·7365·206f·6620·7468··c,·because·of·th | |||
| 0003c290:·6520·7379·7374·656d·2072·656c·6174·6564··e·system·related | |||
| 0003c2a0:·2063·6f6e·6669·6720·6669·6c65·7329·2061···config·files)·a | |||
| 0003c2b0:·6e64·2074·6865·6e20·6765·7420·6669·6c65··nd·then·get·file | |||
| 0003c2c0:·7320·6e61·6d65·730a·6669·6c65·735f·7769··s·names.files_wi | |||
| 0003c2d0:·7468·5f69·6e63·6f72·7265·6374·5f68·6173··th_incorrect_has | |||
| 0003c2e0:·683d·2224·2872·706d·202d·5661·202d·2d6e··h="$(rpm·-Va·--n | |||
| 0003c2f0:·6f63·6f6e·6669·6720·7c20·6772·6570·202d··oconfig·|·grep·- | |||
| 0003c300:·4520·275e·2e2e·3527·207c·2061·776b·2027··E·'^..5'·|·awk·' | |||
| 0003c310:·7b70·7269·6e74·2024·4e46·7d27·2029·220a··{print·$NF}'·)". | |||
| 0003c320:·0a23·2046·726f·6d20·6669·6c65·7320·6e61··.#·From·files·na | |||
| 0003c330:·6d65·7320·6765·7420·7061·636b·6167·6520··mes·get·package· | |||
| 0003c340:·6e61·6d65·7320·616e·6420·6368·616e·6765··names·and·change | |||
| 0003c350:·206e·6577·6c69·6e65·2074·6f20·7370·6163···newline·to·spac | |||
| 0003c360:·652c·2062·6563·6175·7365·2072·706d·2077··e,·because·rpm·w | |||
| 0003c370:·7269·7465·7320·6561·6368·2070·6163·6b61··rites·each·packa | |||
| 0003c380:·6765·2074·6f20·6e65·7720·6c69·6e65·0a70··ge·to·new·line.p | |||
| 0003c390:·6163·6b61·6765·735f·746f·5f72·6569·6e73··ackages_to_reins | |||
| 0003c3a0:·7461·6c6c·3d22·2428·7270·6d20·2d71·6620··tall="$(rpm·-qf· | |||
| 0003c3b0:·2466·696c·6573·5f77·6974·685f·696e·636f··$files_with_inco | |||
| 0003c3c0:·7272·6563·745f·6861·7368·207c·2074·7220··rrect_hash·|·tr· | |||
| 0003c3d0:·275c·6e27·2027·2027·2922·0a0a·0a79·756d··'\n'·'·')"...yum | |||
| 0003c3e0:·2072·6569·6e73·7461·6c6c·202d·7920·2470···reinstall·-y·$p | |||
| 0003c3f0:·6163·6b61·6765·735f·746f·5f72·6569·6e73··ackages_to_reins | |||
| 0003c400:·7461·6c6c·0a3c·2f63·6f64·653e·3c2f·7072··tall.</code></pr | |||
| 0003c410:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c420:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c430:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c440:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c450:·6172·6765·743d·2223·6964·6d39·3230·3222··arget="#idm9202" | |||
| 0003c460:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c470:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c480:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c490:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c4a0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c4b0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c4c0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003c4d0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c4e0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c4f0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c500:·6522·2069·643d·2269·646d·3932·3032·223e··e"·id="idm9202"> | |||
| 0003c510:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c520:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c530:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c540:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c550:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c560:·7869·7479·3a3c·2f74·683e·3c74·643e·6869··xity:</th><td>hi | |||
| 0003c570:·6768·3c2f·7464·3e3c·2f74·723e·3c74·723e··gh</td></tr><tr> | |||
| 0003c580:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c590:·2f74·683e·3c74·643e·6d65·6469·756d·3c2f··/th><td>medium</ | |||
| 0003c5a0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c5b0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003c5c0:·643e·7265·7374·7269·6374·3c2f·7464·3e3c··d>restrict</td>< | |||
| 0003c5d0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c5e0:·3e3c·636f·6465·3e2d·206e·616d·653a·2027··><code>-·name:·' | |||
| 0003c5f0:·5365·7420·6661·6374·3a20·5061·636b·6167··Set·fact:·Packag | |||
| 0003c | 0003c600:·6520·6d61·6e61·6765·7220·7265·696e·7374··e·manager·reinst | ||
| 0003c610:·616c·6c20·636f·6d6d·616e·6420·2864·6e66··all·command·(dnf | |||
| 0003c620:·2927·0a20·2073·6574·5f66·6163·743a·0a20··)'.··set_fact:.· | |||
| 0003c630:·2020·2070·6163·6b61·6765·5f6d·616e·6167·····package_manag | |||
| 0003c640:·6572·5f72·6569·6e73·7461·6c6c·5f63·6d64··er_reinstall_cmd | |||
| 0003c650:·3a20·646e·6620·7265·696e·7374·616c·6c20··:·dnf·reinstall· | |||
| 0003c660:·2d79·0a20·2077·6865·6e3a·2061·6e73·6962··-y.··when:·ansib | |||
| 0003c380:·6c5f·636d·643a·2064·6e66·2072·6569·6e73··l_cmd:·dnf·reins | |||
| 0003c390:·7461·6c6c·202d·790a·2020·7768·656e·3a20··tall·-y.··when:· | |||
| 0003c3a0:·616e·7369·626c·655f·6469·7374·7269·6275··ansible_distribu | |||
| 0003c3b0:·7469·6f6e·203d·3d20·2246·6564·6f72·6122··tion·==·"Fedora" | |||
| 0003c3c0:·0a20·2074·6167·733a·0a20·202d·2043·4345··.··tags:.··-·CCE | |||
| 0003c3d0:·2d32·3731·3537·2d37·0a20·202d·2043·4a49··-27157-7.··-·CJI | |||
| 0003c3e0:·532d·352e·3130·2e34·2e31·0a20·202d·2044··S-5.10.4.1.··-·D | |||
| 0003c3f0:·4953·412d·5354·4947·2d52·4845·4c2d·3037··ISA-STIG-RHEL-07 | |||
| 0003c400:·2d30·3130·3032·300a·2020·2d20·4e49·5354··-010020.··-·NIST | |||
| Max diff block lines reached; 19682498/19729196 bytes (99.76%) of diff not shown. | |||
| Offset 14388, 15 lines modified | Offset 14388, 15 lines modified | ||
| 00038330:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00038330:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00038340:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00038340:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00038350:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00038350:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00038360:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00038360:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00038370:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00038370:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00038380:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00038380:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00038390:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00038390:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 000383a0:·206f·6620·3230·323 | 000383a0:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 000383b0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000383b0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000383c0:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 000383c0:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 000383d0:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 000383d0:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 000383e0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 000383e0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 000383f0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 000383f0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00038400:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00038400:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00038410:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00038410:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15404, 340 lines modified | Offset 15404, 340 lines modified | ||
| 0003c2b0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003c2b0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c2c0:·6d39·3230·3122·2074·6162·696e·6465·783d··m9201"·tabindex= | 0003c2c0:·6d39·3230·3122·2074·6162·696e·6465·783d··m9201"·tabindex= | ||
| 0003c2d0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003c2d0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003c2e0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003c2e0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003c2f0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003c2f0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003c300:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003c300:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003c310:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003c310:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003c320:·6564·6961·7469·6f6e·20 | 0003c320:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0003c330:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003c340:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c350:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c360:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c370:·3932·3031·223e·3c74·6162·6c65·2063·6c61··9201"><table·cla | |||
| 0003c380:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003c390:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003c3a0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003c3b0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003c3c0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003c3d0:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003c3e0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003c3f0:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003c400:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003c410:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003c420:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003c430:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c440:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003c450:·616d·653a·2027·5365·7420·6661·6374·3a20··ame:·'Set·fact:· | |||
| 0003c460:·5061·636b·6167·6520·6d61·6e61·6765·7220··Package·manager· | |||
| 0003c470:·7265·696e·7374·616c·6c20·636f·6d6d·616e··reinstall·comman | |||
| 0003c480:·6420·2864·6e66·2927·0a20·2073·6574·5f66··d·(dnf)'.··set_f | |||
| 0003c | 0003c330:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | ||
| 0003c340:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c350:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c360:·6170·7365·2220·6964·3d22·6964·6d39·3230··apse"·id="idm920 | |||
| 0003c370:·3122·3e3c·7072·653e·3c63·6f64·653e·0a23··1"><pre><code>.# | |||
| 0003c380:·2046·696e·6420·7768·6963·6820·6669·6c65···Find·which·file | |||
| 0003c390:·7320·6861·7665·2069·6e63·6f72·7265·6374··s·have·incorrect | |||
| 0003c3a0:·2068·6173·6820·286e·6f74·2069·6e20·2f65···hash·(not·in·/e | |||
| 0003c3b0:·7463·2c20·6265·6361·7573·6520·6f66·2074··tc,·because·of·t | |||
| 0003c3c0:·6865·2073·7973·7465·6d20·7265·6c61·7465··he·system·relate | |||
| 0003c3d0:·6420·636f·6e66·6967·2066·696c·6573·2920··d·config·files)· | |||
| 0003c3e0:·616e·6420·7468·656e·2067·6574·2066·696c··and·then·get·fil | |||
| 0003c3f0:·6573·206e·616d·6573·0a66·696c·6573·5f77··es·names.files_w | |||
| 0003c400:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003c410:·7368·3d22·2428·7270·6d20·2d56·6120·2d2d··sh="$(rpm·-Va·-- | |||
| 0003c420:·6e6f·636f·6e66·6967·207c·2067·7265·7020··noconfig·|·grep· | |||
| 0003c430:·2d45·2027·5e2e·2e35·2720·7c20·6177·6b20··-E·'^..5'·|·awk· | |||
| 0003c440:·277b·7072·696e·7420·244e·467d·2720·2922··'{print·$NF}'·)" | |||
| 0003c450:·0a0a·2320·4672·6f6d·2066·696c·6573·206e··..#·From·files·n | |||
| 0003c460:·616d·6573·2067·6574·2070·6163·6b61·6765··ames·get·package | |||
| 0003c470:·206e·616d·6573·2061·6e64·2063·6861·6e67···names·and·chang | |||
| 0003c480:·6520·6e65·776c·696e·6520·746f·2073·7061··e·newline·to·spa | |||
| 0003c490:·6365·2c20·6265·6361·7573·6520·7270·6d20··ce,·because·rpm· | |||
| 0003c4a0:·7772·6974·6573·2065·6163·6820·7061·636b··writes·each·pack | |||
| 0003c4b0:·6167·6520·746f·206e·6577·206c·696e·650a··age·to·new·line. | |||
| 0003c4c0:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003c4d0:·7374·616c·6c3d·2224·2872·706d·202d·7166··stall="$(rpm·-qf | |||
| 0003c4e0:·2024·6669·6c65·735f·7769·7468·5f69·6e63···$files_with_inc | |||
| 0003c4f0:·6f72·7265·6374·5f68·6173·6820·7c20·7472··orrect_hash·|·tr | |||
| 0003c500:·2027·5c6e·2720·2720·2729·220a·0a0a·7975···'\n'·'·')"...yu | |||
| 0003c510:·6d20·7265·696e·7374·616c·6c20·2d79·2024··m·reinstall·-y·$ | |||
| 0003c520:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003c530:·7374·616c·6c0a·3c2f·636f·6465·3e3c·2f70··stall.</code></p | |||
| 0003c540:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c550:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c560:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c570:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c580:·7461·7267·6574·3d22·2369·646d·3932·3032··target="#idm9202 | |||
| 0003c590:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c5a0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c5b0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c5c0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c5d0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c5e0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c5f0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003c600:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c610:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c620:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c630:·7365·2220·6964·3d22·6964·6d39·3230·3222··se"·id="idm9202" | |||
| 0003c640:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c650:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c660:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c670:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c680:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c690:·6578·6974·793a·3c2f·7468·3e3c·7464·3e68··exity:</th><td>h | |||
| 0003c6a0:·6967·683c·2f74·643e·3c2f·7472·3e3c·7472··igh</td></tr><tr | |||
| 0003c6b0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c6c0:·3c2f·7468·3e3c·7464·3e6d·6564·6975·6d3c··</th><td>medium< | |||
| 0003c6d0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c6e0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c6f0:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 0003c700:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c710:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003c720:·2753·6574·2066·6163·743a·2050·6163·6b61··'Set·fact:·Packa | |||
| 0003c | 0003c730:·6765·206d·616e·6167·6572·2072·6569·6e73··ge·manager·reins | ||
| 0003c740:·7461·6c6c·2063·6f6d·6d61·6e64·2028·646e··tall·command·(dn | |||
| 0003c750:·6629·270a·2020·7365·745f·6661·6374·3a0a··f)'.··set_fact:. | |||
| 0003c760:·2020·2020·7061·636b·6167·655f·6d61·6e61······package_mana | |||
| 0003c770:·6765·725f·7265·696e·7374·616c·6c5f·636d··ger_reinstall_cm | |||
| 0003c780:·643a·2064·6e66·2072·6569·6e73·7461·6c6c··d:·dnf·reinstall | |||
| 0003c790:·202d·790a·2020·7768·656e·3a20·616e·7369···-y.··when:·ansi | |||
| 0003c4b0:·6c6c·5f63·6d64·3a20·646e·6620·7265·696e··ll_cmd:·dnf·rein | |||
| 0003c4c0:·7374·616c·6c20·2d79·0a20·2077·6865·6e3a··stall·-y.··when: | |||
| 0003c4d0:·2061·6e73·6962·6c65·5f64·6973·7472·6962···ansible_distrib | |||
| 0003c4e0:·7574·696f·6e20·3d3d·2022·4665·646f·7261··ution·==·"Fedora | |||
| 0003c4f0:·220a·2020·7461·6773·3a0a·2020·2d20·4343··".··tags:.··-·CC | |||
| 0003c500:·452d·3237·3135·372d·370a·2020·2d20·434a··E-27157-7.··-·CJ | |||
| 0003c510:·4953·2d35·2e31·302e·342e·310a·2020·2d20··IS-5.10.4.1.··-· | |||
| 0003c520:·4449·5341·2d53·5449·472d·5248·454c·2d30··DISA-STIG-RHEL-0 | |||
| 0003c530:·372d·3031·3030·3230·0a20·202d·204e·4953··7-010020.··-·NIS | |||
| 0003c540:·542d·3830·302d·3137·312d·332e·332e·380a··T-800-171-3.3.8. | |||
| Max diff block lines reached; 19664735/19711433 bytes (99.76%) of diff not shown. | |||
| Offset 14441, 15 lines modified | Offset 14441, 15 lines modified | ||
| 00038680:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038680:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038690:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038690:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 000386a0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 000386a0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 000386b0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 000386b0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 000386c0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 000386c0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 000386d0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 000386d0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 000386e0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 000386e0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 000386f0:·3 | 000386f0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038700:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038700:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038710:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038710:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038720:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038720:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038730:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038730:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00038740:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00038740:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00038750:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00038750:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00038760:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00038760:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15398, 193 lines modified | Offset 15398, 193 lines modified | ||
| 0003c250:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003c250:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c260:·743d·2223·6964·6d38·3532·3122·2074·6162··t="#idm8521"·tab | 0003c260:·743d·2223·6964·6d38·3532·3122·2074·6162··t="#idm8521"·tab | ||
| 0003c270:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003c270:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003c280:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003c280:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003c290:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003c290:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003c2a0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003c2a0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003c2b0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003c2b0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003c2c0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003c2c0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | ||
| 0003c2d0:·6e61·636f·6e64·6120·736e·6970·7065·7420··naconda·snippet· | |||
| 0003c2e0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c2f0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c300:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c310:·6964·3d22·6964·6d38·3532·3122·3e3c·7461··id="idm8521"><ta | |||
| 0003c320:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c330:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c340:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c350:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c360:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c370:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003c380:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c390:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003c3a0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c3b0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003c3c0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003c3d0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003c3e0:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a70··le><pre><code>.p | |||
| 0003c3f0:·6163·6b61·6765·202d·2d61·6464·3d61·6964··ackage·--add=aid | |||
| 0003c400:·650a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··e.</code></pre>< | |||
| 0003c410:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c420:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c430:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c440:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c450:·6574·3d22·2369·646d·3835·3232·2220·7461··et="#idm8522"·ta | |||
| 0003c460:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c470:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c480:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c490:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c4a0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c4b0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003c4c0:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003c4d0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c4e0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c4f0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c500:·643d·2269·646d·3835·3232·223e·3c74·6162··d="idm8522"><tab | |||
| 0003c510:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c520:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c530:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c540:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c550:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c560:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c570:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c580:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c590:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c5a0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c5b0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c5c0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c5d0:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | |||
| 0003c5e0:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003c5f0:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003c600:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003c610:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003c620:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003c630:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003c640:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c650:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c660:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c670:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c680:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c690:·3d22·2369·646d·3835·3233·2220·7461·6269··="#idm8523"·tabi | |||
| 0003c6a0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c6b0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c6c0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c6d0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c6e0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c6f0:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003c | 0003c2d0:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | ||
| 0003c | 0003c2e0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | ||
| 0003c | 0003c2f0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | ||
| 0003c | 0003c300:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | ||
| 0003c | 0003c310:·3d22·6964·6d38·3532·3122·3e3c·7461·626c··="idm8521"><tabl | ||
| 0003c | 0003c320:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | ||
| 0003c | 0003c330:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | ||
| 0003c | 0003c340:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | ||
| 0003c | 0003c350:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | ||
| 0003c | 0003c360:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | ||
| 0003c | 0003c370:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003c | 0003c380:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | ||
| 0003c | 0003c390:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | ||
| 0003c | 0003c3a0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003c | 0003c3b0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | ||
| 0003c | 0003c3c0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | ||
| 0003c | 0003c3d0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | ||
| 0003c3e0:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003c3f0:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003c400:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003c410:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003c420:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003c430:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003c440:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003c450:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003c460:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003c470:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003c480:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003c490:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003c4a0:·2223·6964·6d38·3532·3222·2074·6162·696e··"#idm8522"·tabin | |||
| 0003c4b0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003c4c0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003c4d0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003c4e0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003c4f0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003c500:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | |||
| Max diff block lines reached; 6843619/6870031 bytes (99.62%) of diff not shown. | |||
| Offset 54, 15 lines modified | Offset 54, 15 lines modified | ||
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:8 | 58 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 59 | *****·Revision·History·***** | 59 | *****·Revision·History·***** |
| 60 | Current·version:·0.1.65 | 60 | Current·version:·0.1.65 |
| 61 | ····*·draft·(as·of·202 | 61 | ····*·draft·(as·of·2025-02-23) |
| 62 | *****·Table·of·Contents·***** | 62 | *****·Table·of·Contents·***** |
| 63 | ···1.·System_Settings | 63 | ···1.·System_Settings |
| 64 | ·········1.·Installing_and_Maintaining_Software | 64 | ·········1.·Installing_and_Maintaining_Software |
| 65 | ·········2.·Account_and_Access_Control | 65 | ·········2.·Account_and_Access_Control |
| 66 | ·········3.·System_Accounting_with_auditd | 66 | ·········3.·System_Accounting_with_auditd |
| 67 | ·········4.·GRUB2_bootloader_configuration | 67 | ·········4.·GRUB2_bootloader_configuration |
| 68 | ·········5.·Configure_Syslog | 68 | ·········5.·Configure_Syslog |
| Offset 95, 31 lines modified | Offset 95, 39 lines modified | ||
| 95 | $·sudo·yum·install·aide | 95 | $·sudo·yum·install·aide |
| 96 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 96 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 97 | Severity: ·medium | 97 | Severity: ·medium |
| 98 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 98 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 99 | Identifiers·Identifiers: ·CCE-80844-4 | 99 | Identifiers·Identifiers: ·CCE-80844-4 |
| 100 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 100 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 101 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 101 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 102 | Remediation_Anaconda_snippet_⇲ | ||
| 103 | Complexity:·low | ||
| 104 | Disruption:·low | ||
| 105 | Strategy:···enable | ||
| 106 | package·--add=aide | ||
| 107 | Remediation_Puppet_snippet_⇲ | 102 | Remediation_Puppet_snippet_⇲ |
| 108 | Complexity:·low | 103 | Complexity:·low |
| 109 | Disruption:·low | 104 | Disruption:·low |
| 110 | Strategy:···enable | 105 | Strategy:···enable |
| 111 | include·install_aide | 106 | include·install_aide |
| 112 | class·install_aide·{ | 107 | class·install_aide·{ |
| 113 | ··package·{·'aide': | 108 | ··package·{·'aide': |
| 114 | ····ensure·=>·'installed', | 109 | ····ensure·=>·'installed', |
| 115 | ··} | 110 | ··} |
| 116 | } | 111 | } |
| 112 | Remediation_Shell_script_⇲ | ||
| 113 | Complexity:·low | ||
| 114 | Disruption:·low | ||
| 115 | Strategy:···enable | ||
| 116 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 117 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 118 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 119 | ····yum·install·-y·"aide" | ||
| 120 | fi | ||
| 121 | else | ||
| 122 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 123 | fi | ||
| 117 | Remediation_Ansible_snippet_⇲ | 124 | Remediation_Ansible_snippet_⇲ |
| 118 | Complexity:·low | 125 | Complexity:·low |
| 119 | Disruption:·low | 126 | Disruption:·low |
| 120 | Strategy:···enable | 127 | Strategy:···enable |
| 121 | -·name:·Ensure·aide·is·installed | 128 | -·name:·Ensure·aide·is·installed |
| 122 | ··package: | 129 | ··package: |
| 123 | ····name:·aide | 130 | ····name:·aide |
| Offset 138, 42 lines modified | Offset 146, 48 lines modified | ||
| 138 | ··-·no_reboot_needed | 146 | ··-·no_reboot_needed |
| 139 | ··-·package_aide_installed | 147 | ··-·package_aide_installed |
| 140 | Remediation_OSBuild_Blueprint_snippet_⇲ | 148 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 141 | [[packages]] | 149 | [[packages]] |
| 142 | name·=·"aide" | 150 | name·=·"aide" |
| 143 | version·=·"*" | 151 | version·=·"*" |
| 144 | Remediation_ | 152 | Remediation_Anaconda_snippet_⇲ |
| 145 | Complexity:·low | 153 | Complexity:·low |
| 146 | Disruption:·low | 154 | Disruption:·low |
| 147 | Strategy:···enable | 155 | Strategy:···enable |
| 148 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 149 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 156 | package·--add=aide | ||
| 150 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 151 | ····yum·install·-y·"aide" | ||
| 152 | fi | ||
| 153 | else | ||
| 154 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 155 | fi | ||
| 156 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 157 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 157 | Run·the·following·command·to·generate·a·new·database: | 158 | Run·the·following·command·to·generate·a·new·database: |
| 158 | $·sudo·/usr/sbin/aide·--init | 159 | $·sudo·/usr/sbin/aide·--init |
| 159 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 160 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 160 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 161 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 161 | To·initiate·a·manual·check,·run·the·following·command: | 162 | To·initiate·a·manual·check,·run·the·following·command: |
| 162 | $·sudo·/usr/sbin/aide·--check | 163 | $·sudo·/usr/sbin/aide·--check |
| 163 | If·this·check·produces·any·unexpected·output,·investigate. | 164 | If·this·check·produces·any·unexpected·output,·investigate. |
| 164 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 165 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 165 | Severity: ·medium | 166 | Severity: ·medium |
| 166 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 167 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 167 | Identifiers·Identifiers: ·CCE-80675-2 | 168 | Identifiers·Identifiers: ·CCE-80675-2 |
| 168 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 169 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 169 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 170 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 171 | Remediation_Shell_script_⇲ | ||
| 172 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 173 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 174 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 175 | ····yum·install·-y·"aide" | ||
| 176 | fi | ||
| 177 | /usr/sbin/aide·--init | ||
| 178 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 179 | else | ||
| 180 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 181 | fi | ||
| 170 | Remediation_Ansible_snippet_⇲ | 182 | Remediation_Ansible_snippet_⇲ |
| 171 | Complexity:·low | 183 | Complexity:·low |
| 172 | Disruption:·low | 184 | Disruption:·low |
| 173 | Strategy:···restrict | 185 | Strategy:···restrict |
| 174 | -·name:·Ensure·AIDE·is·installed | 186 | -·name:·Ensure·AIDE·is·installed |
| 175 | ··package: | 187 | ··package: |
| 176 | ····name:·'{{·item·}}' | 188 | ····name:·'{{·item·}}' |
| Offset 242, 244 lines modified | Offset 256, 238 lines modified | ||
| 242 | ··-·PCI-DSS-Req-11.5 | 256 | ··-·PCI-DSS-Req-11.5 |
| 243 | ··-·aide_build_database | 257 | ··-·aide_build_database |
| 244 | ··-·low_complexity | 258 | ··-·low_complexity |
| 245 | ··-·low_disruption | 259 | ··-·low_disruption |
| 246 | ··-·medium_severity | 260 | ··-·medium_severity |
| 247 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 248 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| Max diff block lines reached; 785874/791611 bytes (99.28%) of diff not shown. | |||
| Offset 14440, 15 lines modified | Offset 14440, 15 lines modified | ||
| 00038670:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038670:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00038680:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00038680:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038690:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038690:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 000386a0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 000386a0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 000386b0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 000386b0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 000386c0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 000386c0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 000386d0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 000386d0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 000386e0:·3 | 000386e0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 000386f0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 000386f0:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038700:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038700:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038710:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038710:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038720:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038720:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00038730:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00038730:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00038740:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00038740:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00038750:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00038750:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15397, 193 lines modified | Offset 15397, 193 lines modified | ||
| 0003c240:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003c240:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c250:·743d·2223·6964·6d38·3532·3122·2074·6162··t="#idm8521"·tab | 0003c250:·743d·2223·6964·6d38·3532·3122·2074·6162··t="#idm8521"·tab | ||
| 0003c260:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003c260:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003c270:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003c270:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003c280:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003c280:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003c290:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003c290:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003c2a0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003c2a0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003c2b0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003c2b0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | ||
| 0003c2c0:·6e61·636f·6e64·6120·736e·6970·7065·7420··naconda·snippet· | |||
| 0003c2d0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c2e0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c2f0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c300:·6964·3d22·6964·6d38·3532·3122·3e3c·7461··id="idm8521"><ta | |||
| 0003c310:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c320:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c330:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c340:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c350:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c360:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003c370:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c380:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003c390:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c3a0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003c3b0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003c3c0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003c3d0:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a70··le><pre><code>.p | |||
| 0003c3e0:·6163·6b61·6765·202d·2d61·6464·3d61·6964··ackage·--add=aid | |||
| 0003c3f0:·650a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··e.</code></pre>< | |||
| 0003c400:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c410:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c420:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c430:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c440:·6574·3d22·2369·646d·3835·3232·2220·7461··et="#idm8522"·ta | |||
| 0003c450:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c460:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c470:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c480:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c490:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c4a0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003c4b0:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003c4c0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c4d0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c4e0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c4f0:·643d·2269·646d·3835·3232·223e·3c74·6162··d="idm8522"><tab | |||
| 0003c500:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c510:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c520:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c530:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c540:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c550:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c560:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c570:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c580:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c590:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c5a0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c5b0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c5c0:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | |||
| 0003c5d0:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003c5e0:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003c5f0:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003c600:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003c610:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003c620:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003c630:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c640:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c650:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c660:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c670:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c680:·3d22·2369·646d·3835·3233·2220·7461·6269··="#idm8523"·tabi | |||
| 0003c690:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c6a0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c6b0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c6c0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c6d0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c6e0:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003c | 0003c2c0:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | ||
| 0003c | 0003c2d0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | ||
| 0003c | 0003c2e0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | ||
| 0003c | 0003c2f0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | ||
| 0003c | 0003c300:·3d22·6964·6d38·3532·3122·3e3c·7461·626c··="idm8521"><tabl | ||
| 0003c | 0003c310:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | ||
| 0003c | 0003c320:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | ||
| 0003c | 0003c330:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | ||
| 0003c | 0003c340:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | ||
| 0003c | 0003c350:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | ||
| 0003c | 0003c360:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003c | 0003c370:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | ||
| 0003c | 0003c380:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | ||
| 0003c | 0003c390:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003c | 0003c3a0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | ||
| 0003c | 0003c3b0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | ||
| 0003c | 0003c3c0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | ||
| 0003c | 0003c3d0:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | ||
| 0003c810:·6d65·3a20·456e·7375·7265·2061·6964·6520··me:·Ensure·aide· | |||
| 0003c820:·6973·2069·6e73·7461·6c6c·6564·0a20·2070··is·installed.··p | |||
| 0003c830:·6163·6b61·6765·3a0a·2020·2020·6e61·6d65··ackage:.····name | |||
| 0003c840:·3a20·6169·6465·0a20·2020·2073·7461·7465··:·aide.····state | |||
| 0003c850:·3a20·7072·6573·656e·740a·2020·7768·656e··:·present.··when | |||
| 0003c860:·3a20·616e·7369·626c·655f·7669·7274·7561··:·ansible_virtua | |||
| 0003c870:·6c69·7a61·7469·6f6e·5f74·7970·6520·6e6f··lization_type·no | |||
| 0003c880:·7420·696e·205b·2264·6f63·6b65·7222·2c20··t·in·["docker",· | |||
| 0003c890:·226c·7863·222c·2022·6f70·656e·767a·222c··"lxc",·"openvz", | |||
| 0003c8a0:·2022·706f·646d·616e·222c·2022·636f·6e74···"podman",·"cont | |||
| 0003c8b0:·6169·6e65·7222·5d0a·2020·7461·6773·3a0a··ainer"].··tags:. | |||
| 0003c8c0:·2020·2d20·4343·452d·3830·3834·342d·340a····-·CCE-80844-4. | |||
| 0003c8d0:·2020·2d20·434a·4953·2d35·2e31·302e·312e····-·CJIS-5.10.1. | |||
| 0003c8e0:·330a·2020·2d20·4449·5341·2d53·5449·472d··3.··-·DISA-STIG- | |||
| 0003c8f0:·5248·454c·2d30·382d·3031·3033·3539·0a20··RHEL-08-010359.· | |||
| 0003c900:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003c910:·4d2d·3628·6129·0a20·202d·2050·4349·2d44··M-6(a).··-·PCI-D | |||
| 0003c920:·5353·2d52·6571·2d31·312e·350a·2020·2d20··SS-Req-11.5.··-· | |||
| Max diff block lines reached; 7072240/7098652 bytes (99.63%) of diff not shown. | |||
| Offset 54, 15 lines modified | Offset 54, 15 lines modified | ||
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:8 | 58 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 59 | *****·Revision·History·***** | 59 | *****·Revision·History·***** |
| 60 | Current·version:·0.1.65 | 60 | Current·version:·0.1.65 |
| 61 | ····*·draft·(as·of·202 | 61 | ····*·draft·(as·of·2025-02-23) |
| 62 | *****·Table·of·Contents·***** | 62 | *****·Table·of·Contents·***** |
| 63 | ···1.·System_Settings | 63 | ···1.·System_Settings |
| 64 | ·········1.·Installing_and_Maintaining_Software | 64 | ·········1.·Installing_and_Maintaining_Software |
| 65 | ·········2.·Account_and_Access_Control | 65 | ·········2.·Account_and_Access_Control |
| 66 | ·········3.·System_Accounting_with_auditd | 66 | ·········3.·System_Accounting_with_auditd |
| 67 | ·········4.·GRUB2_bootloader_configuration | 67 | ·········4.·GRUB2_bootloader_configuration |
| 68 | ·········5.·Configure_Syslog | 68 | ·········5.·Configure_Syslog |
| Offset 95, 31 lines modified | Offset 95, 39 lines modified | ||
| 95 | $·sudo·yum·install·aide | 95 | $·sudo·yum·install·aide |
| 96 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 96 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 97 | Severity: ·medium | 97 | Severity: ·medium |
| 98 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 98 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 99 | Identifiers·Identifiers: ·CCE-80844-4 | 99 | Identifiers·Identifiers: ·CCE-80844-4 |
| 100 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 100 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 101 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 101 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 102 | Remediation_Anaconda_snippet_⇲ | ||
| 103 | Complexity:·low | ||
| 104 | Disruption:·low | ||
| 105 | Strategy:···enable | ||
| 106 | package·--add=aide | ||
| 107 | Remediation_Puppet_snippet_⇲ | 102 | Remediation_Puppet_snippet_⇲ |
| 108 | Complexity:·low | 103 | Complexity:·low |
| 109 | Disruption:·low | 104 | Disruption:·low |
| 110 | Strategy:···enable | 105 | Strategy:···enable |
| 111 | include·install_aide | 106 | include·install_aide |
| 112 | class·install_aide·{ | 107 | class·install_aide·{ |
| 113 | ··package·{·'aide': | 108 | ··package·{·'aide': |
| 114 | ····ensure·=>·'installed', | 109 | ····ensure·=>·'installed', |
| 115 | ··} | 110 | ··} |
| 116 | } | 111 | } |
| 112 | Remediation_Shell_script_⇲ | ||
| 113 | Complexity:·low | ||
| 114 | Disruption:·low | ||
| 115 | Strategy:···enable | ||
| 116 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 117 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 118 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 119 | ····yum·install·-y·"aide" | ||
| 120 | fi | ||
| 121 | else | ||
| 122 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 123 | fi | ||
| 117 | Remediation_Ansible_snippet_⇲ | 124 | Remediation_Ansible_snippet_⇲ |
| 118 | Complexity:·low | 125 | Complexity:·low |
| 119 | Disruption:·low | 126 | Disruption:·low |
| 120 | Strategy:···enable | 127 | Strategy:···enable |
| 121 | -·name:·Ensure·aide·is·installed | 128 | -·name:·Ensure·aide·is·installed |
| 122 | ··package: | 129 | ··package: |
| 123 | ····name:·aide | 130 | ····name:·aide |
| Offset 138, 42 lines modified | Offset 146, 48 lines modified | ||
| 138 | ··-·no_reboot_needed | 146 | ··-·no_reboot_needed |
| 139 | ··-·package_aide_installed | 147 | ··-·package_aide_installed |
| 140 | Remediation_OSBuild_Blueprint_snippet_⇲ | 148 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 141 | [[packages]] | 149 | [[packages]] |
| 142 | name·=·"aide" | 150 | name·=·"aide" |
| 143 | version·=·"*" | 151 | version·=·"*" |
| 144 | Remediation_ | 152 | Remediation_Anaconda_snippet_⇲ |
| 145 | Complexity:·low | 153 | Complexity:·low |
| 146 | Disruption:·low | 154 | Disruption:·low |
| 147 | Strategy:···enable | 155 | Strategy:···enable |
| 148 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 149 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 156 | package·--add=aide | ||
| 150 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 151 | ····yum·install·-y·"aide" | ||
| 152 | fi | ||
| 153 | else | ||
| 154 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 155 | fi | ||
| 156 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 157 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 157 | Run·the·following·command·to·generate·a·new·database: | 158 | Run·the·following·command·to·generate·a·new·database: |
| 158 | $·sudo·/usr/sbin/aide·--init | 159 | $·sudo·/usr/sbin/aide·--init |
| 159 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 160 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 160 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 161 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 161 | To·initiate·a·manual·check,·run·the·following·command: | 162 | To·initiate·a·manual·check,·run·the·following·command: |
| 162 | $·sudo·/usr/sbin/aide·--check | 163 | $·sudo·/usr/sbin/aide·--check |
| 163 | If·this·check·produces·any·unexpected·output,·investigate. | 164 | If·this·check·produces·any·unexpected·output,·investigate. |
| 164 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 165 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 165 | Severity: ·medium | 166 | Severity: ·medium |
| 166 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 167 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 167 | Identifiers·Identifiers: ·CCE-80675-2 | 168 | Identifiers·Identifiers: ·CCE-80675-2 |
| 168 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 169 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 169 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 170 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 171 | Remediation_Shell_script_⇲ | ||
| 172 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 173 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 174 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 175 | ····yum·install·-y·"aide" | ||
| 176 | fi | ||
| 177 | /usr/sbin/aide·--init | ||
| 178 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 179 | else | ||
| 180 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 181 | fi | ||
| 170 | Remediation_Ansible_snippet_⇲ | 182 | Remediation_Ansible_snippet_⇲ |
| 171 | Complexity:·low | 183 | Complexity:·low |
| 172 | Disruption:·low | 184 | Disruption:·low |
| 173 | Strategy:···restrict | 185 | Strategy:···restrict |
| 174 | -·name:·Ensure·AIDE·is·installed | 186 | -·name:·Ensure·AIDE·is·installed |
| 175 | ··package: | 187 | ··package: |
| 176 | ····name:·'{{·item·}}' | 188 | ····name:·'{{·item·}}' |
| Offset 242, 28 lines modified | Offset 256, 14 lines modified | ||
| 242 | ··-·PCI-DSS-Req-11.5 | 256 | ··-·PCI-DSS-Req-11.5 |
| 243 | ··-·aide_build_database | 257 | ··-·aide_build_database |
| 244 | ··-·low_complexity | 258 | ··-·low_complexity |
| 245 | ··-·low_disruption | 259 | ··-·low_disruption |
| 246 | ··-·medium_severity | 260 | ··-·medium_severity |
| 247 | ··-·no_reboot_needed | 261 | ··-·no_reboot_needed |
| 248 | ··-·restrict_strategy | 262 | ··-·restrict_strategy |
| Max diff block lines reached; 814233/819976 bytes (99.30%) of diff not shown. | |||
| Offset 14442, 15 lines modified | Offset 14442, 15 lines modified | ||
| 00038690:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00038690:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 000386a0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 000386a0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 000386b0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 000386b0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 000386c0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 000386c0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 000386d0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 000386d0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 000386e0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 000386e0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 000386f0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 000386f0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038700:·3 | 00038700:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038710:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038710:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038720:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038720:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038730:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038730:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038740:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038740:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00038750:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00038750:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00038760:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00038760:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00038770:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00038770:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15393, 192 lines modified | Offset 15393, 192 lines modified | ||
| 0003c200:·2d74·6172·6765·743d·2223·6964·6d38·3532··-target="#idm852 | 0003c200:·2d74·6172·6765·743d·2223·6964·6d38·3532··-target="#idm852 | ||
| 0003c210:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | 0003c210:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | ||
| 0003c220:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003c220:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003c230:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003c230:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003c240:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003c240:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003c250:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003c250:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003c260:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003c260:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003c270:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003c270:·7469·6f6e·2041·6e61·636f·6e64·6120·736e··tion·Anaconda·sn | |||
| 0003c280:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c290:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c2a0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c2b0:·6170·7365·2220·6964·3d22·6964·6d38·3532··apse"·id="idm852 | |||
| 0003c2c0:·3122·3e3c·7461·626c·6520·636c·6173·733d··1"><table·class= | |||
| 0003c2d0:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003c2e0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003c2f0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003c300:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003c310:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003c320:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003c330:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003c340:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c350:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003c360:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003c370:·3e65·6e61·626c·653c·2f74·643e·3c2f·7472··>enable</td></tr | |||
| 0003c380:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003c390:·6f64·653e·0a70·6163·6b61·6765·202d·2d61··ode>.package·--a | |||
| 0003c3a0:·6464·3d61·6964·650a·3c2f·636f·6465·3e3c··dd=aide.</code>< | |||
| 0003c3b0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c3c0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c3d0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c3e0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c3f0:·612d·7461·7267·6574·3d22·2369·646d·3835··a-target="#idm85 | |||
| 0003c400:·3232·2220·7461·6269·6e64·6578·3d22·3022··22"·tabindex="0" | |||
| 0003c410:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c420:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c430:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c440:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c450:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c460:·6174·696f·6e20·5075·7070·6574·2073·6e69··ation·Puppet·sni | |||
| 0003c470:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c480:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c490:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c4a0:·7073·6522·2069·643d·2269·646d·3835·3232··pse"·id="idm8522 | |||
| 0003c4b0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c4c0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c4d0:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c4e0:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c4f0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c500:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c510:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c520:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c530:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c540:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c550:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c560:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c570:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c580:·6465·3e69·6e63·6c75·6465·2069·6e73·7461··de>include·insta | |||
| 0003c590:·6c6c·5f61·6964·650a·0a63·6c61·7373·2069··ll_aide..class·i | |||
| 0003c5a0:·6e73·7461·6c6c·5f61·6964·6520·7b0a·2020··nstall_aide·{.·· | |||
| 0003c5b0:·7061·636b·6167·6520·7b20·2761·6964·6527··package·{·'aide' | |||
| 0003c5c0:·3a0a·2020·2020·656e·7375·7265·203d·2667··:.····ensure·=&g | |||
| 0003c5d0:·743b·2027·696e·7374·616c·6c65·6427·2c0a··t;·'installed',. | |||
| 0003c5e0:·2020·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70····}.}.</code></p | |||
| 0003c5f0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c600:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c610:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c620:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c630:·7461·7267·6574·3d22·2369·646d·3835·3233··target="#idm8523 | |||
| 0003c640:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c650:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c660:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c670:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c680:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c690:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c6a0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003c | 0003c280:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | ||
| 0003c | 0003c290:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | ||
| 0003c | 0003c2a0:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | ||
| 0003c | 0003c2b0:·7365·2220·6964·3d22·6964·6d38·3532·3122··se"·id="idm8521" | ||
| 0003c | 0003c2c0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | ||
| 0003c | 0003c2d0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | ||
| 0003c | 0003c2e0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003c | 0003c2f0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003c | 0003c300:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | ||
| 0003c | 0003c310:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | ||
| 0003c | 0003c320:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003c | 0003c330:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | ||
| 0003c | 0003c340:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003c | 0003c350:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | ||
| 0003c | 0003c360:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | ||
| 0003c | 0003c370:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003c | 0003c380:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | ||
| 0003c390:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003c3a0:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003c3b0:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003c3c0:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003c3d0:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003c3e0:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003c3f0:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003c400:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c410:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c420:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c430:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c440:·6172·6765·743d·2223·6964·6d38·3532·3222··arget="#idm8522" | |||
| 0003c450:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c460:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c470:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c480:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c490:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c4a0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| Max diff block lines reached; 6590697/6616971 bytes (99.60%) of diff not shown. | |||
| Offset 54, 15 lines modified | Offset 54, 15 lines modified | ||
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:8 | 58 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 59 | *****·Revision·History·***** | 59 | *****·Revision·History·***** |
| 60 | Current·version:·0.1.65 | 60 | Current·version:·0.1.65 |
| 61 | ····*·draft·(as·of·202 | 61 | ····*·draft·(as·of·2025-02-23) |
| 62 | *****·Table·of·Contents·***** | 62 | *****·Table·of·Contents·***** |
| 63 | ···1.·System_Settings | 63 | ···1.·System_Settings |
| 64 | ·········1.·Installing_and_Maintaining_Software | 64 | ·········1.·Installing_and_Maintaining_Software |
| 65 | ·········2.·Account_and_Access_Control | 65 | ·········2.·Account_and_Access_Control |
| 66 | ·········3.·System_Accounting_with_auditd | 66 | ·········3.·System_Accounting_with_auditd |
| 67 | ·········4.·Configure_Syslog | 67 | ·········4.·Configure_Syslog |
| 68 | ·········5.·Network_Configuration_and_Firewalls | 68 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 94, 31 lines modified | Offset 94, 39 lines modified | ||
| 94 | $·sudo·yum·install·aide | 94 | $·sudo·yum·install·aide |
| 95 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 95 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 96 | Severity: ·medium | 96 | Severity: ·medium |
| 97 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 97 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 98 | Identifiers·Identifiers: ·CCE-80844-4 | 98 | Identifiers·Identifiers: ·CCE-80844-4 |
| 99 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 99 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 100 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 100 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 101 | Remediation_Anaconda_snippet_⇲ | ||
| 102 | Complexity:·low | ||
| 103 | Disruption:·low | ||
| 104 | Strategy:···enable | ||
| 105 | package·--add=aide | ||
| 106 | Remediation_Puppet_snippet_⇲ | 101 | Remediation_Puppet_snippet_⇲ |
| 107 | Complexity:·low | 102 | Complexity:·low |
| 108 | Disruption:·low | 103 | Disruption:·low |
| 109 | Strategy:···enable | 104 | Strategy:···enable |
| 110 | include·install_aide | 105 | include·install_aide |
| 111 | class·install_aide·{ | 106 | class·install_aide·{ |
| 112 | ··package·{·'aide': | 107 | ··package·{·'aide': |
| 113 | ····ensure·=>·'installed', | 108 | ····ensure·=>·'installed', |
| 114 | ··} | 109 | ··} |
| 115 | } | 110 | } |
| 111 | Remediation_Shell_script_⇲ | ||
| 112 | Complexity:·low | ||
| 113 | Disruption:·low | ||
| 114 | Strategy:···enable | ||
| 115 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 116 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 117 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 118 | ····yum·install·-y·"aide" | ||
| 119 | fi | ||
| 120 | else | ||
| 121 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 122 | fi | ||
| 116 | Remediation_Ansible_snippet_⇲ | 123 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·low | 124 | Complexity:·low |
| 118 | Disruption:·low | 125 | Disruption:·low |
| 119 | Strategy:···enable | 126 | Strategy:···enable |
| 120 | -·name:·Ensure·aide·is·installed | 127 | -·name:·Ensure·aide·is·installed |
| 121 | ··package: | 128 | ··package: |
| 122 | ····name:·aide | 129 | ····name:·aide |
| Offset 137, 42 lines modified | Offset 145, 48 lines modified | ||
| 137 | ··-·no_reboot_needed | 145 | ··-·no_reboot_needed |
| 138 | ··-·package_aide_installed | 146 | ··-·package_aide_installed |
| 139 | Remediation_OSBuild_Blueprint_snippet_⇲ | 147 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 140 | [[packages]] | 148 | [[packages]] |
| 141 | name·=·"aide" | 149 | name·=·"aide" |
| 142 | version·=·"*" | 150 | version·=·"*" |
| 143 | Remediation_ | 151 | Remediation_Anaconda_snippet_⇲ |
| 144 | Complexity:·low | 152 | Complexity:·low |
| 145 | Disruption:·low | 153 | Disruption:·low |
| 146 | Strategy:···enable | 154 | Strategy:···enable |
| 147 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 148 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 155 | package·--add=aide | ||
| 149 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 150 | ····yum·install·-y·"aide" | ||
| 151 | fi | ||
| 152 | else | ||
| 153 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 154 | fi | ||
| 155 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 156 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 156 | Run·the·following·command·to·generate·a·new·database: | 157 | Run·the·following·command·to·generate·a·new·database: |
| 157 | $·sudo·/usr/sbin/aide·--init | 158 | $·sudo·/usr/sbin/aide·--init |
| 158 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 159 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 159 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 160 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 160 | To·initiate·a·manual·check,·run·the·following·command: | 161 | To·initiate·a·manual·check,·run·the·following·command: |
| 161 | $·sudo·/usr/sbin/aide·--check | 162 | $·sudo·/usr/sbin/aide·--check |
| 162 | If·this·check·produces·any·unexpected·output,·investigate. | 163 | If·this·check·produces·any·unexpected·output,·investigate. |
| 163 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 164 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 164 | Severity: ·medium | 165 | Severity: ·medium |
| 165 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 166 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 166 | Identifiers·Identifiers: ·CCE-80675-2 | 167 | Identifiers·Identifiers: ·CCE-80675-2 |
| 167 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 168 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 168 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 169 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 170 | Remediation_Shell_script_⇲ | ||
| 171 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 172 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 173 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 174 | ····yum·install·-y·"aide" | ||
| 175 | fi | ||
| 176 | /usr/sbin/aide·--init | ||
| 177 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 178 | else | ||
| 179 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 180 | fi | ||
| 169 | Remediation_Ansible_snippet_⇲ | 181 | Remediation_Ansible_snippet_⇲ |
| 170 | Complexity:·low | 182 | Complexity:·low |
| 171 | Disruption:·low | 183 | Disruption:·low |
| 172 | Strategy:···restrict | 184 | Strategy:···restrict |
| 173 | -·name:·Ensure·AIDE·is·installed | 185 | -·name:·Ensure·AIDE·is·installed |
| 174 | ··package: | 186 | ··package: |
| 175 | ····name:·'{{·item·}}' | 187 | ····name:·'{{·item·}}' |
| Offset 241, 244 lines modified | Offset 255, 238 lines modified | ||
| 241 | ··-·PCI-DSS-Req-11.5 | 255 | ··-·PCI-DSS-Req-11.5 |
| 242 | ··-·aide_build_database | 256 | ··-·aide_build_database |
| 243 | ··-·low_complexity | 257 | ··-·low_complexity |
| 244 | ··-·low_disruption | 258 | ··-·low_disruption |
| 245 | ··-·medium_severity | 259 | ··-·medium_severity |
| 246 | ··-·no_reboot_needed | 260 | ··-·no_reboot_needed |
| 247 | ··-·restrict_strategy | 261 | ··-·restrict_strategy |
| Max diff block lines reached; 746175/751917 bytes (99.24%) of diff not shown. | |||
| Offset 14440, 16 lines modified | Offset 14440, 16 lines modified | ||
| 00038670:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038670:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038680:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038680:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00038690:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00038690:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 000386a0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 000386a0:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 000386b0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 000386b0:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 000386c0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 000386c0:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 000386d0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000386d0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000386e0:·2020·2861·7320·6f66·2032·3032·3 | 000386e0:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 000386f0:·2d32·3 | 000386f0:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038700:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038700:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00038710:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00038710:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00038720:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00038720:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00038730:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00038730:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00038740:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00038740:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00038750:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00038750:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00038760:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00038760:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15161, 145 lines modified | Offset 15161, 145 lines modified | ||
| 0003b380:·7267·6574·3d22·2369·646d·3132·3833·3222··rget="#idm12832" | 0003b380:·7267·6574·3d22·2369·646d·3132·3833·3222··rget="#idm12832" | ||
| 0003b390:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003b390:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003b3a0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003b3a0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003b3b0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003b3b0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003b3c0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003b3c0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003b3d0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003b3d0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003b3e0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003b3e0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003b3f0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003b | 0003b3f0:·6f6e·2053·6865·6c6c·2073·6372·6970·7420··on·Shell·script· | ||
| 0003b400:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b410:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b420:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b430:·6964·3d22·6964·6d31·3238·3332·223e·3c74··id="idm12832"><t | |||
| 0003b4 | 0003b440:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | ||
| 0003b420:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003b430:·6522·2069·643d·2269·646d·3132·3833·3222··e"·id="idm12832" | |||
| 0003b440:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003b450:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003b460:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003b470:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003b480:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003b4 | 0003b450:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | ||
| 0003b460:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003b470:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003b480:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003b490:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003b4a0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003b4b0:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003b4c0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003b4d0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003b4e0:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003b4 | 0003b4f0:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | ||
| 0003b500:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003b510:·3e0a·666f·7220·6620·696e·202f·6574·632f··>.for·f·in·/etc/ | |||
| 0003b520:·7375·646f·6572·7320·2f65·7463·2f73·7564··sudoers·/etc/sud | |||
| 0003b530:·6f65·7273·2e64·2f2a·203b·2064·6f0a·2020··oers.d/*·;·do.·· | |||
| 0003b540:·6966·205b·2021·202d·6520·2224·6622·205d··if·[·!·-e·"$f"·] | |||
| 0003b550:·203b·2074·6865·6e0a·2020·2020·636f·6e74···;·then.····cont | |||
| 0003b560:·696e·7565·0a20·2066·690a·2020·6d61·7463··inue.··fi.··matc | |||
| 0003b570:·6869·6e67·5f6c·6973·743d·2428·6772·6570··hing_list=$(grep | |||
| 0003b580:·202d·5020·275e·283f·2123·292e·2a5b·5c73···-P·'^(?!#).*[\s | |||
| 0003b590:·5d2b·5c21·6175·7468·656e·7469·6361·7465··]+\!authenticate | |||
| 0003b5a0:·2e2a·2427·2024·6620·7c20·756e·6971·2029··.*$'·$f·|·uniq·) | |||
| 0003b5b0:·0a20·2069·6620·2120·7465·7374·202d·7a20··.··if·!·test·-z· | |||
| 0003b5c0:·2224·6d61·7463·6869·6e67·5f6c·6973·7422··"$matching_list" | |||
| 0003b5d0:·3b20·7468·656e·0a20·2020·2077·6869·6c65··;·then.····while | |||
| 0003b5e0:·2049·4653·3d20·7265·6164·202d·7220·656e···IFS=·read·-r·en | |||
| 0003b5f0:·7472·793b·2064·6f0a·2020·2020·2020·2320··try;·do.······#· | |||
| 0003b600:·636f·6d6d·656e·7420·6f75·7420·2221·6175··comment·out·"!au | |||
| 0003b4b0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003b4c0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003b4d0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003b4e0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003b4f0:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003b500:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003b510:·6f64·653e·2d20·6e61·6d65·3a20·4669·6e64··ode>-·name:·Find | |||
| 0003b520:·202f·6574·632f·7375·646f·6572·732e·642f···/etc/sudoers.d/ | |||
| 0003b530:·2066·696c·6573·0a20·2066·696e·643a·0a20···files.··find:.· | |||
| 0003b540:·2020·2070·6174·6873·3a0a·2020·2020·2d20·····paths:.····-· | |||
| 0003b550:·2f65·7463·2f73·7564·6f65·7273·2e64·2f0a··/etc/sudoers.d/. | |||
| 0003b560:·2020·7265·6769·7374·6572·3a20·7375·646f····register:·sudo | |||
| 0003b570:·6572·730a·2020·7461·6773·3a0a·2020·2d20··ers.··tags:.··-· | |||
| 0003b580:·4343·452d·3832·3230·322d·330a·2020·2d20··CCE-82202-3.··-· | |||
| 0003b590:·4449·5341·2d53·5449·472d·5248·454c·2d30··DISA-STIG-RHEL-0 | |||
| 0003b5a0:·382d·3031·3033·3831·0a20·202d·204e·4953··8-010381.··-·NIS | |||
| 0003b5b0:·542d·3830·302d·3533·2d43·4d2d·3628·6129··T-800-53-CM-6(a) | |||
| 0003b5c0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003b5d0:·2d49·412d·3131·0a20·202d·206c·6f77·5f63··-IA-11.··-·low_c | |||
| 0003b5e0:·6f6d·706c·6578·6974·790a·2020·2d20·6c6f··omplexity.··-·lo | |||
| 0003b5f0:·775f·6469·7372·7570·7469·6f6e·0a20·202d··w_disruption.··- | |||
| 0003b600:·206d·6564·6975·6d5f·7365·7665·7269·7479···medium_severity | |||
| 0003b610:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 0003b620:·6565·6465·640a·2020·2d20·7265·7374·7269··eeded.··-·restri | |||
| 0003b630:·6374·5f73·7472·6174·6567·790a·2020·2d20··ct_strategy.··-· | |||
| 0003b640:·7375·646f·5f72·656d·6f76·655f·6e6f·5f61··sudo_remove_no_a | |||
| 0003b650:·7574·6865·6e74·6963·6174·650a·0a2d·206e··uthenticate..-·n | |||
| 0003b660:·616d·653a·2052·656d·6f76·6520·6c69·6e65··ame:·Remove·line | |||
| 0003b670:·7320·636f·6e74·6169·6e69·6e67·2021·6175··s·containing·!au | |||
| 0003b6 | 0003b610:·7468·656e·7469·6361·7465·2220·6d61·7463··thenticate"·matc | ||
| 0003b620:·6865·7320·746f·2070·7265·7365·7276·6520··hes·to·preserve· | |||
| 0003b630:·7573·6572·2064·6174·610a·2020·2020·2020··user·data.······ | |||
| 0003b640:·7365·6420·2d69·2022·732f·5e24·7b65·6e74··sed·-i·"s/^${ent | |||
| 0003b650:·7279·7d24·2f23·2026·616d·703b·2f67·2220··ry}$/#·&/g"· | |||
| 0003b660:·2466·0a20·2020·2064·6f6e·6520·266c·743b··$f.····done·< | |||
| 0003b670:·266c·743b·266c·743b·2022·246d·6174·6368··<<·"$match | |||
| 0003b680:·696e·675f·6c69·7374·220a·0a20·2020·202f··ing_list"..····/ | |||
| 0003b690:·7375·646f·6572·7320·6669·6c65·730a·2020··sudoers·files.·· | |||
| 0003b6a0:·7265·706c·6163·653a·0a20·2020·2072·6567··replace:.····reg | |||
| 0003b6b0:·6578·703a·2028·5e28·3f21·2329·2e2a·5b5c··exp:·(^(?!#).*[\ | |||
| 0003b6c0:·735d·2b5c·2161·7574·6865·6e74·6963·6174··s]+\!authenticat | |||
| 0003b6d0:·652e·2a24·290a·2020·2020·7265·706c·6163··e.*$).····replac | |||
| 0003b6e0:·653a·2027·2320·5c67·266c·743b·3126·6774··e:·'#·\g<1> | |||
| 0003b6f0:·3b27·0a20·2020·2070·6174·683a·2027·7b7b··;'.····path:·'{{ | |||
| 0003b700:·2069·7465·6d2e·7061·7468·207d·7d27·0a20···item.path·}}'.· | |||
| 0003b710:·2020·2076·616c·6964·6174·653a·202f·7573·····validate:·/us | |||
| 0003b | 0003b690:·7573·722f·7362·696e·2f76·6973·7564·6f20··usr/sbin/visudo· | ||
| 0003b6a0:·2d63·6620·2466·2026·616d·703b·2667·743b··-cf·$f·&> | |||
| 0003b6b0:·202f·6465·762f·6e75·6c6c·207c·7c20·6563···/dev/null·||·ec | |||
| 0003b6c0:·686f·2022·4661·696c·2074·6f20·7661·6c69··ho·"Fail·to·vali | |||
| 0003b6d0:·6461·7465·2024·6620·7769·7468·2076·6973··date·$f·with·vis | |||
| 0003b6e0:·7564·6f22·0a20·2066·690a·646f·6e65·0a3c··udo".··fi.done.< | |||
| 0003b6f0:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003b700:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003b710:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003b720:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003b730:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003b740:·2223·6964·6d31·3238·3333·2220·7461·6269··"#idm12833"·tabi | |||
| 0003b750:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003b760:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003b770:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| Max diff block lines reached; 2485404/2505330 bytes (99.20%) of diff not shown. | |||
| Offset 54, 15 lines modified | Offset 54, 15 lines modified | ||
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:8 | 58 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 59 | *****·Revision·History·***** | 59 | *****·Revision·History·***** |
| 60 | Current·version:·0.1.65 | 60 | Current·version:·0.1.65 |
| 61 | ····*·draft·(as·of·202 | 61 | ····*·draft·(as·of·2025-02-23) |
| 62 | *****·Table·of·Contents·***** | 62 | *****·Table·of·Contents·***** |
| 63 | ···1.·System_Settings | 63 | ···1.·System_Settings |
| 64 | ·········1.·Installing_and_Maintaining_Software | 64 | ·········1.·Installing_and_Maintaining_Software |
| 65 | ·········2.·Account_and_Access_Control | 65 | ·········2.·Account_and_Access_Control |
| 66 | ·········3.·Configure_Syslog | 66 | ·········3.·Configure_Syslog |
| 67 | ·········4.·File_Permissions_and_Masks | 67 | ·········4.·File_Permissions_and_Masks |
| 68 | ···2.·Services | 68 | ···2.·Services |
| Offset 100, 14 lines modified | Offset 100, 33 lines modified | ||
| 100 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 100 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 101 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 101 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 102 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 102 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 103 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 103 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 104 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 104 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 105 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 105 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 106 | ············000373-VMM-001490,·RHEL-08-010381,·SV-230272r854027_rule | 106 | ············000373-VMM-001490,·RHEL-08-010381,·SV-230272r854027_rule |
| 107 | Remediation_Shell_script_⇲ | ||
| 108 | Complexity:·low | ||
| 109 | Disruption:·low | ||
| 110 | Strategy:···restrict | ||
| 111 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 112 | ··if·[·!·-e·"$f"·]·;·then | ||
| 113 | ····continue | ||
| 114 | ··fi | ||
| 115 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 116 | ··if·!·test·-z·"$matching_list";·then | ||
| 117 | ····while·IFS=·read·-r·entry;·do | ||
| 118 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 119 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 120 | ····done·<<<·"$matching_list" | ||
| 121 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 122 | ··fi | ||
| 123 | done | ||
| 107 | Remediation_Ansible_snippet_⇲ | 124 | Remediation_Ansible_snippet_⇲ |
| 108 | Complexity:·low | 125 | Complexity:·low |
| 109 | Disruption:·low | 126 | Disruption:·low |
| 110 | Strategy:···restrict | 127 | Strategy:···restrict |
| 111 | -·name:·Find·/etc/sudoers.d/·files | 128 | -·name:·Find·/etc/sudoers.d/·files |
| 112 | ··find: | 129 | ··find: |
| 113 | ····paths: | 130 | ····paths: |
| Offset 141, 33 lines modified | Offset 160, 14 lines modified | ||
| 141 | ··-·NIST-800-53-IA-11 | 160 | ··-·NIST-800-53-IA-11 |
| 142 | ··-·low_complexity | 161 | ··-·low_complexity |
| 143 | ··-·low_disruption | 162 | ··-·low_disruption |
| 144 | ··-·medium_severity | 163 | ··-·medium_severity |
| 145 | ··-·no_reboot_needed | 164 | ··-·no_reboot_needed |
| 146 | ··-·restrict_strategy | 165 | ··-·restrict_strategy |
| 147 | ··-·sudo_remove_no_authenticate | 166 | ··-·sudo_remove_no_authenticate |
| 148 | Remediation_Shell_script_⇲ | ||
| 149 | Complexity:·low | ||
| 150 | Disruption:·low | ||
| 151 | Strategy:···restrict | ||
| 152 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 153 | ··if·[·!·-e·"$f"·]·;·then | ||
| 154 | ····continue | ||
| 155 | ··fi | ||
| 156 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 157 | ··if·!·test·-z·"$matching_list";·then | ||
| 158 | ····while·IFS=·read·-r·entry;·do | ||
| 159 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 160 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 161 | ····done·<<<·"$matching_list" | ||
| 162 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 163 | ··fi | ||
| 164 | done | ||
| 165 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 167 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 166 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 168 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 167 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 169 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 168 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 170 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 169 | Warning: ·This·rule·is·disabled·on·Red·Hat·Virtualization·Hosts·and·Managers,·it·will·report·not | 171 | Warning: ·This·rule·is·disabled·on·Red·Hat·Virtualization·Hosts·and·Managers,·it·will·report·not |
| 170 | applicable.·RHV·requires·to·perform·operations·as·root·without·being·asked·for·password. | 172 | applicable.·RHV·requires·to·perform·operations·as·root·without·being·asked·for·password. |
| 171 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 173 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| Offset 181, 14 lines modified | Offset 181, 33 lines modified | ||
| 181 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 181 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 182 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 182 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 183 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 183 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 184 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 184 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 185 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 185 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 186 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 186 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 187 | ············000373-VMM-001490,·RHEL-08-010380,·SV-230271r854026_rule | 187 | ············000373-VMM-001490,·RHEL-08-010380,·SV-230271r854026_rule |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | Complexity:·low | ||
| 190 | Disruption:·low | ||
| 191 | Strategy:···restrict | ||
| 192 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 193 | ··if·[·!·-e·"$f"·]·;·then | ||
| 194 | ····continue | ||
| 195 | ··fi | ||
| 196 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 197 | ··if·!·test·-z·"$matching_list";·then | ||
| 198 | ····while·IFS=·read·-r·entry;·do | ||
| 199 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 200 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 201 | ····done·<<<·"$matching_list" | ||
| 202 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 203 | ··fi | ||
| 204 | done | ||
| 188 | Remediation_Ansible_snippet_⇲ | 205 | Remediation_Ansible_snippet_⇲ |
| 189 | Complexity:·low | 206 | Complexity:·low |
| 190 | Disruption:·low | 207 | Disruption:·low |
| 191 | Strategy:···restrict | 208 | Strategy:···restrict |
| 192 | -·name:·Find·/etc/sudoers.d/·files | 209 | -·name:·Find·/etc/sudoers.d/·files |
| 193 | ··find: | 210 | ··find: |
| 194 | ····paths: | 211 | ····paths: |
| Offset 222, 33 lines modified | Offset 241, 14 lines modified | ||
| 222 | ··-·NIST-800-53-IA-11 | 241 | ··-·NIST-800-53-IA-11 |
| 223 | ··-·low_complexity | 242 | ··-·low_complexity |
| 224 | ··-·low_disruption | 243 | ··-·low_disruption |
| 225 | ··-·medium_severity | 244 | ··-·medium_severity |
| 226 | ··-·no_reboot_needed | 245 | ··-·no_reboot_needed |
| 227 | ··-·restrict_strategy | 246 | ··-·restrict_strategy |
| 228 | ··-·sudo_remove_nopasswd | 247 | ··-·sudo_remove_nopasswd |
| 229 | Remediation_Shell_script_⇲ | ||
| 230 | Complexity:·low | ||
| Max diff block lines reached; 177279/182874 bytes (96.94%) of diff not shown. | |||
| Offset 14433, 16 lines modified | Offset 14433, 16 lines modified | ||
| 00038600:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00038600:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00038610:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00038610:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00038620:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00038620:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00038630:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00038630:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00038640:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00038640:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00038650:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00038650:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00038660:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038660:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038670:·2020·2861·7320·6f66·2032·3032·3 | 00038670:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00038680:·2d32·3 | 00038680:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00038690:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00038690:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 000386a0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 000386a0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 000386b0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 000386b0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 000386c0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 000386c0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 000386d0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 000386d0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 000386e0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 000386e0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 000386f0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 000386f0:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 15438, 193 lines modified | Offset 15438, 193 lines modified | ||
| 0003c4d0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003c4d0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003c4e0:·646d·3835·3231·2220·7461·6269·6e64·6578··dm8521"·tabindex | 0003c4e0:·646d·3835·3231·2220·7461·6269·6e64·6578··dm8521"·tabindex | ||
| 0003c4f0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003c4f0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003c500:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003c500:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003c510:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003c510:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003c520:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003c520:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003c530:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003c530:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003c540:·6d65·6469·6174·696f·6e20·5075·7070·6574··mediation·Puppet | |||
| 0003c540:·6d65·6469·6174·696f·6e20·416e·6163·6f6e··mediation·Anacon | |||
| 0003c550:·6461·2073·6e69·7070·6574·20e2·87b2·3c2f··da·snippet·...</ | |||
| 0003c560:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c570:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c580:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003c590:·646d·3835·3231·223e·3c74·6162·6c65·2063··dm8521"><table·c | |||
| 0003c5a0:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003c5b0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003c5c0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003c5d0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003c5e0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003c5f0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c600:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c610:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003c620:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c630:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c640:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003c650:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003c660:·7265·3e3c·636f·6465·3e0a·7061·636b·6167··re><code>.packag | |||
| 0003c670:·6520·2d2d·6164·643d·6169·6465·0a3c·2f63··e·--add=aide.</c | |||
| 0003c680:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c690:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c6a0:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c6b0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c6c0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c6d0:·6964·6d38·3532·3222·2074·6162·696e·6465··idm8522"·tabinde | |||
| 0003c6e0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c6f0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c700:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c710:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c720:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c730:·656d·6564·6961·7469·6f6e·2050·7570·7065··emediation·Puppe | |||
| 0003c740:·7420·736e·6970·7065·7420·e287·b23c·2f61··t·snippet·...</a | |||
| 0003c750:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c760:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c770:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c780:·6d38·3532·3222·3e3c·7461·626c·6520·636c··m8522"><table·cl | |||
| 0003c790:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c7a0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c7b0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c7c0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c7d0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c7e0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c7f0:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003c800:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003c810:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c820:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003c830:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003c840:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c850:·653e·3c63·6f64·653e·696e·636c·7564·6520··e><code>include· | |||
| 0003c860:·696e·7374·616c·6c5f·6169·6465·0a0a·636c··install_aide..cl | |||
| 0003c870:·6173·7320·696e·7374·616c·6c5f·6169·6465··ass·install_aide | |||
| 0003c880:·207b·0a20·2070·6163·6b61·6765·207b·2027···{.··package·{·' | |||
| 0003c890:·6169·6465·273a·0a20·2020·2065·6e73·7572··aide':.····ensur | |||
| 0003c8a0:·6520·3d26·6774·3b20·2769·6e73·7461·6c6c··e·=>·'install | |||
| 0003c8b0:·6564·272c·0a20·207d·0a7d·0a3c·2f63·6f64··ed',.··}.}.</cod | |||
| 0003c8c0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c8d0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c8e0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003c8f0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003c900:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003c910:·6d38·3532·3322·2074·6162·696e·6465·783d··m8523"·tabindex= | |||
| 0003c920:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003c930:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003c940:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003c950:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003c960:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003c970:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003c | 0003c550:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | ||
| 0003c | 0003c560:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | ||
| 0003c | 0003c570:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | ||
| 0003c | 0003c580:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | ||
| 0003c | 0003c590:·3835·3231·223e·3c74·6162·6c65·2063·6c61··8521"><table·cla | ||
| 0003c | 0003c5a0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | ||
| 0003c | 0003c5b0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | ||
| 0003c | 0003c5c0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | ||
| 0003c | 0003c5d0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | ||
| 0003c | 0003c5e0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | ||
| 0003c | 0003c5f0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003c | 0003c600:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003c | 0003c610:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | ||
| 0003c | 0003c620:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003c | 0003c630:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | ||
| 0003c | 0003c640:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | ||
| 0003c | 0003c650:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | ||
| 0003c660:·3e3c·636f·6465·3e69·6e63·6c75·6465·2069··><code>include·i | |||
| 0003c670:·6e73·7461·6c6c·5f61·6964·650a·0a63·6c61··nstall_aide..cla | |||
| 0003c680:·7373·2069·6e73·7461·6c6c·5f61·6964·6520··ss·install_aide· | |||
| 0003c690:·7b0a·2020·7061·636b·6167·6520·7b20·2761··{.··package·{·'a | |||
| 0003c6a0:·6964·6527·3a0a·2020·2020·656e·7375·7265··ide':.····ensure | |||
| 0003c6b0:·203d·2667·743b·2027·696e·7374·616c·6c65···=>·'installe | |||
| 0003c6c0:·6427·2c0a·2020·7d0a·7d0a·3c2f·636f·6465··d',.··}.}.</code | |||
| 0003c6d0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c6e0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c6f0:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003ca90:·3e3c·636f·6465·3e2d·206e·616d·653a·2045··><code>-·name:·E | |||
| 0003caa0:·6e73·7572·6520·6169·6465·2069·7320·696e··nsure·aide·is·in | |||
| 0003cab0:·7374·616c·6c65·640a·2020·7061·636b·6167··stalled.··packag | |||
| 0003cac0:·653a·0a20·2020·206e·616d·653a·2061·6964··e:.····name:·aid | |||
| 0003cad0:·650a·2020·2020·7374·6174·653a·2070·7265··e.····state:·pre | |||
| 0003cae0:·7365·6e74·0a20·2077·6865·6e3a·2061·6e73··sent.··when:·ans | |||
| 0003caf0:·6962·6c65·5f76·6972·7475·616c·697a·6174··ible_virtualizat | |||
| Max diff block lines reached; 18954681/18981231 bytes (99.86%) of diff not shown. | |||
| Offset 14434, 15 lines modified | Offset 14434, 15 lines modified | ||
| 00038610:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038610:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00038620:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00038620:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00038630:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00038630:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00038640:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00038640:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00038650:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00038650:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 00038660:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 00038660:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 00038670:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 00038670:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 00038680:·6f66·2032·3032·3 | 00038680:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 00038690:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 00038690:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 000386a0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 000386a0:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 000386b0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 000386b0:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 000386c0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 000386c0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 000386d0:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 000386d0:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 000386e0:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 000386e0:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 000386f0:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 000386f0:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15428, 192 lines modified | Offset 15428, 192 lines modified | ||
| 0003c430:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003c430:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003c440:·3835·3231·2220·7461·6269·6e64·6578·3d22··8521"·tabindex=" | 0003c440:·3835·3231·2220·7461·6269·6e64·6578·3d22··8521"·tabindex=" | ||
| 0003c450:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003c450:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003c460:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003c460:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003c470:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003c470:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003c480:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003c480:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003c490:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003c490:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003c4a0:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003c4a0:·6469·6174·696f·6e20·416e·6163·6f6e·6461··diation·Anaconda | |||
| 0003c4b0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003c4c0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c4d0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c4e0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c4f0:·3835·3231·223e·3c74·6162·6c65·2063·6c61··8521"><table·cla | |||
| 0003c500:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003c510:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003c520:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003c530:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003c540:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003c550:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c560:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c570:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003c580:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c590:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c5a0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003c5b0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c5c0:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003c5d0:·2d2d·6164·643d·6169·6465·0a3c·2f63·6f64··--add=aide.</cod | |||
| 0003c5e0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c5f0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c600:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003c610:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003c620:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003c630:·6d38·3532·3222·2074·6162·696e·6465·783d··m8522"·tabindex= | |||
| 0003c640:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003c650:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003c660:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003c670:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003c680:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003c690:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003c6a0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003c6b0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c6c0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c6d0:·6c6c·6170·7365·2220·6964·3d22·6964·6d38··llapse"·id="idm8 | |||
| 0003c6e0:·3532·3222·3e3c·7461·626c·6520·636c·6173··522"><table·clas | |||
| 0003c6f0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c700:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c710:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c720:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c730:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c740:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c750:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c760:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c770:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c780:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c790:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003c7a0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c7b0:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003c7c0:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003c7d0:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003c7e0:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003c7f0:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003c800:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003c810:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003c820:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c830:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c840:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c850:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003c860:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | |||
| 0003c870:·3532·3322·2074·6162·696e·6465·783d·2230··523"·tabindex="0 | |||
| 0003c880:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c890:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c8a0:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c8b0:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003c8c0:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003c8d0:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003c | 0003c4b0:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | ||
| 0003c | 0003c4c0:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | ||
| 0003c | 0003c4d0:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | ||
| 0003c | 0003c4e0:·6c61·7073·6522·2069·643d·2269·646d·3835··lapse"·id="idm85 | ||
| 0003c | 0003c4f0:·3231·223e·3c74·6162·6c65·2063·6c61·7373··21"><table·class | ||
| 0003c | 0003c500:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | ||
| 0003c | 0003c510:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003c | 0003c520:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003c | 0003c530:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | ||
| 0003c | 0003c540:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | ||
| 0003c | 0003c550:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003c | 0003c560:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | ||
| 0003c | 0003c570:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | ||
| 0003c | 0003c580:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003c | 0003c590:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | ||
| 0003c | 0003c5a0:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | ||
| 0003c | 0003c5b0:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | ||
| 0003c5c0:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003c5d0:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003c5e0:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003c5f0:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003c600:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003c610:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003c620:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003c630:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c640:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c650:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c9f0:·636f·6465·3e2d·206e·616d·653a·2045·6e73··code>-·name:·Ens | |||
| 0003ca00:·7572·6520·6169·6465·2069·7320·696e·7374··ure·aide·is·inst | |||
| 0003ca10:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 0003ca20:·0a20·2020·206e·616d·653a·2061·6964·650a··.····name:·aide. | |||
| 0003ca30:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | |||
| 0003ca40:·6e74·0a20·2077·6865·6e3a·2061·6e73·6962··nt.··when:·ansib | |||
| 0003ca50:·6c65·5f76·6972·7475·616c·697a·6174·696f··le_virtualizatio | |||
| 0003ca60:·6e5f·7479·7065·206e·6f74·2069·6e20·5b22··n_type·not·in·[" | |||
| Max diff block lines reached; 7624250/7650524 bytes (99.66%) of diff not shown. | |||
| Offset 52, 15 lines modified | Offset 52, 15 lines modified | ||
| 52 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 52 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 57 | *****·Revision·History·***** | 57 | *****·Revision·History·***** |
| 58 | Current·version:·0.1.65 | 58 | Current·version:·0.1.65 |
| 59 | ····*·draft·(as·of·202 | 59 | ····*·draft·(as·of·2025-02-23) |
| 60 | *****·Table·of·Contents·***** | 60 | *****·Table·of·Contents·***** |
| 61 | ···1.·System_Settings | 61 | ···1.·System_Settings |
| 62 | ·········1.·Installing_and_Maintaining_Software | 62 | ·········1.·Installing_and_Maintaining_Software |
| 63 | ·········2.·Account_and_Access_Control | 63 | ·········2.·Account_and_Access_Control |
| 64 | ·········3.·GRUB2_bootloader_configuration | 64 | ·········3.·GRUB2_bootloader_configuration |
| 65 | ·········4.·Configure_Syslog | 65 | ·········4.·Configure_Syslog |
| 66 | ·········5.·Network_Configuration_and_Firewalls | 66 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 98, 31 lines modified | Offset 98, 39 lines modified | ||
| 98 | The·aide·package·can·be·installed·with·the·following·command: | 98 | The·aide·package·can·be·installed·with·the·following·command: |
| 99 | $·sudo·yum·install·aide | 99 | $·sudo·yum·install·aide |
| 100 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 100 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 101 | Severity: ················medium | 101 | Severity: ················medium |
| 102 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 102 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 103 | Identifiers·and·References·Identifiers: ·CCE-80844-4 | 103 | Identifiers·and·References·Identifiers: ·CCE-80844-4 |
| 104 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 104 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 105 | Remediation_Anaconda_snippet_⇲ | ||
| 106 | Complexity:·low | ||
| 107 | Disruption:·low | ||
| 108 | Strategy:···enable | ||
| 109 | package·--add=aide | ||
| 110 | Remediation_Puppet_snippet_⇲ | 105 | Remediation_Puppet_snippet_⇲ |
| 111 | Complexity:·low | 106 | Complexity:·low |
| 112 | Disruption:·low | 107 | Disruption:·low |
| 113 | Strategy:···enable | 108 | Strategy:···enable |
| 114 | include·install_aide | 109 | include·install_aide |
| 115 | class·install_aide·{ | 110 | class·install_aide·{ |
| 116 | ··package·{·'aide': | 111 | ··package·{·'aide': |
| 117 | ····ensure·=>·'installed', | 112 | ····ensure·=>·'installed', |
| 118 | ··} | 113 | ··} |
| 119 | } | 114 | } |
| 115 | Remediation_Shell_script_⇲ | ||
| 116 | Complexity:·low | ||
| 117 | Disruption:·low | ||
| 118 | Strategy:···enable | ||
| 119 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 120 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 121 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 122 | ····yum·install·-y·"aide" | ||
| 123 | fi | ||
| 124 | else | ||
| 125 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 126 | fi | ||
| 120 | Remediation_Ansible_snippet_⇲ | 127 | Remediation_Ansible_snippet_⇲ |
| 121 | Complexity:·low | 128 | Complexity:·low |
| 122 | Disruption:·low | 129 | Disruption:·low |
| 123 | Strategy:···enable | 130 | Strategy:···enable |
| 124 | -·name:·Ensure·aide·is·installed | 131 | -·name:·Ensure·aide·is·installed |
| 125 | ··package: | 132 | ··package: |
| 126 | ····name:·aide | 133 | ····name:·aide |
| Offset 141, 41 lines modified | Offset 149, 47 lines modified | ||
| 141 | ··-·no_reboot_needed | 149 | ··-·no_reboot_needed |
| 142 | ··-·package_aide_installed | 150 | ··-·package_aide_installed |
| 143 | Remediation_OSBuild_Blueprint_snippet_⇲ | 151 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 144 | [[packages]] | 152 | [[packages]] |
| 145 | name·=·"aide" | 153 | name·=·"aide" |
| 146 | version·=·"*" | 154 | version·=·"*" |
| 147 | Remediation_ | 155 | Remediation_Anaconda_snippet_⇲ |
| 148 | Complexity:·low | 156 | Complexity:·low |
| 149 | Disruption:·low | 157 | Disruption:·low |
| 150 | Strategy:···enable | 158 | Strategy:···enable |
| 151 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 152 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | package·--add=aide | ||
| 153 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 154 | ····yum·install·-y·"aide" | ||
| 155 | fi | ||
| 156 | else | ||
| 157 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 158 | fi | ||
| 159 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 160 | Run·the·following·command·to·generate·a·new·database: | 161 | Run·the·following·command·to·generate·a·new·database: |
| 161 | $·sudo·/usr/sbin/aide·--init | 162 | $·sudo·/usr/sbin/aide·--init |
| 162 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 163 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 164 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 164 | To·initiate·a·manual·check,·run·the·following·command: | 165 | To·initiate·a·manual·check,·run·the·following·command: |
| 165 | $·sudo·/usr/sbin/aide·--check | 166 | $·sudo·/usr/sbin/aide·--check |
| 166 | If·this·check·produces·any·unexpected·output,·investigate. | 167 | If·this·check·produces·any·unexpected·output,·investigate. |
| 167 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 168 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 168 | Severity: ················medium | 169 | Severity: ················medium |
| 169 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 170 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 170 | Identifiers·and·References·Identifiers: ·CCE-80675-2 | 171 | Identifiers·and·References·Identifiers: ·CCE-80675-2 |
| 171 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 172 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 173 | Remediation_Shell_script_⇲ | ||
| 174 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 175 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 176 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 177 | ····yum·install·-y·"aide" | ||
| 178 | fi | ||
| 179 | /usr/sbin/aide·--init | ||
| 180 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 181 | else | ||
| 182 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 183 | fi | ||
| 172 | Remediation_Ansible_snippet_⇲ | 184 | Remediation_Ansible_snippet_⇲ |
| 173 | Complexity:·low | 185 | Complexity:·low |
| 174 | Disruption:·low | 186 | Disruption:·low |
| 175 | Strategy:···restrict | 187 | Strategy:···restrict |
| 176 | -·name:·Ensure·AIDE·is·installed | 188 | -·name:·Ensure·AIDE·is·installed |
| 177 | ··package: | 189 | ··package: |
| 178 | ····name:·'{{·item·}}' | 190 | ····name:·'{{·item·}}' |
| Offset 244, 28 lines modified | Offset 258, 14 lines modified | ||
| 244 | ··-·PCI-DSS-Req-11.5 | 258 | ··-·PCI-DSS-Req-11.5 |
| 245 | ··-·aide_build_database | 259 | ··-·aide_build_database |
| 246 | ··-·low_complexity | 260 | ··-·low_complexity |
| 247 | ··-·low_disruption | 261 | ··-·low_disruption |
| 248 | ··-·medium_severity | 262 | ··-·medium_severity |
| 249 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 250 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 251 | Remediation_Shell_script_⇲ | ||
| Max diff block lines reached; 975282/981218 bytes (99.40%) of diff not shown. | |||
| Offset 14435, 16 lines modified | Offset 14435, 16 lines modified | ||
| 00038620:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00038620:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00038630:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00038630:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00038640:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00038640:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00038650:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00038650:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00038660:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00038660:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00038670:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00038670:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00038680:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038680:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038690:·2861·7320·6f66·2032·3032·3 | 00038690:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 000386a0:·3 | 000386a0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 000386b0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 000386b0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 000386c0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 000386c0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 000386d0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 000386d0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 000386e0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 000386e0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 000386f0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 000386f0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038700:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038700:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038710:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038710:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15424, 192 lines modified | Offset 15424, 192 lines modified | ||
| 0003c3f0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003c3f0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c400:·6d38·3532·3122·2074·6162·696e·6465·783d··m8521"·tabindex= | 0003c400:·6d38·3532·3122·2074·6162·696e·6465·783d··m8521"·tabindex= | ||
| 0003c410:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003c410:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003c420:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003c420:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003c430:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003c430:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003c440:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003c440:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003c450:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003c450:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003c460:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003c460:·6564·6961·7469·6f6e·2041·6e61·636f·6e64··ediation·Anacond | |||
| 0003c470:·6120·736e·6970·7065·7420·e287·b23c·2f61··a·snippet·...</a | |||
| 0003c480:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c490:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c4a0:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c4b0:·6d38·3532·3122·3e3c·7461·626c·6520·636c··m8521"><table·cl | |||
| 0003c4c0:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c4d0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c4e0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c4f0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c500:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c510:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c520:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003c530:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003c540:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c550:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003c560:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003c570:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c580:·653e·3c63·6f64·653e·0a70·6163·6b61·6765··e><code>.package | |||
| 0003c590:·202d·2d61·6464·3d61·6964·650a·3c2f·636f···--add=aide.</co | |||
| 0003c5a0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003c5b0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003c5c0:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003c5d0:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003c5e0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003c5f0:·646d·3835·3232·2220·7461·6269·6e64·6578··dm8522"·tabindex | |||
| 0003c600:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003c610:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003c620:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003c630:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003c640:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003c650:·6d65·6469·6174·696f·6e20·5075·7070·6574··mediation·Puppet | |||
| 0003c660:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003c670:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c680:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c690:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c6a0:·3835·3232·223e·3c74·6162·6c65·2063·6c61··8522"><table·cla | |||
| 0003c6b0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003c6c0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003c6d0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003c6e0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003c6f0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003c700:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c710:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c720:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003c730:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c740:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003c750:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003c760:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c770:·3e3c·636f·6465·3e69·6e63·6c75·6465·2069··><code>include·i | |||
| 0003c780:·6e73·7461·6c6c·5f61·6964·650a·0a63·6c61··nstall_aide..cla | |||
| 0003c790:·7373·2069·6e73·7461·6c6c·5f61·6964·6520··ss·install_aide· | |||
| 0003c7a0:·7b0a·2020·7061·636b·6167·6520·7b20·2761··{.··package·{·'a | |||
| 0003c7b0:·6964·6527·3a0a·2020·2020·656e·7375·7265··ide':.····ensure | |||
| 0003c7c0:·203d·2667·743b·2027·696e·7374·616c·6c65···=>·'installe | |||
| 0003c7d0:·6427·2c0a·2020·7d0a·7d0a·3c2f·636f·6465··d',.··}.}.</code | |||
| 0003c7e0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c7f0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c800:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c810:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003c820:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003c830:·3835·3233·2220·7461·6269·6e64·6578·3d22··8523"·tabindex=" | |||
| 0003c840:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003c850:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003c860:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003c870:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003c880:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003c890:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003c | 0003c470:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | ||
| 0003c | 0003c480:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | ||
| 0003c | 0003c490:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | ||
| 0003c | 0003c4a0:·6c6c·6170·7365·2220·6964·3d22·6964·6d38··llapse"·id="idm8 | ||
| 0003c | 0003c4b0:·3532·3122·3e3c·7461·626c·6520·636c·6173··521"><table·clas | ||
| 0003c | 0003c4c0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | ||
| 0003c | 0003c4d0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | ||
| 0003c | 0003c4e0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | ||
| 0003c | 0003c4f0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | ||
| 0003c | 0003c500:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | ||
| 0003c | 0003c510:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003c | 0003c520:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | ||
| 0003c | 0003c530:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | ||
| 0003c | 0003c540:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | ||
| 0003c | 0003c550:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | ||
| 0003c | 0003c560:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | ||
| 0003c | 0003c570:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | ||
| 0003c580:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003c590:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003c5a0:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003c5b0:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003c5c0:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003c5d0:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003c5e0:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003c5f0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c600:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c610:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c620:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003c630:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | |||
| 0003c640:·3532·3222·2074·6162·696e·6465·783d·2230··522"·tabindex="0 | |||
| 0003c650:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c660:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c670:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c680:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| Max diff block lines reached; 7530529/7556941 bytes (99.65%) of diff not shown. | |||
| Offset 53, 15 lines modified | Offset 53, 15 lines modified | ||
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 58 | *****·Revision·History·***** | 58 | *****·Revision·History·***** |
| 59 | Current·version:·0.1.65 | 59 | Current·version:·0.1.65 |
| 60 | ····*·draft·(as·of·202 | 60 | ····*·draft·(as·of·2025-02-23) |
| 61 | *****·Table·of·Contents·***** | 61 | *****·Table·of·Contents·***** |
| 62 | ···1.·System_Settings | 62 | ···1.·System_Settings |
| 63 | ·········1.·Installing_and_Maintaining_Software | 63 | ·········1.·Installing_and_Maintaining_Software |
| 64 | ·········2.·Account_and_Access_Control | 64 | ·········2.·Account_and_Access_Control |
| 65 | ·········3.·GRUB2_bootloader_configuration | 65 | ·········3.·GRUB2_bootloader_configuration |
| 66 | ·········4.·Configure_Syslog | 66 | ·········4.·Configure_Syslog |
| 67 | ·········5.·Network_Configuration_and_Firewalls | 67 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 98, 31 lines modified | Offset 98, 39 lines modified | ||
| 98 | The·aide·package·can·be·installed·with·the·following·command: | 98 | The·aide·package·can·be·installed·with·the·following·command: |
| 99 | $·sudo·yum·install·aide | 99 | $·sudo·yum·install·aide |
| 100 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 100 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 101 | Severity: ················medium | 101 | Severity: ················medium |
| 102 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 102 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 103 | Identifiers·and·References·Identifiers: ·CCE-80844-4 | 103 | Identifiers·and·References·Identifiers: ·CCE-80844-4 |
| 104 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 104 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 105 | Remediation_Anaconda_snippet_⇲ | ||
| 106 | Complexity:·low | ||
| 107 | Disruption:·low | ||
| 108 | Strategy:···enable | ||
| 109 | package·--add=aide | ||
| 110 | Remediation_Puppet_snippet_⇲ | 105 | Remediation_Puppet_snippet_⇲ |
| 111 | Complexity:·low | 106 | Complexity:·low |
| 112 | Disruption:·low | 107 | Disruption:·low |
| 113 | Strategy:···enable | 108 | Strategy:···enable |
| 114 | include·install_aide | 109 | include·install_aide |
| 115 | class·install_aide·{ | 110 | class·install_aide·{ |
| 116 | ··package·{·'aide': | 111 | ··package·{·'aide': |
| 117 | ····ensure·=>·'installed', | 112 | ····ensure·=>·'installed', |
| 118 | ··} | 113 | ··} |
| 119 | } | 114 | } |
| 115 | Remediation_Shell_script_⇲ | ||
| 116 | Complexity:·low | ||
| 117 | Disruption:·low | ||
| 118 | Strategy:···enable | ||
| 119 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 120 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 121 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 122 | ····yum·install·-y·"aide" | ||
| 123 | fi | ||
| 124 | else | ||
| 125 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 126 | fi | ||
| 120 | Remediation_Ansible_snippet_⇲ | 127 | Remediation_Ansible_snippet_⇲ |
| 121 | Complexity:·low | 128 | Complexity:·low |
| 122 | Disruption:·low | 129 | Disruption:·low |
| 123 | Strategy:···enable | 130 | Strategy:···enable |
| 124 | -·name:·Ensure·aide·is·installed | 131 | -·name:·Ensure·aide·is·installed |
| 125 | ··package: | 132 | ··package: |
| 126 | ····name:·aide | 133 | ····name:·aide |
| Offset 141, 41 lines modified | Offset 149, 47 lines modified | ||
| 141 | ··-·no_reboot_needed | 149 | ··-·no_reboot_needed |
| 142 | ··-·package_aide_installed | 150 | ··-·package_aide_installed |
| 143 | Remediation_OSBuild_Blueprint_snippet_⇲ | 151 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 144 | [[packages]] | 152 | [[packages]] |
| 145 | name·=·"aide" | 153 | name·=·"aide" |
| 146 | version·=·"*" | 154 | version·=·"*" |
| 147 | Remediation_ | 155 | Remediation_Anaconda_snippet_⇲ |
| 148 | Complexity:·low | 156 | Complexity:·low |
| 149 | Disruption:·low | 157 | Disruption:·low |
| 150 | Strategy:···enable | 158 | Strategy:···enable |
| 151 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 152 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | package·--add=aide | ||
| 153 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 154 | ····yum·install·-y·"aide" | ||
| 155 | fi | ||
| 156 | else | ||
| 157 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 158 | fi | ||
| 159 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 160 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 160 | Run·the·following·command·to·generate·a·new·database: | 161 | Run·the·following·command·to·generate·a·new·database: |
| 161 | $·sudo·/usr/sbin/aide·--init | 162 | $·sudo·/usr/sbin/aide·--init |
| 162 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 163 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 163 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 164 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 164 | To·initiate·a·manual·check,·run·the·following·command: | 165 | To·initiate·a·manual·check,·run·the·following·command: |
| 165 | $·sudo·/usr/sbin/aide·--check | 166 | $·sudo·/usr/sbin/aide·--check |
| 166 | If·this·check·produces·any·unexpected·output,·investigate. | 167 | If·this·check·produces·any·unexpected·output,·investigate. |
| 167 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 168 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 168 | Severity: ················medium | 169 | Severity: ················medium |
| 169 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 170 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 170 | Identifiers·and·References·Identifiers: ·CCE-80675-2 | 171 | Identifiers·and·References·Identifiers: ·CCE-80675-2 |
| 171 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 172 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 173 | Remediation_Shell_script_⇲ | ||
| 174 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 175 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 176 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 177 | ····yum·install·-y·"aide" | ||
| 178 | fi | ||
| 179 | /usr/sbin/aide·--init | ||
| 180 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 181 | else | ||
| 182 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 183 | fi | ||
| 172 | Remediation_Ansible_snippet_⇲ | 184 | Remediation_Ansible_snippet_⇲ |
| 173 | Complexity:·low | 185 | Complexity:·low |
| 174 | Disruption:·low | 186 | Disruption:·low |
| 175 | Strategy:···restrict | 187 | Strategy:···restrict |
| 176 | -·name:·Ensure·AIDE·is·installed | 188 | -·name:·Ensure·AIDE·is·installed |
| 177 | ··package: | 189 | ··package: |
| 178 | ····name:·'{{·item·}}' | 190 | ····name:·'{{·item·}}' |
| Offset 244, 28 lines modified | Offset 258, 14 lines modified | ||
| 244 | ··-·PCI-DSS-Req-11.5 | 258 | ··-·PCI-DSS-Req-11.5 |
| 245 | ··-·aide_build_database | 259 | ··-·aide_build_database |
| 246 | ··-·low_complexity | 260 | ··-·low_complexity |
| 247 | ··-·low_disruption | 261 | ··-·low_disruption |
| 248 | ··-·medium_severity | 262 | ··-·medium_severity |
| 249 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 250 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 251 | Remediation_Shell_script_⇲ | ||
| Max diff block lines reached; 962096/968032 bytes (99.39%) of diff not shown. | |||
| Offset 14435, 16 lines modified | Offset 14435, 16 lines modified | ||
| 00038620:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00038620:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00038630:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00038630:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00038640:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00038640:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00038650:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00038650:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00038660:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00038660:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00038670:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00038670:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00038680:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038680:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038690:·2861·7320·6f66·2032·3032·3 | 00038690:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 000386a0:·3 | 000386a0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 000386b0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 000386b0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 000386c0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 000386c0:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 000386d0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 000386d0:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 000386e0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 000386e0:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 000386f0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 000386f0:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00038700:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00038700:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00038710:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00038710:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15435, 192 lines modified | Offset 15435, 192 lines modified | ||
| 0003c4a0:·7461·7267·6574·3d22·2369·646d·3835·3231··target="#idm8521 | 0003c4a0:·7461·7267·6574·3d22·2369·646d·3835·3231··target="#idm8521 | ||
| 0003c4b0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003c4b0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003c4c0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003c4c0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003c4d0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003c4d0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003c4e0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003c4e0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003c4f0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003c4f0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003c500:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003c500:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003c510:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003c510:·696f·6e20·416e·6163·6f6e·6461·2073·6e69··ion·Anaconda·sni | |||
| 0003c520:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c530:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c540:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c550:·7073·6522·2069·643d·2269·646d·3835·3231··pse"·id="idm8521 | |||
| 0003c560:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003c570:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003c580:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003c590:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003c5a0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003c5b0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003c5c0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c5d0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c5e0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c5f0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c600:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c610:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003c620:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c630:·6465·3e0a·7061·636b·6167·6520·2d2d·6164··de>.package·--ad | |||
| 0003c640:·643d·6169·6465·0a3c·2f63·6f64·653e·3c2f··d=aide.</code></ | |||
| 0003c650:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c660:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c670:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c680:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c690:·2d74·6172·6765·743d·2223·6964·6d38·3532··-target="#idm852 | |||
| 0003c6a0:·3222·2074·6162·696e·6465·783d·2230·2220··2"·tabindex="0"· | |||
| 0003c6b0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c6c0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c6d0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c6e0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c6f0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c700:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003c710:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c720:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c730:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c740:·7365·2220·6964·3d22·6964·6d38·3532·3222··se"·id="idm8522" | |||
| 0003c750:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c760:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c770:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c780:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c790:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c7a0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c7b0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c7c0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c7d0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c7e0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c7f0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c800:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003c810:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c820:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003c830:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003c840:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003c850:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003c860:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003c870:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003c880:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003c890:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c8a0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c8b0:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c8c0:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c8d0:·6172·6765·743d·2223·6964·6d38·3532·3322··arget="#idm8523" | |||
| 0003c8e0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c8f0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c900:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c910:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c920:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c930:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c940:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003c | 0003c520:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 0003c | 0003c530:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 0003c | 0003c540:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 0003c | 0003c550:·6522·2069·643d·2269·646d·3835·3231·223e··e"·id="idm8521"> | ||
| 0003c | 0003c560:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003c | 0003c570:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 0003c | 0003c580:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003c | 0003c590:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003c | 0003c5a0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 0003c | 0003c5b0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003c5c0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c5d0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c5e0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c5f0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003c600:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003c610:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003c620:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c630:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003c640:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003c650:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003c660:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003c670:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003c680:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003c690:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003c6a0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c6b0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c6c0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c6d0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c6e0:·7267·6574·3d22·2369·646d·3835·3232·2220··rget="#idm8522"· | |||
| 0003c6f0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c700:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c710:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c720:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c730:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| Max diff block lines reached; 18879586/18905998 bytes (99.86%) of diff not shown. | |||
| Offset 14428, 15 lines modified | Offset 14428, 15 lines modified | ||
| 000385b0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 000385b0:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 000385c0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 000385c0:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 000385d0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 000385d0:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 000385e0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 000385e0:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 000385f0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 000385f0:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00038600:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00038600:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00038610:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00038610:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00038620:·3230·323 | 00038620:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00038630:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00038630:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00038640:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00038640:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00038650:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00038650:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00038660:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00038660:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00038670:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00038670:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00038680:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00038680:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00038690:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00038690:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15375, 329 lines modified | Offset 15375, 329 lines modified | ||
| 0003c0e0:·6574·3d22·2369·646d·3831·3630·2220·7461··et="#idm8160"·ta | 0003c0e0:·6574·3d22·2369·646d·3831·3630·2220·7461··et="#idm8160"·ta | ||
| 0003c0f0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003c0f0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003c100:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003c100:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003c110:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003c110:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003c120:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003c120:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003c130:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003c130:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003c140:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003c140:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003c150:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | |||
| 0003c160:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c170:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c180:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c190:·2269·646d·3831·3630·223e·3c70·7265·3e3c··"idm8160"><pre>< | |||
| 0003c1a0:·636f·6465·3e0a·2320·4669·6e64·2077·6869··code>.#·Find·whi | |||
| 0003c1b0:·6368·2066·696c·6573·2068·6176·6520·696e··ch·files·have·in | |||
| 0003c1c0:·636f·7272·6563·7420·6861·7368·2028·6e6f··correct·hash·(no | |||
| 0003c1d0:·7420·696e·202f·6574·632c·2062·6563·6175··t·in·/etc,·becau | |||
| 0003c1e0:·7365·206f·6620·7468·6520·7379·7374·656d··se·of·the·system | |||
| 0003c1f0:·2072·656c·6174·6564·2063·6f6e·6669·6720···related·config· | |||
| 0003c200:·6669·6c65·7329·2061·6e64·2074·6865·6e20··files)·and·then· | |||
| 0003c210:·6765·7420·6669·6c65·7320·6e61·6d65·730a··get·files·names. | |||
| 0003c150:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003c160:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c170:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c180:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c190:·6964·3d22·6964·6d38·3136·3022·3e3c·7461··id="idm8160"><ta | |||
| 0003c1a0:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c1b0:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c1c0:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c1d0:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c1e0:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c1f0:·793a·3c2f·7468·3e3c·7464·3e68·6967·683c··y:</th><td>high< | |||
| 0003c200:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c210:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003c220:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003c230:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c240:·6174·6567·793a·3c2f·7468·3e3c·7464·3e72··ategy:</th><td>r | |||
| 0003c250:·6573·7472·6963·743c·2f74·643e·3c2f·7472··estrict</td></tr | |||
| 0003c260:·3e3c·2f74·6162·6c65·3e3c·7072·653e·3c63··></table><pre><c | |||
| 0003c270:·6f64·653e·2d20·6e61·6d65·3a20·2753·6574··ode>-·name:·'Set | |||
| 0003c280:·2066·6163·743a·2050·6163·6b61·6765·206d···fact:·Package·m | |||
| 0003c290:·616e·6167·6572·2072·6569·6e73·7461·6c6c··anager·reinstall | |||
| 0003c2a0:·2063·6f6d·6d61·6e64·2028·646e·6629·270a···command·(dnf)'. | |||
| 0003c2b0:·2020·7365·745f·6661·6374·3a0a·2020·2020····set_fact:.···· | |||
| 0003c2c0:·7061·636b·6167·655f·6d61·6e61·6765·725f··package_manager_ | |||
| 0003c2d0:·7265·696e·7374·616c·6c5f·636d·643a·2064··reinstall_cmd:·d | |||
| 0003c2e0:·6e66·2072·6569·6e73·7461·6c6c·202d·790a··nf·reinstall·-y. | |||
| 0003c2f0:·2020·7768·656e·3a20·616e·7369·626c·655f····when:·ansible_ | |||
| 0003c300:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003c310:·2246·6564·6f72·6122·0a20·2074·6167·733a··"Fedora".··tags: | |||
| 0003c320:·0a20·202d·2043·4345·2d38·3038·3537·2d36··.··-·CCE-80857-6 | |||
| 0003c330:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003c340:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003c350:·3137·312d·332e·332e·380a·2020·2d20·4e49··171-3.3.8.··-·NI | |||
| 0003c360:·5354·2d38·3030·2d31·3731·2d33·2e34·2e31··ST-800-171-3.4.1 | |||
| 0003c370:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c380:·2d41·552d·3928·3329·0a20·202d·204e·4953··-AU-9(3).··-·NIS | |||
| 0003c390:·542d·3830·302d·3533·2d43·4d2d·3628·6329··T-800-53-CM-6(c) | |||
| 0003c3a0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c3b0:·2d43·4d2d·3628·6429·0a20·202d·204e·4953··-CM-6(d).··-·NIS | |||
| 0003c3c0:·542d·3830·302d·3533·2d53·492d·370a·2020··T-800-53-SI-7.·· | |||
| 0003c3d0:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003c3e0:·2d37·2831·290a·2020·2d20·4e49·5354·2d38··-7(1).··-·NIST-8 | |||
| 0003c3f0:·3030·2d35·332d·5349·2d37·2836·290a·2020··00-53-SI-7(6).·· | |||
| 0003c400:·2d20·5043·492d·4453·532d·5265·712d·3131··-·PCI-DSS-Req-11 | |||
| 0003c410:·2e35·0a20·202d·2068·6967·685f·636f·6d70··.5.··-·high_comp | |||
| 0003c420:·6c65·7869·7479·0a20·202d·2068·6967·685f··lexity.··-·high_ | |||
| 0003c430:·7365·7665·7269·7479·0a20·202d·206d·6564··severity.··-·med | |||
| 0003c440:·6975·6d5f·6469·7372·7570·7469·6f6e·0a20··ium_disruption.· | |||
| 0003c450:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 0003c460:·6465·640a·2020·2d20·7265·7374·7269·6374··ded.··-·restrict | |||
| 0003c470:·5f73·7472·6174·6567·790a·2020·2d20·7270··_strategy.··-·rp | |||
| 0003c480:·6d5f·7665·7269·6679·5f68·6173·6865·730a··m_verify_hashes. | |||
| 0003c490:·0a2d·206e·616d·653a·2027·5365·7420·6661··.-·name:·'Set·fa | |||
| 0003c4a0:·6374·3a20·5061·636b·6167·6520·6d61·6e61··ct:·Package·mana | |||
| 0003c4b0:·6765·7220·7265·696e·7374·616c·6c20·636f··ger·reinstall·co | |||
| 0003c4c0:·6d6d·616e·6420·2879·756d·2927·0a20·2073··mmand·(yum)'.··s | |||
| 0003c4d0:·6574·5f66·6163·743a·0a20·2020·2070·6163··et_fact:.····pac | |||
| 0003c4e0:·6b61·6765·5f6d·616e·6167·6572·5f72·6569··kage_manager_rei | |||
| 0003c4f0:·6e73·7461·6c6c·5f63·6d64·3a20·7975·6d20··nstall_cmd:·yum· | |||
| 0003c500:·7265·696e·7374·616c·6c20·2d79·0a20·2077··reinstall·-y.··w | |||
| 0003c510:·6865·6e3a·2028·616e·7369·626c·655f·6469··hen:·(ansible_di | |||
| 0003c520:·7374·7269·6275·7469·6f6e·203d·3d20·2252··stribution·==·"R | |||
| 0003c530:·6564·4861·7422·206f·7220·616e·7369·626c··edHat"·or·ansibl | |||
| 0003c540:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003c550:·3d20·2243·656e·744f·5322·206f·7220·616e··=·"CentOS"·or·an | |||
| 0003c560:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003c570:·6f6e·0a20·2020·203d·3d20·224f·7261·636c··on.····==·"Oracl | |||
| 0003c580:·654c·696e·7578·2229·0a20·2074·6167·733a··eLinux").··tags: | |||
| 0003c590:·0a20·202d·2043·4345·2d38·3038·3537·2d36··.··-·CCE-80857-6 | |||
| 0003c5a0:·0a20·202d·2043·4a49·532d·352e·3130·2e34··.··-·CJIS-5.10.4 | |||
| 0003c5b0:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003c5c0:·3137·312d·332e·332e·380a·2020·2d20·4e49··171-3.3.8.··-·NI | |||
| 0003c5d0:·5354·2d38·3030·2d31·3731·2d33·2e34·2e31··ST-800-171-3.4.1 | |||
| 0003c5e0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c5f0:·2d41·552d·3928·3329·0a20·202d·204e·4953··-AU-9(3).··-·NIS | |||
| 0003c600:·542d·3830·302d·3533·2d43·4d2d·3628·6329··T-800-53-CM-6(c) | |||
| 0003c610:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c620:·2d43·4d2d·3628·6429·0a20·202d·204e·4953··-CM-6(d).··-·NIS | |||
| 0003c630:·542d·3830·302d·3533·2d53·492d·370a·2020··T-800-53-SI-7.·· | |||
| 0003c640:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003c650:·2d37·2831·290a·2020·2d20·4e49·5354·2d38··-7(1).··-·NIST-8 | |||
| 0003c660:·3030·2d35·332d·5349·2d37·2836·290a·2020··00-53-SI-7(6).·· | |||
| 0003c670:·2d20·5043·492d·4453·532d·5265·712d·3131··-·PCI-DSS-Req-11 | |||
| 0003c680:·2e35·0a20·202d·2068·6967·685f·636f·6d70··.5.··-·high_comp | |||
| 0003c690:·6c65·7869·7479·0a20·202d·2068·6967·685f··lexity.··-·high_ | |||
| 0003c6a0:·7365·7665·7269·7479·0a20·202d·206d·6564··severity.··-·med | |||
| 0003c6b0:·6975·6d5f·6469·7372·7570·7469·6f6e·0a20··ium_disruption.· | |||
| 0003c6c0:·202d·206e·6f5f·7265·626f·6f74·5f6e·6565···-·no_reboot_nee | |||
| 0003c6d0:·6465·640a·2020·2d20·7265·7374·7269·6374··ded.··-·restrict | |||
| 0003c6e0:·5f73·7472·6174·6567·790a·2020·2d20·7270··_strategy.··-·rp | |||
| 0003c6f0:·6d5f·7665·7269·6679·5f68·6173·6865·730a··m_verify_hashes. | |||
| Max diff block lines reached; 9700144/9745324 bytes (99.54%) of diff not shown. | |||
| Offset 51, 15 lines modified | Offset 51, 15 lines modified | ||
| 51 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 51 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 52 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 52 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 56 | *****·Revision·History·***** | 56 | *****·Revision·History·***** |
| 57 | Current·version:·0.1.65 | 57 | Current·version:·0.1.65 |
| 58 | ····*·draft·(as·of·202 | 58 | ····*·draft·(as·of·2025-02-23) |
| 59 | *****·Table·of·Contents·***** | 59 | *****·Table·of·Contents·***** |
| 60 | ···1.·System_Settings | 60 | ···1.·System_Settings |
| 61 | ·········1.·Installing_and_Maintaining_Software | 61 | ·········1.·Installing_and_Maintaining_Software |
| 62 | ·········2.·Account_and_Access_Control | 62 | ·········2.·Account_and_Access_Control |
| 63 | ·········3.·System_Accounting_with_auditd | 63 | ·········3.·System_Accounting_with_auditd |
| 64 | ·········4.·GRUB2_bootloader_configuration | 64 | ·········4.·GRUB2_bootloader_configuration |
| 65 | ·········5.·Network_Configuration_and_Firewalls | 65 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 92, 14 lines modified | Offset 92, 24 lines modified | ||
| 92 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 92 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 93 | $·sudo·rpm·-Uvh·PACKAGENAME | 93 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 94 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 94 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 95 | Severity: ················high | 95 | Severity: ················high |
| 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 97 | Identifiers·and·References·Identifiers: ·CCE-80857-6 | 97 | Identifiers·and·References·Identifiers: ·CCE-80857-6 |
| 98 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 98 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 99 | Remediation_Shell_script_⇲ | ||
| 100 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 101 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 102 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 103 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 104 | yum·reinstall·-y·$packages_to_reinstall | ||
| 99 | Remediation_Ansible_snippet_⇲ | 105 | Remediation_Ansible_snippet_⇲ |
| 100 | Complexity:·high | 106 | Complexity:·high |
| 101 | Disruption:·medium | 107 | Disruption:·medium |
| 102 | Strategy:···restrict | 108 | Strategy:···restrict |
| 103 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 109 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 104 | ··set_fact: | 110 | ··set_fact: |
| 105 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 111 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 249, 38 lines modified | Offset 259, 57 lines modified | ||
| 249 | ··-·PCI-DSS-Req-11.5 | 259 | ··-·PCI-DSS-Req-11.5 |
| 250 | ··-·high_complexity | 260 | ··-·high_complexity |
| 251 | ··-·high_severity | 261 | ··-·high_severity |
| 252 | ··-·medium_disruption | 262 | ··-·medium_disruption |
| 253 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 254 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 255 | ··-·rpm_verify_hashes | 265 | ··-·rpm_verify_hashes |
| 256 | Remediation_Shell_script_⇲ | ||
| 257 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 258 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 259 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 260 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 261 | yum·reinstall·-y·$packages_to_reinstall | ||
| 262 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 266 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 263 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 267 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 264 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 268 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 265 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 269 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 266 | $·rpm·-qf·FILENAME | 270 | $·rpm·-qf·FILENAME |
| 267 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 271 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 268 | $·sudo·rpm·--setperms·PACKAGENAME | 272 | $·sudo·rpm·--setperms·PACKAGENAME |
| 269 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 273 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 270 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 274 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 271 | Severity: ················high | 275 | Severity: ················high |
| 272 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 276 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 273 | Identifiers·and·References·Identifiers: ·CCE-80858-4 | 277 | Identifiers·and·References·Identifiers: ·CCE-80858-4 |
| 274 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 278 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 279 | Remediation_Shell_script_⇲ | ||
| 280 | Complexity:·high | ||
| 281 | Disruption:·medium | ||
| 282 | Strategy:···restrict | ||
| 283 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 284 | declare·-A·SETPERMS_RPM_DICT | ||
| 285 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 286 | #·is·expected·by·the·RPM·database | ||
| 287 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 288 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 289 | do | ||
| 290 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 291 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 292 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 293 | ········do | ||
| 294 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 295 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 296 | ········done | ||
| 297 | done | ||
| 298 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 299 | #·correct·values | ||
| 300 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 301 | do | ||
| 302 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 303 | done | ||
| 275 | Remediation_Ansible_snippet_⇲ | 304 | Remediation_Ansible_snippet_⇲ |
| 276 | Complexity:·high | 305 | Complexity:·high |
| 277 | Disruption:·medium | 306 | Disruption:·medium |
| 278 | Strategy:···restrict | 307 | Strategy:···restrict |
| 279 | -·name:·Read·list·of·files·with·incorrect·permissions | 308 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 280 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 309 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 281 | ····--nocaps·--nolinkto·--nouser·--nogroup | 310 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 357, 70 lines modified | Offset 386, 49 lines modified | ||
| 357 | ··-·PCI-DSS-Req-11.5 | 386 | ··-·PCI-DSS-Req-11.5 |
| 358 | ··-·high_complexity | 387 | ··-·high_complexity |
| 359 | ··-·high_severity | 388 | ··-·high_severity |
| 360 | ··-·medium_disruption | 389 | ··-·medium_disruption |
| 361 | ··-·no_reboot_needed | 390 | ··-·no_reboot_needed |
| 362 | ··-·restrict_strategy | 391 | ··-·restrict_strategy |
| 363 | ··-·rpm_verify_permissions | 392 | ··-·rpm_verify_permissions |
| 364 | Remediation_Shell_script_⇲ | ||
| 365 | Complexity:·high | ||
| 366 | Disruption:·medium | ||
| 367 | Strategy:···restrict | ||
| 368 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 369 | declare·-A·SETPERMS_RPM_DICT | ||
| 370 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 371 | #·is·expected·by·the·RPM·database | ||
| 372 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 914694/923034 bytes (99.10%) of diff not shown. | |||
| Offset 14468, 16 lines modified | Offset 14468, 16 lines modified | ||
| 00038830:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00038830:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00038840:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00038840:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00038850:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00038850:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00038860:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00038860:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00038870:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00038870:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00038880:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00038880:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00038890:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038890:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000388a0:·2020·2020·2861·7320·6f66·2032·3032·3 | 000388a0:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 000388b0:·303 | 000388b0:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 000388c0:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 000388c0:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 000388d0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 000388d0:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 000388e0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 000388e0:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 000388f0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 000388f0:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00038900:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00038900:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00038910:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00038910:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00038920:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00038920:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15449, 193 lines modified | Offset 15449, 193 lines modified | ||
| 0003c580:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003c580:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c590:·743d·2223·6964·6d38·3532·3122·2074·6162··t="#idm8521"·tab | 0003c590:·743d·2223·6964·6d38·3532·3122·2074·6162··t="#idm8521"·tab | ||
| 0003c5a0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003c5a0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003c5b0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003c5b0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003c5c0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003c5c0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003c5d0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003c5d0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003c5e0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003c5e0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003c5f0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003c5f0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | ||
| 0003c600:·6e61·636f·6e64·6120·736e·6970·7065·7420··naconda·snippet· | |||
| 0003c610:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c620:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c630:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003c640:·6964·3d22·6964·6d38·3532·3122·3e3c·7461··id="idm8521"><ta | |||
| 0003c650:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003c660:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003c670:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003c680:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003c690:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003c6a0:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003c6b0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c6c0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003c6d0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003c6e0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003c6f0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | |||
| 0003c700:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | |||
| 0003c710:·6c65·3e3c·7072·653e·3c63·6f64·653e·0a70··le><pre><code>.p | |||
| 0003c720:·6163·6b61·6765·202d·2d61·6464·3d61·6964··ackage·--add=aid | |||
| 0003c730:·650a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··e.</code></pre>< | |||
| 0003c740:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c750:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c760:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c770:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c780:·6574·3d22·2369·646d·3835·3232·2220·7461··et="#idm8522"·ta | |||
| 0003c790:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c7a0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c7b0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c7c0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c7d0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c7e0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003c7f0:·5075·7070·6574·2073·6e69·7070·6574·20e2··Puppet·snippet·. | |||
| 0003c800:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c810:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c820:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c830:·643d·2269·646d·3835·3232·223e·3c74·6162··d="idm8522"><tab | |||
| 0003c840:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c850:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c860:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c870:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c880:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c890:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c8a0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c8b0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c8c0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c8d0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c8e0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c8f0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c900:·653e·3c70·7265·3e3c·636f·6465·3e69·6e63··e><pre><code>inc | |||
| 0003c910:·6c75·6465·2069·6e73·7461·6c6c·5f61·6964··lude·install_aid | |||
| 0003c920:·650a·0a63·6c61·7373·2069·6e73·7461·6c6c··e..class·install | |||
| 0003c930:·5f61·6964·6520·7b0a·2020·7061·636b·6167··_aide·{.··packag | |||
| 0003c940:·6520·7b20·2761·6964·6527·3a0a·2020·2020··e·{·'aide':.···· | |||
| 0003c950:·656e·7375·7265·203d·2667·743b·2027·696e··ensure·=>·'in | |||
| 0003c960:·7374·616c·6c65·6427·2c0a·2020·7d0a·7d0a··stalled',.··}.}. | |||
| 0003c970:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c980:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c990:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c9a0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c9b0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c9c0:·3d22·2369·646d·3835·3233·2220·7461·6269··="#idm8523"·tabi | |||
| 0003c9d0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c9e0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c9f0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003ca00:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003ca10:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003ca20:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003c | 0003c600:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | ||
| 0003c | 0003c610:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | ||
| 0003c | 0003c620:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | ||
| 0003c | 0003c630:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | ||
| 0003c | 0003c640:·3d22·6964·6d38·3532·3122·3e3c·7461·626c··="idm8521"><tabl | ||
| 0003c | 0003c650:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | ||
| 0003c | 0003c660:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | ||
| 0003c | 0003c670:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | ||
| 0003c | 0003c680:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | ||
| 0003c | 0003c690:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | ||
| 0003c | 0003c6a0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | ||
| 0003c | 0003c6b0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | ||
| 0003c | 0003c6c0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | ||
| 0003c | 0003c6d0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003c | 0003c6e0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | ||
| 0003c | 0003c6f0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | ||
| 0003c | 0003c700:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | ||
| 0003c710:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003c720:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003c730:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003c740:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003c750:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003c760:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003c770:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003c780:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003c790:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003c7a0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003c7b0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003c7c0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003c7d0:·2223·6964·6d38·3532·3222·2074·6162·696e··"#idm8522"·tabin | |||
| 0003c7e0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003c7f0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003c800:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003c810:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003c820:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| Max diff block lines reached; 8438877/8465427 bytes (99.69%) of diff not shown. | |||
| Offset 61, 15 lines modified | Offset 61, 15 lines modified | ||
| 61 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 61 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 62 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 62 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 63 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 63 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 64 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 64 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 65 | ····*·cpe:/o:redhat:enterprise_linux:8 | 65 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 66 | *****·Revision·History·***** | 66 | *****·Revision·History·***** |
| 67 | Current·version:·0.1.65 | 67 | Current·version:·0.1.65 |
| 68 | ····*·draft·(as·of·202 | 68 | ····*·draft·(as·of·2025-02-23) |
| 69 | *****·Table·of·Contents·***** | 69 | *****·Table·of·Contents·***** |
| 70 | ···1.·System_Settings | 70 | ···1.·System_Settings |
| 71 | ·········1.·Installing_and_Maintaining_Software | 71 | ·········1.·Installing_and_Maintaining_Software |
| 72 | ·········2.·Account_and_Access_Control | 72 | ·········2.·Account_and_Access_Control |
| 73 | ·········3.·System_Accounting_with_auditd | 73 | ·········3.·System_Accounting_with_auditd |
| 74 | ·········4.·GRUB2_bootloader_configuration | 74 | ·········4.·GRUB2_bootloader_configuration |
| 75 | ·········5.·zIPL_bootloader_configuration | 75 | ·········5.·zIPL_bootloader_configuration |
| Offset 104, 31 lines modified | Offset 104, 39 lines modified | ||
| 104 | The·aide·package·can·be·installed·with·the·following·command: | 104 | The·aide·package·can·be·installed·with·the·following·command: |
| 105 | $·sudo·yum·install·aide | 105 | $·sudo·yum·install·aide |
| 106 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 106 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 107 | Severity: ················medium | 107 | Severity: ················medium |
| 108 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 108 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 109 | Identifiers·and·References·Identifiers: ·CCE-80844-4 | 109 | Identifiers·and·References·Identifiers: ·CCE-80844-4 |
| 110 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 110 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 111 | Remediation_Anaconda_snippet_⇲ | ||
| 112 | Complexity:·low | ||
| 113 | Disruption:·low | ||
| 114 | Strategy:···enable | ||
| 115 | package·--add=aide | ||
| 116 | Remediation_Puppet_snippet_⇲ | 111 | Remediation_Puppet_snippet_⇲ |
| 117 | Complexity:·low | 112 | Complexity:·low |
| 118 | Disruption:·low | 113 | Disruption:·low |
| 119 | Strategy:···enable | 114 | Strategy:···enable |
| 120 | include·install_aide | 115 | include·install_aide |
| 121 | class·install_aide·{ | 116 | class·install_aide·{ |
| 122 | ··package·{·'aide': | 117 | ··package·{·'aide': |
| 123 | ····ensure·=>·'installed', | 118 | ····ensure·=>·'installed', |
| 124 | ··} | 119 | ··} |
| 125 | } | 120 | } |
| 121 | Remediation_Shell_script_⇲ | ||
| 122 | Complexity:·low | ||
| 123 | Disruption:·low | ||
| 124 | Strategy:···enable | ||
| 125 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 126 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 127 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 128 | ····yum·install·-y·"aide" | ||
| 129 | fi | ||
| 130 | else | ||
| 131 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 132 | fi | ||
| 126 | Remediation_Ansible_snippet_⇲ | 133 | Remediation_Ansible_snippet_⇲ |
| 127 | Complexity:·low | 134 | Complexity:·low |
| 128 | Disruption:·low | 135 | Disruption:·low |
| 129 | Strategy:···enable | 136 | Strategy:···enable |
| 130 | -·name:·Ensure·aide·is·installed | 137 | -·name:·Ensure·aide·is·installed |
| 131 | ··package: | 138 | ··package: |
| 132 | ····name:·aide | 139 | ····name:·aide |
| Offset 147, 28 lines modified | Offset 155, 20 lines modified | ||
| 147 | ··-·no_reboot_needed | 155 | ··-·no_reboot_needed |
| 148 | ··-·package_aide_installed | 156 | ··-·package_aide_installed |
| 149 | Remediation_OSBuild_Blueprint_snippet_⇲ | 157 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 150 | [[packages]] | 158 | [[packages]] |
| 151 | name·=·"aide" | 159 | name·=·"aide" |
| 152 | version·=·"*" | 160 | version·=·"*" |
| 153 | Remediation_ | 161 | Remediation_Anaconda_snippet_⇲ |
| 154 | Complexity:·low | 162 | Complexity:·low |
| 155 | Disruption:·low | 163 | Disruption:·low |
| 156 | Strategy:···enable | 164 | Strategy:···enable |
| 157 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 158 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 165 | package·--add=aide | ||
| 159 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 160 | ····yum·install·-y·"aide" | ||
| 161 | fi | ||
| 162 | else | ||
| 163 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 164 | fi | ||
| 165 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 166 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 166 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 167 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 167 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. | 168 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. |
| 168 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 169 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 169 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 170 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 178, 14 lines modified | Offset 178, 27 lines modified | ||
| 178 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 178 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 179 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 179 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 180 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 180 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 181 | Severity: ················high | 181 | Severity: ················high |
| 182 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 182 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 183 | Identifiers·and·References·Identifiers: ·CCE-82155-3 | 183 | Identifiers·and·References·Identifiers: ·CCE-82155-3 |
| 184 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-08-010020,·SV-230223r792855_rule | 184 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-08-010020,·SV-230223r792855_rule |
| 185 | Remediation_Shell_script_⇲ | ||
| 186 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 187 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 188 | fips-mode-setup·--enable | ||
| 189 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 190 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 191 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 192 | fi | ||
| 193 | else | ||
| 194 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 195 | fi | ||
| 185 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 186 | Complexity:·medium | 197 | Complexity:·medium |
| 187 | Disruption:·medium | 198 | Disruption:·medium |
| 188 | Reboot:·····true | 199 | Reboot:·····true |
| 189 | Strategy:···restrict | 200 | Strategy:···restrict |
| 190 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 201 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 191 | ··command:·/usr/bin/fips-mode-setup·--check | 202 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 246, 27 lines modified | Offset 259, 14 lines modified | ||
| 246 | ··-·NIST-800-53-SC-13 | 259 | ··-·NIST-800-53-SC-13 |
| 247 | ··-·enable_dracut_fips_module | 260 | ··-·enable_dracut_fips_module |
| 248 | ··-·high_severity | 261 | ··-·high_severity |
| 249 | ··-·medium_complexity | 262 | ··-·medium_complexity |
| 250 | ··-·medium_disruption | 263 | ··-·medium_disruption |
| 251 | ··-·reboot_required | 264 | ··-·reboot_required |
| 252 | ··-·restrict_strategy | 265 | ··-·restrict_strategy |
| Max diff block lines reached; 1108443/1115636 bytes (99.36%) of diff not shown. | |||
| Offset 14435, 15 lines modified | Offset 14435, 15 lines modified | ||
| 00038620:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00038620:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00038630:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00038630:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00038640:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00038640:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00038650:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00038650:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00038660:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00038660:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00038670:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00038670:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00038680:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00038680:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00038690:·6173·206f·6620·3230·323 | 00038690:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 000386a0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 000386a0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 000386b0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 000386b0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 000386c0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 000386c0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 000386d0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 000386d0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 000386e0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 000386e0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 000386f0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 000386f0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00038700:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00038700:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15411, 330 lines modified | Offset 15411, 330 lines modified | ||
| 0003c320:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003c320:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003c330:·2369·646d·3831·3630·2220·7461·6269·6e64··#idm8160"·tabind | 0003c330:·2369·646d·3831·3630·2220·7461·6269·6e64··#idm8160"·tabind | ||
| 0003c340:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003c340:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003c350:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003c350:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003c360:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003c360:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003c370:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003c370:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003c380:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003c380:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003c390:·5265·6d65·6469·6174·696f·6e20· | 0003c390:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003c3a0:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003c3b0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003c3 | 0003c3a0:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | ||
| 0003c3b0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003c3c0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003c3d0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003c3e0:·3831·3630·223e·3c70·7265·3e3c·636f·6465··8160"><pre><code | |||
| 0003c3f0:·3e0a·2320·4669·6e64·2077·6869·6368·2066··>.#·Find·which·f | |||
| 0003c400:·696c·6573·2068·6176·6520·696e·636f·7272··iles·have·incorr | |||
| 0003c410:·6563·7420·6861·7368·2028·6e6f·7420·696e··ect·hash·(not·in | |||
| 0003c420:·202f·6574·632c·2062·6563·6175·7365·206f···/etc,·because·o | |||
| 0003c430:·6620·7468·6520·7379·7374·656d·2072·656c··f·the·system·rel | |||
| 0003c440:·6174·6564·2063·6f6e·6669·6720·6669·6c65··ated·config·file | |||
| 0003c450:·7329·2061·6e64·2074·6865·6e20·6765·7420··s)·and·then·get· | |||
| 0003c460:·6669·6c65·7320·6e61·6d65·730a·6669·6c65··files·names.file | |||
| 0003c470:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003c480:·5f68·6173·683d·2224·2872·706d·202d·5661··_hash="$(rpm·-Va | |||
| 0003c490:·202d·2d6e·6f63·6f6e·6669·6720·7c20·6772···--noconfig·|·gr | |||
| 0003c4a0:·6570·202d·4520·275e·2e2e·3527·207c·2061··ep·-E·'^..5'·|·a | |||
| 0003c4b0:·776b·2027·7b70·7269·6e74·2024·4e46·7d27··wk·'{print·$NF}' | |||
| 0003c4c0:·2029·220a·0a23·2046·726f·6d20·6669·6c65···)"..#·From·file | |||
| 0003c4d0:·7320·6e61·6d65·7320·6765·7420·7061·636b··s·names·get·pack | |||
| 0003c4e0:·6167·6520·6e61·6d65·7320·616e·6420·6368··age·names·and·ch | |||
| 0003c4f0:·616e·6765·206e·6577·6c69·6e65·2074·6f20··ange·newline·to· | |||
| 0003c500:·7370·6163·652c·2062·6563·6175·7365·2072··space,·because·r | |||
| 0003c510:·706d·2077·7269·7465·7320·6561·6368·2070··pm·writes·each·p | |||
| 0003c520:·6163·6b61·6765·2074·6f20·6e65·7720·6c69··ackage·to·new·li | |||
| 0003c530:·6e65·0a70·6163·6b61·6765·735f·746f·5f72··ne.packages_to_r | |||
| 0003c540:·6569·6e73·7461·6c6c·3d22·2428·7270·6d20··einstall="$(rpm· | |||
| 0003c550:·2d71·6620·2466·696c·6573·5f77·6974·685f··-qf·$files_with_ | |||
| 0003c560:·696e·636f·7272·6563·745f·6861·7368·207c··incorrect_hash·| | |||
| 0003c570:·2074·7220·275c·6e27·2027·2027·2922·0a0a···tr·'\n'·'·')".. | |||
| 0003c580:·0a79·756d·2072·6569·6e73·7461·6c6c·202d··.yum·reinstall·- | |||
| 0003c590:·7920·2470·6163·6b61·6765·735f·746f·5f72··y·$packages_to_r | |||
| 0003c5a0:·6569·6e73·7461·6c6c·0a3c·2f63·6f64·653e··einstall.</code> | |||
| 0003c5b0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003c5c0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003c5d0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003c | 0003c5e0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | ||
| 0003c5f0:·7461·2d74·6172·6765·743d·2223·6964·6d38··ta-target="#idm8 | |||
| 0003c600:·3136·3122·2074·6162·696e·6465·783d·2230··161"·tabindex="0 | |||
| 0003c610:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003c620:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003c630:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003c640:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003c650:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003c660:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003c670:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c680:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c690:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c6a0:·6c61·7073·6522·2069·643d·2269·646d·3831··lapse"·id="idm81 | |||
| 0003c6b0:·3631·223e·3c74·6162·6c65·2063·6c61·7373··61"><table·class | |||
| 0003c6c0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c6d0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c6e0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | |||
| 0003c6f0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c700:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | |||
| 0003c710:·643e·6869·6768·3c2f·7464·3e3c·2f74·723e··d>high</td></tr> | |||
| 0003c720:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c730:·6f6e·3a3c·2f74·683e·3c74·643e·6d65·6469··on:</th><td>medi | |||
| 0003c740:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003c750:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c760:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003c770:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003c780:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003c3e0:·6964·6d38·3136·3022·3e3c·7461·626c·6520··idm8160"><table· | |||
| 0003c3f0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003c400:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003c410:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003c420:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003c430:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003c440:·7468·3e3c·7464·3e68·6967·683c·2f74·643e··th><td>high</td> | |||
| 0003c450:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003c460:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003c470:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003c480:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003c490:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003c4a0:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003c4b0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c4c0:·2d20·6e61·6d65·3a20·2753·6574·2066·6163··-·name:·'Set·fac | |||
| 0003c4d0:·743a·2050·6163·6b61·6765·206d·616e·6167··t:·Package·manag | |||
| 0003c4e0:·6572·2072·6569·6e73·7461·6c6c·2063·6f6d··er·reinstall·com | |||
| 0003c4f0:·6d61·6e64·2028·646e·6629·270a·2020·7365··mand·(dnf)'.··se | |||
| 0003c500:·745f·6661·6374·3a0a·2020·2020·7061·636b··t_fact:.····pack | |||
| 0003c510:·6167·655f·6d61·6e61·6765·725f·7265·696e··age_manager_rein | |||
| 0003c520:·7374·616c·6c5f·636d·643a·2064·6e66·2072··stall_cmd:·dnf·r | |||
| 0003c530:·6569·6e73·7461·6c6c·202d·790a·2020·7768··einstall·-y.··wh | |||
| 0003c540:·656e·3a20·616e·7369·626c·655f·6469·7374··en:·ansible_dist | |||
| 0003c550:·7269·6275·7469·6f6e·203d·3d20·2246·6564··ribution·==·"Fed | |||
| 0003c560:·6f72·6122·0a20·2074·6167·733a·0a20·202d··ora".··tags:.··- | |||
| 0003c570:·2043·4345·2d38·3038·3537·2d36·0a20·202d···CCE-80857-6.··- | |||
| 0003c580:·2043·4a49·532d·352e·3130·2e34·2e31·0a20···CJIS-5.10.4.1.· | |||
| 0003c590:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003c5a0:·332e·332e·380a·2020·2d20·4e49·5354·2d38··3.3.8.··-·NIST-8 | |||
| 0003c5b0:·3030·2d31·3731·2d33·2e34·2e31·0a20·202d··00-171-3.4.1.··- | |||
| 0003c5c0:·204e·4953·542d·3830·302d·3533·2d41·552d···NIST-800-53-AU- | |||
| 0003c5d0:·3928·3329·0a20·202d·204e·4953·542d·3830··9(3).··-·NIST-80 | |||
| 0003c5e0:·302d·3533·2d43·4d2d·3628·6329·0a20·202d··0-53-CM-6(c).··- | |||
| 0003c5f0:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003c600:·3628·6429·0a20·202d·204e·4953·542d·3830··6(d).··-·NIST-80 | |||
| 0003c610:·302d·3533·2d53·492d·370a·2020·2d20·4e49··0-53-SI-7.··-·NI | |||
| 0003c620:·5354·2d38·3030·2d35·332d·5349·2d37·2831··ST-800-53-SI-7(1 | |||
| 0003c630:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| Max diff block lines reached; 6232060/6277378 bytes (99.28%) of diff not shown. | |||
| Offset 52, 15 lines modified | Offset 52, 15 lines modified | ||
| 52 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 52 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 57 | *****·Revision·History·***** | 57 | *****·Revision·History·***** |
| 58 | Current·version:·0.1.65 | 58 | Current·version:·0.1.65 |
| 59 | ····*·draft·(as·of·202 | 59 | ····*·draft·(as·of·2025-02-23) |
| 60 | *****·Table·of·Contents·***** | 60 | *****·Table·of·Contents·***** |
| 61 | ···1.·System_Settings | 61 | ···1.·System_Settings |
| 62 | ·········1.·Installing_and_Maintaining_Software | 62 | ·········1.·Installing_and_Maintaining_Software |
| 63 | ·········2.·Account_and_Access_Control | 63 | ·········2.·Account_and_Access_Control |
| 64 | ·········3.·System_Accounting_with_auditd | 64 | ·········3.·System_Accounting_with_auditd |
| 65 | ·········4.·Configure_Syslog | 65 | ·········4.·Configure_Syslog |
| 66 | ·········5.·Network_Configuration_and_Firewalls | 66 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 99, 14 lines modified | Offset 99, 24 lines modified | ||
| 99 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 99 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 100 | $·sudo·rpm·-Uvh·PACKAGENAME | 100 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 101 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 101 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 102 | Severity: ················high | 102 | Severity: ················high |
| 103 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 103 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 104 | Identifiers·and·References·Identifiers: ·CCE-80857-6 | 104 | Identifiers·and·References·Identifiers: ·CCE-80857-6 |
| 105 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 105 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 106 | Remediation_Shell_script_⇲ | ||
| 107 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 108 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 109 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 110 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 111 | yum·reinstall·-y·$packages_to_reinstall | ||
| 106 | Remediation_Ansible_snippet_⇲ | 112 | Remediation_Ansible_snippet_⇲ |
| 107 | Complexity:·high | 113 | Complexity:·high |
| 108 | Disruption:·medium | 114 | Disruption:·medium |
| 109 | Strategy:···restrict | 115 | Strategy:···restrict |
| 110 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 116 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 111 | ··set_fact: | 117 | ··set_fact: |
| 112 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 118 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 256, 37 lines modified | Offset 266, 52 lines modified | ||
| 256 | ··-·PCI-DSS-Req-11.5 | 266 | ··-·PCI-DSS-Req-11.5 |
| 257 | ··-·high_complexity | 267 | ··-·high_complexity |
| 258 | ··-·high_severity | 268 | ··-·high_severity |
| 259 | ··-·medium_disruption | 269 | ··-·medium_disruption |
| 260 | ··-·no_reboot_needed | 270 | ··-·no_reboot_needed |
| 261 | ··-·restrict_strategy | 271 | ··-·restrict_strategy |
| 262 | ··-·rpm_verify_hashes | 272 | ··-·rpm_verify_hashes |
| 263 | Remediation_Shell_script_⇲ | ||
| 264 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 265 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 266 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 267 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 268 | yum·reinstall·-y·$packages_to_reinstall | ||
| 269 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 273 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 270 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 274 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 271 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 275 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 272 | run·the·following·command·to·determine·which·package·owns·it: | 276 | run·the·following·command·to·determine·which·package·owns·it: |
| 273 | $·rpm·-qf·FILENAME | 277 | $·rpm·-qf·FILENAME |
| 274 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 278 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 275 | $·sudo·rpm·--setugids·PACKAGENAME | 279 | $·sudo·rpm·--setugids·PACKAGENAME |
| 276 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 280 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 277 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 281 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 278 | Severity: ················high | 282 | Severity: ················high |
| 279 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 283 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 280 | Identifiers·and·References·Identifiers: ·CCE-82196-7 | 284 | Identifiers·and·References·Identifiers: ·CCE-82196-7 |
| 281 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 285 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 286 | Remediation_Shell_script_⇲ | ||
| 287 | Complexity:·high | ||
| 288 | Disruption:·medium | ||
| 289 | Strategy:···restrict | ||
| 290 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 291 | declare·-A·SETPERMS_RPM_DICT | ||
| 292 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 293 | #·is·expected·by·the·RPM·database | ||
| 294 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 295 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 296 | do | ||
| 297 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 298 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 299 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 300 | done | ||
| 301 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 302 | #·correct·values | ||
| 303 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 304 | do | ||
| 305 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 306 | done | ||
| 282 | Remediation_Ansible_snippet_⇲ | 307 | Remediation_Ansible_snippet_⇲ |
| 283 | Complexity:·high | 308 | Complexity:·high |
| 284 | Disruption:·medium | 309 | Disruption:·medium |
| 285 | Strategy:···restrict | 310 | Strategy:···restrict |
| 286 | -·name:·Read·list·of·files·with·incorrect·ownership | 311 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 287 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 312 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 288 | ····--nocaps·--nolinkto·--nomode | 313 | ····--nocaps·--nolinkto·--nomode |
| Offset 360, 53 lines modified | Offset 385, 57 lines modified | ||
| 360 | ··-·PCI-DSS-Req-11.5 | 385 | ··-·PCI-DSS-Req-11.5 |
| 361 | ··-·high_complexity | 386 | ··-·high_complexity |
| 362 | ··-·high_severity | 387 | ··-·high_severity |
| 363 | ··-·medium_disruption | 388 | ··-·medium_disruption |
| 364 | ··-·no_reboot_needed | 389 | ··-·no_reboot_needed |
| 365 | ··-·restrict_strategy | 390 | ··-·restrict_strategy |
| 366 | ··-·rpm_verify_ownership | 391 | ··-·rpm_verify_ownership |
| 392 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 393 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 394 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 395 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 396 | $·rpm·-qf·FILENAME | ||
| 397 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 398 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 399 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 400 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 401 | Severity: ················high | ||
| 402 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 403 | Identifiers·and·References·Identifiers: ·CCE-80858-4 | ||
| 404 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | ||
| 367 | Remediation_Shell_script_⇲ | 405 | Remediation_Shell_script_⇲ |
| 368 | Complexity:·high | 406 | Complexity:·high |
| Max diff block lines reached; 657358/666793 bytes (98.59%) of diff not shown. | |||
| Offset 14455, 15 lines modified | Offset 14455, 15 lines modified | ||
| 00038760:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00038760:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00038770:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00038770:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00038780:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00038780:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00038790:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00038790:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 000387a0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 000387a0:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 000387b0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 000387b0:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 000387c0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 000387c0:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 000387d0:·6620·3230·323 | 000387d0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 000387e0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 000387e0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 000387f0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 000387f0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00038800:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00038800:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 00038810:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 00038810:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 00038820:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 00038820:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00038830:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00038830:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00038840:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00038840:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15437, 330 lines modified | Offset 15437, 330 lines modified | ||
| 0003c4c0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003c4c0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c4d0:·743d·2223·6964·6d38·3136·3022·2074·6162··t="#idm8160"·tab | 0003c4d0:·743d·2223·6964·6d38·3136·3022·2074·6162··t="#idm8160"·tab | ||
| 0003c4e0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003c4e0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003c4f0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003c4f0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003c500:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003c500:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003c510:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003c510:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003c520:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003c520:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003c530:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003c530:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 0003c540:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003c550:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c5 | 0003c540:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | ||
| 0003c550:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003c560:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003c570:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003c580:·6964·6d38·3136·3022·3e3c·7072·653e·3c63··idm8160"><pre><c | |||
| 0003c590:·6f64·653e·0a23·2046·696e·6420·7768·6963··ode>.#·Find·whic | |||
| 0003c5a0:·6820·6669·6c65·7320·6861·7665·2069·6e63··h·files·have·inc | |||
| 0003c5b0:·6f72·7265·6374·2068·6173·6820·286e·6f74··orrect·hash·(not | |||
| 0003c5c0:·2069·6e20·2f65·7463·2c20·6265·6361·7573···in·/etc,·becaus | |||
| 0003c5d0:·6520·6f66·2074·6865·2073·7973·7465·6d20··e·of·the·system· | |||
| 0003c5e0:·7265·6c61·7465·6420·636f·6e66·6967·2066··related·config·f | |||
| 0003c5f0:·696c·6573·2920·616e·6420·7468·656e·2067··iles)·and·then·g | |||
| 0003c600:·6574·2066·696c·6573·206e·616d·6573·0a66··et·files·names.f | |||
| 0003c610:·696c·6573·5f77·6974·685f·696e·636f·7272··iles_with_incorr | |||
| 0003c620:·6563·745f·6861·7368·3d22·2428·7270·6d20··ect_hash="$(rpm· | |||
| 0003c630:·2d56·6120·2d2d·6e6f·636f·6e66·6967·207c··-Va·--noconfig·| | |||
| 0003c640:·2067·7265·7020·2d45·2027·5e2e·2e35·2720···grep·-E·'^..5'· | |||
| 0003c650:·7c20·6177·6b20·277b·7072·696e·7420·244e··|·awk·'{print·$N | |||
| 0003c660:·467d·2720·2922·0a0a·2320·4672·6f6d·2066··F}'·)"..#·From·f | |||
| 0003c670:·696c·6573·206e·616d·6573·2067·6574·2070··iles·names·get·p | |||
| 0003c680:·6163·6b61·6765·206e·616d·6573·2061·6e64··ackage·names·and | |||
| 0003c690:·2063·6861·6e67·6520·6e65·776c·696e·6520···change·newline· | |||
| 0003c6a0:·746f·2073·7061·6365·2c20·6265·6361·7573··to·space,·becaus | |||
| 0003c6b0:·6520·7270·6d20·7772·6974·6573·2065·6163··e·rpm·writes·eac | |||
| 0003c6c0:·6820·7061·636b·6167·6520·746f·206e·6577··h·package·to·new | |||
| 0003c6d0:·206c·696e·650a·7061·636b·6167·6573·5f74···line.packages_t | |||
| 0003c6e0:·6f5f·7265·696e·7374·616c·6c3d·2224·2872··o_reinstall="$(r | |||
| 0003c6f0:·706d·202d·7166·2024·6669·6c65·735f·7769··pm·-qf·$files_wi | |||
| 0003c700:·7468·5f69·6e63·6f72·7265·6374·5f68·6173··th_incorrect_has | |||
| 0003c710:·6820·7c20·7472·2027·5c6e·2720·2720·2729··h·|·tr·'\n'·'·') | |||
| 0003c720:·220a·0a0a·7975·6d20·7265·696e·7374·616c··"...yum·reinstal | |||
| 0003c730:·6c20·2d79·2024·7061·636b·6167·6573·5f74··l·-y·$packages_t | |||
| 0003c740:·6f5f·7265·696e·7374·616c·6c0a·3c2f·636f··o_reinstall.</co | |||
| 0003c750:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003c760:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003c770:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003c | 0003c780:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | ||
| 0003c790:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003c7a0:·646d·3831·3631·2220·7461·6269·6e64·6578··dm8161"·tabindex | |||
| 0003c7b0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003c7c0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003c7d0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003c7e0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003c7f0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003c800:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003c810:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003c820:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c830:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c840:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c850:·6d38·3136·3122·3e3c·7461·626c·6520·636c··m8161"><table·cl | |||
| 0003c860:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003c870:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003c880:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003c890:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003c8a0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003c8b0:·3e3c·7464·3e68·6967·683c·2f74·643e·3c2f··><td>high</td></ | |||
| 0003c8c0:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c8d0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6d··ption:</th><td>m | |||
| 0003c8e0:·6564·6975·6d3c·2f74·643e·3c2f·7472·3e3c··edium</td></tr>< | |||
| 0003c8f0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c900:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003c910:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003c920:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003c580:·643d·2269·646d·3831·3630·223e·3c74·6162··d="idm8160"><tab | |||
| 0003c590:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c5a0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c5b0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c5c0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c5d0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c5e0:·3a3c·2f74·683e·3c74·643e·6869·6768·3c2f··:</th><td>high</ | |||
| 0003c5f0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c600:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003c610:·3c74·643e·6d65·6469·756d·3c2f·7464·3e3c··<td>medium</td>< | |||
| 0003c620:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003c630:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003c640:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003c650:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003c660:·6465·3e2d·206e·616d·653a·2027·5365·7420··de>-·name:·'Set· | |||
| 0003c670:·6661·6374·3a20·5061·636b·6167·6520·6d61··fact:·Package·ma | |||
| 0003c680:·6e61·6765·7220·7265·696e·7374·616c·6c20··nager·reinstall· | |||
| 0003c690:·636f·6d6d·616e·6420·2864·6e66·2927·0a20··command·(dnf)'.· | |||
| 0003c6a0:·2073·6574·5f66·6163·743a·0a20·2020·2070···set_fact:.····p | |||
| 0003c6b0:·6163·6b61·6765·5f6d·616e·6167·6572·5f72··ackage_manager_r | |||
| 0003c6c0:·6569·6e73·7461·6c6c·5f63·6d64·3a20·646e··einstall_cmd:·dn | |||
| 0003c6d0:·6620·7265·696e·7374·616c·6c20·2d79·0a20··f·reinstall·-y.· | |||
| 0003c6e0:·2077·6865·6e3a·2061·6e73·6962·6c65·5f64···when:·ansible_d | |||
| 0003c6f0:·6973·7472·6962·7574·696f·6e20·3d3d·2022··istribution·==·" | |||
| 0003c700:·4665·646f·7261·220a·2020·7461·6773·3a0a··Fedora".··tags:. | |||
| 0003c710:·2020·2d20·4343·452d·3830·3835·372d·360a····-·CCE-80857-6. | |||
| 0003c720:·2020·2d20·434a·4953·2d35·2e31·302e·342e····-·CJIS-5.10.4. | |||
| 0003c730:·310a·2020·2d20·4e49·5354·2d38·3030·2d31··1.··-·NIST-800-1 | |||
| 0003c740:·3731·2d33·2e33·2e38·0a20·202d·204e·4953··71-3.3.8.··-·NIS | |||
| 0003c750:·542d·3830·302d·3137·312d·332e·342e·310a··T-800-171-3.4.1. | |||
| 0003c760:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c770:·4155·2d39·2833·290a·2020·2d20·4e49·5354··AU-9(3).··-·NIST | |||
| 0003c780:·2d38·3030·2d35·332d·434d·2d36·2863·290a··-800-53-CM-6(c). | |||
| 0003c790:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c7a0:·434d·2d36·2864·290a·2020·2d20·4e49·5354··CM-6(d).··-·NIST | |||
| 0003c7b0:·2d38·3030·2d35·332d·5349·2d37·0a20·202d··-800-53-SI-7.··- | |||
| 0003c7c0:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003c7d0:·3728·3129·0a20·202d·204e·4953·542d·3830··7(1).··-·NIST-80 | |||
| Max diff block lines reached; 17031736/17077054 bytes (99.73%) of diff not shown. | |||
| Offset 14448, 15 lines modified | Offset 14448, 15 lines modified | ||
| 000386f0:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 000386f0:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00038700:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00038700:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00038710:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00038710:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00038720:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00038720:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00038730:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00038730:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00038740:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00038740:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00038750:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00038750:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 00038760:·6620·3230·323 | 00038760:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 00038770:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 00038770:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 00038780:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 00038780:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 00038790:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 00038790:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 000387a0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 000387a0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 000387b0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 000387b0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 000387c0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 000387c0:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 000387d0:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 000387d0:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15439, 330 lines modified | Offset 15439, 330 lines modified | ||
| 0003c4e0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003c4e0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003c4f0:·2223·6964·6d38·3136·3022·2074·6162·696e··"#idm8160"·tabin | 0003c4f0:·2223·6964·6d38·3136·3022·2074·6162·696e··"#idm8160"·tabin | ||
| 0003c500:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003c500:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c510:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c510:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c520:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c520:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c530:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c530:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c540:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c540:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c550:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c550:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 0003c560:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | |||
| 0003c570:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c580:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c590:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c5a0:·6d38·3136·3022·3e3c·7072·653e·3c63·6f64··m8160"><pre><cod | |||
| 0003c5b0:·653e·0a23·2046·696e·6420·7768·6963·6820··e>.#·Find·which· | |||
| 0003c5c0:·6669·6c65·7320·6861·7665·2069·6e63·6f72··files·have·incor | |||
| 0003c5d0:·7265·6374·2068·6173·6820·286e·6f74·2069··rect·hash·(not·i | |||
| 0003c5e0:·6e20·2f65·7463·2c20·6265·6361·7573·6520··n·/etc,·because· | |||
| 0003c5f0:·6f66·2074·6865·2073·7973·7465·6d20·7265··of·the·system·re | |||
| 0003c600:·6c61·7465·6420·636f·6e66·6967·2066·696c··lated·config·fil | |||
| 0003c610:·6573·2920·616e·6420·7468·656e·2067·6574··es)·and·then·get | |||
| 0003c620:·2066·696c·6573·206e·616d·6573·0a66·696c···files·names.fil | |||
| 0003c560:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003c570:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c580:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c590:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c5a0:·2269·646d·3831·3630·223e·3c74·6162·6c65··"idm8160"><table | |||
| 0003c5b0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c5c0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c5d0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c5e0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c5f0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c600:·2f74·683e·3c74·643e·6869·6768·3c2f·7464··/th><td>high</td | |||
| 0003c610:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c620:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c630:·643e·6d65·6469·756d·3c2f·7464·3e3c·2f74··d>medium</td></t | |||
| 0003c640:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c650:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003c660:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 0003c670:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c680:·3e2d·206e·616d·653a·2027·5365·7420·6661··>-·name:·'Set·fa | |||
| 0003c690:·6374·3a20·5061·636b·6167·6520·6d61·6e61··ct:·Package·mana | |||
| 0003c6a0:·6765·7220·7265·696e·7374·616c·6c20·636f··ger·reinstall·co | |||
| 0003c6b0:·6d6d·616e·6420·2864·6e66·2927·0a20·2073··mmand·(dnf)'.··s | |||
| 0003c6c0:·6574·5f66·6163·743a·0a20·2020·2070·6163··et_fact:.····pac | |||
| 0003c6d0:·6b61·6765·5f6d·616e·6167·6572·5f72·6569··kage_manager_rei | |||
| 0003c6e0:·6e73·7461·6c6c·5f63·6d64·3a20·646e·6620··nstall_cmd:·dnf· | |||
| 0003c6f0:·7265·696e·7374·616c·6c20·2d79·0a20·2077··reinstall·-y.··w | |||
| 0003c700:·6865·6e3a·2061·6e73·6962·6c65·5f64·6973··hen:·ansible_dis | |||
| 0003c710:·7472·6962·7574·696f·6e20·3d3d·2022·4665··tribution·==·"Fe | |||
| 0003c720:·646f·7261·220a·2020·7461·6773·3a0a·2020··dora".··tags:.·· | |||
| 0003c730:·2d20·4343·452d·3830·3835·372d·360a·2020··-·CCE-80857-6.·· | |||
| 0003c740:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| 0003c750:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003c760:·2d33·2e33·2e38·0a20·202d·204e·4953·542d··-3.3.8.··-·NIST- | |||
| 0003c770:·3830·302d·3137·312d·332e·342e·310a·2020··800-171-3.4.1.·· | |||
| 0003c780:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003c790:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003c7a0:·3030·2d35·332d·434d·2d36·2863·290a·2020··00-53-CM-6(c).·· | |||
| 0003c7b0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003c7c0:·2d36·2864·290a·2020·2d20·4e49·5354·2d38··-6(d).··-·NIST-8 | |||
| 0003c7d0:·3030·2d35·332d·5349·2d37·0a20·202d·204e··00-53-SI-7.··-·N | |||
| 0003c7e0:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003c7f0:·3129·0a20·202d·204e·4953·542d·3830·302d··1).··-·NIST-800- | |||
| 0003c800:·3533·2d53·492d·3728·3629·0a20·202d·2050··53-SI-7(6).··-·P | |||
| 0003c810:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003c820:·2020·2d20·6869·6768·5f63·6f6d·706c·6578····-·high_complex | |||
| 0003c830:·6974·790a·2020·2d20·6869·6768·5f73·6576··ity.··-·high_sev | |||
| 0003c840:·6572·6974·790a·2020·2d20·6d65·6469·756d··erity.··-·medium | |||
| 0003c850:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | |||
| 0003c860:·6e6f·5f72·6562·6f6f·745f·6e65·6564·6564··no_reboot_needed | |||
| 0003c870:·0a20·202d·2072·6573·7472·6963·745f·7374··.··-·restrict_st | |||
| 0003c880:·7261·7465·6779·0a20·202d·2072·706d·5f76··rategy.··-·rpm_v | |||
| 0003c890:·6572·6966·795f·6861·7368·6573·0a0a·2d20··erify_hashes..-· | |||
| 0003c8a0:·6e61·6d65·3a20·2753·6574·2066·6163·743a··name:·'Set·fact: | |||
| 0003c8b0:·2050·6163·6b61·6765·206d·616e·6167·6572···Package·manager | |||
| 0003c8c0:·2072·6569·6e73·7461·6c6c·2063·6f6d·6d61···reinstall·comma | |||
| 0003c8d0:·6e64·2028·7975·6d29·270a·2020·7365·745f··nd·(yum)'.··set_ | |||
| 0003c8e0:·6661·6374·3a0a·2020·2020·7061·636b·6167··fact:.····packag | |||
| 0003c8f0:·655f·6d61·6e61·6765·725f·7265·696e·7374··e_manager_reinst | |||
| 0003c900:·616c·6c5f·636d·643a·2079·756d·2072·6569··all_cmd:·yum·rei | |||
| 0003c910:·6e73·7461·6c6c·202d·790a·2020·7768·656e··nstall·-y.··when | |||
| 0003c920:·3a20·2861·6e73·6962·6c65·5f64·6973·7472··:·(ansible_distr | |||
| 0003c930:·6962·7574·696f·6e20·3d3d·2022·5265·6448··ibution·==·"RedH | |||
| 0003c940:·6174·2220·6f72·2061·6e73·6962·6c65·5f64··at"·or·ansible_d | |||
| 0003c950:·6973·7472·6962·7574·696f·6e20·3d3d·2022··istribution·==·" | |||
| 0003c960:·4365·6e74·4f53·2220·6f72·2061·6e73·6962··CentOS"·or·ansib | |||
| 0003c970:·6c65·5f64·6973·7472·6962·7574·696f·6e0a··le_distribution. | |||
| 0003c980:·2020·2020·3d3d·2022·4f72·6163·6c65·4c69······==·"OracleLi | |||
| 0003c990:·6e75·7822·290a·2020·7461·6773·3a0a·2020··nux").··tags:.·· | |||
| 0003c9a0:·2d20·4343·452d·3830·3835·372d·360a·2020··-·CCE-80857-6.·· | |||
| 0003c9b0:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| 0003c9c0:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003c9d0:·2d33·2e33·2e38·0a20·202d·204e·4953·542d··-3.3.8.··-·NIST- | |||
| 0003c9e0:·3830·302d·3137·312d·332e·342e·310a·2020··800-171-3.4.1.·· | |||
| 0003c9f0:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003ca00:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003ca10:·3030·2d35·332d·434d·2d36·2863·290a·2020··00-53-CM-6(c).·· | |||
| 0003ca20:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003ca30:·2d36·2864·290a·2020·2d20·4e49·5354·2d38··-6(d).··-·NIST-8 | |||
| 0003ca40:·3030·2d35·332d·5349·2d37·0a20·202d·204e··00-53-SI-7.··-·N | |||
| 0003ca50:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003ca60:·3129·0a20·202d·204e·4953·542d·3830·302d··1).··-·NIST-800- | |||
| 0003ca70:·3533·2d53·492d·3728·3629·0a20·202d·2050··53-SI-7(6).··-·P | |||
| 0003ca80:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003ca90:·2020·2d20·6869·6768·5f63·6f6d·706c·6578····-·high_complex | |||
| 0003caa0:·6974·790a·2020·2d20·6869·6768·5f73·6576··ity.··-·high_sev | |||
| 0003cab0:·6572·6974·790a·2020·2d20·6d65·6469·756d··erity.··-·medium | |||
| 0003cac0:·5f64·6973·7275·7074·696f·6e0a·2020·2d20··_disruption.··-· | |||
| 0003cad0:·6e6f·5f72·6562·6f6f·745f·6e65·6564·6564··no_reboot_needed | |||
| 0003cae0:·0a20·202d·2072·6573·7472·6963·745f·7374··.··-·restrict_st | |||
| 0003caf0:·7261·7465·6779·0a20·202d·2072·706d·5f76··rategy.··-·rpm_v | |||
| Max diff block lines reached; 9153781/9199099 bytes (99.51%) of diff not shown. | |||
| Offset 55, 15 lines modified | Offset 55, 15 lines modified | ||
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 58 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 58 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 59 | ····*·cpe:/o:redhat:enterprise_linux:8 | 59 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 60 | *****·Revision·History·***** | 60 | *****·Revision·History·***** |
| 61 | Current·version:·0.1.65 | 61 | Current·version:·0.1.65 |
| 62 | ····*·draft·(as·of·202 | 62 | ····*·draft·(as·of·2025-02-23) |
| 63 | *****·Table·of·Contents·***** | 63 | *****·Table·of·Contents·***** |
| 64 | ···1.·System_Settings | 64 | ···1.·System_Settings |
| 65 | ·········1.·Installing_and_Maintaining_Software | 65 | ·········1.·Installing_and_Maintaining_Software |
| 66 | ·········2.·Account_and_Access_Control | 66 | ·········2.·Account_and_Access_Control |
| 67 | ·········3.·System_Accounting_with_auditd | 67 | ·········3.·System_Accounting_with_auditd |
| 68 | ·········4.·Configure_Syslog | 68 | ·········4.·Configure_Syslog |
| 69 | ·········5.·Network_Configuration_and_Firewalls | 69 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 105, 14 lines modified | Offset 105, 24 lines modified | ||
| 105 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 105 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 106 | $·sudo·rpm·-Uvh·PACKAGENAME | 106 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 107 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 107 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 108 | Severity: ················high | 108 | Severity: ················high |
| 109 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 109 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 110 | Identifiers·and·References·Identifiers: ·CCE-80857-6 | 110 | Identifiers·and·References·Identifiers: ·CCE-80857-6 |
| 111 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 111 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 112 | Remediation_Shell_script_⇲ | ||
| 113 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 114 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 115 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 116 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 117 | yum·reinstall·-y·$packages_to_reinstall | ||
| 112 | Remediation_Ansible_snippet_⇲ | 118 | Remediation_Ansible_snippet_⇲ |
| 113 | Complexity:·high | 119 | Complexity:·high |
| 114 | Disruption:·medium | 120 | Disruption:·medium |
| 115 | Strategy:···restrict | 121 | Strategy:···restrict |
| 116 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 122 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 117 | ··set_fact: | 123 | ··set_fact: |
| 118 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 124 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 262, 37 lines modified | Offset 272, 52 lines modified | ||
| 262 | ··-·PCI-DSS-Req-11.5 | 272 | ··-·PCI-DSS-Req-11.5 |
| 263 | ··-·high_complexity | 273 | ··-·high_complexity |
| 264 | ··-·high_severity | 274 | ··-·high_severity |
| 265 | ··-·medium_disruption | 275 | ··-·medium_disruption |
| 266 | ··-·no_reboot_needed | 276 | ··-·no_reboot_needed |
| 267 | ··-·restrict_strategy | 277 | ··-·restrict_strategy |
| 268 | ··-·rpm_verify_hashes | 278 | ··-·rpm_verify_hashes |
| 269 | Remediation_Shell_script_⇲ | ||
| 270 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 271 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 272 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 273 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 274 | yum·reinstall·-y·$packages_to_reinstall | ||
| 275 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 279 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 276 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 280 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 277 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 281 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 278 | run·the·following·command·to·determine·which·package·owns·it: | 282 | run·the·following·command·to·determine·which·package·owns·it: |
| 279 | $·rpm·-qf·FILENAME | 283 | $·rpm·-qf·FILENAME |
| 280 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 284 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 281 | $·sudo·rpm·--setugids·PACKAGENAME | 285 | $·sudo·rpm·--setugids·PACKAGENAME |
| 282 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 286 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 283 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 287 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 284 | Severity: ················high | 288 | Severity: ················high |
| 285 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 289 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 286 | Identifiers·and·References·Identifiers: ·CCE-82196-7 | 290 | Identifiers·and·References·Identifiers: ·CCE-82196-7 |
| 287 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 291 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 292 | Remediation_Shell_script_⇲ | ||
| 293 | Complexity:·high | ||
| 294 | Disruption:·medium | ||
| 295 | Strategy:···restrict | ||
| 296 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 297 | declare·-A·SETPERMS_RPM_DICT | ||
| 298 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 299 | #·is·expected·by·the·RPM·database | ||
| 300 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 301 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 302 | do | ||
| 303 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 304 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 305 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 306 | done | ||
| 307 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 308 | #·correct·values | ||
| 309 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 310 | do | ||
| 311 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 312 | done | ||
| 288 | Remediation_Ansible_snippet_⇲ | 313 | Remediation_Ansible_snippet_⇲ |
| 289 | Complexity:·high | 314 | Complexity:·high |
| 290 | Disruption:·medium | 315 | Disruption:·medium |
| 291 | Strategy:···restrict | 316 | Strategy:···restrict |
| 292 | -·name:·Read·list·of·files·with·incorrect·ownership | 317 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 293 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 318 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 294 | ····--nocaps·--nolinkto·--nomode | 319 | ····--nocaps·--nolinkto·--nomode |
| Offset 366, 53 lines modified | Offset 391, 57 lines modified | ||
| 366 | ··-·PCI-DSS-Req-11.5 | 391 | ··-·PCI-DSS-Req-11.5 |
| 367 | ··-·high_complexity | 392 | ··-·high_complexity |
| 368 | ··-·high_severity | 393 | ··-·high_severity |
| 369 | ··-·medium_disruption | 394 | ··-·medium_disruption |
| 370 | ··-·no_reboot_needed | 395 | ··-·no_reboot_needed |
| 371 | ··-·restrict_strategy | 396 | ··-·restrict_strategy |
| 372 | ··-·rpm_verify_ownership | 397 | ··-·rpm_verify_ownership |
| 398 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 399 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 400 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 401 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 402 | $·rpm·-qf·FILENAME | ||
| 403 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 404 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 405 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 406 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 407 | Severity: ················high | ||
| 408 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 409 | Identifiers·and·References·Identifiers: ·CCE-80858-4 | ||
| 410 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | ||
| 373 | Remediation_Shell_script_⇲ | 411 | Remediation_Shell_script_⇲ |
| 374 | Complexity:·high | 412 | Complexity:·high |
| Max diff block lines reached; 946889/956326 bytes (99.01%) of diff not shown. | |||
| Offset 14442, 15 lines modified | Offset 14442, 15 lines modified | ||
| 00038690:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00038690:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 000386a0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 000386a0:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 000386b0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 000386b0:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 000386c0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 000386c0:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 000386d0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 000386d0:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 000386e0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 000386e0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 000386f0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 000386f0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00038700:·3032·3 | 00038700:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00038710:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00038710:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00038720:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00038720:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00038730:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00038730:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00038740:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00038740:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00038750:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00038750:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00038760:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00038760:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00038770:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00038770:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15423, 192 lines modified | Offset 15423, 192 lines modified | ||
| 0003c3e0:·6172·6765·743d·2223·6964·6d38·3532·3122··arget="#idm8521" | 0003c3e0:·6172·6765·743d·2223·6964·6d38·3532·3122··arget="#idm8521" | ||
| 0003c3f0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003c3f0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003c400:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003c400:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003c410:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003c410:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003c420:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003c420:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003c430:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003c430:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003c440:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003c440:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003c450:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003c450:·6f6e·2041·6e61·636f·6e64·6120·736e·6970··on·Anaconda·snip | |||
| 0003c460:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c470:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c480:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c490:·7365·2220·6964·3d22·6964·6d38·3532·3122··se"·id="idm8521" | |||
| 0003c4a0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c4b0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c4c0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003c4d0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c4e0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c4f0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c500:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c510:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c520:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c530:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c540:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c550:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003c560:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c570:·653e·0a70·6163·6b61·6765·202d·2d61·6464··e>.package·--add | |||
| 0003c580:·3d61·6964·650a·3c2f·636f·6465·3e3c·2f70··=aide.</code></p | |||
| 0003c590:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c5a0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c5b0:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c5c0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003c5d0:·7461·7267·6574·3d22·2369·646d·3835·3232··target="#idm8522 | |||
| 0003c5e0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003c5f0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003c600:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003c610:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c620:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c630:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c640:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003c650:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c660:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c670:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c680:·6522·2069·643d·2269·646d·3835·3232·223e··e"·id="idm8522"> | |||
| 0003c690:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c6a0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c6b0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c6c0:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c6d0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c6e0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003c6f0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c700:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c710:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c720:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003c730:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003c740:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003c750:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c760:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003c770:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003c780:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003c790:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003c7a0:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003c7b0:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003c7c0:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003c7d0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c7e0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c7f0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c800:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c810:·7267·6574·3d22·2369·646d·3835·3233·2220··rget="#idm8523"· | |||
| 0003c820:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c830:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c840:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c850:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c860:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c870:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003c880:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c | 0003c460:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 0003c | 0003c470:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 0003c | 0003c480:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 0003c | 0003c490:·2220·6964·3d22·6964·6d38·3532·3122·3e3c··"·id="idm8521">< | ||
| 0003c | 0003c4a0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | ||
| 0003c | 0003c4b0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | ||
| 0003c | 0003c4c0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 0003c | 0003c4d0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | ||
| 0003c | 0003c4e0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | ||
| 0003c | 0003c4f0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | ||
| 0003c | 0003c500:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003c | 0003c510:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | ||
| 0003c | 0003c520:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003c | 0003c530:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | ||
| 0003c | 0003c540:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | ||
| 0003c | 0003c550:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | ||
| 0003c | 0003c560:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | ||
| 0003c570:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003c580:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003c590:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003c5a0:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003c5b0:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003c5c0:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003c5d0:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003c5e0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c5f0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003c600:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003c610:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003c620:·6765·743d·2223·6964·6d38·3532·3222·2074··get="#idm8522"·t | |||
| 0003c630:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c640:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c650:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c660:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c670:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003c680:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| Max diff block lines reached; 8440326/8466600 bytes (99.69%) of diff not shown. | |||
| Offset 53, 15 lines modified | Offset 53, 15 lines modified | ||
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 55 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 55 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 56 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 56 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 57 | ····*·cpe:/o:redhat:enterprise_linux:8 | 57 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 58 | *****·Revision·History·***** | 58 | *****·Revision·History·***** |
| 59 | Current·version:·0.1.65 | 59 | Current·version:·0.1.65 |
| 60 | ····*·draft·(as·of·202 | 60 | ····*·draft·(as·of·2025-02-23) |
| 61 | *****·Table·of·Contents·***** | 61 | *****·Table·of·Contents·***** |
| 62 | ···1.·System_Settings | 62 | ···1.·System_Settings |
| 63 | ·········1.·Installing_and_Maintaining_Software | 63 | ·········1.·Installing_and_Maintaining_Software |
| 64 | ·········2.·Account_and_Access_Control | 64 | ·········2.·Account_and_Access_Control |
| 65 | ·········3.·System_Accounting_with_auditd | 65 | ·········3.·System_Accounting_with_auditd |
| 66 | ·········4.·GRUB2_bootloader_configuration | 66 | ·········4.·GRUB2_bootloader_configuration |
| 67 | ·········5.·zIPL_bootloader_configuration | 67 | ·········5.·zIPL_bootloader_configuration |
| Offset 96, 31 lines modified | Offset 96, 39 lines modified | ||
| 96 | The·aide·package·can·be·installed·with·the·following·command: | 96 | The·aide·package·can·be·installed·with·the·following·command: |
| 97 | $·sudo·yum·install·aide | 97 | $·sudo·yum·install·aide |
| 98 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 98 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 99 | Severity: ················medium | 99 | Severity: ················medium |
| 100 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 100 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 101 | Identifiers·and·References·Identifiers: ·CCE-80844-4 | 101 | Identifiers·and·References·Identifiers: ·CCE-80844-4 |
| 102 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 102 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 103 | Remediation_Anaconda_snippet_⇲ | ||
| 104 | Complexity:·low | ||
| 105 | Disruption:·low | ||
| 106 | Strategy:···enable | ||
| 107 | package·--add=aide | ||
| 108 | Remediation_Puppet_snippet_⇲ | 103 | Remediation_Puppet_snippet_⇲ |
| 109 | Complexity:·low | 104 | Complexity:·low |
| 110 | Disruption:·low | 105 | Disruption:·low |
| 111 | Strategy:···enable | 106 | Strategy:···enable |
| 112 | include·install_aide | 107 | include·install_aide |
| 113 | class·install_aide·{ | 108 | class·install_aide·{ |
| 114 | ··package·{·'aide': | 109 | ··package·{·'aide': |
| 115 | ····ensure·=>·'installed', | 110 | ····ensure·=>·'installed', |
| 116 | ··} | 111 | ··} |
| 117 | } | 112 | } |
| 113 | Remediation_Shell_script_⇲ | ||
| 114 | Complexity:·low | ||
| 115 | Disruption:·low | ||
| 116 | Strategy:···enable | ||
| 117 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 118 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 119 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 120 | ····yum·install·-y·"aide" | ||
| 121 | fi | ||
| 122 | else | ||
| 123 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 124 | fi | ||
| 118 | Remediation_Ansible_snippet_⇲ | 125 | Remediation_Ansible_snippet_⇲ |
| 119 | Complexity:·low | 126 | Complexity:·low |
| 120 | Disruption:·low | 127 | Disruption:·low |
| 121 | Strategy:···enable | 128 | Strategy:···enable |
| 122 | -·name:·Ensure·aide·is·installed | 129 | -·name:·Ensure·aide·is·installed |
| 123 | ··package: | 130 | ··package: |
| 124 | ····name:·aide | 131 | ····name:·aide |
| Offset 139, 28 lines modified | Offset 147, 20 lines modified | ||
| 139 | ··-·no_reboot_needed | 147 | ··-·no_reboot_needed |
| 140 | ··-·package_aide_installed | 148 | ··-·package_aide_installed |
| 141 | Remediation_OSBuild_Blueprint_snippet_⇲ | 149 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 142 | [[packages]] | 150 | [[packages]] |
| 143 | name·=·"aide" | 151 | name·=·"aide" |
| 144 | version·=·"*" | 152 | version·=·"*" |
| 145 | Remediation_ | 153 | Remediation_Anaconda_snippet_⇲ |
| 146 | Complexity:·low | 154 | Complexity:·low |
| 147 | Disruption:·low | 155 | Disruption:·low |
| 148 | Strategy:···enable | 156 | Strategy:···enable |
| 149 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 150 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 157 | package·--add=aide | ||
| 151 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 152 | ····yum·install·-y·"aide" | ||
| 153 | fi | ||
| 154 | else | ||
| 155 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 156 | fi | ||
| 157 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules | 158 | Group ·Federal·Information·Processing·Standard·(FIPS)· Group·contains·2·rules |
| 158 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. | 159 | [ref] ·The·Federal·Information·Processing·Standard·(FIPS)·is·a·computer·security·standard·which·is·developed·by·the·U.S.·Government·and·industry·working·groups·to·validate·the·quality·of·cryptographic·modules.·The·FIPS·standard·provides·four·security·levels·to·ensure·adequate·coverage·of·different·industries,·implementation·of·cryptographic·modules,·and·organizational·sizes·and·requirements. |
| 159 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. | 160 | FIPS·140-2·is·the·current·standard·for·validating·that·mechanisms·used·to·access·cryptographic·modules·utilize·authentication·that·meets·industry·and·government·requirements.·For·government·systems,·this·allows·Security·Levels·1,·2,·3,·or·4·for·use·on·Red·Hat·Enterprise·Linux·8. |
| 160 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. | 161 | See·http://csrc.nist.gov/publications/PubsFIPS.html·for·more·information. |
| 161 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** | 162 | ***·Rule ·Enable·Dracut·FIPS·Module· [ref]·*** |
| Offset 170, 14 lines modified | Offset 170, 27 lines modified | ||
| 170 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 170 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 171 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 171 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 172 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 172 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 173 | Severity: ················high | 173 | Severity: ················high |
| 174 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 174 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 175 | Identifiers·and·References·Identifiers: ·CCE-82155-3 | 175 | Identifiers·and·References·Identifiers: ·CCE-82155-3 |
| 176 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-08-010020,·SV-230223r792855_rule | 176 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590,·RHEL-08-010020,·SV-230223r792855_rule |
| 177 | Remediation_Shell_script_⇲ | ||
| 178 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 179 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 180 | fips-mode-setup·--enable | ||
| 181 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 182 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 183 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 184 | fi | ||
| 185 | else | ||
| 186 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 187 | fi | ||
| 177 | Remediation_Ansible_snippet_⇲ | 188 | Remediation_Ansible_snippet_⇲ |
| 178 | Complexity:·medium | 189 | Complexity:·medium |
| 179 | Disruption:·medium | 190 | Disruption:·medium |
| 180 | Reboot:·····true | 191 | Reboot:·····true |
| 181 | Strategy:···restrict | 192 | Strategy:···restrict |
| 182 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 193 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 183 | ··command:·/usr/bin/fips-mode-setup·--check | 194 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 238, 27 lines modified | Offset 251, 14 lines modified | ||
| 238 | ··-·NIST-800-53-SC-13 | 251 | ··-·NIST-800-53-SC-13 |
| 239 | ··-·enable_dracut_fips_module | 252 | ··-·enable_dracut_fips_module |
| 240 | ··-·high_severity | 253 | ··-·high_severity |
| 241 | ··-·medium_complexity | 254 | ··-·medium_complexity |
| 242 | ··-·medium_disruption | 255 | ··-·medium_disruption |
| 243 | ··-·reboot_required | 256 | ··-·reboot_required |
| 244 | ··-·restrict_strategy | 257 | ··-·restrict_strategy |
| Max diff block lines reached; 1108442/1115633 bytes (99.36%) of diff not shown. | |||
| Offset 14419, 15 lines modified | Offset 14419, 15 lines modified | ||
| 00038520:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00038520:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00038530:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00038530:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00038540:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00038540:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00038550:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00038550:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00038560:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00038560:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00038570:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00038570:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00038580:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00038580:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00038590:·7320·6f66·2032·3032·3 | 00038590:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 000385a0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 000385a0:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 000385b0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 000385b0:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 000385c0:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 000385c0:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 000385d0:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 000385d0:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 000385e0:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 000385e0:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 000385f0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 000385f0:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00038600:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00038600:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15382, 330 lines modified | Offset 15382, 330 lines modified | ||
| 0003c150:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003c150:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003c160:·2223·6964·6d38·3136·3022·2074·6162·696e··"#idm8160"·tabin | 0003c160:·2223·6964·6d38·3136·3022·2074·6162·696e··"#idm8160"·tabin | ||
| 0003c170:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003c170:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c180:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c180:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c190:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c190:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c1a0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c1a0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c1b0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c1b0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c1c0:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c1c0:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 0003c1d0:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003c1e0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c1 | 0003c1d0:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | ||
| 0003c1e0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003c1f0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003c200:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003c210:·6d38·3136·3022·3e3c·7072·653e·3c63·6f64··m8160"><pre><cod | |||
| 0003c220:·653e·0a23·2046·696e·6420·7768·6963·6820··e>.#·Find·which· | |||
| 0003c230:·6669·6c65·7320·6861·7665·2069·6e63·6f72··files·have·incor | |||
| 0003c240:·7265·6374·2068·6173·6820·286e·6f74·2069··rect·hash·(not·i | |||
| 0003c250:·6e20·2f65·7463·2c20·6265·6361·7573·6520··n·/etc,·because· | |||
| 0003c260:·6f66·2074·6865·2073·7973·7465·6d20·7265··of·the·system·re | |||
| 0003c270:·6c61·7465·6420·636f·6e66·6967·2066·696c··lated·config·fil | |||
| 0003c280:·6573·2920·616e·6420·7468·656e·2067·6574··es)·and·then·get | |||
| 0003c290:·2066·696c·6573·206e·616d·6573·0a66·696c···files·names.fil | |||
| 0003c2a0:·6573·5f77·6974·685f·696e·636f·7272·6563··es_with_incorrec | |||
| 0003c2b0:·745f·6861·7368·3d22·2428·7270·6d20·2d56··t_hash="$(rpm·-V | |||
| 0003c2c0:·6120·2d2d·6e6f·636f·6e66·6967·207c·2067··a·--noconfig·|·g | |||
| 0003c2d0:·7265·7020·2d45·2027·5e2e·2e35·2720·7c20··rep·-E·'^..5'·|· | |||
| 0003c2e0:·6177·6b20·277b·7072·696e·7420·244e·467d··awk·'{print·$NF} | |||
| 0003c2f0:·2720·2922·0a0a·2320·4672·6f6d·2066·696c··'·)"..#·From·fil | |||
| 0003c300:·6573·206e·616d·6573·2067·6574·2070·6163··es·names·get·pac | |||
| 0003c310:·6b61·6765·206e·616d·6573·2061·6e64·2063··kage·names·and·c | |||
| 0003c320:·6861·6e67·6520·6e65·776c·696e·6520·746f··hange·newline·to | |||
| 0003c330:·2073·7061·6365·2c20·6265·6361·7573·6520···space,·because· | |||
| 0003c340:·7270·6d20·7772·6974·6573·2065·6163·6820··rpm·writes·each· | |||
| 0003c350:·7061·636b·6167·6520·746f·206e·6577·206c··package·to·new·l | |||
| 0003c360:·696e·650a·7061·636b·6167·6573·5f74·6f5f··ine.packages_to_ | |||
| 0003c370:·7265·696e·7374·616c·6c3d·2224·2872·706d··reinstall="$(rpm | |||
| 0003c380:·202d·7166·2024·6669·6c65·735f·7769·7468···-qf·$files_with | |||
| 0003c390:·5f69·6e63·6f72·7265·6374·5f68·6173·6820··_incorrect_hash· | |||
| 0003c3a0:·7c20·7472·2027·5c6e·2720·2720·2729·220a··|·tr·'\n'·'·')". | |||
| 0003c3b0:·0a0a·7975·6d20·7265·696e·7374·616c·6c20··..yum·reinstall· | |||
| 0003c3c0:·2d79·2024·7061·636b·6167·6573·5f74·6f5f··-y·$packages_to_ | |||
| 0003c3d0:·7265·696e·7374·616c·6c0a·3c2f·636f·6465··reinstall.</code | |||
| 0003c3e0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c3f0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c400:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c | 0003c410:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | ||
| 0003c420:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003c430:·3831·3631·2220·7461·6269·6e64·6578·3d22··8161"·tabindex=" | |||
| 0003c440:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003c450:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003c460:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003c470:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003c480:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003c490:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003c4a0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003c4b0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c4c0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c4d0:·6c6c·6170·7365·2220·6964·3d22·6964·6d38··llapse"·id="idm8 | |||
| 0003c4e0:·3136·3122·3e3c·7461·626c·6520·636c·6173··161"><table·clas | |||
| 0003c4f0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c500:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c510:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c520:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c530:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c540:·7464·3e68·6967·683c·2f74·643e·3c2f·7472··td>high</td></tr | |||
| 0003c550:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c560:·696f·6e3a·3c2f·7468·3e3c·7464·3e6d·6564··ion:</th><td>med | |||
| 0003c570:·6975·6d3c·2f74·643e·3c2f·7472·3e3c·7472··ium</td></tr><tr | |||
| 0003c580:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c590:·7468·3e3c·7464·3e72·6573·7472·6963·743c··th><td>restrict< | |||
| 0003c5a0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c5b0:·3e3c·7072·653e·3c63·6f64·653e·2d20·6e61··><pre><code>-·na | |||
| 0003c210:·2269·646d·3831·3630·223e·3c74·6162·6c65··"idm8160"><table | |||
| 0003c220:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c230:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c240:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c250:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c260:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c270:·2f74·683e·3c74·643e·6869·6768·3c2f·7464··/th><td>high</td | |||
| 0003c280:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c290:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c2a0:·643e·6d65·6469·756d·3c2f·7464·3e3c·2f74··d>medium</td></t | |||
| 0003c2b0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c2c0:·6779·3a3c·2f74·683e·3c74·643e·7265·7374··gy:</th><td>rest | |||
| 0003c2d0:·7269·6374·3c2f·7464·3e3c·2f74·723e·3c2f··rict</td></tr></ | |||
| 0003c2e0:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c2f0:·3e2d·206e·616d·653a·2027·5365·7420·6661··>-·name:·'Set·fa | |||
| 0003c300:·6374·3a20·5061·636b·6167·6520·6d61·6e61··ct:·Package·mana | |||
| 0003c310:·6765·7220·7265·696e·7374·616c·6c20·636f··ger·reinstall·co | |||
| 0003c320:·6d6d·616e·6420·2864·6e66·2927·0a20·2073··mmand·(dnf)'.··s | |||
| 0003c330:·6574·5f66·6163·743a·0a20·2020·2070·6163··et_fact:.····pac | |||
| 0003c340:·6b61·6765·5f6d·616e·6167·6572·5f72·6569··kage_manager_rei | |||
| 0003c350:·6e73·7461·6c6c·5f63·6d64·3a20·646e·6620··nstall_cmd:·dnf· | |||
| 0003c360:·7265·696e·7374·616c·6c20·2d79·0a20·2077··reinstall·-y.··w | |||
| 0003c370:·6865·6e3a·2061·6e73·6962·6c65·5f64·6973··hen:·ansible_dis | |||
| 0003c380:·7472·6962·7574·696f·6e20·3d3d·2022·4665··tribution·==·"Fe | |||
| 0003c390:·646f·7261·220a·2020·7461·6773·3a0a·2020··dora".··tags:.·· | |||
| 0003c3a0:·2d20·4343·452d·3830·3835·372d·360a·2020··-·CCE-80857-6.·· | |||
| 0003c3b0:·2d20·434a·4953·2d35·2e31·302e·342e·310a··-·CJIS-5.10.4.1. | |||
| 0003c3c0:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003c3d0:·2d33·2e33·2e38·0a20·202d·204e·4953·542d··-3.3.8.··-·NIST- | |||
| 0003c3e0:·3830·302d·3137·312d·332e·342e·310a·2020··800-171-3.4.1.·· | |||
| 0003c3f0:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003c400:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003c410:·3030·2d35·332d·434d·2d36·2863·290a·2020··00-53-CM-6(c).·· | |||
| 0003c420:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003c430:·2d36·2864·290a·2020·2d20·4e49·5354·2d38··-6(d).··-·NIST-8 | |||
| 0003c440:·3030·2d35·332d·5349·2d37·0a20·202d·204e··00-53-SI-7.··-·N | |||
| 0003c450:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003c460:·3129·0a20·202d·204e·4953·542d·3830·302d··1).··-·NIST-800- | |||
| Max diff block lines reached; 15056333/15101651 bytes (99.70%) of diff not shown. | |||
| Offset 48, 15 lines modified | Offset 48, 15 lines modified | ||
| 48 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 48 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 49 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 49 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 50 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 50 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 51 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 52 | ····*·cpe:/o:redhat:enterprise_linux:8 | 52 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 53 | *****·Revision·History·***** | 53 | *****·Revision·History·***** |
| 54 | Current·version:·0.1.65 | 54 | Current·version:·0.1.65 |
| 55 | ····*·draft·(as·of·202 | 55 | ····*·draft·(as·of·2025-02-23) |
| 56 | *****·Table·of·Contents·***** | 56 | *****·Table·of·Contents·***** |
| 57 | ···1.·System_Settings | 57 | ···1.·System_Settings |
| 58 | ·········1.·Installing_and_Maintaining_Software | 58 | ·········1.·Installing_and_Maintaining_Software |
| 59 | ·········2.·Account_and_Access_Control | 59 | ·········2.·Account_and_Access_Control |
| 60 | ·········3.·System_Accounting_with_auditd | 60 | ·········3.·System_Accounting_with_auditd |
| 61 | ·········4.·GRUB2_bootloader_configuration | 61 | ·········4.·GRUB2_bootloader_configuration |
| 62 | ·········5.·Configure_Syslog | 62 | ·········5.·Configure_Syslog |
| Offset 92, 14 lines modified | Offset 92, 24 lines modified | ||
| 92 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 92 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 93 | $·sudo·rpm·-Uvh·PACKAGENAME | 93 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 94 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 94 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 95 | Severity: ················high | 95 | Severity: ················high |
| 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 97 | Identifiers·and·References·Identifiers: ·CCE-80857-6 | 97 | Identifiers·and·References·Identifiers: ·CCE-80857-6 |
| 98 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 98 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 99 | Remediation_Shell_script_⇲ | ||
| 100 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 101 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 102 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 103 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 104 | yum·reinstall·-y·$packages_to_reinstall | ||
| 99 | Remediation_Ansible_snippet_⇲ | 105 | Remediation_Ansible_snippet_⇲ |
| 100 | Complexity:·high | 106 | Complexity:·high |
| 101 | Disruption:·medium | 107 | Disruption:·medium |
| 102 | Strategy:···restrict | 108 | Strategy:···restrict |
| 103 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 109 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 104 | ··set_fact: | 110 | ··set_fact: |
| 105 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 111 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 249, 38 lines modified | Offset 259, 57 lines modified | ||
| 249 | ··-·PCI-DSS-Req-11.5 | 259 | ··-·PCI-DSS-Req-11.5 |
| 250 | ··-·high_complexity | 260 | ··-·high_complexity |
| 251 | ··-·high_severity | 261 | ··-·high_severity |
| 252 | ··-·medium_disruption | 262 | ··-·medium_disruption |
| 253 | ··-·no_reboot_needed | 263 | ··-·no_reboot_needed |
| 254 | ··-·restrict_strategy | 264 | ··-·restrict_strategy |
| 255 | ··-·rpm_verify_hashes | 265 | ··-·rpm_verify_hashes |
| 256 | Remediation_Shell_script_⇲ | ||
| 257 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 258 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 259 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 260 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 261 | yum·reinstall·-y·$packages_to_reinstall | ||
| 262 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 266 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 263 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 267 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 264 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 268 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 265 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 269 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 266 | $·rpm·-qf·FILENAME | 270 | $·rpm·-qf·FILENAME |
| 267 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 271 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 268 | $·sudo·rpm·--setperms·PACKAGENAME | 272 | $·sudo·rpm·--setperms·PACKAGENAME |
| 269 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 273 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 270 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 274 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 271 | Severity: ················high | 275 | Severity: ················high |
| 272 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 276 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 273 | Identifiers·and·References·Identifiers: ·CCE-80858-4 | 277 | Identifiers·and·References·Identifiers: ·CCE-80858-4 |
| 274 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 278 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 279 | Remediation_Shell_script_⇲ | ||
| 280 | Complexity:·high | ||
| 281 | Disruption:·medium | ||
| 282 | Strategy:···restrict | ||
| 283 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 284 | declare·-A·SETPERMS_RPM_DICT | ||
| 285 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 286 | #·is·expected·by·the·RPM·database | ||
| 287 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 288 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 289 | do | ||
| 290 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 291 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 292 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 293 | ········do | ||
| 294 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 295 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 296 | ········done | ||
| 297 | done | ||
| 298 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 299 | #·correct·values | ||
| 300 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 301 | do | ||
| 302 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 303 | done | ||
| 275 | Remediation_Ansible_snippet_⇲ | 304 | Remediation_Ansible_snippet_⇲ |
| 276 | Complexity:·high | 305 | Complexity:·high |
| 277 | Disruption:·medium | 306 | Disruption:·medium |
| 278 | Strategy:···restrict | 307 | Strategy:···restrict |
| 279 | -·name:·Read·list·of·files·with·incorrect·permissions | 308 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 280 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 309 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 281 | ····--nocaps·--nolinkto·--nouser·--nogroup | 310 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 357, 70 lines modified | Offset 386, 49 lines modified | ||
| 357 | ··-·PCI-DSS-Req-11.5 | 386 | ··-·PCI-DSS-Req-11.5 |
| 358 | ··-·high_complexity | 387 | ··-·high_complexity |
| 359 | ··-·high_severity | 388 | ··-·high_severity |
| 360 | ··-·medium_disruption | 389 | ··-·medium_disruption |
| 361 | ··-·no_reboot_needed | 390 | ··-·no_reboot_needed |
| 362 | ··-·restrict_strategy | 391 | ··-·restrict_strategy |
| 363 | ··-·rpm_verify_permissions | 392 | ··-·rpm_verify_permissions |
| 364 | Remediation_Shell_script_⇲ | ||
| 365 | Complexity:·high | ||
| 366 | Disruption:·medium | ||
| 367 | Strategy:···restrict | ||
| 368 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 369 | declare·-A·SETPERMS_RPM_DICT | ||
| 370 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 371 | #·is·expected·by·the·RPM·database | ||
| 372 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1067754/1076075 bytes (99.23%) of diff not shown. | |||
| Offset 14427, 15 lines modified | Offset 14427, 15 lines modified | ||
| 000385a0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 000385a0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 000385b0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 000385b0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 000385c0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 000385c0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 000385d0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 000385d0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 000385e0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 000385e0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 000385f0:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 000385f0:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00038600:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00038600:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00038610:·206f·6620·3230·323 | 00038610:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00038620:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038620:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038630:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00038630:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00038640:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00038640:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00038650:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00038650:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00038660:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00038660:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00038670:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00038670:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00038680:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00038680:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15370, 192 lines modified | Offset 15370, 192 lines modified | ||
| 0003c090:·7267·6574·3d22·2369·646d·3835·3231·2220··rget="#idm8521"· | 0003c090:·7267·6574·3d22·2369·646d·3835·3231·2220··rget="#idm8521"· | ||
| 0003c0a0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003c0a0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003c0b0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003c0b0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003c0c0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003c0c0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003c0d0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003c0d0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003c0e0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003c0e0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003c0f0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003c0f0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003c100:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003c100:·6e20·416e·6163·6f6e·6461·2073·6e69·7070··n·Anaconda·snipp | |||
| 0003c110:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c120:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c130:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c140:·6522·2069·643d·2269·646d·3835·3231·223e··e"·id="idm8521"> | |||
| 0003c150:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003c160:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003c170:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003c180:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003c190:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003c1a0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003c1b0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003c1c0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c1d0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c1e0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003c1f0:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003c200:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003c210:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003c220:·3e0a·7061·636b·6167·6520·2d2d·6164·643d··>.package·--add= | |||
| 0003c230:·6169·6465·0a3c·2f63·6f64·653e·3c2f·7072··aide.</code></pr | |||
| 0003c240:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c250:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c260:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c270:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c280:·6172·6765·743d·2223·6964·6d38·3532·3222··arget="#idm8522" | |||
| 0003c290:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c2a0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c2b0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c2c0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c2d0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c2e0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c2f0:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003c300:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c310:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c320:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c330:·2220·6964·3d22·6964·6d38·3532·3222·3e3c··"·id="idm8522">< | |||
| 0003c340:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c350:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c360:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c370:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c380:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c390:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003c3a0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c3b0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c3c0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c3d0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003c3e0:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003c3f0:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003c400:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c410:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003c420:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003c430:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003c440:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003c450:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003c460:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003c470:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003c480:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c490:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003c4a0:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003c4b0:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003c4c0:·6765·743d·2223·6964·6d38·3532·3322·2074··get="#idm8523"·t | |||
| 0003c4d0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c4e0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c4f0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c500:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c510:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003c520:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003c530:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003c | 0003c110:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | ||
| 0003c | 0003c120:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | ||
| 0003c | 0003c130:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | ||
| 0003c | 0003c140:·2069·643d·2269·646d·3835·3231·223e·3c74···id="idm8521"><t | ||
| 0003c | 0003c150:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | ||
| 0003c | 0003c160:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | ||
| 0003c | 0003c170:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | ||
| 0003c | 0003c180:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | ||
| 0003c | 0003c190:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | ||
| 0003c | 0003c1a0:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | ||
| 0003c | 0003c1b0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | ||
| 0003c | 0003c1c0:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | ||
| 0003c | 0003c1d0:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003c | 0003c1e0:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | ||
| 0003c | 0003c1f0:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | ||
| 0003c | 0003c200:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | ||
| 0003c | 0003c210:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | ||
| 0003c220:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003c230:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003c240:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003c250:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003c260:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003c270:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003c280:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003c290:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c2a0:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c2b0:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003c2c0:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003c2d0:·6574·3d22·2369·646d·3835·3232·2220·7461··et="#idm8522"·ta | |||
| 0003c2e0:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003c2f0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003c300:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003c310:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003c320:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003c330:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| Max diff block lines reached; 2573071/2599345 bytes (98.99%) of diff not shown. | |||
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 50 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 51 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 52 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 52 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·System_Settings | 59 | ···1.·System_Settings |
| 60 | ·········1.·Installing_and_Maintaining_Software | 60 | ·········1.·Installing_and_Maintaining_Software |
| 61 | ·········2.·Account_and_Access_Control | 61 | ·········2.·Account_and_Access_Control |
| 62 | ·········3.·System_Accounting_with_auditd | 62 | ·········3.·System_Accounting_with_auditd |
| 63 | ·········4.·GRUB2_bootloader_configuration | 63 | ·········4.·GRUB2_bootloader_configuration |
| 64 | ·········5.·Network_Configuration_and_Firewalls | 64 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 86, 31 lines modified | Offset 86, 39 lines modified | ||
| 86 | The·aide·package·can·be·installed·with·the·following·command: | 86 | The·aide·package·can·be·installed·with·the·following·command: |
| 87 | $·sudo·yum·install·aide | 87 | $·sudo·yum·install·aide |
| 88 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 88 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 89 | Severity: ················medium | 89 | Severity: ················medium |
| 90 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 90 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 91 | Identifiers·and·References·Identifiers: ·CCE-80844-4 | 91 | Identifiers·and·References·Identifiers: ·CCE-80844-4 |
| 92 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule | 92 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199,·RHEL-08-010359,·1.3.1,·SV-251710r854081_rule |
| 93 | Remediation_Anaconda_snippet_⇲ | ||
| 94 | Complexity:·low | ||
| 95 | Disruption:·low | ||
| 96 | Strategy:···enable | ||
| 97 | package·--add=aide | ||
| 98 | Remediation_Puppet_snippet_⇲ | 93 | Remediation_Puppet_snippet_⇲ |
| 99 | Complexity:·low | 94 | Complexity:·low |
| 100 | Disruption:·low | 95 | Disruption:·low |
| 101 | Strategy:···enable | 96 | Strategy:···enable |
| 102 | include·install_aide | 97 | include·install_aide |
| 103 | class·install_aide·{ | 98 | class·install_aide·{ |
| 104 | ··package·{·'aide': | 99 | ··package·{·'aide': |
| 105 | ····ensure·=>·'installed', | 100 | ····ensure·=>·'installed', |
| 106 | ··} | 101 | ··} |
| 107 | } | 102 | } |
| 103 | Remediation_Shell_script_⇲ | ||
| 104 | Complexity:·low | ||
| 105 | Disruption:·low | ||
| 106 | Strategy:···enable | ||
| 107 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 108 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 109 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 110 | ····yum·install·-y·"aide" | ||
| 111 | fi | ||
| 112 | else | ||
| 113 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 114 | fi | ||
| 108 | Remediation_Ansible_snippet_⇲ | 115 | Remediation_Ansible_snippet_⇲ |
| 109 | Complexity:·low | 116 | Complexity:·low |
| 110 | Disruption:·low | 117 | Disruption:·low |
| 111 | Strategy:···enable | 118 | Strategy:···enable |
| 112 | -·name:·Ensure·aide·is·installed | 119 | -·name:·Ensure·aide·is·installed |
| 113 | ··package: | 120 | ··package: |
| 114 | ····name:·aide | 121 | ····name:·aide |
| Offset 129, 28 lines modified | Offset 137, 20 lines modified | ||
| 129 | ··-·no_reboot_needed | 137 | ··-·no_reboot_needed |
| 130 | ··-·package_aide_installed | 138 | ··-·package_aide_installed |
| 131 | Remediation_OSBuild_Blueprint_snippet_⇲ | 139 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 132 | [[packages]] | 140 | [[packages]] |
| 133 | name·=·"aide" | 141 | name·=·"aide" |
| 134 | version·=·"*" | 142 | version·=·"*" |
| 135 | Remediation_ | 143 | Remediation_Anaconda_snippet_⇲ |
| 136 | Complexity:·low | 144 | Complexity:·low |
| 137 | Disruption:·low | 145 | Disruption:·low |
| 138 | Strategy:···enable | 146 | Strategy:···enable |
| 139 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 140 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 147 | package·--add=aide | ||
| 141 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 142 | ····yum·install·-y·"aide" | ||
| 143 | fi | ||
| 144 | else | ||
| 145 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 146 | fi | ||
| 147 | Group ·System·Cryptographic·Policies· Group·contains·2·rules | 148 | Group ·System·Cryptographic·Policies· Group·contains·2·rules |
| 148 | [ref] ·Linux·has·the·capability·to·centrally·configure·cryptographic·polices.·The·command·update-crypto-policies·is·used·to·set·the·policy·applicable·for·the·various·cryptographic·back-ends,·such·as·SSL/TLS·libraries.·The·configured·cryptographic·policies·will·be·the·default·policy·used·by·these·backends·unless·the·application·user·configures·them·otherwise.·When·the·system·has·been·configured·to·use·the·centralized·cryptographic·policies,·the·administrator·is·assured·that·any·application·that·utilizes·the·supported·backends·will·follow·a·policy·that·adheres·to·the·configured·profile.·Currently·the·supported·backends·are: | 149 | [ref] ·Linux·has·the·capability·to·centrally·configure·cryptographic·polices.·The·command·update-crypto-policies·is·used·to·set·the·policy·applicable·for·the·various·cryptographic·back-ends,·such·as·SSL/TLS·libraries.·The·configured·cryptographic·policies·will·be·the·default·policy·used·by·these·backends·unless·the·application·user·configures·them·otherwise.·When·the·system·has·been·configured·to·use·the·centralized·cryptographic·policies,·the·administrator·is·assured·that·any·application·that·utilizes·the·supported·backends·will·follow·a·policy·that·adheres·to·the·configured·profile.·Currently·the·supported·backends·are: |
| 149 | ····*·GnuTLS·library | 150 | ····*·GnuTLS·library |
| 150 | ····*·OpenSSL·library | 151 | ····*·OpenSSL·library |
| 151 | ····*·NSS·library | 152 | ····*·NSS·library |
| 152 | ····*·OpenJDK | 153 | ····*·OpenJDK |
| 153 | ····*·Libkrb5 | 154 | ····*·Libkrb5 |
| Offset 164, 39 lines modified | Offset 164, 33 lines modified | ||
| 164 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 164 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 165 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 165 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 166 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. | 166 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. |
| 167 | Severity: ················high | 167 | Severity: ················high |
| 168 | Rule·ID:···················xccdf_org.ssgproject.content_rule_configure_crypto_policy | 168 | Rule·ID:···················xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 169 | Identifiers·and·References·Identifiers: ·CCE-80935-0 | 169 | Identifiers·and·References·Identifiers: ·CCE-80935-0 |
| 170 | ···························References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174,·RHEL-08-010020,·1.10,·1.11,·SV-230223r792855_rule | 170 | ···························References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2)(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a),·MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174,·RHEL-08-010020,·1.10,·1.11,·SV-230223r792855_rule |
| 171 | Remediation_Shell_script_⇲ | ||
| 172 | var_system_crypto_policy='FIPS' | ||
| 173 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 174 | rc=$? | ||
| 175 | if·test·"$rc"·=·127;·then | ||
| 176 | » echo·"$stderr_of_call"·>&2 | ||
| 177 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 178 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 179 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 180 | » false··#·end·with·an·error·code | ||
| 181 | elif·test·"$rc"·!=·0;·then | ||
| 182 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 183 | » false··#·end·with·an·error·code | ||
| 184 | fi | ||
| 171 | Remediation_Kubernetes_snippet_⇲ | ||
| 172 | Complexity:·low | ||
| 173 | Disruption:·low | ||
| 174 | Reboot:·····true | ||
| 175 | Strategy:···restrict | ||
| 176 | --- | ||
| 177 | apiVersion:·machineconfiguration.openshift.io/v1 | ||
| 178 | kind:·MachineConfig | ||
| 179 | spec: | ||
| Max diff block lines reached; 321943/329162 bytes (97.81%) of diff not shown. | |||
| Offset 14426, 15 lines modified | Offset 14426, 15 lines modified | ||
| 00038590:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00038590:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 000385a0:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 000385a0:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 000385b0:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 000385b0:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 000385c0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 000385c0:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 000385d0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 000385d0:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 000385e0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 000385e0:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 000385f0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 000385f0:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 00038600:·6f66·2032·3032·3 | 00038600:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 00038610:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 00038610:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 00038620:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 00038620:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00038630:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00038630:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00038640:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00038640:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00038650:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00038650:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00038660:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00038660:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00038670:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00038670:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15371, 329 lines modified | Offset 15371, 329 lines modified | ||
| 0003c0a0:·7267·6574·3d22·2369·646d·3831·3630·2220··rget="#idm8160"· | 0003c0a0:·7267·6574·3d22·2369·646d·3831·3630·2220··rget="#idm8160"· | ||
| 0003c0b0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003c0b0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003c0c0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003c0c0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003c0d0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003c0d0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003c0e0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003c0e0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003c0f0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003c0f0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003c100:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003c100:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003c110:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | |||
| 0003c120:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c130:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c140:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c150:·643d·2269·646d·3831·3630·223e·3c70·7265··d="idm8160"><pre | |||
| 0003c160:·3e3c·636f·6465·3e0a·2320·4669·6e64·2077··><code>.#·Find·w | |||
| 0003c170:·6869·6368·2066·696c·6573·2068·6176·6520··hich·files·have· | |||
| 0003c180:·696e·636f·7272·6563·7420·6861·7368·2028··incorrect·hash·( | |||
| 0003c190:·6e6f·7420·696e·202f·6574·632c·2062·6563··not·in·/etc,·bec | |||
| 0003c1a0:·6175·7365·206f·6620·7468·6520·7379·7374··ause·of·the·syst | |||
| 0003c1b0:·656d·2072·656c·6174·6564·2063·6f6e·6669··em·related·confi | |||
| 0003c1c0:·6720·6669·6c65·7329·2061·6e64·2074·6865··g·files)·and·the | |||
| 0003c1d0:·6e20·6765·7420·6669·6c65·7320·6e61·6d65··n·get·files·name | |||
| 0003c1e0:·730a·6669·6c65·735f·7769·7468·5f69·6e63··s.files_with_inc | |||
| 0003c1f0:·6f72·7265·6374·5f68·6173·683d·2224·2872··orrect_hash="$(r | |||
| 0003c200:·706d·202d·5661·202d·2d6e·6f63·6f6e·6669··pm·-Va·--noconfi | |||
| 0003c210:·6720·7c20·6772·6570·202d·4520·275e·2e2e··g·|·grep·-E·'^.. | |||
| 0003c220:·3527·207c·2061·776b·2027·7b70·7269·6e74··5'·|·awk·'{print | |||
| 0003c230:·2024·4e46·7d27·2029·220a·0a23·2046·726f···$NF}'·)"..#·Fro | |||
| 0003c240:·6d20·6669·6c65·7320·6e61·6d65·7320·6765··m·files·names·ge | |||
| 0003c110:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c120:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c130:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c140:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c150:·2220·6964·3d22·6964·6d38·3136·3022·3e3c··"·id="idm8160">< | |||
| 0003c160:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c170:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c180:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c190:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c1a0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c1b0:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003c1c0:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003c1d0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c1e0:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003c1f0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003c200:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003c210:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003c220:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c230:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003c240:·6574·2066·6163·743a·2050·6163·6b61·6765··et·fact:·Package | |||
| 0003c250:·206d·616e·6167·6572·2072·6569·6e73·7461···manager·reinsta | |||
| 0003c260:·6c6c·2063·6f6d·6d61·6e64·2028·646e·6629··ll·command·(dnf) | |||
| 0003c270:·270a·2020·7365·745f·6661·6374·3a0a·2020··'.··set_fact:.·· | |||
| 0003c2 | 0003c250:·7420·7061·636b·6167·6520·6e61·6d65·7320··t·package·names· | ||
| 0003c290:·725f·7265·696e·7374·616c·6c5f·636d·643a··r_reinstall_cmd: | |||
| 0003c2a0:·2064·6e66·2072·6569·6e73·7461·6c6c·202d···dnf·reinstall·- | |||
| 0003c2b0:·790a·2020·7768·656e·3a20·616e·7369·626c··y.··when:·ansibl | |||
| 0003c2c0:·655f·6469·7374·7269·6275·7469·6f6e·203d··e_distribution·= | |||
| 0003c2d0:·3d20·2246·6564·6f72·6122·0a20·2074·6167··=·"Fedora".··tag | |||
| 0003c2e0:·733a·0a20·202d·2043·4345·2d38·3038·3537··s:.··-·CCE-80857 | |||
| 0003c2f0:·2d36·0a20·202d·2043·4a49·532d·352e·3130··-6.··-·CJIS-5.10 | |||
| 0003c300:·2e34·2e31·0a20·202d·204e·4953·542d·3830··.4.1.··-·NIST-80 | |||
| 0003c310:·302d·3137·312d·332e·332e·380a·2020·2d20··0-171-3.3.8.··-· | |||
| 0003c320:·4e49·5354·2d38·3030·2d31·3731·2d33·2e34··NIST-800-171-3.4 | |||
| 0003c330:·2e31·0a20·202d·204e·4953·542d·3830·302d··.1.··-·NIST-800- | |||
| 0003c340:·3533·2d41·552d·3928·3329·0a20·202d·204e··53-AU-9(3).··-·N | |||
| 0003c350:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003c360:·6329·0a20·202d·204e·4953·542d·3830·302d··c).··-·NIST-800- | |||
| 0003c370:·3533·2d43·4d2d·3628·6429·0a20·202d·204e··53-CM-6(d).··-·N | |||
| 0003c380:·4953·542d·3830·302d·3533·2d53·492d·370a··IST-800-53-SI-7. | |||
| 0003c390:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c3a0:·5349·2d37·2831·290a·2020·2d20·4e49·5354··SI-7(1).··-·NIST | |||
| 0003c3b0:·2d38·3030·2d35·332d·5349·2d37·2836·290a··-800-53-SI-7(6). | |||
| 0003c3c0:·2020·2d20·5043·492d·4453·532d·5265·712d····-·PCI-DSS-Req- | |||
| 0003c3d0:·3131·2e35·0a20·202d·2068·6967·685f·636f··11.5.··-·high_co | |||
| 0003c3e0:·6d70·6c65·7869·7479·0a20·202d·2068·6967··mplexity.··-·hig | |||
| 0003c3f0:·685f·7365·7665·7269·7479·0a20·202d·206d··h_severity.··-·m | |||
| 0003c400:·6564·6975·6d5f·6469·7372·7570·7469·6f6e··edium_disruption | |||
| 0003c410:·0a20·202d·206e·6f5f·7265·626f·6f74·5f6e··.··-·no_reboot_n | |||
| 0003c420:·6565·6465·640a·2020·2d20·7265·7374·7269··eeded.··-·restri | |||
| 0003c430:·6374·5f73·7472·6174·6567·790a·2020·2d20··ct_strategy.··-· | |||
| 0003c | 0003c260:·616e·6420·6368·616e·6765·206e·6577·6c69··and·change·newli | ||
| 0003c270:·6e65·2074·6f20·7370·6163·652c·2062·6563··ne·to·space,·bec | |||
| 0003c280:·6175·7365·2072·706d·2077·7269·7465·7320··ause·rpm·writes· | |||
| 0003c290:·6561·6368·2070·6163·6b61·6765·2074·6f20··each·package·to· | |||
| 0003c2a0:·6e65·7720·6c69·6e65·0a70·6163·6b61·6765··new·line.package | |||
| 0003c2b0:·735f·746f·5f72·6569·6e73·7461·6c6c·3d22··s_to_reinstall=" | |||
| 0003c2c0:·2428·7270·6d20·2d71·6620·2466·696c·6573··$(rpm·-qf·$files | |||
| 0003c2d0:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003c2e0:·6861·7368·207c·2074·7220·275c·6e27·2027··hash·|·tr·'\n'·' | |||
| 0003c2f0:·2027·2922·0a0a·0a79·756d·2072·6569·6e73···')"...yum·reins | |||
| 0003c300:·7461·6c6c·202d·7920·2470·6163·6b61·6765··tall·-y·$package | |||
| 0003c310:·735f·746f·5f72·6569·6e73·7461·6c6c·0a3c··s_to_reinstall.< | |||
| 0003c320:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003c330:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003c340:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003c350:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003c360:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003c370:·2223·6964·6d38·3136·3122·2074·6162·696e··"#idm8161"·tabin | |||
| 0003c380:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003c390:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003c3a0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003c3b0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003c3c0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003c3d0:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003c3e0:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003c3f0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c400:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c410:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c420:·2269·646d·3831·3631·223e·3c74·6162·6c65··"idm8161"><table | |||
| 0003c430:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c440:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c450:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c460:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| Max diff block lines reached; 7429806/7474986 bytes (99.40%) of diff not shown. | |||
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | ····*·cpe:/o:redhat:enterprise_linux:8.6 | 50 | ····*·cpe:/o:redhat:enterprise_linux:8.6 |
| 51 | ····*·cpe:/o:redhat:enterprise_linux:8.7 | 51 | ····*·cpe:/o:redhat:enterprise_linux:8.7 |
| 52 | ····*·cpe:/o:redhat:enterprise_linux:8.8 | 52 | ····*·cpe:/o:redhat:enterprise_linux:8.8 |
| 53 | ····*·cpe:/o:redhat:enterprise_linux:8.9 | 53 | ····*·cpe:/o:redhat:enterprise_linux:8.9 |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:8 | 54 | ····*·cpe:/o:redhat:enterprise_linux:8 |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·System_Settings | 59 | ···1.·System_Settings |
| 60 | ·········1.·Installing_and_Maintaining_Software | 60 | ·········1.·Installing_and_Maintaining_Software |
| 61 | ·········2.·Account_and_Access_Control | 61 | ·········2.·Account_and_Access_Control |
| 62 | ·········3.·System_Accounting_with_auditd | 62 | ·········3.·System_Accounting_with_auditd |
| 63 | ·········4.·Configure_Syslog | 63 | ·········4.·Configure_Syslog |
| 64 | ·········5.·File_Permissions_and_Masks | 64 | ·········5.·File_Permissions_and_Masks |
| Offset 91, 14 lines modified | Offset 91, 24 lines modified | ||
| 91 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 91 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 92 | $·sudo·rpm·-Uvh·PACKAGENAME | 92 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 93 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 93 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 94 | Severity: ················high | 94 | Severity: ················high |
| 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 95 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 96 | Identifiers·and·References·Identifiers: ·CCE-80857-6 | 96 | Identifiers·and·References·Identifiers: ·CCE-80857-6 |
| 97 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 | 97 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1 |
| 98 | Remediation_Shell_script_⇲ | ||
| 99 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 100 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 101 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 102 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 103 | yum·reinstall·-y·$packages_to_reinstall | ||
| 98 | Remediation_Ansible_snippet_⇲ | 104 | Remediation_Ansible_snippet_⇲ |
| 99 | Complexity:·high | 105 | Complexity:·high |
| 100 | Disruption:·medium | 106 | Disruption:·medium |
| 101 | Strategy:···restrict | 107 | Strategy:···restrict |
| 102 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 108 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 103 | ··set_fact: | 109 | ··set_fact: |
| 104 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 110 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 248, 38 lines modified | Offset 258, 57 lines modified | ||
| 248 | ··-·PCI-DSS-Req-11.5 | 258 | ··-·PCI-DSS-Req-11.5 |
| 249 | ··-·high_complexity | 259 | ··-·high_complexity |
| 250 | ··-·high_severity | 260 | ··-·high_severity |
| 251 | ··-·medium_disruption | 261 | ··-·medium_disruption |
| 252 | ··-·no_reboot_needed | 262 | ··-·no_reboot_needed |
| 253 | ··-·restrict_strategy | 263 | ··-·restrict_strategy |
| 254 | ··-·rpm_verify_hashes | 264 | ··-·rpm_verify_hashes |
| 255 | Remediation_Shell_script_⇲ | ||
| 256 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 257 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 258 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 259 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 260 | yum·reinstall·-y·$packages_to_reinstall | ||
| 261 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 265 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 262 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 266 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 263 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 267 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 264 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 268 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 265 | $·rpm·-qf·FILENAME | 269 | $·rpm·-qf·FILENAME |
| 266 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 270 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 267 | $·sudo·rpm·--setperms·PACKAGENAME | 271 | $·sudo·rpm·--setperms·PACKAGENAME |
| 268 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 272 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 269 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 273 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 270 | Severity: ················high | 274 | Severity: ················high |
| 271 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 275 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 272 | Identifiers·and·References·Identifiers: ·CCE-80858-4 | 276 | Identifiers·and·References·Identifiers: ·CCE-80858-4 |
| 273 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 | 277 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.8.1.4,·1.8.1.5,·1.8.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9 |
| 278 | Remediation_Shell_script_⇲ | ||
| 279 | Complexity:·high | ||
| 280 | Disruption:·medium | ||
| 281 | Strategy:···restrict | ||
| 282 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 283 | declare·-A·SETPERMS_RPM_DICT | ||
| 284 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 285 | #·is·expected·by·the·RPM·database | ||
| 286 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 287 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 288 | do | ||
| 289 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 290 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 291 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 292 | ········do | ||
| 293 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 294 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 295 | ········done | ||
| 296 | done | ||
| 297 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 298 | #·correct·values | ||
| 299 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 300 | do | ||
| 301 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 302 | done | ||
| 274 | Remediation_Ansible_snippet_⇲ | 303 | Remediation_Ansible_snippet_⇲ |
| 275 | Complexity:·high | 304 | Complexity:·high |
| 276 | Disruption:·medium | 305 | Disruption:·medium |
| 277 | Strategy:···restrict | 306 | Strategy:···restrict |
| 278 | -·name:·Read·list·of·files·with·incorrect·permissions | 307 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 279 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 308 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 280 | ····--nocaps·--nolinkto·--nouser·--nogroup | 309 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 356, 43 lines modified | Offset 385, 14 lines modified | ||
| 356 | ··-·PCI-DSS-Req-11.5 | 385 | ··-·PCI-DSS-Req-11.5 |
| 357 | ··-·high_complexity | 386 | ··-·high_complexity |
| 358 | ··-·high_severity | 387 | ··-·high_severity |
| 359 | ··-·medium_disruption | 388 | ··-·medium_disruption |
| 360 | ··-·no_reboot_needed | 389 | ··-·no_reboot_needed |
| 361 | ··-·restrict_strategy | 390 | ··-·restrict_strategy |
| 362 | ··-·rpm_verify_permissions | 391 | ··-·rpm_verify_permissions |
| 363 | Remediation_Shell_script_⇲ | ||
| 364 | Complexity:·high | ||
| 365 | Disruption:·medium | ||
| 366 | Strategy:···restrict | ||
| 367 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 368 | declare·-A·SETPERMS_RPM_DICT | ||
| 369 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 370 | #·is·expected·by·the·RPM·database | ||
| 371 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 578231/586551 bytes (98.58%) of diff not shown. | |||
| Offset 14445, 16 lines modified | Offset 14445, 16 lines modified | ||
| 000386c0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 000386c0:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 000386d0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 000386d0:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 000386e0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 000386e0:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 000386f0:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 000386f0:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00038700:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00038700:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00038710:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00038710:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00038720:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038720:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038730:·2020·2020·2028·6173·206f·6620·3230·323 | 00038730:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 00038740:·2d30·3 | 00038740:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 00038750:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 00038750:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 00038760:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 00038760:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 00038770:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 00038770:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 00038780:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 00038780:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 00038790:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 00038790:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 000387a0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 000387a0:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 000387b0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 000387b0:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 15447, 193 lines modified | Offset 15447, 193 lines modified | ||
| 0003c560:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003c560:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003c570:·2223·6964·6d38·3532·3122·2074·6162·696e··"#idm8521"·tabin | 0003c570:·2223·6964·6d38·3532·3122·2074·6162·696e··"#idm8521"·tabin | ||
| 0003c580:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003c580:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003c590:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003c590:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003c5a0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003c5a0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003c5b0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003c5b0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003c5c0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003c5c0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003c5d0:·3e52·656d·6564·6961·7469·6f6e·20 | 0003c5d0:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003c5e0:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003c5f0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c600:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c610:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c620:·3d22·6964·6d38·3532·3122·3e3c·7461·626c··="idm8521"><tabl | |||
| 0003c630:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c640:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c650:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003c660:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003c670:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003c680:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c690:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c6a0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c6b0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c6c0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c6d0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003c6e0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c6f0:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003c700:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003c710:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c720:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c730:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c740:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c750:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003c760:·3d22·2369·646d·3835·3232·2220·7461·6269··="#idm8522"·tabi | |||
| 0003c770:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003c780:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003c790:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003c7a0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003c7b0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003c7c0:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003c7d0:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003c7e0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003c7f0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003c800:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003c810:·2269·646d·3835·3232·223e·3c74·6162·6c65··"idm8522"><table | |||
| 0003c820:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003c830:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003c840:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003c850:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003c860:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003c870:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c880:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003c890:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003c8a0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003c8b0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003c8c0:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003c8d0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003c8e0:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003c8f0:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003c900:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003c910:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003c920:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003c930:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003c940:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003c950:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c960:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c970:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c980:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c990:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c9a0:·2369·646d·3835·3233·2220·7461·6269·6e64··#idm8523"·tabind | |||
| 0003c9b0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c9c0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c9d0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c9e0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c9f0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003ca00:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003c | 0003c5e0:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003c | 0003c5f0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003c | 0003c600:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003c | 0003c610:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003c | 0003c620:·6964·6d38·3532·3122·3e3c·7461·626c·6520··idm8521"><table· | ||
| 0003c | 0003c630:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003c | 0003c640:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003c | 0003c650:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003c | 0003c660:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003c | 0003c670:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003c | 0003c680:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c | 0003c690:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003c | 0003c6a0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003c | 0003c6b0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003c | 0003c6c0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003c | 0003c6d0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003c | 0003c6e0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003c | 0003c6f0:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | ||
| 0003cb30:·3a20·456e·7375·7265·2061·6964·6520·6973··:·Ensure·aide·is | |||
| 0003cb40:·2069·6e73·7461·6c6c·6564·0a20·2070·6163···installed.··pac | |||
| 0003cb50:·6b61·6765·3a0a·2020·2020·6e61·6d65·3a20··kage:.····name:· | |||
| 0003cb60:·6169·6465·0a20·2020·2073·7461·7465·3a20··aide.····state:· | |||
| 0003cb70:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 0003cb80:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003cb90:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003cba0:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003cbb0:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003cbc0:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003cbd0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0003cbe0:·2d20·4343·452d·3830·3834·342d·340a·2020··-·CCE-80844-4.·· | |||
| 0003cbf0:·2d20·434a·4953·2d35·2e31·302e·312e·330a··-·CJIS-5.10.1.3. | |||
| 0003cc00:·2020·2d20·4449·5341·2d53·5449·472d·5248····-·DISA-STIG-RH | |||
| 0003cc10:·454c·2d30·382d·3031·3033·3539·0a20·202d··EL-08-010359.··- | |||
| 0003cc20:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003cc30:·3628·6129·0a20·202d·2050·4349·2d44·5353··6(a).··-·PCI-DSS | |||
| Max diff block lines reached; 25730869/25757419 bytes (99.90%) of diff not shown. | |||
| Offset 14470, 15 lines modified | Offset 14470, 15 lines modified | ||
| 00038850:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00038850:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00038860:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00038860:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00038870:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00038870:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00038880:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00038880:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00038890:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00038890:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 000388a0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 000388a0:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 000388b0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 000388b0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 000388c0:·3230·323 | 000388c0:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 000388d0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 000388d0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 000388e0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 000388e0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 000388f0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 000388f0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00038900:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00038900:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00038910:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00038910:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00038920:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00038920:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00038930:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00038930:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15466, 193 lines modified | Offset 15466, 193 lines modified | ||
| 0003c690:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003c690:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003c6a0:·3d22·2369·646d·3835·3231·2220·7461·6269··="#idm8521"·tabi | 0003c6a0:·3d22·2369·646d·3835·3231·2220·7461·6269··="#idm8521"·tabi | ||
| 0003c6b0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003c6b0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003c6c0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003c6c0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003c6d0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003c6d0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003c6e0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003c6e0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003c6f0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003c6f0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003c700:·223e·5265·6d65·6469·6174·696f·6e20· | 0003c700:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | ||
| 0003c710:·6163·6f6e·6461·2073·6e69·7070·6574·20e2··aconda·snippet·. | |||
| 0003c720:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c730:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c740:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c750:·643d·2269·646d·3835·3231·223e·3c74·6162··d="idm8521"><tab | |||
| 0003c760:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c770:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c780:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c790:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c7a0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c7b0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c7c0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c7d0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c7e0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c7f0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c800:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c810:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c820:·653e·3c70·7265·3e3c·636f·6465·3e0a·7061··e><pre><code>.pa | |||
| 0003c830:·636b·6167·6520·2d2d·6164·643d·6169·6465··ckage·--add=aide | |||
| 0003c840:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c850:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c860:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c870:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c880:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003c890:·743d·2223·6964·6d38·3532·3222·2074·6162··t="#idm8522"·tab | |||
| 0003c8a0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003c8b0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003c8c0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003c8d0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003c8e0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003c8f0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | |||
| 0003c900:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | |||
| 0003c910:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c920:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c930:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c940:·3d22·6964·6d38·3532·3222·3e3c·7461·626c··="idm8522"><tabl | |||
| 0003c950:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c960:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c970:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003c980:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003c990:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003c9a0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c9b0:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c9c0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c9d0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c9e0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c9f0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003ca00:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003ca10:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003ca20:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003ca30:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003ca40:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003ca50:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003ca60:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003ca70:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003ca80:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003ca90:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003caa0:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003cab0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003cac0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003cad0:·2223·6964·6d38·3532·3322·2074·6162·696e··"#idm8523"·tabin | |||
| 0003cae0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003caf0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003cb00:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003cb10:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003cb20:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003cb30:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003c | 0003c710:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | ||
| 0003c | 0003c720:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 0003c | 0003c730:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 0003c | 0003c740:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 0003c | 0003c750:·2269·646d·3835·3231·223e·3c74·6162·6c65··"idm8521"><table | ||
| 0003c | 0003c760:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 0003c | 0003c770:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 0003c | 0003c780:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 0003c | 0003c790:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 0003c | 0003c7a0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 0003c | 0003c7b0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003c | 0003c7c0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 0003c | 0003c7d0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 0003c | 0003c7e0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003c | 0003c7f0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 0003c | 0003c800:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | ||
| 0003c | 0003c810:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | ||
| 0003c820:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003c830:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003c840:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003c850:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003c860:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003c870:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003c880:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003c890:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c8a0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c8b0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c8c0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c8d0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c8e0:·2369·646d·3835·3232·2220·7461·6269·6e64··#idm8522"·tabind | |||
| 0003c8f0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c900:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c910:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c920:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c930:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c940:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | |||
| Max diff block lines reached; 25671439/25697851 bytes (99.90%) of diff not shown. | |||
| Offset 14305, 16 lines modified | Offset 14305, 16 lines modified | ||
| 00037e00:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00037e00:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00037e10:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00037e10:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00037e20:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00037e20:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00037e30:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00037e30:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00037e40:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00037e40:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00037e50:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00037e50:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00037e60:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e60:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e70:·2020·2028·6173·206f·6620·3230·323 | 00037e70:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00037e80:·3 | 00037e80:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00037e90:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00037e90:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00037ea0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00037ea0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00037eb0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00037eb0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00037ec0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00037ec0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00037ed0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00037ed0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00037ee0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00037ee0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00037ef0:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00037ef0:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15246, 191 lines modified | Offset 15246, 191 lines modified | ||
| 0003b8d0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003b8d0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003b8e0:·3735·3834·2220·7461·6269·6e64·6578·3d22··7584"·tabindex=" | 0003b8e0:·3735·3834·2220·7461·6269·6e64·6578·3d22··7584"·tabindex=" | ||
| 0003b8f0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003b8f0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003b900:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003b900:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003b910:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003b910:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003b920:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003b920:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003b930:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003b930:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003b940:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003b940:·6469·6174·696f·6e20·416e·6163·6f6e·6461··diation·Anaconda | |||
| 0003b950:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b960:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b970:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b980:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b990:·3735·3834·223e·3c74·6162·6c65·2063·6c61··7584"><table·cla | |||
| 0003b9a0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b9b0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b9c0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b9d0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b9e0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003b9f0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003ba00:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003ba10:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003ba20:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003ba30:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003ba40:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003ba50:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003ba60:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003ba70:·2d2d·6164·643d·6169·6465·0a3c·2f63·6f64··--add=aide.</cod | |||
| 0003ba80:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003ba90:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003baa0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bab0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bac0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bad0:·6d37·3538·3522·2074·6162·696e·6465·783d··m7585"·tabindex= | |||
| 0003bae0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003baf0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bb00:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bb10:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bb20:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bb30:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003bb40:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bb50:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bb60:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bb70:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003bb80:·3538·3522·3e3c·7461·626c·6520·636c·6173··585"><table·clas | |||
| 0003bb90:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bba0:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bbb0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bbc0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bbd0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bbe0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bbf0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bc00:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bc10:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bc20:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bc30:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003bc40:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bc50:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003bc60:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003bc70:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003bc80:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003bc90:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003bca0:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003bcb0:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003bcc0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003bcd0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003bce0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003bcf0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003bd00:·7461·2d74·6172·6765·743d·2223·6964·6d37··ta-target="#idm7 | |||
| 0003bd10:·3538·3622·2074·6162·696e·6465·783d·2230··586"·tabindex="0 | |||
| 0003bd20:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003bd30:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003bd40:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003bd50:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003bd60:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003bd70:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003b | 0003b950:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | ||
| 0003b | 0003b960:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | ||
| 0003b | 0003b970:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | ||
| 0003b | 0003b980:·6c61·7073·6522·2069·643d·2269·646d·3735··lapse"·id="idm75 | ||
| 0003b | 0003b990:·3834·223e·3c74·6162·6c65·2063·6c61·7373··84"><table·class | ||
| 0003b | 0003b9a0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | ||
| 0003b | 0003b9b0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003b | 0003b9c0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003b | 0003b9d0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | ||
| 0003b | 0003b9e0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | ||
| 0003b | 0003b9f0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003b | 0003ba00:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | ||
| 0003b | 0003ba10:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | ||
| 0003b | 0003ba20:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003b | 0003ba30:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | ||
| 0003b | 0003ba40:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | ||
| 0003b | 0003ba50:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | ||
| 0003ba60:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003ba70:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003ba80:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003ba90:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003baa0:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003bab0:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003bac0:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003bad0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bae0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003baf0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bb00:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bb10:·612d·7461·7267·6574·3d22·2369·646d·3735··a-target="#idm75 | |||
| 0003bb20:·3835·2220·7461·6269·6e64·6578·3d22·3022··85"·tabindex="0" | |||
| 0003bb30:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bb40:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bb50:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bb60:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| Max diff block lines reached; 6588708/6614982 bytes (99.60%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(enhanced) | 44 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:9 | 47 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 84, 31 lines modified | Offset 84, 39 lines modified | ||
| 84 | $·sudo·dnf·install·aide | 84 | $·sudo·dnf·install·aide |
| 85 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 85 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 86 | Severity: ·medium | 86 | Severity: ·medium |
| 87 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 87 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 88 | Identifiers·Identifiers: ·CCE-90843-4 | 88 | Identifiers·Identifiers: ·CCE-90843-4 |
| 89 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 89 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 90 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 90 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 91 | Remediation_Anaconda_snippet_⇲ | ||
| 92 | Complexity:·low | ||
| 93 | Disruption:·low | ||
| 94 | Strategy:···enable | ||
| 95 | package·--add=aide | ||
| 96 | Remediation_Puppet_snippet_⇲ | 91 | Remediation_Puppet_snippet_⇲ |
| 97 | Complexity:·low | 92 | Complexity:·low |
| 98 | Disruption:·low | 93 | Disruption:·low |
| 99 | Strategy:···enable | 94 | Strategy:···enable |
| 100 | include·install_aide | 95 | include·install_aide |
| 101 | class·install_aide·{ | 96 | class·install_aide·{ |
| 102 | ··package·{·'aide': | 97 | ··package·{·'aide': |
| 103 | ····ensure·=>·'installed', | 98 | ····ensure·=>·'installed', |
| 104 | ··} | 99 | ··} |
| 105 | } | 100 | } |
| 101 | Remediation_Shell_script_⇲ | ||
| 102 | Complexity:·low | ||
| 103 | Disruption:·low | ||
| 104 | Strategy:···enable | ||
| 105 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 106 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 107 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 108 | ····dnf·install·-y·"aide" | ||
| 109 | fi | ||
| 110 | else | ||
| 111 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 112 | fi | ||
| 106 | Remediation_Ansible_snippet_⇲ | 113 | Remediation_Ansible_snippet_⇲ |
| 107 | Complexity:·low | 114 | Complexity:·low |
| 108 | Disruption:·low | 115 | Disruption:·low |
| 109 | Strategy:···enable | 116 | Strategy:···enable |
| 110 | -·name:·Ensure·aide·is·installed | 117 | -·name:·Ensure·aide·is·installed |
| 111 | ··package: | 118 | ··package: |
| 112 | ····name:·aide | 119 | ····name:·aide |
| Offset 126, 42 lines modified | Offset 134, 48 lines modified | ||
| 126 | ··-·no_reboot_needed | 134 | ··-·no_reboot_needed |
| 127 | ··-·package_aide_installed | 135 | ··-·package_aide_installed |
| 128 | Remediation_OSBuild_Blueprint_snippet_⇲ | 136 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 129 | [[packages]] | 137 | [[packages]] |
| 130 | name·=·"aide" | 138 | name·=·"aide" |
| 131 | version·=·"*" | 139 | version·=·"*" |
| 132 | Remediation_ | 140 | Remediation_Anaconda_snippet_⇲ |
| 133 | Complexity:·low | 141 | Complexity:·low |
| 134 | Disruption:·low | 142 | Disruption:·low |
| 135 | Strategy:···enable | 143 | Strategy:···enable |
| 136 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 137 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 144 | package·--add=aide | ||
| 138 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 139 | ····dnf·install·-y·"aide" | ||
| 140 | fi | ||
| 141 | else | ||
| 142 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 143 | fi | ||
| 144 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 145 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 145 | Run·the·following·command·to·generate·a·new·database: | 146 | Run·the·following·command·to·generate·a·new·database: |
| 146 | $·sudo·/usr/sbin/aide·--init | 147 | $·sudo·/usr/sbin/aide·--init |
| 147 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 148 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 148 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 149 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 149 | To·initiate·a·manual·check,·run·the·following·command: | 150 | To·initiate·a·manual·check,·run·the·following·command: |
| 150 | $·sudo·/usr/sbin/aide·--check | 151 | $·sudo·/usr/sbin/aide·--check |
| 151 | If·this·check·produces·any·unexpected·output,·investigate. | 152 | If·this·check·produces·any·unexpected·output,·investigate. |
| 152 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 153 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 153 | Severity: ·medium | 154 | Severity: ·medium |
| 154 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 155 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 155 | Identifiers·Identifiers: ·CCE-83438-2 | 156 | Identifiers·Identifiers: ·CCE-83438-2 |
| 156 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 157 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 157 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 158 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 159 | Remediation_Shell_script_⇲ | ||
| 160 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 161 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 163 | ····dnf·install·-y·"aide" | ||
| 164 | fi | ||
| 165 | /usr/sbin/aide·--init | ||
| 166 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 167 | else | ||
| 168 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 169 | fi | ||
| 158 | Remediation_Ansible_snippet_⇲ | 170 | Remediation_Ansible_snippet_⇲ |
| 159 | Complexity:·low | 171 | Complexity:·low |
| 160 | Disruption:·low | 172 | Disruption:·low |
| 161 | Strategy:···restrict | 173 | Strategy:···restrict |
| 162 | -·name:·Ensure·AIDE·is·installed | 174 | -·name:·Ensure·AIDE·is·installed |
| 163 | ··package: | 175 | ··package: |
| 164 | ····name:·'{{·item·}}' | 176 | ····name:·'{{·item·}}' |
| Offset 230, 189 lines modified | Offset 244, 183 lines modified | ||
| 230 | ··-·PCI-DSS-Req-11.5 | 244 | ··-·PCI-DSS-Req-11.5 |
| 231 | ··-·aide_build_database | 245 | ··-·aide_build_database |
| 232 | ··-·low_complexity | 246 | ··-·low_complexity |
| 233 | ··-·low_disruption | 247 | ··-·low_disruption |
| 234 | ··-·medium_severity | 248 | ··-·medium_severity |
| 235 | ··-·no_reboot_needed | 249 | ··-·no_reboot_needed |
| 236 | ··-·restrict_strategy | 250 | ··-·restrict_strategy |
| Max diff block lines reached; 747139/752821 bytes (99.25%) of diff not shown. | |||
| Offset 14304, 16 lines modified | Offset 14304, 16 lines modified | ||
| 00037df0:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00037df0:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00037e00:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00037e00:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00037e10:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00037e10:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00037e20:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00037e20:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00037e30:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00037e30:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00037e40:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00037e40:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e60:·2020·2028·6173·206f·6620·3230·323 | 00037e60:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00037e70:·3 | 00037e70:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00037e80:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00037e80:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00037e90:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00037e90:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00037ea0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00037ea0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00037eb0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00037eb0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00037ec0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00037ec0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00037ed0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00037ed0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00037ee0:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00037ee0:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15245, 191 lines modified | Offset 15245, 191 lines modified | ||
| 0003b8c0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003b8c0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003b8d0:·3735·3834·2220·7461·6269·6e64·6578·3d22··7584"·tabindex=" | 0003b8d0:·3735·3834·2220·7461·6269·6e64·6578·3d22··7584"·tabindex=" | ||
| 0003b8e0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003b8e0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003b8f0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003b8f0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003b900:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003b900:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003b910:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003b910:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003b920:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003b920:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003b930:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003b930:·6469·6174·696f·6e20·416e·6163·6f6e·6461··diation·Anaconda | |||
| 0003b940:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b950:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b960:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b970:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b980:·3735·3834·223e·3c74·6162·6c65·2063·6c61··7584"><table·cla | |||
| 0003b990:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b9a0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b9b0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b9c0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b9d0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003b9e0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003b9f0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003ba00:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003ba10:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003ba20:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003ba30:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003ba40:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003ba50:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003ba60:·2d2d·6164·643d·6169·6465·0a3c·2f63·6f64··--add=aide.</cod | |||
| 0003ba70:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003ba80:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003ba90:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003baa0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bab0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bac0:·6d37·3538·3522·2074·6162·696e·6465·783d··m7585"·tabindex= | |||
| 0003bad0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bae0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003baf0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bb00:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bb10:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bb20:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003bb30:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bb40:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bb50:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bb60:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003bb70:·3538·3522·3e3c·7461·626c·6520·636c·6173··585"><table·clas | |||
| 0003bb80:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bb90:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bba0:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bbb0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bbc0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bbd0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bbe0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bbf0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bc00:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bc10:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bc20:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003bc30:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003bc40:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003bc50:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003bc60:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003bc70:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003bc80:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003bc90:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003bca0:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003bcb0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003bcc0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003bcd0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003bce0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003bcf0:·7461·2d74·6172·6765·743d·2223·6964·6d37··ta-target="#idm7 | |||
| 0003bd00:·3538·3622·2074·6162·696e·6465·783d·2230··586"·tabindex="0 | |||
| 0003bd10:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003bd20:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003bd30:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003bd40:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003bd50:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003bd60:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003b | 0003b940:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | ||
| 0003b | 0003b950:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | ||
| 0003b | 0003b960:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | ||
| 0003b | 0003b970:·6c61·7073·6522·2069·643d·2269·646d·3735··lapse"·id="idm75 | ||
| 0003b | 0003b980:·3834·223e·3c74·6162·6c65·2063·6c61·7373··84"><table·class | ||
| 0003b | 0003b990:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | ||
| 0003b | 0003b9a0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003b | 0003b9b0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003b | 0003b9c0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | ||
| 0003b | 0003b9d0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | ||
| 0003b | 0003b9e0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003b | 0003b9f0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | ||
| 0003b | 0003ba00:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | ||
| 0003b | 0003ba10:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003b | 0003ba20:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | ||
| 0003b | 0003ba30:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | ||
| 0003b | 0003ba40:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | ||
| 0003ba50:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003ba60:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003ba70:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003ba80:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003ba90:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003baa0:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003bab0:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003bac0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bad0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bae0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003baf0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bb00:·612d·7461·7267·6574·3d22·2369·646d·3735··a-target="#idm75 | |||
| 0003bb10:·3835·2220·7461·6269·6e64·6578·3d22·3022··85"·tabindex="0" | |||
| 0003bb20:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bb30:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bb40:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bb50:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| Max diff block lines reached; 6791495/6817769 bytes (99.61%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(high) | 44 | Profile·Title·ANSSI-BP-028·(high) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:9 | 47 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·GRUB2_bootloader_configuration | 56 | ·········4.·GRUB2_bootloader_configuration |
| 57 | ·········5.·Configure_Syslog | 57 | ·········5.·Configure_Syslog |
| Offset 84, 31 lines modified | Offset 84, 39 lines modified | ||
| 84 | $·sudo·dnf·install·aide | 84 | $·sudo·dnf·install·aide |
| 85 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 85 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 86 | Severity: ·medium | 86 | Severity: ·medium |
| 87 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 87 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 88 | Identifiers·Identifiers: ·CCE-90843-4 | 88 | Identifiers·Identifiers: ·CCE-90843-4 |
| 89 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 89 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 90 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 90 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 91 | Remediation_Anaconda_snippet_⇲ | ||
| 92 | Complexity:·low | ||
| 93 | Disruption:·low | ||
| 94 | Strategy:···enable | ||
| 95 | package·--add=aide | ||
| 96 | Remediation_Puppet_snippet_⇲ | 91 | Remediation_Puppet_snippet_⇲ |
| 97 | Complexity:·low | 92 | Complexity:·low |
| 98 | Disruption:·low | 93 | Disruption:·low |
| 99 | Strategy:···enable | 94 | Strategy:···enable |
| 100 | include·install_aide | 95 | include·install_aide |
| 101 | class·install_aide·{ | 96 | class·install_aide·{ |
| 102 | ··package·{·'aide': | 97 | ··package·{·'aide': |
| 103 | ····ensure·=>·'installed', | 98 | ····ensure·=>·'installed', |
| 104 | ··} | 99 | ··} |
| 105 | } | 100 | } |
| 101 | Remediation_Shell_script_⇲ | ||
| 102 | Complexity:·low | ||
| 103 | Disruption:·low | ||
| 104 | Strategy:···enable | ||
| 105 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 106 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 107 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 108 | ····dnf·install·-y·"aide" | ||
| 109 | fi | ||
| 110 | else | ||
| 111 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 112 | fi | ||
| 106 | Remediation_Ansible_snippet_⇲ | 113 | Remediation_Ansible_snippet_⇲ |
| 107 | Complexity:·low | 114 | Complexity:·low |
| 108 | Disruption:·low | 115 | Disruption:·low |
| 109 | Strategy:···enable | 116 | Strategy:···enable |
| 110 | -·name:·Ensure·aide·is·installed | 117 | -·name:·Ensure·aide·is·installed |
| 111 | ··package: | 118 | ··package: |
| 112 | ····name:·aide | 119 | ····name:·aide |
| Offset 126, 42 lines modified | Offset 134, 48 lines modified | ||
| 126 | ··-·no_reboot_needed | 134 | ··-·no_reboot_needed |
| 127 | ··-·package_aide_installed | 135 | ··-·package_aide_installed |
| 128 | Remediation_OSBuild_Blueprint_snippet_⇲ | 136 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 129 | [[packages]] | 137 | [[packages]] |
| 130 | name·=·"aide" | 138 | name·=·"aide" |
| 131 | version·=·"*" | 139 | version·=·"*" |
| 132 | Remediation_ | 140 | Remediation_Anaconda_snippet_⇲ |
| 133 | Complexity:·low | 141 | Complexity:·low |
| 134 | Disruption:·low | 142 | Disruption:·low |
| 135 | Strategy:···enable | 143 | Strategy:···enable |
| 136 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 137 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 144 | package·--add=aide | ||
| 138 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 139 | ····dnf·install·-y·"aide" | ||
| 140 | fi | ||
| 141 | else | ||
| 142 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 143 | fi | ||
| 144 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 145 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 145 | Run·the·following·command·to·generate·a·new·database: | 146 | Run·the·following·command·to·generate·a·new·database: |
| 146 | $·sudo·/usr/sbin/aide·--init | 147 | $·sudo·/usr/sbin/aide·--init |
| 147 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 148 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 148 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 149 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 149 | To·initiate·a·manual·check,·run·the·following·command: | 150 | To·initiate·a·manual·check,·run·the·following·command: |
| 150 | $·sudo·/usr/sbin/aide·--check | 151 | $·sudo·/usr/sbin/aide·--check |
| 151 | If·this·check·produces·any·unexpected·output,·investigate. | 152 | If·this·check·produces·any·unexpected·output,·investigate. |
| 152 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 153 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 153 | Severity: ·medium | 154 | Severity: ·medium |
| 154 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 155 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 155 | Identifiers·Identifiers: ·CCE-83438-2 | 156 | Identifiers·Identifiers: ·CCE-83438-2 |
| 156 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 157 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 157 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 158 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 159 | Remediation_Shell_script_⇲ | ||
| 160 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 161 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 163 | ····dnf·install·-y·"aide" | ||
| 164 | fi | ||
| 165 | /usr/sbin/aide·--init | ||
| 166 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 167 | else | ||
| 168 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 169 | fi | ||
| 158 | Remediation_Ansible_snippet_⇲ | 170 | Remediation_Ansible_snippet_⇲ |
| 159 | Complexity:·low | 171 | Complexity:·low |
| 160 | Disruption:·low | 172 | Disruption:·low |
| 161 | Strategy:···restrict | 173 | Strategy:···restrict |
| 162 | -·name:·Ensure·AIDE·is·installed | 174 | -·name:·Ensure·AIDE·is·installed |
| 163 | ··package: | 175 | ··package: |
| 164 | ····name:·'{{·item·}}' | 176 | ····name:·'{{·item·}}' |
| Offset 230, 28 lines modified | Offset 244, 14 lines modified | ||
| 230 | ··-·PCI-DSS-Req-11.5 | 244 | ··-·PCI-DSS-Req-11.5 |
| 231 | ··-·aide_build_database | 245 | ··-·aide_build_database |
| 232 | ··-·low_complexity | 246 | ··-·low_complexity |
| 233 | ··-·low_disruption | 247 | ··-·low_disruption |
| 234 | ··-·medium_severity | 248 | ··-·medium_severity |
| 235 | ··-·no_reboot_needed | 249 | ··-·no_reboot_needed |
| 236 | ··-·restrict_strategy | 250 | ··-·restrict_strategy |
| Max diff block lines reached; 771138/776819 bytes (99.27%) of diff not shown. | |||
| Offset 14306, 16 lines modified | Offset 14306, 16 lines modified | ||
| 00037e10:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00037e10:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00037e20:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00037e20:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00037e30:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00037e30:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00037e40:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00037e40:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00037e50:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00037e50:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 00037e60:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 00037e60:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 00037e70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e80:·2020·2028·6173·206f·6620·3230·323 | 00037e80:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00037e90:·3 | 00037e90:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00037ea0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00037ea0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00037eb0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00037eb0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00037ec0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00037ec0:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00037ed0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00037ed0:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00037ee0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00037ee0:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00037ef0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00037ef0:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00037f00:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00037f00:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15240, 191 lines modified | Offset 15240, 191 lines modified | ||
| 0003b870:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003b870:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003b880:·3d22·2369·646d·3735·3834·2220·7461·6269··="#idm7584"·tabi | 0003b880:·3d22·2369·646d·3735·3834·2220·7461·6269··="#idm7584"·tabi | ||
| 0003b890:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003b890:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003b8a0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003b8a0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003b8b0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003b8b0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003b8c0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003b8c0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003b8d0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003b8d0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003b8e0:·223e·5265·6d65·6469·6174·696f·6e20· | 0003b8e0:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | ||
| 0003b8f0:·6163·6f6e·6461·2073·6e69·7070·6574·20e2··aconda·snippet·. | |||
| 0003b900:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003b910:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003b920:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003b930:·643d·2269·646d·3735·3834·223e·3c74·6162··d="idm7584"><tab | |||
| 0003b940:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003b950:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003b960:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003b970:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003b980:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003b990:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003b9a0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003b9b0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b9c0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003b9d0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003b9e0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003b9f0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003ba00:·653e·3c70·7265·3e3c·636f·6465·3e0a·7061··e><pre><code>.pa | |||
| 0003ba10:·636b·6167·6520·2d2d·6164·643d·6169·6465··ckage·--add=aide | |||
| 0003ba20:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003ba30:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003ba40:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003ba50:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003ba60:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003ba70:·743d·2223·6964·6d37·3538·3522·2074·6162··t="#idm7585"·tab | |||
| 0003ba80:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003ba90:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003baa0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bab0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bac0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bad0:·2122·3e52·656d·6564·6961·7469·6f6e·2050··!">Remediation·P | |||
| 0003bae0:·7570·7065·7420·736e·6970·7065·7420·e287··uppet·snippet·.. | |||
| 0003baf0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003bb00:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003bb10:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003bb20:·3d22·6964·6d37·3538·3522·3e3c·7461·626c··="idm7585"><tabl | |||
| 0003bb30:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003bb40:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003bb50:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003bb60:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003bb70:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003bb80:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003bb90:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003bba0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003bbb0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003bbc0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003bbd0:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003bbe0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003bbf0:·3e3c·7072·653e·3c63·6f64·653e·696e·636c··><pre><code>incl | |||
| 0003bc00:·7564·6520·696e·7374·616c·6c5f·6169·6465··ude·install_aide | |||
| 0003bc10:·0a0a·636c·6173·7320·696e·7374·616c·6c5f··..class·install_ | |||
| 0003bc20:·6169·6465·207b·0a20·2070·6163·6b61·6765··aide·{.··package | |||
| 0003bc30:·207b·2027·6169·6465·273a·0a20·2020·2065···{·'aide':.····e | |||
| 0003bc40:·6e73·7572·6520·3d26·6774·3b20·2769·6e73··nsure·=>·'ins | |||
| 0003bc50:·7461·6c6c·6564·272c·0a20·207d·0a7d·0a3c··talled',.··}.}.< | |||
| 0003bc60:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003bc70:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003bc80:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bc90:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bca0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003bcb0:·2223·6964·6d37·3538·3622·2074·6162·696e··"#idm7586"·tabin | |||
| 0003bcc0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003bcd0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003bce0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003bcf0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003bd00:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003bd10:·3e52·656d·6564·6961·7469·6f6e·2041·6e73··>Remediation·Ans | |||
| 0003b | 0003b8f0:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | ||
| 0003b | 0003b900:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | ||
| 0003b | 0003b910:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | ||
| 0003b | 0003b920:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | ||
| 0003b | 0003b930:·2269·646d·3735·3834·223e·3c74·6162·6c65··"idm7584"><table | ||
| 0003b | 0003b940:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | ||
| 0003b | 0003b950:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | ||
| 0003b | 0003b960:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | ||
| 0003b | 0003b970:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | ||
| 0003b | 0003b980:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | ||
| 0003b | 0003b990:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | ||
| 0003b | 0003b9a0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | ||
| 0003b | 0003b9b0:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | ||
| 0003b | 0003b9c0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | ||
| 0003b | 0003b9d0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | ||
| 0003b | 0003b9e0:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | ||
| 0003b | 0003b9f0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | ||
| 0003ba00:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003ba10:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003ba20:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003ba30:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003ba40:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003ba50:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003ba60:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003ba70:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003ba80:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003ba90:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003baa0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003bab0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003bac0:·2369·646d·3735·3835·2220·7461·6269·6e64··#idm7585"·tabind | |||
| 0003bad0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003bae0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003baf0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003bb00:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003bb10:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| Max diff block lines reached; 6340480/6366754 bytes (99.59%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(intermediary) | 44 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:9 | 47 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·System_Accounting_with_auditd | 55 | ·········3.·System_Accounting_with_auditd |
| 56 | ·········4.·Configure_Syslog | 56 | ·········4.·Configure_Syslog |
| 57 | ·········5.·Network_Configuration_and_Firewalls | 57 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 83, 31 lines modified | Offset 83, 39 lines modified | ||
| 83 | $·sudo·dnf·install·aide | 83 | $·sudo·dnf·install·aide |
| 84 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 84 | Rationale:··The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 85 | Severity: ·medium | 85 | Severity: ·medium |
| 86 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed | 86 | Rule·ID:····xccdf_org.ssgproject.content_rule_package_aide_installed |
| 87 | Identifiers·Identifiers: ·CCE-90843-4 | 87 | Identifiers·Identifiers: ·CCE-90843-4 |
| 88 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, | 88 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7, |
| 89 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 89 | References··A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 90 | Remediation_Anaconda_snippet_⇲ | ||
| 91 | Complexity:·low | ||
| 92 | Disruption:·low | ||
| 93 | Strategy:···enable | ||
| 94 | package·--add=aide | ||
| 95 | Remediation_Puppet_snippet_⇲ | 90 | Remediation_Puppet_snippet_⇲ |
| 96 | Complexity:·low | 91 | Complexity:·low |
| 97 | Disruption:·low | 92 | Disruption:·low |
| 98 | Strategy:···enable | 93 | Strategy:···enable |
| 99 | include·install_aide | 94 | include·install_aide |
| 100 | class·install_aide·{ | 95 | class·install_aide·{ |
| 101 | ··package·{·'aide': | 96 | ··package·{·'aide': |
| 102 | ····ensure·=>·'installed', | 97 | ····ensure·=>·'installed', |
| 103 | ··} | 98 | ··} |
| 104 | } | 99 | } |
| 100 | Remediation_Shell_script_⇲ | ||
| 101 | Complexity:·low | ||
| 102 | Disruption:·low | ||
| 103 | Strategy:···enable | ||
| 104 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 105 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 106 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 107 | ····dnf·install·-y·"aide" | ||
| 108 | fi | ||
| 109 | else | ||
| 110 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 111 | fi | ||
| 105 | Remediation_Ansible_snippet_⇲ | 112 | Remediation_Ansible_snippet_⇲ |
| 106 | Complexity:·low | 113 | Complexity:·low |
| 107 | Disruption:·low | 114 | Disruption:·low |
| 108 | Strategy:···enable | 115 | Strategy:···enable |
| 109 | -·name:·Ensure·aide·is·installed | 116 | -·name:·Ensure·aide·is·installed |
| 110 | ··package: | 117 | ··package: |
| 111 | ····name:·aide | 118 | ····name:·aide |
| Offset 125, 42 lines modified | Offset 133, 48 lines modified | ||
| 125 | ··-·no_reboot_needed | 133 | ··-·no_reboot_needed |
| 126 | ··-·package_aide_installed | 134 | ··-·package_aide_installed |
| 127 | Remediation_OSBuild_Blueprint_snippet_⇲ | 135 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 128 | [[packages]] | 136 | [[packages]] |
| 129 | name·=·"aide" | 137 | name·=·"aide" |
| 130 | version·=·"*" | 138 | version·=·"*" |
| 131 | Remediation_ | 139 | Remediation_Anaconda_snippet_⇲ |
| 132 | Complexity:·low | 140 | Complexity:·low |
| 133 | Disruption:·low | 141 | Disruption:·low |
| 134 | Strategy:···enable | 142 | Strategy:···enable |
| 135 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 136 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 143 | package·--add=aide | ||
| 137 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 138 | ····dnf·install·-y·"aide" | ||
| 139 | fi | ||
| 140 | else | ||
| 141 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 142 | fi | ||
| 143 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 144 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 144 | Run·the·following·command·to·generate·a·new·database: | 145 | Run·the·following·command·to·generate·a·new·database: |
| 145 | $·sudo·/usr/sbin/aide·--init | 146 | $·sudo·/usr/sbin/aide·--init |
| 146 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 147 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 147 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 148 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 148 | To·initiate·a·manual·check,·run·the·following·command: | 149 | To·initiate·a·manual·check,·run·the·following·command: |
| 149 | $·sudo·/usr/sbin/aide·--check | 150 | $·sudo·/usr/sbin/aide·--check |
| 150 | If·this·check·produces·any·unexpected·output,·investigate. | 151 | If·this·check·produces·any·unexpected·output,·investigate. |
| 151 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 152 | Rationale:··For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 152 | Severity: ·medium | 153 | Severity: ·medium |
| 153 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database | 154 | Rule·ID:····xccdf_org.ssgproject.content_rule_aide_build_database |
| 154 | Identifiers·Identifiers: ·CCE-83438-2 | 155 | Identifiers·Identifiers: ·CCE-83438-2 |
| 155 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, | 156 | and·········References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1, |
| 156 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 157 | References··PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 158 | Remediation_Shell_script_⇲ | ||
| 159 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 160 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 162 | ····dnf·install·-y·"aide" | ||
| 163 | fi | ||
| 164 | /usr/sbin/aide·--init | ||
| 165 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 166 | else | ||
| 167 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 168 | fi | ||
| 157 | Remediation_Ansible_snippet_⇲ | 169 | Remediation_Ansible_snippet_⇲ |
| 158 | Complexity:·low | 170 | Complexity:·low |
| 159 | Disruption:·low | 171 | Disruption:·low |
| 160 | Strategy:···restrict | 172 | Strategy:···restrict |
| 161 | -·name:·Ensure·AIDE·is·installed | 173 | -·name:·Ensure·AIDE·is·installed |
| 162 | ··package: | 174 | ··package: |
| 163 | ····name:·'{{·item·}}' | 175 | ····name:·'{{·item·}}' |
| Offset 229, 189 lines modified | Offset 243, 183 lines modified | ||
| 229 | ··-·PCI-DSS-Req-11.5 | 243 | ··-·PCI-DSS-Req-11.5 |
| 230 | ··-·aide_build_database | 244 | ··-·aide_build_database |
| 231 | ··-·low_complexity | 245 | ··-·low_complexity |
| 232 | ··-·low_disruption | 246 | ··-·low_disruption |
| 233 | ··-·medium_severity | 247 | ··-·medium_severity |
| 234 | ··-·no_reboot_needed | 248 | ··-·no_reboot_needed |
| 235 | ··-·restrict_strategy | 249 | ··-·restrict_strategy |
| Max diff block lines reached; 707669/713364 bytes (99.20%) of diff not shown. | |||
| Offset 14305, 15 lines modified | Offset 14305, 15 lines modified | ||
| 00037e00:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037e00:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037e10:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037e10:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037e20:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037e20:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037e30:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037e30:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037e40:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037e40:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037e50:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037e50:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037e60:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037e60:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037e70:·6173·206f·6620·3230·323 | 00037e70:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037e80:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037e80:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037e90:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037e90:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037ea0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037ea0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037eb0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037eb0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037ec0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037ec0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037ed0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037ed0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037ee0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037ee0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15013, 141 lines modified | Offset 15013, 141 lines modified | ||
| 0003aa40:·7461·7267·6574·3d22·2369·646d·3131·3030··target="#idm1100 | 0003aa40:·7461·7267·6574·3d22·2369·646d·3131·3030··target="#idm1100 | ||
| 0003aa50:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | 0003aa50:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | ||
| 0003aa60:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003aa60:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003aa70:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003aa70:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003aa80:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003aa80:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003aa90:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003aa90:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003aaa0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003aaa0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003aab0:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003aac0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003aad0:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003aae0:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003aaf0:·7073·6522·2069·643d·2269·646d·3131·3030··pse"·id="idm1100 | |||
| 0003ab00:·3622·3e3c·7461·626c·6520·636c·6173·733d··6"><table·class= | |||
| 0003ab10:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003ab20:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003ab30:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003ab40:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003ab50:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003ab60:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003ab70:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003ab80:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003ab90:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003aba0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003abb0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003abc0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003abd0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4669··<code>-·name:·Fi | |||
| 0003abe0:·6e64·202f·6574·632f·7375·646f·6572·732e··nd·/etc/sudoers. | |||
| 0003abf0:·642f·2066·696c·6573·0a20·2066·696e·643a··d/·files.··find: | |||
| 0003ac00:·0a20·2020·2070·6174·6873·3a0a·2020·2020··.····paths:.···· | |||
| 0003ac10:·2d20·2f65·7463·2f73·7564·6f65·7273·2e64··-·/etc/sudoers.d | |||
| 0003ac20:·2f0a·2020·7265·6769·7374·6572·3a20·7375··/.··register:·su | |||
| 0003ac30:·646f·6572·730a·2020·7461·6773·3a0a·2020··doers.··tags:.·· | |||
| 0003ac40:·2d20·4343·452d·3833·3534·342d·370a·2020··-·CCE-83544-7.·· | |||
| 0003ac50:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003ac60:·2d36·2861·290a·2020·2d20·4e49·5354·2d38··-6(a).··-·NIST-8 | |||
| 0003ac70:·3030·2d35·332d·4941·2d31·310a·2020·2d20··00-53-IA-11.··-· | |||
| 0003ac80:·6c6f·775f·636f·6d70·6c65·7869·7479·0a20··low_complexity.· | |||
| 0003ac90:·202d·206c·6f77·5f64·6973·7275·7074·696f···-·low_disruptio | |||
| 0003aca0:·6e0a·2020·2d20·6d65·6469·756d·5f73·6576··n.··-·medium_sev | |||
| 0003acb0:·6572·6974·790a·2020·2d20·6e6f·5f72·6562··erity.··-·no_reb | |||
| 0003acc0:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 0003acd0:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 0003ace0:·0a20·202d·2073·7564·6f5f·7265·6d6f·7665··.··-·sudo_remove | |||
| 0003acf0:·5f6e·6f5f·6175·7468·656e·7469·6361·7465··_no_authenticate | |||
| 0003ad00:·0a0a·2d20·6e61·6d65·3a20·5265·6d6f·7665··..-·name:·Remove | |||
| 0003ad10:·206c·696e·6573·2063·6f6e·7461·696e·696e···lines·containin | |||
| 0003ad20:·6720·2161·7574·6865·6e74·6963·6174·6520··g·!authenticate· | |||
| 0003ad30:·6672·6f6d·2073·7564·6f65·7273·2066·696c··from·sudoers·fil | |||
| 0003ad40:·6573·0a20·2072·6570·6c61·6365·3a0a·2020··es.··replace:.·· | |||
| 0003ad50:·2020·7265·6765·7870·3a20·285e·283f·2123····regexp:·(^(?!# | |||
| 0003ad60:·292e·2a5b·5c73·5d2b·5c21·6175·7468·656e··).*[\s]+\!authen | |||
| 0003ad70:·7469·6361·7465·2e2a·2429·0a20·2020·2072··ticate.*$).····r | |||
| 0003ad80:·6570·6c61·6365·3a20·2723·205c·6726·6c74··eplace:·'#·\g< | |||
| 0003ad90:·3b31·2667·743b·270a·2020·2020·7061·7468··;1>'.····path | |||
| 0003ada0:·3a20·277b·7b20·6974·656d·2e70·6174·6820··:·'{{·item.path· | |||
| 0003adb0:·7d7d·270a·2020·2020·7661·6c69·6461·7465··}}'.····validate | |||
| 0003adc0:·3a20·2f75·7372·2f73·6269·6e2f·7669·7375··:·/usr/sbin/visu | |||
| 0003add0:·646f·202d·6366·2025·730a·2020·7769·7468··do·-cf·%s.··with | |||
| 0003ade0:·5f69·7465·6d73·3a0a·2020·2d20·7061·7468··_items:.··-·path | |||
| 0003adf0:·3a20·2f65·7463·2f73·7564·6f65·7273·0a20··:·/etc/sudoers.· | |||
| 0003ae00:·202d·2027·7b7b·2073·7564·6f65·7273·2e66···-·'{{·sudoers.f | |||
| 0003ae10:·696c·6573·207d·7d27·0a20·2074·6167·733a··iles·}}'.··tags: | |||
| 0003ae20:·0a20·202d·2043·4345·2d38·3335·3434·2d37··.··-·CCE-83544-7 | |||
| 0003ae30:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003ae40:·2d43·4d2d·3628·6129·0a20·202d·204e·4953··-CM-6(a).··-·NIS | |||
| 0003ae50:·542d·3830·302d·3533·2d49·412d·3131·0a20··T-800-53-IA-11.· | |||
| 0003ae60:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 0003ae70:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 0003ae80:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 0003ae90:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 0003aea0:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 0003aeb0:·2d20·7265·7374·7269·6374·5f73·7472·6174··-·restrict_strat | |||
| 0003aec0:·6567·790a·2020·2d20·7375·646f·5f72·656d··egy.··-·sudo_rem | |||
| 0003aed0:·6f76·655f·6e6f·5f61·7574·6865·6e74·6963··ove_no_authentic | |||
| 0003aee0:·6174·650a·3c2f·636f·6465·3e3c·2f70·7265··ate.</code></pre | |||
| 0003aef0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003af00:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003af10:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003af20:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003af30:·7267·6574·3d22·2369·646d·3131·3030·3722··rget="#idm11007" | |||
| 0003af40:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003af50:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003af60:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003af70:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003af80:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003af90:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003a | 0003aab0:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003aac0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003aad0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003aae0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003aaf0:·2220·6964·3d22·6964·6d31·3130·3036·223e··"·id="idm11006"> | |||
| 0003ab00:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003ab10:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003ab20:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003ab30:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003ab40:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003ab50:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003ab60:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003ab70:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003ab80:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003ab90:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003aba0:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003abb0:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003abc0:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003abd0:·6465·3e0a·666f·7220·6620·696e·202f·6574··de>.for·f·in·/et | |||
| 0003abe0:·632f·7375·646f·6572·7320·2f65·7463·2f73··c/sudoers·/etc/s | |||
| 0003abf0:·7564·6f65·7273·2e64·2f2a·203b·2064·6f0a··udoers.d/*·;·do. | |||
| 0003ac00:·2020·6966·205b·2021·202d·6520·2224·6622····if·[·!·-e·"$f" | |||
| 0003ac10:·205d·203b·2074·6865·6e0a·2020·2020·636f···]·;·then.····co | |||
| 0003ac20:·6e74·696e·7565·0a20·2066·690a·2020·6d61··ntinue.··fi.··ma | |||
| 0003ac30:·7463·6869·6e67·5f6c·6973·743d·2428·6772··tching_list=$(gr | |||
| Max diff block lines reached; 2436289/2455525 bytes (99.22%) of diff not shown. | |||
| Offset 43, 15 lines modified | Offset 43, 15 lines modified | ||
| 43 | *****·Profile·Information·***** | 43 | *****·Profile·Information·***** |
| 44 | Profile·Title·ANSSI-BP-028·(minimal) | 44 | Profile·Title·ANSSI-BP-028·(minimal) |
| 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 45 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 46 | ***·CPE·Platforms·*** | 46 | ***·CPE·Platforms·*** |
| 47 | ····*·cpe:/o:redhat:enterprise_linux:9 | 47 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 48 | *****·Revision·History·***** | 48 | *****·Revision·History·***** |
| 49 | Current·version:·0.1.65 | 49 | Current·version:·0.1.65 |
| 50 | ····*·draft·(as·of·202 | 50 | ····*·draft·(as·of·2025-02-23) |
| 51 | *****·Table·of·Contents·***** | 51 | *****·Table·of·Contents·***** |
| 52 | ···1.·System_Settings | 52 | ···1.·System_Settings |
| 53 | ·········1.·Installing_and_Maintaining_Software | 53 | ·········1.·Installing_and_Maintaining_Software |
| 54 | ·········2.·Account_and_Access_Control | 54 | ·········2.·Account_and_Access_Control |
| 55 | ·········3.·Configure_Syslog | 55 | ·········3.·Configure_Syslog |
| 56 | ·········4.·File_Permissions_and_Masks | 56 | ·········4.·File_Permissions_and_Masks |
| 57 | ···2.·Services | 57 | ···2.·Services |
| Offset 89, 14 lines modified | Offset 89, 33 lines modified | ||
| 89 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 89 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 90 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 90 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 91 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 91 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 92 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 92 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 93 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 93 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 94 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 94 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 95 | ············000373-VMM-001490 | 95 | ············000373-VMM-001490 |
| 96 | Remediation_Shell_script_⇲ | ||
| 97 | Complexity:·low | ||
| 98 | Disruption:·low | ||
| 99 | Strategy:···restrict | ||
| 100 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 101 | ··if·[·!·-e·"$f"·]·;·then | ||
| 102 | ····continue | ||
| 103 | ··fi | ||
| 104 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 105 | ··if·!·test·-z·"$matching_list";·then | ||
| 106 | ····while·IFS=·read·-r·entry;·do | ||
| 107 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 108 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 109 | ····done·<<<·"$matching_list" | ||
| 110 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 111 | ··fi | ||
| 112 | done | ||
| 96 | Remediation_Ansible_snippet_⇲ | 113 | Remediation_Ansible_snippet_⇲ |
| 97 | Complexity:·low | 114 | Complexity:·low |
| 98 | Disruption:·low | 115 | Disruption:·low |
| 99 | Strategy:···restrict | 116 | Strategy:···restrict |
| 100 | -·name:·Find·/etc/sudoers.d/·files | 117 | -·name:·Find·/etc/sudoers.d/·files |
| 101 | ··find: | 118 | ··find: |
| 102 | ····paths: | 119 | ····paths: |
| Offset 128, 33 lines modified | Offset 147, 14 lines modified | ||
| 128 | ··-·NIST-800-53-IA-11 | 147 | ··-·NIST-800-53-IA-11 |
| 129 | ··-·low_complexity | 148 | ··-·low_complexity |
| 130 | ··-·low_disruption | 149 | ··-·low_disruption |
| 131 | ··-·medium_severity | 150 | ··-·medium_severity |
| 132 | ··-·no_reboot_needed | 151 | ··-·no_reboot_needed |
| 133 | ··-·restrict_strategy | 152 | ··-·restrict_strategy |
| 134 | ··-·sudo_remove_no_authenticate | 153 | ··-·sudo_remove_no_authenticate |
| 135 | Remediation_Shell_script_⇲ | ||
| 136 | Complexity:·low | ||
| 137 | Disruption:·low | ||
| 138 | Strategy:···restrict | ||
| 139 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 140 | ··if·[·!·-e·"$f"·]·;·then | ||
| 141 | ····continue | ||
| 142 | ··fi | ||
| 143 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 144 | ··if·!·test·-z·"$matching_list";·then | ||
| 145 | ····while·IFS=·read·-r·entry;·do | ||
| 146 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 147 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 148 | ····done·<<<·"$matching_list" | ||
| 149 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 150 | ··fi | ||
| 151 | done | ||
| 152 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 154 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 153 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 155 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 154 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 156 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 155 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 157 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 156 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 158 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 157 | ············have·authorization. | 159 | ············have·authorization. |
| 158 | Rationale: | 160 | Rationale: |
| Offset 166, 14 lines modified | Offset 166, 33 lines modified | ||
| 166 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 166 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 167 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 167 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 168 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 168 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 169 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 169 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 170 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 170 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 171 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 171 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 172 | ············000373-VMM-001490 | 172 | ············000373-VMM-001490 |
| 173 | Remediation_Shell_script_⇲ | ||
| 174 | Complexity:·low | ||
| 175 | Disruption:·low | ||
| 176 | Strategy:···restrict | ||
| 177 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 178 | ··if·[·!·-e·"$f"·]·;·then | ||
| 179 | ····continue | ||
| 180 | ··fi | ||
| 181 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 182 | ··if·!·test·-z·"$matching_list";·then | ||
| 183 | ····while·IFS=·read·-r·entry;·do | ||
| 184 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 185 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 186 | ····done·<<<·"$matching_list" | ||
| 187 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 188 | ··fi | ||
| 189 | done | ||
| 173 | Remediation_Ansible_snippet_⇲ | 190 | Remediation_Ansible_snippet_⇲ |
| 174 | Complexity:·low | 191 | Complexity:·low |
| 175 | Disruption:·low | 192 | Disruption:·low |
| 176 | Strategy:···restrict | 193 | Strategy:···restrict |
| 177 | -·name:·Find·/etc/sudoers.d/·files | 194 | -·name:·Find·/etc/sudoers.d/·files |
| 178 | ··find: | 195 | ··find: |
| 179 | ····paths: | 196 | ····paths: |
| Offset 205, 33 lines modified | Offset 224, 14 lines modified | ||
| 205 | ··-·NIST-800-53-IA-11 | 224 | ··-·NIST-800-53-IA-11 |
| 206 | ··-·low_complexity | 225 | ··-·low_complexity |
| 207 | ··-·low_disruption | 226 | ··-·low_disruption |
| 208 | ··-·medium_severity | 227 | ··-·medium_severity |
| 209 | ··-·no_reboot_needed | 228 | ··-·no_reboot_needed |
| 210 | ··-·restrict_strategy | 229 | ··-·restrict_strategy |
| 211 | ··-·sudo_remove_nopasswd | 230 | ··-·sudo_remove_nopasswd |
| 212 | Remediation_Shell_script_⇲ | ||
| 213 | Complexity:·low | ||
| Max diff block lines reached; 171058/176427 bytes (96.96%) of diff not shown. | |||
| Offset 14292, 15 lines modified | Offset 14292, 15 lines modified | ||
| 00037d30:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037d30:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037d40:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037d40:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037d50:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037d50:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037d60:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037d60:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037d70:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037d70:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037d80:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037d80:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037d90:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037d90:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037da0:·6173·206f·6620·3230·323 | 00037da0:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037db0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037db0:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037dc0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037dc0:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037dd0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037dd0:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037de0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037de0:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037df0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037df0:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037e00:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037e00:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037e10:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037e10:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15280, 190 lines modified | Offset 15280, 190 lines modified | ||
| 0003baf0:·6172·6765·743d·2223·6964·6d37·3538·3422··arget="#idm7584" | 0003baf0:·6172·6765·743d·2223·6964·6d37·3538·3422··arget="#idm7584" | ||
| 0003bb00:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003bb00:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003bb10:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003bb10:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003bb20:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003bb20:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003bb30:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003bb30:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003bb40:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003bb40:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003bb50:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003bb50:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003bb60:·6f6e·2050·7570·7065·7420·736e·6970·7065··on·Puppet·snippe | |||
| 0003bb60:·6f6e·2041·6e61·636f·6e64·6120·736e·6970··on·Anaconda·snip | |||
| 0003bb70:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003bb80:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003bb90:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003bba0:·7365·2220·6964·3d22·6964·6d37·3538·3422··se"·id="idm7584" | |||
| 0003bbb0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003bbc0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003bbd0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003bbe0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003bbf0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003bc00:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003bc10:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bc20:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003bc30:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bc40:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bc50:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003bc60:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003bc70:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003bc80:·653e·0a70·6163·6b61·6765·202d·2d61·6464··e>.package·--add | |||
| 0003bc90:·3d61·6964·650a·3c2f·636f·6465·3e3c·2f70··=aide.</code></p | |||
| 0003bca0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003bcb0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003bcc0:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003bcd0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003bce0:·7461·7267·6574·3d22·2369·646d·3735·3835··target="#idm7585 | |||
| 0003bcf0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003bd00:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003bd10:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003bd20:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003bd30:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003bd40:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003bd50:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003bd60:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003bd70:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003bd80:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003bd90:·6522·2069·643d·2269·646d·3735·3835·223e··e"·id="idm7585"> | |||
| 0003bda0:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003bdb0:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003bdc0:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003bdd0:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003bde0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003bdf0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | |||
| 0003be00:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003be10:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003be20:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003be30:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003be40:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | |||
| 0003be50:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | |||
| 0003be60:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | |||
| 0003be70:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003be80:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003be90:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003bea0:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003beb0:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003bec0:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003bed0:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003bee0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003bef0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003bf00:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003bf10:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003bf20:·7267·6574·3d22·2369·646d·3735·3836·2220··rget="#idm7586"· | |||
| 0003bf30:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bf40:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bf50:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bf60:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bf70:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003bf80:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003bf90:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003b | 0003bb70:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 0003b | 0003bb80:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 0003b | 0003bb90:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 0003b | 0003bba0:·2220·6964·3d22·6964·6d37·3538·3422·3e3c··"·id="idm7584">< | ||
| 0003b | 0003bbb0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | ||
| 0003b | 0003bbc0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | ||
| 0003 | 0003bbd0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 0003 | 0003bbe0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | ||
| 0003 | 0003bbf0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | ||
| 0003c0 | 0003bc00:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | ||
| 0003 | 0003bc10:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 0003 | 0003bc20:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | ||
| 0003 | 0003bc30:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003 | 0003bc40:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | ||
| 0003 | 0003bc50:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | ||
| 0003 | 0003bc60:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | ||
| 0003 | 0003bc70:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | ||
| 0003bc80:·696e·636c·7564·6520·696e·7374·616c·6c5f··include·install_ | |||
| 0003bc90:·6169·6465·0a0a·636c·6173·7320·696e·7374··aide..class·inst | |||
| 0003bca0:·616c·6c5f·6169·6465·207b·0a20·2070·6163··all_aide·{.··pac | |||
| 0003bcb0:·6b61·6765·207b·2027·6169·6465·273a·0a20··kage·{·'aide':.· | |||
| 0003bcc0:·2020·2065·6e73·7572·6520·3d26·6774·3b20·····ensure·=>· | |||
| 0003bcd0:·2769·6e73·7461·6c6c·6564·272c·0a20·207d··'installed',.··} | |||
| 0003bce0:·0a7d·0a3c·2f63·6f64·653e·3c2f·7072·653e··.}.</code></pre> | |||
| 0003bcf0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003bd00:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003bd10:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003bd20:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003bd30:·6765·743d·2223·6964·6d37·3538·3522·2074··get="#idm7585"·t | |||
| 0003bd40:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003bd50:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003bd60:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003bd70:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003bd80:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003bd90:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| Max diff block lines reached; 18821356/18847354 bytes (99.86%) of diff not shown. | |||
| Offset 14293, 15 lines modified | Offset 14293, 15 lines modified | ||
| 00037d40:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | 00037d40:·7279·3c2f·6832·3e3c·703e·4375·7272·656e··ry</h2><p>Curren | ||
| 00037d50:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | 00037d50:·7420·7665·7273·696f·6e3a·203c·7374·726f··t·version:·<stro | ||
| 00037d60:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | 00037d60:·6e67·3e30·2e31·2e36·353c·2f73·7472·6f6e··ng>0.1.65</stron | ||
| 00037d70:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | 00037d70:·673e·3c2f·703e·3c75·6c3e·3c6c·693e·3c73··g></p><ul><li><s | ||
| 00037d80:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | 00037d80:·7472·6f6e·673e·6472·6166·743c·2f73·7472··trong>draft</str | ||
| 00037d90:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | 00037d90:·6f6e·673e·0a20·2020·2020·2020·2020·2020··ong>.··········· | ||
| 00037da0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | 00037da0:·2020·2020·2020·2020·2028·6173·206f·6620···········(as·of· | ||
| 00037db0:·3230·323 | 00037db0:·3230·3235·2d30·322d·3233·290a·2020·2020··2025-02-23).···· | ||
| 00037dc0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | 00037dc0:·2020·2020·2020·2020·2020·2020·3c2f·6c69··············</li | ||
| 00037dd0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | 00037dd0:·3e3c·2f75·6c3e·3c2f·6469·763e·3c68·323e··></ul></div><h2> | ||
| 00037de0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | 00037de0:·5461·626c·6520·6f66·2043·6f6e·7465·6e74··Table·of·Content | ||
| 00037df0:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | 00037df0:·733c·2f68·323e·3c6f·6c3e·3c6c·693e·3c61··s</h2><ol><li><a | ||
| 00037e00:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | 00037e00:·2068·7265·663d·2223·7863·6364·665f·6f72···href="#xccdf_or | ||
| 00037e10:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | 00037e10:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | ||
| 00037e20:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | 00037e20:·7465·6e74·5f67·726f·7570·5f73·7973·7465··tent_group_syste | ||
| Offset 15270, 190 lines modified | Offset 15270, 190 lines modified | ||
| 0003ba50:·6765·743d·2223·6964·6d37·3538·3422·2074··get="#idm7584"·t | 0003ba50:·6765·743d·2223·6964·6d37·3538·3422·2074··get="#idm7584"·t | ||
| 0003ba60:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003ba60:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003ba70:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003ba70:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003ba80:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003ba80:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003ba90:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003ba90:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003baa0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003baa0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003bab0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003bab0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003bac0:·2050·7570·7065·7420·736e·6970·7065·7420···Puppet·snippet· | |||
| 0003bac0:·2041·6e61·636f·6e64·6120·736e·6970·7065···Anaconda·snippe | |||
| 0003bad0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bae0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003baf0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bb00:·2220·6964·3d22·6964·6d37·3538·3422·3e3c··"·id="idm7584">< | |||
| 0003bb10:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bb20:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bb30:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bb40:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bb50:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bb60:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 0003bb70:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bb80:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bb90:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bba0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003bbb0:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003bbc0:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003bbd0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003bbe0:·0a70·6163·6b61·6765·202d·2d61·6464·3d61··.package·--add=a | |||
| 0003bbf0:·6964·650a·3c2f·636f·6465·3e3c·2f70·7265··ide.</code></pre | |||
| 0003bc00:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003bc10:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003bc20:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003bc30:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003bc40:·7267·6574·3d22·2369·646d·3735·3835·2220··rget="#idm7585"· | |||
| 0003bc50:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bc60:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bc70:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bc80:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bc90:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003bca0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003bcb0:·6e20·5075·7070·6574·2073·6e69·7070·6574··n·Puppet·snippet | |||
| 0003bcc0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bcd0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bce0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bcf0:·2069·643d·2269·646d·3735·3835·223e·3c74···id="idm7585"><t | |||
| 0003bd00:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bd10:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bd20:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bd30:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003bd40:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003bd50:·7479·3a3c·2f74·683e·3c74·643e·6c6f·773c··ty:</th><td>low< | |||
| 0003bd60:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bd70:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003bd80:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003bd90:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003bda0:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003bdb0:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003bdc0:·626c·653e·3c70·7265·3e3c·636f·6465·3e69··ble><pre><code>i | |||
| 0003bdd0:·6e63·6c75·6465·2069·6e73·7461·6c6c·5f61··nclude·install_a | |||
| 0003bde0:·6964·650a·0a63·6c61·7373·2069·6e73·7461··ide..class·insta | |||
| 0003bdf0:·6c6c·5f61·6964·6520·7b0a·2020·7061·636b··ll_aide·{.··pack | |||
| 0003be00:·6167·6520·7b20·2761·6964·6527·3a0a·2020··age·{·'aide':.·· | |||
| 0003be10:·2020·656e·7375·7265·203d·2667·743b·2027····ensure·=>·' | |||
| 0003be20:·696e·7374·616c·6c65·6427·2c0a·2020·7d0a··installed',.··}. | |||
| 0003be30:·7d0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··}.</code></pre>< | |||
| 0003be40:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003be50:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003be60:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003be70:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003be80:·6574·3d22·2369·646d·3735·3836·2220·7461··et="#idm7586"·ta | |||
| 0003be90:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003bea0:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003beb0:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003bec0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003bed0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003bee0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003bef0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003b | 0003bad0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | ||
| 0003b | 0003bae0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | ||
| 0003b | 0003baf0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | ||
| 0003b | 0003bb00:·6964·3d22·6964·6d37·3538·3422·3e3c·7461··id="idm7584"><ta | ||
| 0003b | 0003bb10:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | ||
| 0003b | 0003bb20:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | ||
| 0003b | 0003bb30:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | ||
| 0003b | 0003bb40:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | ||
| 0003b | 0003bb50:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | ||
| 0003b | 0003bb60:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | ||
| 0003b | 0003bb70:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003b | 0003bb80:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | ||
| 0003b | 0003bb90:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003b | 0003bba0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | ||
| 0003b | 0003bbb0:·793a·3c2f·7468·3e3c·7464·3e65·6e61·626c··y:</th><td>enabl | ||
| 0003b | 0003bbc0:·653c·2f74·643e·3c2f·7472·3e3c·2f74·6162··e</td></tr></tab | ||
| 0003bbd0:·6c65·3e3c·7072·653e·3c63·6f64·653e·696e··le><pre><code>in | |||
| 0003bbe0:·636c·7564·6520·696e·7374·616c·6c5f·6169··clude·install_ai | |||
| 0003bbf0:·6465·0a0a·636c·6173·7320·696e·7374·616c··de..class·instal | |||
| 0003bc00:·6c5f·6169·6465·207b·0a20·2070·6163·6b61··l_aide·{.··packa | |||
| 0003bc10:·6765·207b·2027·6169·6465·273a·0a20·2020··ge·{·'aide':.··· | |||
| 0003bc20:·2065·6e73·7572·6520·3d26·6774·3b20·2769···ensure·=>·'i | |||
| 0003bc30:·6e73·7461·6c6c·6564·272c·0a20·207d·0a7d··nstalled',.··}.} | |||
| 0003bc40:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bc50:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bc60:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bc70:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bc80:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bc90:·743d·2223·6964·6d37·3538·3522·2074·6162··t="#idm7585"·tab | |||
| 0003bca0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bcb0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bcc0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bcd0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bce0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bcf0:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | |||
| Max diff block lines reached; 7511558/7537556 bytes (99.66%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | Profile·Title·[DRAFT]·CIS·Red·Hat·Enterprise·Linux·9·Benchmark·for·Level·1·- | 40 | Profile·Title·[DRAFT]·CIS·Red·Hat·Enterprise·Linux·9·Benchmark·for·Level·1·- |
| 41 | ··············Server | 41 | ··············Server |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:redhat:enterprise_linux:9 | 44 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·GRUB2_bootloader_configuration | 52 | ·········3.·GRUB2_bootloader_configuration |
| 53 | ·········4.·Configure_Syslog | 53 | ·········4.·Configure_Syslog |
| 54 | ·········5.·Network_Configuration_and_Firewalls | 54 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 86, 31 lines modified | Offset 86, 39 lines modified | ||
| 86 | The·aide·package·can·be·installed·with·the·following·command: | 86 | The·aide·package·can·be·installed·with·the·following·command: |
| 87 | $·sudo·dnf·install·aide | 87 | $·sudo·dnf·install·aide |
| 88 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 88 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 89 | Severity: ················medium | 89 | Severity: ················medium |
| 90 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 90 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 91 | Identifiers·and·References·Identifiers: ·CCE-90843-4 | 91 | Identifiers·and·References·Identifiers: ·CCE-90843-4 |
| 92 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 92 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 93 | Remediation_Anaconda_snippet_⇲ | ||
| 94 | Complexity:·low | ||
| 95 | Disruption:·low | ||
| 96 | Strategy:···enable | ||
| 97 | package·--add=aide | ||
| 98 | Remediation_Puppet_snippet_⇲ | 93 | Remediation_Puppet_snippet_⇲ |
| 99 | Complexity:·low | 94 | Complexity:·low |
| 100 | Disruption:·low | 95 | Disruption:·low |
| 101 | Strategy:···enable | 96 | Strategy:···enable |
| 102 | include·install_aide | 97 | include·install_aide |
| 103 | class·install_aide·{ | 98 | class·install_aide·{ |
| 104 | ··package·{·'aide': | 99 | ··package·{·'aide': |
| 105 | ····ensure·=>·'installed', | 100 | ····ensure·=>·'installed', |
| 106 | ··} | 101 | ··} |
| 107 | } | 102 | } |
| 103 | Remediation_Shell_script_⇲ | ||
| 104 | Complexity:·low | ||
| 105 | Disruption:·low | ||
| 106 | Strategy:···enable | ||
| 107 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 108 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 109 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 110 | ····dnf·install·-y·"aide" | ||
| 111 | fi | ||
| 112 | else | ||
| 113 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 114 | fi | ||
| 108 | Remediation_Ansible_snippet_⇲ | 115 | Remediation_Ansible_snippet_⇲ |
| 109 | Complexity:·low | 116 | Complexity:·low |
| 110 | Disruption:·low | 117 | Disruption:·low |
| 111 | Strategy:···enable | 118 | Strategy:···enable |
| 112 | -·name:·Ensure·aide·is·installed | 119 | -·name:·Ensure·aide·is·installed |
| 113 | ··package: | 120 | ··package: |
| 114 | ····name:·aide | 121 | ····name:·aide |
| Offset 128, 41 lines modified | Offset 136, 47 lines modified | ||
| 128 | ··-·no_reboot_needed | 136 | ··-·no_reboot_needed |
| 129 | ··-·package_aide_installed | 137 | ··-·package_aide_installed |
| 130 | Remediation_OSBuild_Blueprint_snippet_⇲ | 138 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 131 | [[packages]] | 139 | [[packages]] |
| 132 | name·=·"aide" | 140 | name·=·"aide" |
| 133 | version·=·"*" | 141 | version·=·"*" |
| 134 | Remediation_ | 142 | Remediation_Anaconda_snippet_⇲ |
| 135 | Complexity:·low | 143 | Complexity:·low |
| 136 | Disruption:·low | 144 | Disruption:·low |
| 137 | Strategy:···enable | 145 | Strategy:···enable |
| 138 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 139 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 146 | package·--add=aide | ||
| 140 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 141 | ····dnf·install·-y·"aide" | ||
| 142 | fi | ||
| 143 | else | ||
| 144 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 145 | fi | ||
| 146 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 147 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 147 | Run·the·following·command·to·generate·a·new·database: | 148 | Run·the·following·command·to·generate·a·new·database: |
| 148 | $·sudo·/usr/sbin/aide·--init | 149 | $·sudo·/usr/sbin/aide·--init |
| 149 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 150 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 150 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 151 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 151 | To·initiate·a·manual·check,·run·the·following·command: | 152 | To·initiate·a·manual·check,·run·the·following·command: |
| 152 | $·sudo·/usr/sbin/aide·--check | 153 | $·sudo·/usr/sbin/aide·--check |
| 153 | If·this·check·produces·any·unexpected·output,·investigate. | 154 | If·this·check·produces·any·unexpected·output,·investigate. |
| 154 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 155 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 155 | Severity: ················medium | 156 | Severity: ················medium |
| 156 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 157 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 157 | Identifiers·and·References·Identifiers: ·CCE-83438-2 | 158 | Identifiers·and·References·Identifiers: ·CCE-83438-2 |
| 158 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 159 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 160 | Remediation_Shell_script_⇲ | ||
| 161 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 162 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 163 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 164 | ····dnf·install·-y·"aide" | ||
| 165 | fi | ||
| 166 | /usr/sbin/aide·--init | ||
| 167 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 168 | else | ||
| 169 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 170 | fi | ||
| 159 | Remediation_Ansible_snippet_⇲ | 171 | Remediation_Ansible_snippet_⇲ |
| 160 | Complexity:·low | 172 | Complexity:·low |
| 161 | Disruption:·low | 173 | Disruption:·low |
| 162 | Strategy:···restrict | 174 | Strategy:···restrict |
| 163 | -·name:·Ensure·AIDE·is·installed | 175 | -·name:·Ensure·AIDE·is·installed |
| 164 | ··package: | 176 | ··package: |
| 165 | ····name:·'{{·item·}}' | 177 | ····name:·'{{·item·}}' |
| Offset 231, 28 lines modified | Offset 245, 14 lines modified | ||
| 231 | ··-·PCI-DSS-Req-11.5 | 245 | ··-·PCI-DSS-Req-11.5 |
| 232 | ··-·aide_build_database | 246 | ··-·aide_build_database |
| 233 | ··-·low_complexity | 247 | ··-·low_complexity |
| 234 | ··-·low_disruption | 248 | ··-·low_disruption |
| 235 | ··-·medium_severity | 249 | ··-·medium_severity |
| 236 | ··-·no_reboot_needed | 250 | ··-·no_reboot_needed |
| 237 | ··-·restrict_strategy | 251 | ··-·restrict_strategy |
| 238 | Remediation_Shell_script_⇲ | ||
| Max diff block lines reached; 958344/964248 bytes (99.39%) of diff not shown. | |||
| Offset 14294, 15 lines modified | Offset 14294, 15 lines modified | ||
| 00037d50:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037d50:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037d60:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037d60:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037d70:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037d70:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037d80:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037d80:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037d90:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037d90:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037da0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037da0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037db0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037db0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037dc0:·3032·3 | 00037dc0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037dd0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037dd0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037de0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037de0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037df0:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037df0:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037e00:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037e00:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037e10:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037e10:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037e20:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037e20:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037e30:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037e30:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15265, 191 lines modified | Offset 15265, 191 lines modified | ||
| 0003ba00:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003ba00:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003ba10:·2223·6964·6d37·3538·3422·2074·6162·696e··"#idm7584"·tabin | 0003ba10:·2223·6964·6d37·3538·3422·2074·6162·696e··"#idm7584"·tabin | ||
| 0003ba20:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003ba20:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003ba30:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003ba30:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003ba40:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003ba40:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003ba50:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003ba50:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003ba60:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003ba60:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003ba70:·3e52·656d·6564·6961·7469·6f6e·20 | 0003ba70:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | ||
| 0003ba80:·636f·6e64·6120·736e·6970·7065·7420·e287··conda·snippet·.. | |||
| 0003ba90:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003baa0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003bab0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003bac0:·3d22·6964·6d37·3538·3422·3e3c·7461·626c··="idm7584"><tabl | |||
| 0003bad0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003bae0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003baf0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003bb00:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003bb10:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003bb20:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003bb30:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003bb40:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003bb50:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003bb60:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003bb70:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003bb80:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003bb90:·3e3c·7072·653e·3c63·6f64·653e·0a70·6163··><pre><code>.pac | |||
| 0003bba0:·6b61·6765·202d·2d61·6464·3d61·6964·650a··kage·--add=aide. | |||
| 0003bbb0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003bbc0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003bbd0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003bbe0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003bbf0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003bc00:·3d22·2369·646d·3735·3835·2220·7461·6269··="#idm7585"·tabi | |||
| 0003bc10:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003bc20:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003bc30:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003bc40:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003bc50:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003bc60:·223e·5265·6d65·6469·6174·696f·6e20·5075··">Remediation·Pu | |||
| 0003bc70:·7070·6574·2073·6e69·7070·6574·20e2·87b2··ppet·snippet·... | |||
| 0003bc80:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bc90:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003bca0:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003bcb0:·2269·646d·3735·3835·223e·3c74·6162·6c65··"idm7585"><table | |||
| 0003bcc0:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003bcd0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003bce0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003bcf0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003bd00:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003bd10:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bd20:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003bd30:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003bd40:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003bd50:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bd60:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003bd70:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003bd80:·3c70·7265·3e3c·636f·6465·3e69·6e63·6c75··<pre><code>inclu | |||
| 0003bd90:·6465·2069·6e73·7461·6c6c·5f61·6964·650a··de·install_aide. | |||
| 0003bda0:·0a63·6c61·7373·2069·6e73·7461·6c6c·5f61··.class·install_a | |||
| 0003bdb0:·6964·6520·7b0a·2020·7061·636b·6167·6520··ide·{.··package· | |||
| 0003bdc0:·7b20·2761·6964·6527·3a0a·2020·2020·656e··{·'aide':.····en | |||
| 0003bdd0:·7375·7265·203d·2667·743b·2027·696e·7374··sure·=>·'inst | |||
| 0003bde0:·616c·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f··alled',.··}.}.</ | |||
| 0003bdf0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003be00:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003be10:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003be20:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003be30:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003be40:·2369·646d·3735·3836·2220·7461·6269·6e64··#idm7586"·tabind | |||
| 0003be50:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003be60:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003be70:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003be80:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003be90:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003bea0:·5265·6d65·6469·6174·696f·6e20·416e·7369··Remediation·Ansi | |||
| 0003b | 0003ba80:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | ||
| 0003b | 0003ba90:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | ||
| 0003b | 0003baa0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | ||
| 0003b | 0003bab0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | ||
| 0003b | 0003bac0:·6964·6d37·3538·3422·3e3c·7461·626c·6520··idm7584"><table· | ||
| 0003b | 0003bad0:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003b | 0003bae0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003b | 0003baf0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003b | 0003bb00:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003b | 0003bb10:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003b | 0003bb20:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003b | 0003bb30:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003b | 0003bb40:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003b | 0003bb50:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003b | 0003bb60:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003b | 0003bb70:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | ||
| 0003b | 0003bb80:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | ||
| 0003bb90:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003bba0:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003bbb0:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003bbc0:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003bbd0:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003bbe0:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003bbf0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003bc00:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003bc10:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003bc20:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003bc30:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003bc40:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003bc50:·6964·6d37·3538·3522·2074·6162·696e·6465··idm7585"·tabinde | |||
| 0003bc60:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003bc70:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003bc80:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003bc90:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003bca0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003bcb0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | |||
| Max diff block lines reached; 7433218/7459354 bytes (99.65%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | Profile·Title·[DRAFT]·CIS·Red·Hat·Enterprise·Linux·9·Benchmark·for·Level·1·- | 40 | Profile·Title·[DRAFT]·CIS·Red·Hat·Enterprise·Linux·9·Benchmark·for·Level·1·- |
| 41 | ··············Workstation | 41 | ··············Workstation |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:redhat:enterprise_linux:9 | 44 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·Installing_and_Maintaining_Software | 50 | ·········1.·Installing_and_Maintaining_Software |
| 51 | ·········2.·Account_and_Access_Control | 51 | ·········2.·Account_and_Access_Control |
| 52 | ·········3.·GRUB2_bootloader_configuration | 52 | ·········3.·GRUB2_bootloader_configuration |
| 53 | ·········4.·Configure_Syslog | 53 | ·········4.·Configure_Syslog |
| 54 | ·········5.·Network_Configuration_and_Firewalls | 54 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 85, 31 lines modified | Offset 85, 39 lines modified | ||
| 85 | The·aide·package·can·be·installed·with·the·following·command: | 85 | The·aide·package·can·be·installed·with·the·following·command: |
| 86 | $·sudo·dnf·install·aide | 86 | $·sudo·dnf·install·aide |
| 87 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. | 87 | Rationale:·················The·AIDE·package·must·be·installed·if·it·is·to·be·available·for·integrity·checking. |
| 88 | Severity: ················medium | 88 | Severity: ················medium |
| 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed | 89 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_aide_installed |
| 90 | Identifiers·and·References·Identifiers: ·CCE-90843-4 | 90 | Identifiers·and·References·Identifiers: ·CCE-90843-4 |
| 91 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 | 91 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-002696,·CCI-002699,·CCI-001744,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·1034,·1288,·1341,·1417,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·SRG-OS-000363-GPOS-00150,·SRG-OS-000445-GPOS-00199 |
| 92 | Remediation_Anaconda_snippet_⇲ | ||
| 93 | Complexity:·low | ||
| 94 | Disruption:·low | ||
| 95 | Strategy:···enable | ||
| 96 | package·--add=aide | ||
| 97 | Remediation_Puppet_snippet_⇲ | 92 | Remediation_Puppet_snippet_⇲ |
| 98 | Complexity:·low | 93 | Complexity:·low |
| 99 | Disruption:·low | 94 | Disruption:·low |
| 100 | Strategy:···enable | 95 | Strategy:···enable |
| 101 | include·install_aide | 96 | include·install_aide |
| 102 | class·install_aide·{ | 97 | class·install_aide·{ |
| 103 | ··package·{·'aide': | 98 | ··package·{·'aide': |
| 104 | ····ensure·=>·'installed', | 99 | ····ensure·=>·'installed', |
| 105 | ··} | 100 | ··} |
| 106 | } | 101 | } |
| 102 | Remediation_Shell_script_⇲ | ||
| 103 | Complexity:·low | ||
| 104 | Disruption:·low | ||
| 105 | Strategy:···enable | ||
| 106 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 107 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 108 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 109 | ····dnf·install·-y·"aide" | ||
| 110 | fi | ||
| 111 | else | ||
| 112 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 113 | fi | ||
| 107 | Remediation_Ansible_snippet_⇲ | 114 | Remediation_Ansible_snippet_⇲ |
| 108 | Complexity:·low | 115 | Complexity:·low |
| 109 | Disruption:·low | 116 | Disruption:·low |
| 110 | Strategy:···enable | 117 | Strategy:···enable |
| 111 | -·name:·Ensure·aide·is·installed | 118 | -·name:·Ensure·aide·is·installed |
| 112 | ··package: | 119 | ··package: |
| 113 | ····name:·aide | 120 | ····name:·aide |
| Offset 127, 41 lines modified | Offset 135, 47 lines modified | ||
| 127 | ··-·no_reboot_needed | 135 | ··-·no_reboot_needed |
| 128 | ··-·package_aide_installed | 136 | ··-·package_aide_installed |
| 129 | Remediation_OSBuild_Blueprint_snippet_⇲ | 137 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 130 | [[packages]] | 138 | [[packages]] |
| 131 | name·=·"aide" | 139 | name·=·"aide" |
| 132 | version·=·"*" | 140 | version·=·"*" |
| 133 | Remediation_ | 141 | Remediation_Anaconda_snippet_⇲ |
| 134 | Complexity:·low | 142 | Complexity:·low |
| 135 | Disruption:·low | 143 | Disruption:·low |
| 136 | Strategy:···enable | 144 | Strategy:···enable |
| 137 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 138 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 145 | package·--add=aide | ||
| 139 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 140 | ····dnf·install·-y·"aide" | ||
| 141 | fi | ||
| 142 | else | ||
| 143 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 144 | fi | ||
| 145 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 146 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 146 | Run·the·following·command·to·generate·a·new·database: | 147 | Run·the·following·command·to·generate·a·new·database: |
| 147 | $·sudo·/usr/sbin/aide·--init | 148 | $·sudo·/usr/sbin/aide·--init |
| 148 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: | 149 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.gz.·Storing·the·database,·the·configuration·file·/etc/aide.conf,·and·the·binary·/usr/sbin/aide·(or·hashes·of·these·files),·in·a·secure·location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated·database·can·be·installed·as·follows: |
| 149 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | 150 | $·sudo·cp·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz |
| 150 | To·initiate·a·manual·check,·run·the·following·command: | 151 | To·initiate·a·manual·check,·run·the·following·command: |
| 151 | $·sudo·/usr/sbin/aide·--check | 152 | $·sudo·/usr/sbin/aide·--check |
| 152 | If·this·check·produces·any·unexpected·output,·investigate. | 153 | If·this·check·produces·any·unexpected·output,·investigate. |
| 153 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. | 154 | Rationale:·················For·AIDE·to·be·effective,·an·initial·database·of·"known-good"·information·about·files·must·be·captured·and·it·should·be·able·to·be·verified·against·the·installed·files. |
| 154 | Severity: ················medium | 155 | Severity: ················medium |
| 155 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database | 156 | Rule·ID:···················xccdf_org.ssgproject.content_rule_aide_build_database |
| 156 | Identifiers·and·References·Identifiers: ·CCE-83438-2 | 157 | Identifiers·and·References·Identifiers: ·CCE-83438-2 |
| 157 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 | 158 | ···························References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06,·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07,·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3,·CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5 |
| 159 | Remediation_Shell_script_⇲ | ||
| 160 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 161 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 162 | if·!·rpm·-q·--quiet·"aide"·;·then | ||
| 163 | ····dnf·install·-y·"aide" | ||
| 164 | fi | ||
| 165 | /usr/sbin/aide·--init | ||
| 166 | /bin/cp·-p·/var/lib/aide/aide.db.new.gz·/var/lib/aide/aide.db.gz | ||
| 167 | else | ||
| 168 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 169 | fi | ||
| 158 | Remediation_Ansible_snippet_⇲ | 170 | Remediation_Ansible_snippet_⇲ |
| 159 | Complexity:·low | 171 | Complexity:·low |
| 160 | Disruption:·low | 172 | Disruption:·low |
| 161 | Strategy:···restrict | 173 | Strategy:···restrict |
| 162 | -·name:·Ensure·AIDE·is·installed | 174 | -·name:·Ensure·AIDE·is·installed |
| 163 | ··package: | 175 | ··package: |
| 164 | ····name:·'{{·item·}}' | 176 | ····name:·'{{·item·}}' |
| Offset 230, 28 lines modified | Offset 244, 14 lines modified | ||
| 230 | ··-·PCI-DSS-Req-11.5 | 244 | ··-·PCI-DSS-Req-11.5 |
| 231 | ··-·aide_build_database | 245 | ··-·aide_build_database |
| 232 | ··-·low_complexity | 246 | ··-·low_complexity |
| 233 | ··-·low_disruption | 247 | ··-·low_disruption |
| 234 | ··-·medium_severity | 248 | ··-·medium_severity |
| 235 | ··-·no_reboot_needed | 249 | ··-·no_reboot_needed |
| 236 | ··-·restrict_strategy | 250 | ··-·restrict_strategy |
| 237 | Remediation_Shell_script_⇲ | ||
| Max diff block lines reached; 945259/951173 bytes (99.38%) of diff not shown. | |||
| Offset 14294, 15 lines modified | Offset 14294, 15 lines modified | ||
| 00037d50:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037d50:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037d60:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037d60:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037d70:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037d70:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037d80:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037d80:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037d90:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037d90:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037da0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037da0:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037db0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037db0:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037dc0:·3032·3 | 00037dc0:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037dd0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037dd0:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037de0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037de0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037df0:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037df0:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037e00:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037e00:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037e10:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037e10:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037e20:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037e20:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037e30:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037e30:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 15276, 191 lines modified | Offset 15276, 191 lines modified | ||
| 0003bab0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | 0003bab0:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | ||
| 0003bac0:·3735·3834·2220·7461·6269·6e64·6578·3d22··7584"·tabindex=" | 0003bac0:·3735·3834·2220·7461·6269·6e64·6578·3d22··7584"·tabindex=" | ||
| 0003bad0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | 0003bad0:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | ||
| 0003bae0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | 0003bae0:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | ||
| 0003baf0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | 0003baf0:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | ||
| 0003bb00:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | 0003bb00:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | ||
| 0003bb10:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | 0003bb10:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | ||
| 0003bb20:·6469·6174·696f·6e20·5075·7070·6574·2073··diation·Puppet·s | |||
| 0003bb20:·6469·6174·696f·6e20·416e·6163·6f6e·6461··diation·Anaconda | |||
| 0003bb30:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bb40:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bb50:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bb60:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bb70:·3735·3834·223e·3c74·6162·6c65·2063·6c61··7584"><table·cla | |||
| 0003bb80:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bb90:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bba0:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bbb0:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bbc0:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bbd0:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | |||
| 0003bbe0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003bbf0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003bc00:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bc10:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bc20:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003bc30:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003bc40:·3e3c·636f·6465·3e0a·7061·636b·6167·6520··><code>.package· | |||
| 0003bc50:·2d2d·6164·643d·6169·6465·0a3c·2f63·6f64··--add=aide.</cod | |||
| 0003bc60:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003bc70:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003bc80:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bc90:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003bca0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003bcb0:·6d37·3538·3522·2074·6162·696e·6465·783d··m7585"·tabindex= | |||
| 0003bcc0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003bcd0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003bce0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003bcf0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003bd00:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003bd10:·6564·6961·7469·6f6e·2050·7570·7065·7420··ediation·Puppet· | |||
| 0003bd20:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bd30:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bd40:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bd50:·6c6c·6170·7365·2220·6964·3d22·6964·6d37··llapse"·id="idm7 | |||
| 0003bd60:·3538·3522·3e3c·7461·626c·6520·636c·6173··585"><table·clas | |||
| 0003bd70:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003bd80:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003bd90:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003bda0:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003bdb0:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bdc0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bdd0:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003bde0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003bdf0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003be00:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003be10:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003be20:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003be30:·3c63·6f64·653e·696e·636c·7564·6520·696e··<code>include·in | |||
| 0003be40:·7374·616c·6c5f·6169·6465·0a0a·636c·6173··stall_aide..clas | |||
| 0003be50:·7320·696e·7374·616c·6c5f·6169·6465·207b··s·install_aide·{ | |||
| 0003be60:·0a20·2070·6163·6b61·6765·207b·2027·6169··.··package·{·'ai | |||
| 0003be70:·6465·273a·0a20·2020·2065·6e73·7572·6520··de':.····ensure· | |||
| 0003be80:·3d26·6774·3b20·2769·6e73·7461·6c6c·6564··=>·'installed | |||
| 0003be90:·272c·0a20·207d·0a7d·0a3c·2f63·6f64·653e··',.··}.}.</code> | |||
| 0003bea0:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003beb0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003bec0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003bed0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003bee0:·7461·2d74·6172·6765·743d·2223·6964·6d37··ta-target="#idm7 | |||
| 0003bef0:·3538·3622·2074·6162·696e·6465·783d·2230··586"·tabindex="0 | |||
| 0003bf00:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003bf10:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003bf20:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003bf30:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003bf40:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003bf50:·6961·7469·6f6e·2041·6e73·6962·6c65·2073··iation·Ansible·s | |||
| 0003b | 0003bb30:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | ||
| 0003b | 0003bb40:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | ||
| 0003b | 0003bb50:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | ||
| 0003b | 0003bb60:·6c61·7073·6522·2069·643d·2269·646d·3735··lapse"·id="idm75 | ||
| 0003b | 0003bb70:·3834·223e·3c74·6162·6c65·2063·6c61·7373··84"><table·class | ||
| 0003b | 0003bb80:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | ||
| 0003b | 0003bb90:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | ||
| 0003b | 0003bba0:·6572·6564·2074·6162·6c65·2d63·6f6e·6465··ered·table-conde | ||
| 0003b | 0003bbb0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | ||
| 0003b | 0003bbc0:·6d70·6c65·7869·7479·3a3c·2f74·683e·3c74··mplexity:</th><t | ||
| 0003 | 0003bbd0:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | ||
| 0003 | 0003bbe0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | ||
| 0003 | 0003bbf0:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | ||
| 0003c0 | 0003bc00:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | ||
| 0003 | 0003bc10:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | ||
| 0003 | 0003bc20:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | ||
| 0003 | 0003bc30:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | ||
| 0003bc40:·636f·6465·3e69·6e63·6c75·6465·2069·6e73··code>include·ins | |||
| 0003bc50:·7461·6c6c·5f61·6964·650a·0a63·6c61·7373··tall_aide..class | |||
| 0003bc60:·2069·6e73·7461·6c6c·5f61·6964·6520·7b0a···install_aide·{. | |||
| 0003bc70:·2020·7061·636b·6167·6520·7b20·2761·6964····package·{·'aid | |||
| 0003bc80:·6527·3a0a·2020·2020·656e·7375·7265·203d··e':.····ensure·= | |||
| 0003bc90:·2667·743b·2027·696e·7374·616c·6c65·6427··>·'installed' | |||
| 0003bca0:·2c0a·2020·7d0a·7d0a·3c2f·636f·6465·3e3c··,.··}.}.</code>< | |||
| 0003bcb0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003bcc0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003bcd0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003bce0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003bcf0:·612d·7461·7267·6574·3d22·2369·646d·3735··a-target="#idm75 | |||
| 0003bd00:·3835·2220·7461·6269·6e64·6578·3d22·3022··85"·tabindex="0" | |||
| 0003bd10:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003bd20:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003bd30:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003bd40:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003bd50:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| Max diff block lines reached; 18751093/18777229 bytes (99.86%) of diff not shown. | |||
| Offset 14335, 15 lines modified | Offset 14335, 15 lines modified | ||
| 00037fe0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037fe0:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037ff0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037ff0:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00038000:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00038000:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00038010:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00038010:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00038020:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00038020:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00038030:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00038030:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00038040:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00038040:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00038050:·3 | 00038050:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00038060:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00038060:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00038070:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00038070:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00038080:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00038080:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00038090:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00038090:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 000380a0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 000380a0:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 000380b0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 000380b0:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 000380c0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 000380c0:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15102, 178 lines modified | Offset 15102, 178 lines modified | ||
| 0003afd0:·6765·743d·2223·6964·6d38·3037·3822·2074··get="#idm8078"·t | 0003afd0:·6765·743d·2223·6964·6d38·3037·3822·2074··get="#idm8078"·t | ||
| 0003afe0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003afe0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003aff0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003aff0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003b000:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003b000:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003b010:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003b010:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003b020:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003b020:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003b030:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003b030:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003b040:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003b050:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003b060:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003b070:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003b080:·2069·643d·2269·646d·3830·3738·223e·3c74···id="idm8078"><t | |||
| 0003b090:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003b0a0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003b0b0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003b0c0:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003b0d0:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003b0e0:·7479·3a3c·2f74·683e·3c74·643e·6d65·6469··ty:</th><td>medi | |||
| 0003b0f0:·756d·3c2f·7464·3e3c·2f74·723e·3c74·723e··um</td></tr><tr> | |||
| 0003b100:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003b110:·2f74·683e·3c74·643e·6d65·6469·756d·3c2f··/th><td>medium</ | |||
| 0003b120:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003b130:·5265·626f·6f74·3a3c·2f74·683e·3c74·643e··Reboot:</th><td> | |||
| 0003b140:·7472·7565·3c2f·7464·3e3c·2f74·723e·3c74··true</td></tr><t | |||
| 0003b150:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003b160:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003b170:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003b180:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003b190:·616d·653a·2043·6865·636b·2074·6f20·7365··ame:·Check·to·se | |||
| 0003b1a0:·6520·7468·6520·6375·7272·656e·7420·7374··e·the·current·st | |||
| 0003b1b0:·6174·7573·206f·6620·4649·5053·206d·6f64··atus·of·FIPS·mod | |||
| 0003b1c0:·650a·2020·636f·6d6d·616e·643a·202f·7573··e.··command:·/us | |||
| 0003b1d0:·722f·6269·6e2f·6669·7073·2d6d·6f64·652d··r/bin/fips-mode- | |||
| 0003b1e0:·7365·7475·7020·2d2d·6368·6563·6b0a·2020··setup·--check.·· | |||
| 0003b1f0:·7265·6769·7374·6572·3a20·6973·5f66·6970··register:·is_fip | |||
| 0003b200:·735f·656e·6162·6c65·640a·2020·6368·616e··s_enabled.··chan | |||
| 0003b210:·6765·645f·7768·656e·3a20·6661·6c73·650a··ged_when:·false. | |||
| 0003b220:·2020·6661·696c·6564·5f77·6865·6e3a·2066····failed_when:·f | |||
| 0003b230:·616c·7365·0a20·2077·6865·6e3a·2061·6e73··alse.··when:·ans | |||
| 0003b240:·6962·6c65·5f76·6972·7475·616c·697a·6174··ible_virtualizat | |||
| 0003b250:·696f·6e5f·7479·7065·206e·6f74·2069·6e20··ion_type·not·in· | |||
| 0003b260:·5b22·646f·636b·6572·222c·2022·6c78·6322··["docker",·"lxc" | |||
| 0003b270:·2c20·226f·7065·6e76·7a22·2c20·2270·6f64··,·"openvz",·"pod | |||
| 0003b280:·6d61·6e22·2c20·2263·6f6e·7461·696e·6572··man",·"container | |||
| 0003b290:·225d·0a20·2074·6167·733a·0a20·202d·2043··"].··tags:.··-·C | |||
| 0003b2a0:·4345·2d38·3635·3437·2d37·0a20·202d·204e··CE-86547-7.··-·N | |||
| 0003b2b0:·4953·542d·3830·302d·3533·2d43·4d2d·3628··IST-800-53-CM-6( | |||
| 0003b2c0:·6129·0a20·202d·204e·4953·542d·3830·302d··a).··-·NIST-800- | |||
| 0003b2d0:·3533·2d49·412d·370a·2020·2d20·4e49·5354··53-IA-7.··-·NIST | |||
| 0003b2e0:·2d38·3030·2d35·332d·5343·2d31·320a·2020··-800-53-SC-12.·· | |||
| 0003b2f0:·2d20·4e49·5354·2d38·3030·2d35·332d·5343··-·NIST-800-53-SC | |||
| 0003b300:·2d31·3228·3229·0a20·202d·204e·4953·542d··-12(2).··-·NIST- | |||
| 0003b310:·3830·302d·3533·2d53·432d·3132·2833·290a··800-53-SC-12(3). | |||
| 0003b320:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003b330:·5343·2d31·330a·2020·2d20·656e·6162·6c65··SC-13.··-·enable | |||
| 0003b340:·5f64·7261·6375·745f·6669·7073·5f6d·6f64··_dracut_fips_mod | |||
| 0003b350:·756c·650a·2020·2d20·6869·6768·5f73·6576··ule.··-·high_sev | |||
| 0003b360:·6572·6974·790a·2020·2d20·6d65·6469·756d··erity.··-·medium | |||
| 0003b370:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003b380:·6d65·6469·756d·5f64·6973·7275·7074·696f··medium_disruptio | |||
| 0003b390:·6e0a·2020·2d20·7265·626f·6f74·5f72·6571··n.··-·reboot_req | |||
| 0003b3a0:·7569·7265·640a·2020·2d20·7265·7374·7269··uired.··-·restri | |||
| 0003b3b0:·6374·5f73·7472·6174·6567·790a·0a2d·206e··ct_strategy..-·n | |||
| 0003b3c0:·616d·653a·2045·6e61·626c·6520·4649·5053··ame:·Enable·FIPS | |||
| 0003b3d0:·206d·6f64·650a·2020·636f·6d6d·616e·643a···mode.··command: | |||
| 0003b3e0:·202f·7573·722f·6269·6e2f·6669·7073·2d6d···/usr/bin/fips-m | |||
| 0003b3f0:·6f64·652d·7365·7475·7020·2d2d·656e·6162··ode-setup·--enab | |||
| 0003b400:·6c65·0a20·2077·6865·6e3a·0a20·202d·2061··le.··when:.··-·a | |||
| 0003b410:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| 0003b420:·6174·696f·6e5f·7479·7065·206e·6f74·2069··ation_type·not·i | |||
| 0003b430:·6e20·5b22·646f·636b·6572·222c·2022·6c78··n·["docker",·"lx | |||
| 0003b440:·6322·2c20·226f·7065·6e76·7a22·2c20·2270··c",·"openvz",·"p | |||
| 0003b450:·6f64·6d61·6e22·2c20·2263·6f6e·7461·696e··odman",·"contain | |||
| 0003b460:·6572·225d·0a20·202d·2069·735f·6669·7073··er"].··-·is_fips | |||
| 0003b470:·5f65·6e61·626c·6564·2e73·7464·6f75·742e··_enabled.stdout. | |||
| 0003b480:·6669·6e64·2827·4649·5053·206d·6f64·6520··find('FIPS·mode· | |||
| 0003b | 0003b040:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | ||
| 0003b050:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003b060:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003b070:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003b080:·3d22·6964·6d38·3037·3822·3e3c·7072·653e··="idm8078"><pre> | |||
| 0003b090:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003b0a0:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003b0b0:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003b0c0:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003b0d0:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003b0e0:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003b0f0:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003b100:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003b110:·0a0a·6669·7073·2d6d·6f64·652d·7365·7475··..fips-mode-setu | |||
| 0003b120:·7020·2d2d·656e·6162·6c65·0a46·4950·535f··p·--enable.FIPS_ | |||
| 0003b130:·434f·4e46·3d22·2f65·7463·2f64·7261·6375··CONF="/etc/dracu | |||
| 0003b140:·742e·636f·6e66·2e64·2f34·302d·6669·7073··t.conf.d/40-fips | |||
| 0003b150:·2e63·6f6e·6622·0a69·6620·2120·6772·6570··.conf".if·!·grep | |||
| 0003b160:·2022·5e61·6464·5f64·7261·6375·746d·6f64···"^add_dracutmod | |||
| 0003b170:·756c·6573·2b3d·5c22·2066·6970·7320·5c22··ules+=\"·fips·\" | |||
| 0003b180:·2220·2446·4950·535f·434f·4e46·3b20·7468··"·$FIPS_CONF;·th | |||
| 0003b190:·656e·0a20·2020·2065·6368·6f20·2261·6464··en.····echo·"add | |||
| 0003b1a0:·5f64·7261·6375·746d·6f64·756c·6573·2b3d··_dracutmodules+= | |||
| 0003b1b0:·5c22·2066·6970·7320·5c22·2220·2667·743b··\"·fips·\""·> | |||
| 0003b1c0:·2667·743b·2024·4649·5053·5f43·4f4e·460a··>·$FIPS_CONF. | |||
| 0003b1d0:·6669·0a0a·656c·7365·0a20·2020·2026·6774··fi..else.····> | |||
| 0003b1e0:·3b26·616d·703b·3220·6563·686f·2027·5265··;&2·echo·'Re | |||
| 0003b1f0:·6d65·6469·6174·696f·6e20·6973·206e·6f74··mediation·is·not | |||
| 0003b200:·2061·7070·6c69·6361·626c·652c·206e·6f74···applicable,·not | |||
| 0003b210:·6869·6e67·2077·6173·2064·6f6e·6527·0a66··hing·was·done'.f | |||
| 0003b220:·690a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··i.</code></pre>< | |||
| 0003b230:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003b240:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003b250:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003b260:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| Max diff block lines reached; 5893270/5917612 bytes (99.59%) of diff not shown. | |||
| Offset 50, 15 lines modified | Offset 50, 15 lines modified | ||
| 50 | Profile·Title·[DRAFT]·Unclassified·Information·in·Non-federal·Information | 50 | Profile·Title·[DRAFT]·Unclassified·Information·in·Non-federal·Information |
| 51 | ··············Systems·and·Organizations·(NIST·800-171) | 51 | ··············Systems·and·Organizations·(NIST·800-171) |
| 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui | 52 | Profile·ID····xccdf_org.ssgproject.content_profile_cui |
| 53 | ***·CPE·Platforms·*** | 53 | ***·CPE·Platforms·*** |
| 54 | ····*·cpe:/o:redhat:enterprise_linux:9 | 54 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 55 | *****·Revision·History·***** | 55 | *****·Revision·History·***** |
| 56 | Current·version:·0.1.65 | 56 | Current·version:·0.1.65 |
| 57 | ····*·draft·(as·of·202 | 57 | ····*·draft·(as·of·2025-02-23) |
| 58 | *****·Table·of·Contents·***** | 58 | *****·Table·of·Contents·***** |
| 59 | ···1.·System_Settings | 59 | ···1.·System_Settings |
| 60 | ·········1.·Installing_and_Maintaining_Software | 60 | ·········1.·Installing_and_Maintaining_Software |
| 61 | ·········2.·Account_and_Access_Control | 61 | ·········2.·Account_and_Access_Control |
| 62 | ·········3.·System_Accounting_with_auditd | 62 | ·········3.·System_Accounting_with_auditd |
| 63 | ·········4.·GRUB2_bootloader_configuration | 63 | ·········4.·GRUB2_bootloader_configuration |
| 64 | ·········5.·zIPL_bootloader_configuration | 64 | ·········5.·zIPL_bootloader_configuration |
| Offset 92, 14 lines modified | Offset 92, 27 lines modified | ||
| 92 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 92 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 93 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 93 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 94 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 94 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 95 | Severity: ················high | 95 | Severity: ················high |
| 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 96 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 97 | Identifiers·and·References·Identifiers: ·CCE-86547-7 | 97 | Identifiers·and·References·Identifiers: ·CCE-86547-7 |
| 98 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 98 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 99 | Remediation_Shell_script_⇲ | ||
| 100 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 101 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 102 | fips-mode-setup·--enable | ||
| 103 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 104 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 105 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 106 | fi | ||
| 107 | else | ||
| 108 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 109 | fi | ||
| 99 | Remediation_Ansible_snippet_⇲ | 110 | Remediation_Ansible_snippet_⇲ |
| 100 | Complexity:·medium | 111 | Complexity:·medium |
| 101 | Disruption:·medium | 112 | Disruption:·medium |
| 102 | Reboot:·····true | 113 | Reboot:·····true |
| 103 | Strategy:···restrict | 114 | Strategy:···restrict |
| 104 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 115 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 105 | ··command:·/usr/bin/fips-mode-setup·--check | 116 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 157, 27 lines modified | Offset 170, 14 lines modified | ||
| 157 | ··-·NIST-800-53-SC-13 | 170 | ··-·NIST-800-53-SC-13 |
| 158 | ··-·enable_dracut_fips_module | 171 | ··-·enable_dracut_fips_module |
| 159 | ··-·high_severity | 172 | ··-·high_severity |
| 160 | ··-·medium_complexity | 173 | ··-·medium_complexity |
| 161 | ··-·medium_disruption | 174 | ··-·medium_disruption |
| 162 | ··-·reboot_required | 175 | ··-·reboot_required |
| 163 | ··-·restrict_strategy | 176 | ··-·restrict_strategy |
| 164 | Remediation_Shell_script_⇲ | ||
| 165 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 166 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 167 | fips-mode-setup·--enable | ||
| 168 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 169 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 170 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 171 | fi | ||
| 172 | else | ||
| 173 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 174 | fi | ||
| 175 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** | 177 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** |
| 176 | To·enable·FIPS·mode,·run·the·following·command: | 178 | To·enable·FIPS·mode,·run·the·following·command: |
| 177 | fips-mode-setup·--enable | 179 | fips-mode-setup·--enable |
| 178 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: | 180 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: |
| 179 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 | 181 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 |
| 180 | ····*·Creating·/etc/system-fips | 182 | ····*·Creating·/etc/system-fips |
| Offset 231, 31 lines modified | Offset 231, 33 lines modified | ||
| 231 | The·crypto-policies·package·can·be·installed·with·the·following·command: | 231 | The·crypto-policies·package·can·be·installed·with·the·following·command: |
| 232 | $·sudo·dnf·install·crypto-policies | 232 | $·sudo·dnf·install·crypto-policies |
| 233 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. | 233 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. |
| 234 | Severity: ················medium | 234 | Severity: ················medium |
| 235 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed | 235 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed |
| 236 | Identifiers·and·References·Identifiers: ·CCE-83442-4 | 236 | Identifiers·and·References·Identifiers: ·CCE-83442-4 |
| 237 | ···························References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 | 237 | ···························References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 |
| 238 | Remediation_Anaconda_snippet_⇲ | ||
| 239 | Complexity:·low | ||
| 240 | Disruption:·low | ||
| 241 | Strategy:···enable | ||
| 242 | package·--add=crypto-policies | ||
| 243 | Remediation_Puppet_snippet_⇲ | 238 | Remediation_Puppet_snippet_⇲ |
| 244 | Complexity:·low | 239 | Complexity:·low |
| 245 | Disruption:·low | 240 | Disruption:·low |
| 246 | Strategy:···enable | 241 | Strategy:···enable |
| 247 | include·install_crypto-policies | 242 | include·install_crypto-policies |
| 248 | class·install_crypto-policies·{ | 243 | class·install_crypto-policies·{ |
| 249 | ··package·{·'crypto-policies': | 244 | ··package·{·'crypto-policies': |
| 250 | ····ensure·=>·'installed', | 245 | ····ensure·=>·'installed', |
| 251 | ··} | 246 | ··} |
| 252 | } | 247 | } |
| 248 | Remediation_Shell_script_⇲ | ||
| 249 | Complexity:·low | ||
| 250 | Disruption:·low | ||
| 251 | Strategy:···enable | ||
| 252 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 253 | ····dnf·install·-y·"crypto-policies" | ||
| 254 | fi | ||
| 253 | Remediation_Ansible_snippet_⇲ | 255 | Remediation_Ansible_snippet_⇲ |
| 254 | Complexity:·low | 256 | Complexity:·low |
| 255 | Disruption:·low | 257 | Disruption:·low |
| 256 | Strategy:···enable | 258 | Strategy:···enable |
| 257 | -·name:·Ensure·crypto-policies·is·installed | 259 | -·name:·Ensure·crypto-policies·is·installed |
| 258 | ··package: | 260 | ··package: |
| 259 | ····name:·crypto-policies | 261 | ····name:·crypto-policies |
| Offset 269, 58 lines modified | Offset 271, 50 lines modified | ||
| 269 | ··-·no_reboot_needed | 271 | ··-·no_reboot_needed |
| 270 | ··-·package_crypto-policies_installed | 272 | ··-·package_crypto-policies_installed |
| 271 | Remediation_OSBuild_Blueprint_snippet_⇲ | 273 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 272 | [[packages]] | 274 | [[packages]] |
| 273 | name·=·"crypto-policies" | 275 | name·=·"crypto-policies" |
| 274 | version·=·"*" | 276 | version·=·"*" |
| 275 | Remediation_ | 277 | Remediation_Anaconda_snippet_⇲ |
| 276 | Complexity:·low | 278 | Complexity:·low |
| 277 | Disruption:·low | 279 | Disruption:·low |
| 278 | Strategy:···enable | 280 | Strategy:···enable |
| 281 | package·--add=crypto-policies | ||
| 279 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 280 | ····dnf·install·-y·"crypto-policies" | ||
| Max diff block lines reached; 810252/816345 bytes (99.25%) of diff not shown. | |||
| Offset 14300, 16 lines modified | Offset 14300, 16 lines modified | ||
| 00037db0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | 00037db0:·6f6e·2048·6973·746f·7279·3c2f·6832·3e3c··on·History</h2>< | ||
| 00037dc0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | 00037dc0:·703e·4375·7272·656e·7420·7665·7273·696f··p>Current·versio | ||
| 00037dd0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | 00037dd0:·6e3a·203c·7374·726f·6e67·3e30·2e31·2e36··n:·<strong>0.1.6 | ||
| 00037de0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | 00037de0:·353c·2f73·7472·6f6e·673e·3c2f·703e·3c75··5</strong></p><u | ||
| 00037df0:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | 00037df0:·6c3e·3c6c·693e·3c73·7472·6f6e·673e·6472··l><li><strong>dr | ||
| 00037e00:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | 00037e00:·6166·743c·2f73·7472·6f6e·673e·0a20·2020··aft</strong>.··· | ||
| 00037e10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e20:·2028·6173·206f·6620·3230·323 | 00037e20:·2028·6173·206f·6620·3230·3235·2d30·322d···(as·of·2025-02- | ||
| 00037e30:·323 | 00037e30:·3233·290a·2020·2020·2020·2020·2020·2020··23).············ | ||
| 00037e40:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | 00037e40:·2020·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f······</li></ul></ | ||
| 00037e50:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | 00037e50:·6469·763e·3c68·323e·5461·626c·6520·6f66··div><h2>Table·of | ||
| 00037e60:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | 00037e60:·2043·6f6e·7465·6e74·733c·2f68·323e·3c6f···Contents</h2><o | ||
| 00037e70:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | 00037e70:·6c3e·3c6c·693e·3c61·2068·7265·663d·2223··l><li><a·href="# | ||
| 00037e80:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | 00037e80:·7863·6364·665f·6f72·672e·7373·6770·726f··xccdf_org.ssgpro | ||
| 00037e90:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | 00037e90:·6a65·6374·2e63·6f6e·7465·6e74·5f67·726f··ject.content_gro | ||
| 00037ea0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | 00037ea0:·7570·5f73·7973·7465·6d22·3e53·7973·7465··up_system">Syste | ||
| Offset 15272, 329 lines modified | Offset 15272, 329 lines modified | ||
| 0003ba70:·2d74·6172·6765·743d·2223·6964·6d37·3235··-target="#idm725 | 0003ba70:·2d74·6172·6765·743d·2223·6964·6d37·3235··-target="#idm725 | ||
| 0003ba80:·3022·2074·6162·696e·6465·783d·2230·2220··0"·tabindex="0"· | 0003ba80:·3022·2074·6162·696e·6465·783d·2230·2220··0"·tabindex="0"· | ||
| 0003ba90:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003ba90:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003baa0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003baa0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bab0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bab0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003bac0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003bac0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003bad0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003bad0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bae0:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003baf0:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003bb00:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bb10:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bb20:·7073·6522·2069·643d·2269·646d·3732·3530··pse"·id="idm7250 | |||
| 0003bb30:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bb40:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003bb50:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003bb60:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003bb70:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003bb80:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003bb90:·6869·6768·3c2f·7464·3e3c·2f74·723e·3c74··high</td></tr><t | |||
| 0003bba0:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003bbb0:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003bbc0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bbd0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bbe0:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003bbf0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003bc00:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003bc10:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003bc20:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003bc30:·7374·616c·6c20·636f·6d6d·616e·6420·2864··stall·command·(d | |||
| 0003bc40:·6e66·2927·0a20·2073·6574·5f66·6163·743a··nf)'.··set_fact: | |||
| 0003bc50:·0a20·2020·2070·6163·6b61·6765·5f6d·616e··.····package_man | |||
| 0003bc60:·6167·6572·5f72·6569·6e73·7461·6c6c·5f63··ager_reinstall_c | |||
| 0003bc70:·6d64·3a20·646e·6620·7265·696e·7374·616c··md:·dnf·reinstal | |||
| 0003bc80:·6c20·2d79·0a20·2077·6865·6e3a·2061·6e73··l·-y.··when:·ans | |||
| 0003bc90:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003bca0:·6e20·3d3d·2022·4665·646f·7261·220a·2020··n·==·"Fedora".·· | |||
| 0003bcb0:·7461·6773·3a0a·2020·2d20·4343·452d·3930··tags:.··-·CCE-90 | |||
| 0003bcc0:·3834·312d·380a·2020·2d20·434a·4953·2d35··841-8.··-·CJIS-5 | |||
| 0003bcd0:·2e31·302e·342e·310a·2020·2d20·4e49·5354··.10.4.1.··-·NIST | |||
| 0003bce0:·2d38·3030·2d31·3731·2d33·2e33·2e38·0a20··-800-171-3.3.8.· | |||
| 0003bcf0:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003bd00:·332e·342e·310a·2020·2d20·4e49·5354·2d38··3.4.1.··-·NIST-8 | |||
| 0003bd10:·3030·2d35·332d·4155·2d39·2833·290a·2020··00-53-AU-9(3).·· | |||
| 0003bd20:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003bd30:·2d36·2863·290a·2020·2d20·4e49·5354·2d38··-6(c).··-·NIST-8 | |||
| 0003bd40:·3030·2d35·332d·434d·2d36·2864·290a·2020··00-53-CM-6(d).·· | |||
| 0003bd50:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003bd60:·2d37·0a20·202d·204e·4953·542d·3830·302d··-7.··-·NIST-800- | |||
| 0003bd70:·3533·2d53·492d·3728·3129·0a20·202d·204e··53-SI-7(1).··-·N | |||
| 0003bd80:·4953·542d·3830·302d·3533·2d53·492d·3728··IST-800-53-SI-7( | |||
| 0003bd90:·3629·0a20·202d·2050·4349·2d44·5353·2d52··6).··-·PCI-DSS-R | |||
| 0003bda0:·6571·2d31·312e·350a·2020·2d20·6869·6768··eq-11.5.··-·high | |||
| 0003bdb0:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003bdc0:·6869·6768·5f73·6576·6572·6974·790a·2020··high_severity.·· | |||
| 0003bdd0:·2d20·6d65·6469·756d·5f64·6973·7275·7074··-·medium_disrupt | |||
| 0003bde0:·696f·6e0a·2020·2d20·6e6f·5f72·6562·6f6f··ion.··-·no_reboo | |||
| 0003bdf0:·745f·6e65·6564·6564·0a20·202d·2072·6573··t_needed.··-·res | |||
| 0003be00:·7472·6963·745f·7374·7261·7465·6779·0a20··trict_strategy.· | |||
| 0003b | 0003bae0:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003baf0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bb00:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bb10:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bb20:·2220·6964·3d22·6964·6d37·3235·3022·3e3c··"·id="idm7250">< | |||
| 0003bb30:·7072·653e·3c63·6f64·653e·0a23·2046·696e··pre><code>.#·Fin | |||
| 0003bb40:·6420·7768·6963·6820·6669·6c65·7320·6861··d·which·files·ha | |||
| 0003bb50:·7665·2069·6e63·6f72·7265·6374·2068·6173··ve·incorrect·has | |||
| 0003bb60:·6820·286e·6f74·2069·6e20·2f65·7463·2c20··h·(not·in·/etc,· | |||
| 0003bb70:·6265·6361·7573·6520·6f66·2074·6865·2073··because·of·the·s | |||
| 0003bb80:·7973·7465·6d20·7265·6c61·7465·6420·636f··ystem·related·co | |||
| 0003bb90:·6e66·6967·2066·696c·6573·2920·616e·6420··nfig·files)·and· | |||
| 0003bba0:·7468·656e·2067·6574·2066·696c·6573·206e··then·get·files·n | |||
| 0003bbb0:·616d·6573·0a66·696c·6573·5f77·6974·685f··ames.files_with_ | |||
| 0003bbc0:·696e·636f·7272·6563·745f·6861·7368·3d22··incorrect_hash=" | |||
| 0003bbd0:·2428·7270·6d20·2d56·6120·2d2d·6e6f·636f··$(rpm·-Va·--noco | |||
| 0003bbe0:·6e66·6967·207c·2067·7265·7020·2d45·2027··nfig·|·grep·-E·' | |||
| 0003bbf0:·5e2e·2e35·2720·7c20·6177·6b20·277b·7072··^..5'·|·awk·'{pr | |||
| 0003bc00:·696e·7420·244e·467d·2720·2922·0a0a·2320··int·$NF}'·)"..#· | |||
| 0003bc10:·4672·6f6d·2066·696c·6573·206e·616d·6573··From·files·names | |||
| 0003bc20:·2067·6574·2070·6163·6b61·6765·206e·616d···get·package·nam | |||
| 0003bc30:·6573·2061·6e64·2063·6861·6e67·6520·6e65··es·and·change·ne | |||
| 0003bc40:·776c·696e·6520·746f·2073·7061·6365·2c20··wline·to·space,· | |||
| 0003bc50:·6265·6361·7573·6520·7270·6d20·7772·6974··because·rpm·writ | |||
| 0003bc60:·6573·2065·6163·6820·7061·636b·6167·6520··es·each·package· | |||
| 0003bc70:·746f·206e·6577·206c·696e·650a·7061·636b··to·new·line.pack | |||
| 0003bc80:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003bc90:·6c3d·2224·2872·706d·202d·7166·2024·6669··l="$(rpm·-qf·$fi | |||
| 0003bca0:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003bcb0:·6374·5f68·6173·6820·7c20·7472·2027·5c6e··ct_hash·|·tr·'\n | |||
| 0003bcc0:·2720·2720·2729·220a·0a0a·646e·6620·7265··'·'·')"...dnf·re | |||
| 0003bcd0:·696e·7374·616c·6c20·2d79·2024·7061·636b··install·-y·$pack | |||
| 0003bce0:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003bcf0:·6c0a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··l.</code></pre>< | |||
| 0003bd00:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003bd10:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003bd20:·6461·7461·2d74·6f67·676c·653d·2263·6f6c··data-toggle="col | |||
| 0003bd30:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| 0003bd40:·6574·3d22·2369·646d·3732·3531·2220·7461··et="#idm7251"·ta | |||
| 0003bd50:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | |||
| 0003bd60:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | |||
| 0003bd70:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | |||
| 0003bd80:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | |||
| 0003bd90:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | |||
| 0003bda0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | |||
| 0003bdb0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003bdc0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003bdd0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003bde0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003bdf0:·6964·3d22·6964·6d37·3235·3122·3e3c·7461··id="idm7251"><ta | |||
| 0003be00:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003be10:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| Max diff block lines reached; 6271796/6317114 bytes (99.28%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | *****·Profile·Information·***** | 41 | *****·Profile·Information·***** |
| 42 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight | 42 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·Essential·Eight |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_e8 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:redhat:enterprise_linux:9 | 45 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·Configure_Syslog | 54 | ·········4.·Configure_Syslog |
| 55 | ·········5.·Network_Configuration_and_Firewalls | 55 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 88, 14 lines modified | Offset 88, 24 lines modified | ||
| 88 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 88 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 89 | $·sudo·rpm·-Uvh·PACKAGENAME | 89 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 90 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 90 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 91 | Severity: ················high | 91 | Severity: ················high |
| 92 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 92 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 93 | Identifiers·and·References·Identifiers: ·CCE-90841-8 | 93 | Identifiers·and·References·Identifiers: ·CCE-90841-8 |
| 94 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 94 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 95 | Remediation_Shell_script_⇲ | ||
| 96 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 97 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 98 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 99 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 100 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 95 | Remediation_Ansible_snippet_⇲ | 101 | Remediation_Ansible_snippet_⇲ |
| 96 | Complexity:·high | 102 | Complexity:·high |
| 97 | Disruption:·medium | 103 | Disruption:·medium |
| 98 | Strategy:···restrict | 104 | Strategy:···restrict |
| 99 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 105 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 100 | ··set_fact: | 106 | ··set_fact: |
| 101 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 107 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 245, 37 lines modified | Offset 255, 52 lines modified | ||
| 245 | ··-·PCI-DSS-Req-11.5 | 255 | ··-·PCI-DSS-Req-11.5 |
| 246 | ··-·high_complexity | 256 | ··-·high_complexity |
| 247 | ··-·high_severity | 257 | ··-·high_severity |
| 248 | ··-·medium_disruption | 258 | ··-·medium_disruption |
| 249 | ··-·no_reboot_needed | 259 | ··-·no_reboot_needed |
| 250 | ··-·restrict_strategy | 260 | ··-·restrict_strategy |
| 251 | ··-·rpm_verify_hashes | 261 | ··-·rpm_verify_hashes |
| 252 | Remediation_Shell_script_⇲ | ||
| 253 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 254 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 255 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 256 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 257 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 258 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 262 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 259 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 263 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 260 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 264 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 261 | run·the·following·command·to·determine·which·package·owns·it: | 265 | run·the·following·command·to·determine·which·package·owns·it: |
| 262 | $·rpm·-qf·FILENAME | 266 | $·rpm·-qf·FILENAME |
| 263 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 267 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 264 | $·sudo·rpm·--setugids·PACKAGENAME | 268 | $·sudo·rpm·--setugids·PACKAGENAME |
| 265 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 269 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 266 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 270 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 267 | Severity: ················high | 271 | Severity: ················high |
| 268 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 272 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 269 | Identifiers·and·References·Identifiers: ·CCE-90842-6 | 273 | Identifiers·and·References·Identifiers: ·CCE-90842-6 |
| 270 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 274 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 275 | Remediation_Shell_script_⇲ | ||
| 276 | Complexity:·high | ||
| 277 | Disruption:·medium | ||
| 278 | Strategy:···restrict | ||
| 279 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 280 | declare·-A·SETPERMS_RPM_DICT | ||
| 281 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 282 | #·is·expected·by·the·RPM·database | ||
| 283 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 284 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 285 | do | ||
| 286 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 287 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 288 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 289 | done | ||
| 290 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 291 | #·correct·values | ||
| 292 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 293 | do | ||
| 294 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 295 | done | ||
| 271 | Remediation_Ansible_snippet_⇲ | 296 | Remediation_Ansible_snippet_⇲ |
| 272 | Complexity:·high | 297 | Complexity:·high |
| 273 | Disruption:·medium | 298 | Disruption:·medium |
| 274 | Strategy:···restrict | 299 | Strategy:···restrict |
| 275 | -·name:·Read·list·of·files·with·incorrect·ownership | 300 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 276 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 301 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 277 | ····--nocaps·--nolinkto·--nomode | 302 | ····--nocaps·--nolinkto·--nomode |
| Offset 349, 53 lines modified | Offset 374, 57 lines modified | ||
| 349 | ··-·PCI-DSS-Req-11.5 | 374 | ··-·PCI-DSS-Req-11.5 |
| 350 | ··-·high_complexity | 375 | ··-·high_complexity |
| 351 | ··-·high_severity | 376 | ··-·high_severity |
| 352 | ··-·medium_disruption | 377 | ··-·medium_disruption |
| 353 | ··-·no_reboot_needed | 378 | ··-·no_reboot_needed |
| 354 | ··-·restrict_strategy | 379 | ··-·restrict_strategy |
| 355 | ··-·rpm_verify_ownership | 380 | ··-·rpm_verify_ownership |
| 381 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 382 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 383 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 384 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 385 | $·rpm·-qf·FILENAME | ||
| 386 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 387 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 388 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 389 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 390 | Severity: ················high | ||
| 391 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 392 | Identifiers·and·References·Identifiers: ·CCE-90840-0 | ||
| 393 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 356 | Remediation_Shell_script_⇲ | 394 | Remediation_Shell_script_⇲ |
| 357 | Complexity:·high | 395 | Complexity:·high |
| Max diff block lines reached; 725463/734725 bytes (98.74%) of diff not shown. | |||
| Offset 14320, 15 lines modified | Offset 14320, 15 lines modified | ||
| 00037ef0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037ef0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037f00:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037f00:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037f10:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037f10:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037f20:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037f20:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037f30:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037f30:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037f40:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037f40:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037f50:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037f50:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037f60:·206f·6620·3230·323 | 00037f60:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037f70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037f70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037f80:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037f80:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037f90:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037f90:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037fa0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037fa0:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037fb0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037fb0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037fc0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037fc0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037fd0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037fd0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15293, 329 lines modified | Offset 15293, 329 lines modified | ||
| 0003bbc0:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | 0003bbc0:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | ||
| 0003bbd0:·3530·2220·7461·6269·6e64·6578·3d22·3022··50"·tabindex="0" | 0003bbd0:·3530·2220·7461·6269·6e64·6578·3d22·3022··50"·tabindex="0" | ||
| 0003bbe0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003bbe0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003bbf0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003bbf0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003bc00:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003bc00:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003bc10:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003bc10:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003bc20:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003bc20:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003bc30:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | |||
| 0003bc40:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003bc50:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003bc60:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003bc70:·6522·2069·643d·2269·646d·3732·3530·223e··e"·id="idm7250"> | |||
| 0003bc80:·3c70·7265·3e3c·636f·6465·3e0a·2320·4669··<pre><code>.#·Fi | |||
| 0003bc90:·6e64·2077·6869·6368·2066·696c·6573·2068··nd·which·files·h | |||
| 0003bca0:·6176·6520·696e·636f·7272·6563·7420·6861··ave·incorrect·ha | |||
| 0003bcb0:·7368·2028·6e6f·7420·696e·202f·6574·632c··sh·(not·in·/etc, | |||
| 0003bcc0:·2062·6563·6175·7365·206f·6620·7468·6520···because·of·the· | |||
| 0003bcd0:·7379·7374·656d·2072·656c·6174·6564·2063··system·related·c | |||
| 0003bce0:·6f6e·6669·6720·6669·6c65·7329·2061·6e64··onfig·files)·and | |||
| 0003bcf0:·2074·6865·6e20·6765·7420·6669·6c65·7320···then·get·files· | |||
| 0003bd00:·6e61·6d65·730a·6669·6c65·735f·7769·7468··names.files_with | |||
| 0003bd10:·5f69·6e63·6f72·7265·6374·5f68·6173·683d··_incorrect_hash= | |||
| 0003bd20:·2224·2872·706d·202d·5661·202d·2d6e·6f63··"$(rpm·-Va·--noc | |||
| 0003bd30:·6f6e·6669·6720·7c20·6772·6570·202d·4520··onfig·|·grep·-E· | |||
| 0003bd40:·275e·2e2e·3527·207c·2061·776b·2027·7b70··'^..5'·|·awk·'{p | |||
| 0003bd50:·7269·6e74·2024·4e46·7d27·2029·220a·0a23··rint·$NF}'·)"..# | |||
| 0003bd60:·2046·726f·6d20·6669·6c65·7320·6e61·6d65···From·files·name | |||
| 0003bd70:·7320·6765·7420·7061·636b·6167·6520·6e61··s·get·package·na | |||
| 0003bd80:·6d65·7320·616e·6420·6368·616e·6765·206e··mes·and·change·n | |||
| 0003bd90:·6577·6c69·6e65·2074·6f20·7370·6163·652c··ewline·to·space, | |||
| 0003bda0:·2062·6563·6175·7365·2072·706d·2077·7269···because·rpm·wri | |||
| 0003bdb0:·7465·7320·6561·6368·2070·6163·6b61·6765··tes·each·package | |||
| 0003bdc0:·2074·6f20·6e65·7720·6c69·6e65·0a70·6163···to·new·line.pac | |||
| 0003bdd0:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003bde0:·6c6c·3d22·2428·7270·6d20·2d71·6620·2466··ll="$(rpm·-qf·$f | |||
| 0003bdf0:·696c·6573·5f77·6974·685f·696e·636f·7272··iles_with_incorr | |||
| 0003be00:·6563·745f·6861·7368·207c·2074·7220·275c··ect_hash·|·tr·'\ | |||
| 0003be10:·6e27·2027·2027·2922·0a0a·0a64·6e66·2072··n'·'·')"...dnf·r | |||
| 0003be20:·6569·6e73·7461·6c6c·202d·7920·2470·6163··einstall·-y·$pac | |||
| 0003be30:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003be40:·6c6c·0a3c·2f63·6f64·653e·3c2f·7072·653e··ll.</code></pre> | |||
| 0003be50:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003be60:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003be70:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003be80:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003be90:·6765·743d·2223·6964·6d37·3235·3122·2074··get="#idm7251"·t | |||
| 0003bea0:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003beb0:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003bec0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003bed0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003bee0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003bef0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003bf00:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003bf10:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bf20:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bf30:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bf40:·2069·643d·2269·646d·3732·3531·223e·3c74···id="idm7251"><t | |||
| 0003bf50:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bf60:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bf70:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bf80:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003bf90:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003bfa0:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003bfb0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bfc0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bfd0:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003bfe0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003bff0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c000:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003c010:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c020:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003bc30:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003bc40:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003bc50:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bc60:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bc70:·6170·7365·2220·6964·3d22·6964·6d37·3235··apse"·id="idm725 | |||
| 0003bc80:·3022·3e3c·7461·626c·6520·636c·6173·733d··0"><table·class= | |||
| 0003bc90:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003bca0:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003bcb0:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003bcc0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003bcd0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003bce0:·3e68·6967·683c·2f74·643e·3c2f·7472·3e3c··>high</td></tr>< | |||
| 0003bcf0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003bd00:·6e3a·3c2f·7468·3e3c·7464·3e6d·6564·6975··n:</th><td>mediu | |||
| 0003bd10:·6d3c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··m</td></tr><tr>< | |||
| 0003bd20:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bd30:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003bd40:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003bd50:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003bd60:·3a20·2753·6574·2066·6163·743a·2050·6163··:·'Set·fact:·Pac | |||
| 0003bd70:·6b61·6765·206d·616e·6167·6572·2072·6569··kage·manager·rei | |||
| 0003bd80:·6e73·7461·6c6c·2063·6f6d·6d61·6e64·2028··nstall·command·( | |||
| 0003bd90:·646e·6629·270a·2020·7365·745f·6661·6374··dnf)'.··set_fact | |||
| 0003bda0:·3a0a·2020·2020·7061·636b·6167·655f·6d61··:.····package_ma | |||
| 0003bdb0:·6e61·6765·725f·7265·696e·7374·616c·6c5f··nager_reinstall_ | |||
| 0003bdc0:·636d·643a·2064·6e66·2072·6569·6e73·7461··cmd:·dnf·reinsta | |||
| 0003bdd0:·6c6c·202d·790a·2020·7768·656e·3a20·616e··ll·-y.··when:·an | |||
| 0003bde0:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003bdf0:·6f6e·203d·3d20·2246·6564·6f72·6122·0a20··on·==·"Fedora".· | |||
| 0003be00:·2074·6167·733a·0a20·202d·2043·4345·2d39···tags:.··-·CCE-9 | |||
| 0003be10:·3038·3431·2d38·0a20·202d·2043·4a49·532d··0841-8.··-·CJIS- | |||
| 0003be20:·352e·3130·2e34·2e31·0a20·202d·204e·4953··5.10.4.1.··-·NIS | |||
| 0003be30:·542d·3830·302d·3137·312d·332e·332e·380a··T-800-171-3.3.8. | |||
| 0003be40:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003be50:·2d33·2e34·2e31·0a20·202d·204e·4953·542d··-3.4.1.··-·NIST- | |||
| 0003be60:·3830·302d·3533·2d41·552d·3928·3329·0a20··800-53-AU-9(3).· | |||
| 0003be70:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003be80:·4d2d·3628·6329·0a20·202d·204e·4953·542d··M-6(c).··-·NIST- | |||
| 0003be90:·3830·302d·3533·2d43·4d2d·3628·6429·0a20··800-53-CM-6(d).· | |||
| 0003bea0:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| Max diff block lines reached; 16941806/16986986 bytes (99.73%) of diff not shown. | |||
| Offset 14313, 15 lines modified | Offset 14313, 15 lines modified | ||
| 00037e80:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037e80:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037e90:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037e90:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037ea0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037ea0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037eb0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037eb0:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037ec0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037ec0:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037ed0:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037ed0:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037ee0:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037ee0:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037ef0:·206f·6620·3230·323 | 00037ef0:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037f00:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037f10:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037f10:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037f20:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037f20:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037f30:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037f30:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037f40:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037f40:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037f50:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037f50:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037f60:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037f60:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15300, 329 lines modified | Offset 15300, 329 lines modified | ||
| 0003bc30:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | 0003bc30:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | ||
| 0003bc40:·3530·2220·7461·6269·6e64·6578·3d22·3022··50"·tabindex="0" | 0003bc40:·3530·2220·7461·6269·6e64·6578·3d22·3022··50"·tabindex="0" | ||
| 0003bc50:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003bc50:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003bc60:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003bc60:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003bc70:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003bc70:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003bc80:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003bc80:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003bc90:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003bc90:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003bca0:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | |||
| 0003bcb0:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003bcc0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003bcd0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003bce0:·6522·2069·643d·2269·646d·3732·3530·223e··e"·id="idm7250"> | |||
| 0003bcf0:·3c70·7265·3e3c·636f·6465·3e0a·2320·4669··<pre><code>.#·Fi | |||
| 0003bd00:·6e64·2077·6869·6368·2066·696c·6573·2068··nd·which·files·h | |||
| 0003bd10:·6176·6520·696e·636f·7272·6563·7420·6861··ave·incorrect·ha | |||
| 0003bd20:·7368·2028·6e6f·7420·696e·202f·6574·632c··sh·(not·in·/etc, | |||
| 0003bd30:·2062·6563·6175·7365·206f·6620·7468·6520···because·of·the· | |||
| 0003bd40:·7379·7374·656d·2072·656c·6174·6564·2063··system·related·c | |||
| 0003bd50:·6f6e·6669·6720·6669·6c65·7329·2061·6e64··onfig·files)·and | |||
| 0003bd60:·2074·6865·6e20·6765·7420·6669·6c65·7320···then·get·files· | |||
| 0003bd70:·6e61·6d65·730a·6669·6c65·735f·7769·7468··names.files_with | |||
| 0003bd80:·5f69·6e63·6f72·7265·6374·5f68·6173·683d··_incorrect_hash= | |||
| 0003bd90:·2224·2872·706d·202d·5661·202d·2d6e·6f63··"$(rpm·-Va·--noc | |||
| 0003bda0:·6f6e·6669·6720·7c20·6772·6570·202d·4520··onfig·|·grep·-E· | |||
| 0003bdb0:·275e·2e2e·3527·207c·2061·776b·2027·7b70··'^..5'·|·awk·'{p | |||
| 0003bdc0:·7269·6e74·2024·4e46·7d27·2029·220a·0a23··rint·$NF}'·)"..# | |||
| 0003bdd0:·2046·726f·6d20·6669·6c65·7320·6e61·6d65···From·files·name | |||
| 0003bde0:·7320·6765·7420·7061·636b·6167·6520·6e61··s·get·package·na | |||
| 0003bdf0:·6d65·7320·616e·6420·6368·616e·6765·206e··mes·and·change·n | |||
| 0003be00:·6577·6c69·6e65·2074·6f20·7370·6163·652c··ewline·to·space, | |||
| 0003be10:·2062·6563·6175·7365·2072·706d·2077·7269···because·rpm·wri | |||
| 0003be20:·7465·7320·6561·6368·2070·6163·6b61·6765··tes·each·package | |||
| 0003be30:·2074·6f20·6e65·7720·6c69·6e65·0a70·6163···to·new·line.pac | |||
| 0003be40:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003be50:·6c6c·3d22·2428·7270·6d20·2d71·6620·2466··ll="$(rpm·-qf·$f | |||
| 0003be60:·696c·6573·5f77·6974·685f·696e·636f·7272··iles_with_incorr | |||
| 0003be70:·6563·745f·6861·7368·207c·2074·7220·275c··ect_hash·|·tr·'\ | |||
| 0003be80:·6e27·2027·2027·2922·0a0a·0a64·6e66·2072··n'·'·')"...dnf·r | |||
| 0003be90:·6569·6e73·7461·6c6c·202d·7920·2470·6163··einstall·-y·$pac | |||
| 0003bea0:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003beb0:·6c6c·0a3c·2f63·6f64·653e·3c2f·7072·653e··ll.</code></pre> | |||
| 0003bec0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003bed0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003bee0:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003bef0:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003bf00:·6765·743d·2223·6964·6d37·3235·3122·2074··get="#idm7251"·t | |||
| 0003bf10:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003bf20:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003bf30:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003bf40:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003bf50:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003bf60:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003bf70:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003bf80:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bf90:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bfa0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bfb0:·2069·643d·2269·646d·3732·3531·223e·3c74···id="idm7251"><t | |||
| 0003bfc0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bfd0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bfe0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bff0:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c000:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c010:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003c020:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c030:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c040:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003c050:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c060:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c070:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003c080:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c090:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003bca0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003bcb0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003bcc0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bcd0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bce0:·6170·7365·2220·6964·3d22·6964·6d37·3235··apse"·id="idm725 | |||
| 0003bcf0:·3022·3e3c·7461·626c·6520·636c·6173·733d··0"><table·class= | |||
| 0003bd00:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003bd10:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003bd20:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003bd30:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003bd40:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003bd50:·3e68·6967·683c·2f74·643e·3c2f·7472·3e3c··>high</td></tr>< | |||
| 0003bd60:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003bd70:·6e3a·3c2f·7468·3e3c·7464·3e6d·6564·6975··n:</th><td>mediu | |||
| 0003bd80:·6d3c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··m</td></tr><tr>< | |||
| 0003bd90:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bda0:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003bdb0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003bdc0:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003bdd0:·3a20·2753·6574·2066·6163·743a·2050·6163··:·'Set·fact:·Pac | |||
| 0003bde0:·6b61·6765·206d·616e·6167·6572·2072·6569··kage·manager·rei | |||
| 0003bdf0:·6e73·7461·6c6c·2063·6f6d·6d61·6e64·2028··nstall·command·( | |||
| 0003be00:·646e·6629·270a·2020·7365·745f·6661·6374··dnf)'.··set_fact | |||
| 0003be10:·3a0a·2020·2020·7061·636b·6167·655f·6d61··:.····package_ma | |||
| 0003be20:·6e61·6765·725f·7265·696e·7374·616c·6c5f··nager_reinstall_ | |||
| 0003be30:·636d·643a·2064·6e66·2072·6569·6e73·7461··cmd:·dnf·reinsta | |||
| 0003be40:·6c6c·202d·790a·2020·7768·656e·3a20·616e··ll·-y.··when:·an | |||
| 0003be50:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003be60:·6f6e·203d·3d20·2246·6564·6f72·6122·0a20··on·==·"Fedora".· | |||
| 0003be70:·2074·6167·733a·0a20·202d·2043·4345·2d39···tags:.··-·CCE-9 | |||
| 0003be80:·3038·3431·2d38·0a20·202d·2043·4a49·532d··0841-8.··-·CJIS- | |||
| 0003be90:·352e·3130·2e34·2e31·0a20·202d·204e·4953··5.10.4.1.··-·NIS | |||
| 0003bea0:·542d·3830·302d·3137·312d·332e·332e·380a··T-800-171-3.3.8. | |||
| 0003beb0:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003bec0:·2d33·2e34·2e31·0a20·202d·204e·4953·542d··-3.4.1.··-·NIST- | |||
| 0003bed0:·3830·302d·3533·2d41·552d·3928·3329·0a20··800-53-AU-9(3).· | |||
| 0003bee0:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003bef0:·4d2d·3628·6329·0a20·202d·204e·4953·542d··M-6(c).··-·NIST- | |||
| 0003bf00:·3830·302d·3533·2d43·4d2d·3628·6429·0a20··800-53-CM-6(d).· | |||
| 0003bf10:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| Max diff block lines reached; 9064093/9109273 bytes (99.50%) of diff not shown. | |||
| Offset 44, 15 lines modified | Offset 44, 15 lines modified | ||
| 44 | *****·Profile·Information·***** | 44 | *****·Profile·Information·***** |
| 45 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·ISM·Official | 45 | Profile·Title·Australian·Cyber·Security·Centre·(ACSC)·ISM·Official |
| 46 | Profile·ID····xccdf_org.ssgproject.content_profile_ism_o | 46 | Profile·ID····xccdf_org.ssgproject.content_profile_ism_o |
| 47 | ***·CPE·Platforms·*** | 47 | ***·CPE·Platforms·*** |
| 48 | ····*·cpe:/o:redhat:enterprise_linux:9 | 48 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 49 | *****·Revision·History·***** | 49 | *****·Revision·History·***** |
| 50 | Current·version:·0.1.65 | 50 | Current·version:·0.1.65 |
| 51 | ····*·draft·(as·of·202 | 51 | ····*·draft·(as·of·2025-02-23) |
| 52 | *****·Table·of·Contents·***** | 52 | *****·Table·of·Contents·***** |
| 53 | ···1.·System_Settings | 53 | ···1.·System_Settings |
| 54 | ·········1.·Installing_and_Maintaining_Software | 54 | ·········1.·Installing_and_Maintaining_Software |
| 55 | ·········2.·Account_and_Access_Control | 55 | ·········2.·Account_and_Access_Control |
| 56 | ·········3.·System_Accounting_with_auditd | 56 | ·········3.·System_Accounting_with_auditd |
| 57 | ·········4.·Configure_Syslog | 57 | ·········4.·Configure_Syslog |
| 58 | ·········5.·Network_Configuration_and_Firewalls | 58 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 94, 14 lines modified | Offset 94, 24 lines modified | ||
| 94 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 94 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 95 | $·sudo·rpm·-Uvh·PACKAGENAME | 95 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 96 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 96 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 97 | Severity: ················high | 97 | Severity: ················high |
| 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 98 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 99 | Identifiers·and·References·Identifiers: ·CCE-90841-8 | 99 | Identifiers·and·References·Identifiers: ·CCE-90841-8 |
| 100 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 100 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 101 | Remediation_Shell_script_⇲ | ||
| 102 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 103 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 104 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 105 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 106 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 101 | Remediation_Ansible_snippet_⇲ | 107 | Remediation_Ansible_snippet_⇲ |
| 102 | Complexity:·high | 108 | Complexity:·high |
| 103 | Disruption:·medium | 109 | Disruption:·medium |
| 104 | Strategy:···restrict | 110 | Strategy:···restrict |
| 105 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 111 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 106 | ··set_fact: | 112 | ··set_fact: |
| 107 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 113 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 251, 37 lines modified | Offset 261, 52 lines modified | ||
| 251 | ··-·PCI-DSS-Req-11.5 | 261 | ··-·PCI-DSS-Req-11.5 |
| 252 | ··-·high_complexity | 262 | ··-·high_complexity |
| 253 | ··-·high_severity | 263 | ··-·high_severity |
| 254 | ··-·medium_disruption | 264 | ··-·medium_disruption |
| 255 | ··-·no_reboot_needed | 265 | ··-·no_reboot_needed |
| 256 | ··-·restrict_strategy | 266 | ··-·restrict_strategy |
| 257 | ··-·rpm_verify_hashes | 267 | ··-·rpm_verify_hashes |
| 258 | Remediation_Shell_script_⇲ | ||
| 259 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 260 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 261 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 262 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 263 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 264 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 268 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 265 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 269 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 266 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 270 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 267 | run·the·following·command·to·determine·which·package·owns·it: | 271 | run·the·following·command·to·determine·which·package·owns·it: |
| 268 | $·rpm·-qf·FILENAME | 272 | $·rpm·-qf·FILENAME |
| 269 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 273 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 270 | $·sudo·rpm·--setugids·PACKAGENAME | 274 | $·sudo·rpm·--setugids·PACKAGENAME |
| 271 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 275 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 272 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 276 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 273 | Severity: ················high | 277 | Severity: ················high |
| 274 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 278 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 275 | Identifiers·and·References·Identifiers: ·CCE-90842-6 | 279 | Identifiers·and·References·Identifiers: ·CCE-90842-6 |
| 276 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 280 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 281 | Remediation_Shell_script_⇲ | ||
| 282 | Complexity:·high | ||
| 283 | Disruption:·medium | ||
| 284 | Strategy:···restrict | ||
| 285 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 286 | declare·-A·SETPERMS_RPM_DICT | ||
| 287 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 288 | #·is·expected·by·the·RPM·database | ||
| 289 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 290 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 291 | do | ||
| 292 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 293 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 294 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 295 | done | ||
| 296 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 297 | #·correct·values | ||
| 298 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 299 | do | ||
| 300 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 301 | done | ||
| 277 | Remediation_Ansible_snippet_⇲ | 302 | Remediation_Ansible_snippet_⇲ |
| 278 | Complexity:·high | 303 | Complexity:·high |
| 279 | Disruption:·medium | 304 | Disruption:·medium |
| 280 | Strategy:···restrict | 305 | Strategy:···restrict |
| 281 | -·name:·Read·list·of·files·with·incorrect·ownership | 306 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 282 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 307 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 283 | ····--nocaps·--nolinkto·--nomode | 308 | ····--nocaps·--nolinkto·--nomode |
| Offset 355, 53 lines modified | Offset 380, 57 lines modified | ||
| 355 | ··-·PCI-DSS-Req-11.5 | 380 | ··-·PCI-DSS-Req-11.5 |
| 356 | ··-·high_complexity | 381 | ··-·high_complexity |
| 357 | ··-·high_severity | 382 | ··-·high_severity |
| 358 | ··-·medium_disruption | 383 | ··-·medium_disruption |
| 359 | ··-·no_reboot_needed | 384 | ··-·no_reboot_needed |
| 360 | ··-·restrict_strategy | 385 | ··-·restrict_strategy |
| 361 | ··-·rpm_verify_ownership | 386 | ··-·rpm_verify_ownership |
| 387 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 388 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 389 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 390 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 391 | $·rpm·-qf·FILENAME | ||
| 392 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 393 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 394 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 395 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 396 | Severity: ················high | ||
| 397 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 398 | Identifiers·and·References·Identifiers: ·CCE-90840-0 | ||
| 399 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 362 | Remediation_Shell_script_⇲ | 400 | Remediation_Shell_script_⇲ |
| 363 | Complexity:·high | 401 | Complexity:·high |
| Max diff block lines reached; 1015211/1024473 bytes (99.10%) of diff not shown. | |||
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | 00037dd0:·2048·6973·746f·7279·3c2f·6832·3e3c·703e···History</h2><p> | ||
| 00037de0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | 00037de0:·4375·7272·656e·7420·7665·7273·696f·6e3a··Current·version: | ||
| 00037df0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | 00037df0:·203c·7374·726f·6e67·3e30·2e31·2e36·353c···<strong>0.1.65< | ||
| 00037e00:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | 00037e00:·2f73·7472·6f6e·673e·3c2f·703e·3c75·6c3e··/strong></p><ul> | ||
| 00037e10:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | 00037e10:·3c6c·693e·3c73·7472·6f6e·673e·6472·6166··<li><strong>draf | ||
| 00037e20:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | 00037e20:·743c·2f73·7472·6f6e·673e·0a20·2020·2020··t</strong>.····· | ||
| 00037e30:·2020·2020·2020·2020·2020·2020·2020·2028·················( | 00037e30:·2020·2020·2020·2020·2020·2020·2020·2028·················( | ||
| 00037e40:·6173·206f·6620·3230·323 | 00037e40:·6173·206f·6620·3230·3235·2d30·322d·3233··as·of·2025-02-23 | ||
| 00037e50:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | 00037e50:·290a·2020·2020·2020·2020·2020·2020·2020··).·············· | ||
| 00037e60:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | 00037e60:·2020·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469····</li></ul></di | ||
| 00037e70:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | 00037e70:·763e·3c68·323e·5461·626c·6520·6f66·2043··v><h2>Table·of·C | ||
| 00037e80:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | 00037e80:·6f6e·7465·6e74·733c·2f68·323e·3c6f·6c3e··ontents</h2><ol> | ||
| 00037e90:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | 00037e90:·3c6c·693e·3c61·2068·7265·663d·2223·7863··<li><a·href="#xc | ||
| 00037ea0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | 00037ea0:·6364·665f·6f72·672e·7373·6770·726f·6a65··cdf_org.ssgproje | ||
| 00037eb0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | 00037eb0:·6374·2e63·6f6e·7465·6e74·5f67·726f·7570··ct.content_group | ||
| Offset 15069, 178 lines modified | Offset 15069, 178 lines modified | ||
| 0003adc0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | 0003adc0:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| 0003add0:·646d·3830·3738·2220·7461·6269·6e64·6578··dm8078"·tabindex | 0003add0:·646d·3830·3738·2220·7461·6269·6e64·6578··dm8078"·tabindex | ||
| 0003ade0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | 0003ade0:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | ||
| 0003adf0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | 0003adf0:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | ||
| 0003ae00:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | 0003ae00:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | ||
| 0003ae10:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | 0003ae10:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | ||
| 0003ae20:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | 0003ae20:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | ||
| 0003ae30:·6d65·6469·6174·696f·6e20· | 0003ae30:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | ||
| 0003ae40:·7363·7269·7074·20e2·87b2·3c2f·613e·3c62··script·...</a><b | |||
| 0003ae50:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003ae60:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003ae70:·6c61·7073·6522·2069·643d·2269·646d·3830··lapse"·id="idm80 | |||
| 0003ae80:·3738·223e·3c70·7265·3e3c·636f·6465·3e23··78"><pre><code># | |||
| 0003ae90:·2052·656d·6564·6961·7469·6f6e·2069·7320···Remediation·is· | |||
| 0003aea0:·6170·706c·6963·6162·6c65·206f·6e6c·7920··applicable·only· | |||
| 0003aeb0:·696e·2063·6572·7461·696e·2070·6c61·7466··in·certain·platf | |||
| 0003aec0:·6f72·6d73·0a69·6620·5b20·2120·2d66·202f··orms.if·[·!·-f·/ | |||
| 0003aed0:·2e64·6f63·6b65·7265·6e76·205d·2026·616d··.dockerenv·]·&am | |||
| 0003aee0:·703b·2661·6d70·3b20·5b20·2120·2d66·202f··p;&·[·!·-f·/ | |||
| 0003aef0:·7275·6e2f·2e63·6f6e·7461·696e·6572·656e··run/.containeren | |||
| 0003af00:·7620·5d3b·2074·6865·6e0a·0a66·6970·732d··v·];·then..fips- | |||
| 0003ae40:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003ae50:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003ae60:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003ae70:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003ae80:·6d38·3037·3822·3e3c·7461·626c·6520·636c··m8078"><table·cl | |||
| 0003ae90:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003aea0:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003aeb0:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003aec0:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003aed0:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003aee0:·3e3c·7464·3e6d·6564·6975·6d3c·2f74·643e··><td>medium</td> | |||
| 0003aef0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003af00:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003af10:·3e6d·6564·6975·6d3c·2f74·643e·3c2f·7472··>medium</td></tr | |||
| 0003af20:·3e3c·7472·3e3c·7468·3e52·6562·6f6f·743a··><tr><th>Reboot: | |||
| 0003af30:·3c2f·7468·3e3c·7464·3e74·7275·653c·2f74··</th><td>true</t | |||
| 0003af40:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003af50:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003af60:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003af70:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003af80:·3c63·6f64·653e·2d20·6e61·6d65·3a20·4368··<code>-·name:·Ch | |||
| 0003af90:·6563·6b20·746f·2073·6565·2074·6865·2063··eck·to·see·the·c | |||
| 0003afa0:·7572·7265·6e74·2073·7461·7475·7320·6f66··urrent·status·of | |||
| 0003afb0:·2046·4950·5320·6d6f·6465·0a20·2063·6f6d···FIPS·mode.··com | |||
| 0003afc0:·6d61·6e64·3a20·2f75·7372·2f62·696e·2f66··mand:·/usr/bin/f | |||
| 0003af | 0003af10:·6d6f·6465·2d73·6574·7570·202d·2d65·6e61··mode-setup·--ena | ||
| 0003afe0:·2d63·6865·636b·0a20·2072·6567·6973·7465··-check.··registe | |||
| 0003aff0:·723a·2069·735f·6669·7073·5f65·6e61·626c··r:·is_fips_enabl | |||
| 0003b000:·6564·0a20·2063·6861·6e67·6564·5f77·6865··ed.··changed_whe | |||
| 0003b010:·6e3a·2066·616c·7365·0a20·2066·6169·6c65··n:·false.··faile | |||
| 0003b020:·645f·7768·656e·3a20·6661·6c73·650a·2020··d_when:·false.·· | |||
| 0003b030:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003b040:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003b050:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003b060:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003b070:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003 | 0003af20:·626c·650a·4649·5053·5f43·4f4e·463d·222f··ble.FIPS_CONF="/ | ||
| 0003af30:·6574·632f·6472·6163·7574·2e63·6f6e·662e··etc/dracut.conf. | |||
| 0003af40:·642f·3430·2d66·6970·732e·636f·6e66·220a··d/40-fips.conf". | |||
| 0003af50:·6966·2021·2067·7265·7020·225e·6164·645f··if·!·grep·"^add_ | |||
| 0003af60:·6472·6163·7574·6d6f·6475·6c65·732b·3d5c··dracutmodules+=\ | |||
| 0003af70:·2220·6669·7073·205c·2222·2024·4649·5053··"·fips·\""·$FIPS | |||
| 0003af80:·5f43·4f4e·463b·2074·6865·6e0a·2020·2020··_CONF;·then.···· | |||
| 0003af90:·6563·686f·2022·6164·645f·6472·6163·7574··echo·"add_dracut | |||
| 0003afa0:·6d6f·6475·6c65·732b·3d5c·2220·6669·7073··modules+=\"·fips | |||
| 0003afb0:·205c·2222·2026·6774·3b26·6774·3b20·2446···\""·>>·$F | |||
| 0003afc0:·4950·535f·434f·4e46·0a66·690a·0a65·6c73··IPS_CONF.fi..els | |||
| 0003afd0:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003afe0:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003aff0:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003b000:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003b010:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003b020:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003b030:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003b040:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003b050:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003b060:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003b070:·6d38·3037·3922·2074·6162·696e·6465·783d··m8079"·tabindex= | |||
| 0003b080:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003b090:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003b0a0:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003b0b0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003b0c0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003b0d0:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b0e0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b0f0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b100:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b110:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b120:·3830·3739·223e·3c74·6162·6c65·2063·6c61··8079"><table·cla | |||
| 0003b130:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b140:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b150:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b160:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b170:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003b180:·3c74·643e·6d65·6469·756d·3c2f·7464·3e3c··<td>medium</td>< | |||
| 0003b190:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003b1a0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003b1b0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003b1c0:·3c74·723e·3c74·683e·5265·626f·6f74·3a3c··<tr><th>Reboot:< | |||
| 0003b1d0:·2f74·683e·3c74·643e·7472·7565·3c2f·7464··/th><td>true</td | |||
| 0003b1e0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003b1f0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003b200:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003b210:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003b220:·636f·6465·3e2d·206e·616d·653a·2043·6865··code>-·name:·Che | |||
| 0003b230:·636b·2074·6f20·7365·6520·7468·6520·6375··ck·to·see·the·cu | |||
| 0003b240:·7272·656e·7420·7374·6174·7573·206f·6620··rrent·status·of· | |||
| 0003b250:·4649·5053·206d·6f64·650a·2020·636f·6d6d··FIPS·mode.··comm | |||
| 0003b260:·616e·643a·202f·7573·722f·6269·6e2f·6669··and:·/usr/bin/fi | |||
| 0003b270:·7073·2d6d·6f64·652d·7365·7475·7020·2d2d··ps-mode-setup·-- | |||
| Max diff block lines reached; 5893201/5917543 bytes (99.59%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | *****·Profile·Information·***** | 41 | *****·Profile·Information·***** |
| 42 | Profile·Title·Protection·Profile·for·General·Purpose·Operating·Systems | 42 | Profile·Title·Protection·Profile·for·General·Purpose·Operating·Systems |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_ospp |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:redhat:enterprise_linux:9 | 45 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·GRUB2_bootloader_configuration | 54 | ·········4.·GRUB2_bootloader_configuration |
| 55 | ·········5.·zIPL_bootloader_configuration | 55 | ·········5.·zIPL_bootloader_configuration |
| Offset 83, 14 lines modified | Offset 83, 27 lines modified | ||
| 83 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. | 83 | Warning: ·The·system·needs·to·be·rebooted·for·these·changes·to·take·effect. |
| 84 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. | 84 | Warning: ·System·Crypto·Modules·must·be·provided·by·a·vendor·that·undergoes·FIPS-140·certifications.·FIPS-140·is·applicable·to·all·Federal·agencies·that·use·cryptographic-based·security·systems·to·protect·sensitive·information·in·computer·and·telecommunication·systems·(including·voice·systems)·as·defined·in·Section·5131·of·the·Information·Technology·Management·Reform·Act·of·1996,·Public·Law·104-106.·This·standard·shall·be·used·in·designing·and·implementing·cryptographic·modules·that·Federal·departments·and·agencies·operate·or·are·operated·for·them·under·contract.·See·https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf·To·meet·this,·the·system·has·to·have·cryptographic·software·provided·by·a·vendor·that·has·undergone·this·certification.·This·means·providing·documentation,·test·results,·design·information,·and·independent·third·party·review·by·an·accredited·lab.·While·open·source·software·is·capable·of·meeting·this,·it·does·not·meet·FIPS-140·unless·the·vendor·submits·to·this·process. |
| 85 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. | 85 | Rationale:·················Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data.·The·operating·system·must·implement·cryptographic·modules·adhering·to·the·higher·standards·approved·by·the·federal·government·since·this·provides·assurance·they·have·been·tested·and·validated. |
| 86 | Severity: ················high | 86 | Severity: ················high |
| 87 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module | 87 | Rule·ID:···················xccdf_org.ssgproject.content_rule_enable_dracut_fips_module |
| 88 | Identifiers·and·References·Identifiers: ·CCE-86547-7 | 88 | Identifiers·and·References·Identifiers: ·CCE-86547-7 |
| 89 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 | 89 | ···························References: ·CCI-000068,·CCI-000803,·CCI-002450,·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-12(2),·SC-12(3),·IA-7,·SC-13,·CM-6(a),·SC-12,·FCS_RBG_EXT.1,·SRG-OS-000478-GPOS-00223,·SRG-OS-000120-VMM-000600,·SRG-OS-000478-VMM-001980,·SRG-OS-000396-VMM-001590 |
| 90 | Remediation_Shell_script_⇲ | ||
| 91 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 92 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 93 | fips-mode-setup·--enable | ||
| 94 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 95 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 96 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 97 | fi | ||
| 98 | else | ||
| 99 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 100 | fi | ||
| 90 | Remediation_Ansible_snippet_⇲ | 101 | Remediation_Ansible_snippet_⇲ |
| 91 | Complexity:·medium | 102 | Complexity:·medium |
| 92 | Disruption:·medium | 103 | Disruption:·medium |
| 93 | Reboot:·····true | 104 | Reboot:·····true |
| 94 | Strategy:···restrict | 105 | Strategy:···restrict |
| 95 | -·name:·Check·to·see·the·current·status·of·FIPS·mode | 106 | -·name:·Check·to·see·the·current·status·of·FIPS·mode |
| 96 | ··command:·/usr/bin/fips-mode-setup·--check | 107 | ··command:·/usr/bin/fips-mode-setup·--check |
| Offset 148, 27 lines modified | Offset 161, 14 lines modified | ||
| 148 | ··-·NIST-800-53-SC-13 | 161 | ··-·NIST-800-53-SC-13 |
| 149 | ··-·enable_dracut_fips_module | 162 | ··-·enable_dracut_fips_module |
| 150 | ··-·high_severity | 163 | ··-·high_severity |
| 151 | ··-·medium_complexity | 164 | ··-·medium_complexity |
| 152 | ··-·medium_disruption | 165 | ··-·medium_disruption |
| 153 | ··-·reboot_required | 166 | ··-·reboot_required |
| 154 | ··-·restrict_strategy | 167 | ··-·restrict_strategy |
| 155 | Remediation_Shell_script_⇲ | ||
| 156 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 157 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 158 | fips-mode-setup·--enable | ||
| 159 | FIPS_CONF="/etc/dracut.conf.d/40-fips.conf" | ||
| 160 | if·!·grep·"^add_dracutmodules+=\"·fips·\""·$FIPS_CONF;·then | ||
| 161 | ····echo·"add_dracutmodules+=\"·fips·\""·>>·$FIPS_CONF | ||
| 162 | fi | ||
| 163 | else | ||
| 164 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 165 | fi | ||
| 166 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** | 168 | ***·Rule ·Enable·FIPS·Mode· [ref]·*** |
| 167 | To·enable·FIPS·mode,·run·the·following·command: | 169 | To·enable·FIPS·mode,·run·the·following·command: |
| 168 | fips-mode-setup·--enable | 170 | fips-mode-setup·--enable |
| 169 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: | 171 | The·fips-mode-setup·command·will·configure·the·system·in·FIPS·mode·by·automatically·configuring·the·following: |
| 170 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 | 172 | ····*·Setting·the·kernel·FIPS·mode·flag·(/proc/sys/crypto/fips_enabled)·to·1 |
| 171 | ····*·Creating·/etc/system-fips | 173 | ····*·Creating·/etc/system-fips |
| Offset 222, 31 lines modified | Offset 222, 33 lines modified | ||
| 222 | The·crypto-policies·package·can·be·installed·with·the·following·command: | 222 | The·crypto-policies·package·can·be·installed·with·the·following·command: |
| 223 | $·sudo·dnf·install·crypto-policies | 223 | $·sudo·dnf·install·crypto-policies |
| 224 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. | 224 | Rationale:·················Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and·the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms·undermines·the·purposes·of·utilizing·encryption·to·protect·data. |
| 225 | Severity: ················medium | 225 | Severity: ················medium |
| 226 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed | 226 | Rule·ID:···················xccdf_org.ssgproject.content_rule_package_crypto-policies_installed |
| 227 | Identifiers·and·References·Identifiers: ·CCE-83442-4 | 227 | Identifiers·and·References·Identifiers: ·CCE-83442-4 |
| 228 | ···························References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 | 228 | ···························References: ·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS-00173,·SRG-OS-000394-GPOS-00174 |
| 229 | Remediation_Anaconda_snippet_⇲ | ||
| 230 | Complexity:·low | ||
| 231 | Disruption:·low | ||
| 232 | Strategy:···enable | ||
| 233 | package·--add=crypto-policies | ||
| 234 | Remediation_Puppet_snippet_⇲ | 229 | Remediation_Puppet_snippet_⇲ |
| 235 | Complexity:·low | 230 | Complexity:·low |
| 236 | Disruption:·low | 231 | Disruption:·low |
| 237 | Strategy:···enable | 232 | Strategy:···enable |
| 238 | include·install_crypto-policies | 233 | include·install_crypto-policies |
| 239 | class·install_crypto-policies·{ | 234 | class·install_crypto-policies·{ |
| 240 | ··package·{·'crypto-policies': | 235 | ··package·{·'crypto-policies': |
| 241 | ····ensure·=>·'installed', | 236 | ····ensure·=>·'installed', |
| 242 | ··} | 237 | ··} |
| 243 | } | 238 | } |
| 239 | Remediation_Shell_script_⇲ | ||
| 240 | Complexity:·low | ||
| 241 | Disruption:·low | ||
| 242 | Strategy:···enable | ||
| 243 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 244 | ····dnf·install·-y·"crypto-policies" | ||
| 245 | fi | ||
| 244 | Remediation_Ansible_snippet_⇲ | 246 | Remediation_Ansible_snippet_⇲ |
| 245 | Complexity:·low | 247 | Complexity:·low |
| 246 | Disruption:·low | 248 | Disruption:·low |
| 247 | Strategy:···enable | 249 | Strategy:···enable |
| 248 | -·name:·Ensure·crypto-policies·is·installed | 250 | -·name:·Ensure·crypto-policies·is·installed |
| 249 | ··package: | 251 | ··package: |
| 250 | ····name:·crypto-policies | 252 | ····name:·crypto-policies |
| Offset 260, 58 lines modified | Offset 262, 50 lines modified | ||
| 260 | ··-·no_reboot_needed | 262 | ··-·no_reboot_needed |
| 261 | ··-·package_crypto-policies_installed | 263 | ··-·package_crypto-policies_installed |
| 262 | Remediation_OSBuild_Blueprint_snippet_⇲ | 264 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 263 | [[packages]] | 265 | [[packages]] |
| 264 | name·=·"crypto-policies" | 266 | name·=·"crypto-policies" |
| 265 | version·=·"*" | 267 | version·=·"*" |
| 266 | Remediation_ | 268 | Remediation_Anaconda_snippet_⇲ |
| 267 | Complexity:·low | 269 | Complexity:·low |
| 268 | Disruption:·low | 270 | Disruption:·low |
| 269 | Strategy:···enable | 271 | Strategy:···enable |
| 272 | package·--add=crypto-policies | ||
| 270 | if·!·rpm·-q·--quiet·"crypto-policies"·;·then | ||
| 271 | ····dnf·install·-y·"crypto-policies" | ||
| Max diff block lines reached; 810251/816319 bytes (99.26%) of diff not shown. | |||
| Offset 14284, 16 lines modified | Offset 14284, 16 lines modified | ||
| 00037cb0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037cb0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037cc0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037cc0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037cd0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037cd0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037ce0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037ce0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037cf0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037cf0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037d00:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037d00:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037d10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037d10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037d20:·2861·7320·6f66·2032·3032·3 | 00037d20:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037d30:·3 | 00037d30:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037d40:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037d40:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037d50:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037d50:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037d60:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037d60:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037d70:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037d70:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037d80:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037d80:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037d90:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037d90:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037da0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037da0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15243, 329 lines modified | Offset 15243, 329 lines modified | ||
| 0003b8a0:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | 0003b8a0:·612d·7461·7267·6574·3d22·2369·646d·3732··a-target="#idm72 | ||
| 0003b8b0:·3530·2220·7461·6269·6e64·6578·3d22·3022··50"·tabindex="0" | 0003b8b0:·3530·2220·7461·6269·6e64·6578·3d22·3022··50"·tabindex="0" | ||
| 0003b8c0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | 0003b8c0:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | ||
| 0003b8d0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | 0003b8d0:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | ||
| 0003b8e0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | 0003b8e0:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | ||
| 0003b8f0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | 0003b8f0:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | ||
| 0003b900:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | 0003b900:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | ||
| 0003b910:·6174·696f·6e20·5368·656c·6c20·7363·7269··ation·Shell·scri | |||
| 0003b920:·7074·20e2·87b2·3c2f·613e·3c62·723e·3c64··pt·...</a><br><d | |||
| 0003b930:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003b940:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003b950:·6522·2069·643d·2269·646d·3732·3530·223e··e"·id="idm7250"> | |||
| 0003b960:·3c70·7265·3e3c·636f·6465·3e0a·2320·4669··<pre><code>.#·Fi | |||
| 0003b970:·6e64·2077·6869·6368·2066·696c·6573·2068··nd·which·files·h | |||
| 0003b980:·6176·6520·696e·636f·7272·6563·7420·6861··ave·incorrect·ha | |||
| 0003b990:·7368·2028·6e6f·7420·696e·202f·6574·632c··sh·(not·in·/etc, | |||
| 0003b9a0:·2062·6563·6175·7365·206f·6620·7468·6520···because·of·the· | |||
| 0003b9b0:·7379·7374·656d·2072·656c·6174·6564·2063··system·related·c | |||
| 0003b9c0:·6f6e·6669·6720·6669·6c65·7329·2061·6e64··onfig·files)·and | |||
| 0003b9d0:·2074·6865·6e20·6765·7420·6669·6c65·7320···then·get·files· | |||
| 0003b9e0:·6e61·6d65·730a·6669·6c65·735f·7769·7468··names.files_with | |||
| 0003b9f0:·5f69·6e63·6f72·7265·6374·5f68·6173·683d··_incorrect_hash= | |||
| 0003ba00:·2224·2872·706d·202d·5661·202d·2d6e·6f63··"$(rpm·-Va·--noc | |||
| 0003ba10:·6f6e·6669·6720·7c20·6772·6570·202d·4520··onfig·|·grep·-E· | |||
| 0003ba20:·275e·2e2e·3527·207c·2061·776b·2027·7b70··'^..5'·|·awk·'{p | |||
| 0003ba30:·7269·6e74·2024·4e46·7d27·2029·220a·0a23··rint·$NF}'·)"..# | |||
| 0003ba40:·2046·726f·6d20·6669·6c65·7320·6e61·6d65···From·files·name | |||
| 0003ba50:·7320·6765·7420·7061·636b·6167·6520·6e61··s·get·package·na | |||
| 0003ba60:·6d65·7320·616e·6420·6368·616e·6765·206e··mes·and·change·n | |||
| 0003ba70:·6577·6c69·6e65·2074·6f20·7370·6163·652c··ewline·to·space, | |||
| 0003ba80:·2062·6563·6175·7365·2072·706d·2077·7269···because·rpm·wri | |||
| 0003ba90:·7465·7320·6561·6368·2070·6163·6b61·6765··tes·each·package | |||
| 0003baa0:·2074·6f20·6e65·7720·6c69·6e65·0a70·6163···to·new·line.pac | |||
| 0003bab0:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003bac0:·6c6c·3d22·2428·7270·6d20·2d71·6620·2466··ll="$(rpm·-qf·$f | |||
| 0003bad0:·696c·6573·5f77·6974·685f·696e·636f·7272··iles_with_incorr | |||
| 0003bae0:·6563·745f·6861·7368·207c·2074·7220·275c··ect_hash·|·tr·'\ | |||
| 0003baf0:·6e27·2027·2027·2922·0a0a·0a64·6e66·2072··n'·'·')"...dnf·r | |||
| 0003bb00:·6569·6e73·7461·6c6c·202d·7920·2470·6163··einstall·-y·$pac | |||
| 0003bb10:·6b61·6765·735f·746f·5f72·6569·6e73·7461··kages_to_reinsta | |||
| 0003bb20:·6c6c·0a3c·2f63·6f64·653e·3c2f·7072·653e··ll.</code></pre> | |||
| 0003bb30:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003bb40:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003bb50:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003bb60:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003bb70:·6765·743d·2223·6964·6d37·3235·3122·2074··get="#idm7251"·t | |||
| 0003bb80:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003bb90:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003bba0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003bbb0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003bbc0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003bbd0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003bbe0:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003bbf0:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bc00:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bc10:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bc20:·2069·643d·2269·646d·3732·3531·223e·3c74···id="idm7251"><t | |||
| 0003bc30:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003bc40:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003bc50:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003bc60:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003bc70:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003bc80:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003bc90:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bca0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bcb0:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003bcc0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003bcd0:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003bce0:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003bcf0:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003bd00:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003b910:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003b920:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003b930:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003b940:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003b950:·6170·7365·2220·6964·3d22·6964·6d37·3235··apse"·id="idm725 | |||
| 0003b960:·3022·3e3c·7461·626c·6520·636c·6173·733d··0"><table·class= | |||
| 0003b970:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003b980:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003b990:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003b9a0:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003b9b0:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003b9c0:·3e68·6967·683c·2f74·643e·3c2f·7472·3e3c··>high</td></tr>< | |||
| 0003b9d0:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003b9e0:·6e3a·3c2f·7468·3e3c·7464·3e6d·6564·6975··n:</th><td>mediu | |||
| 0003b9f0:·6d3c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··m</td></tr><tr>< | |||
| 0003ba00:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003ba10:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003ba20:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003ba30:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003ba40:·3a20·2753·6574·2066·6163·743a·2050·6163··:·'Set·fact:·Pac | |||
| 0003ba50:·6b61·6765·206d·616e·6167·6572·2072·6569··kage·manager·rei | |||
| 0003ba60:·6e73·7461·6c6c·2063·6f6d·6d61·6e64·2028··nstall·command·( | |||
| 0003ba70:·646e·6629·270a·2020·7365·745f·6661·6374··dnf)'.··set_fact | |||
| 0003ba80:·3a0a·2020·2020·7061·636b·6167·655f·6d61··:.····package_ma | |||
| 0003ba90:·6e61·6765·725f·7265·696e·7374·616c·6c5f··nager_reinstall_ | |||
| 0003baa0:·636d·643a·2064·6e66·2072·6569·6e73·7461··cmd:·dnf·reinsta | |||
| 0003bab0:·6c6c·202d·790a·2020·7768·656e·3a20·616e··ll·-y.··when:·an | |||
| 0003bac0:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003bad0:·6f6e·203d·3d20·2246·6564·6f72·6122·0a20··on·==·"Fedora".· | |||
| 0003bae0:·2074·6167·733a·0a20·202d·2043·4345·2d39···tags:.··-·CCE-9 | |||
| 0003baf0:·3038·3431·2d38·0a20·202d·2043·4a49·532d··0841-8.··-·CJIS- | |||
| 0003bb00:·352e·3130·2e34·2e31·0a20·202d·204e·4953··5.10.4.1.··-·NIS | |||
| 0003bb10:·542d·3830·302d·3137·312d·332e·332e·380a··T-800-171-3.3.8. | |||
| 0003bb20:·2020·2d20·4e49·5354·2d38·3030·2d31·3731····-·NIST-800-171 | |||
| 0003bb30:·2d33·2e34·2e31·0a20·202d·204e·4953·542d··-3.4.1.··-·NIST- | |||
| 0003bb40:·3830·302d·3533·2d41·552d·3928·3329·0a20··800-53-AU-9(3).· | |||
| 0003bb50:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003bb60:·4d2d·3628·6329·0a20·202d·204e·4953·542d··M-6(c).··-·NIST- | |||
| 0003bb70:·3830·302d·3533·2d43·4d2d·3628·6429·0a20··800-53-CM-6(d).· | |||
| Max diff block lines reached; 14788549/14833867 bytes (99.69%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | *****·Profile·Information·***** | 37 | *****·Profile·Information·***** |
| 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·Red·Hat·Enterprise·Linux·9 | 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·Red·Hat·Enterprise·Linux·9 |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:redhat:enterprise_linux:9 | 41 | ····*·cpe:/o:redhat:enterprise_linux:9 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 81, 14 lines modified | Offset 81, 24 lines modified | ||
| 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 81 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 82 | $·sudo·rpm·-Uvh·PACKAGENAME | 82 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 83 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 84 | Severity: ················high | 84 | Severity: ················high |
| 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 85 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 86 | Identifiers·and·References·Identifiers: ·CCE-90841-8 | 86 | Identifiers·and·References·Identifiers: ·CCE-90841-8 |
| 87 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 87 | ···························References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 88 | Remediation_Shell_script_⇲ | ||
| 89 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 90 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 91 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 92 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 93 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 88 | Remediation_Ansible_snippet_⇲ | 94 | Remediation_Ansible_snippet_⇲ |
| 89 | Complexity:·high | 95 | Complexity:·high |
| 90 | Disruption:·medium | 96 | Disruption:·medium |
| 91 | Strategy:···restrict | 97 | Strategy:···restrict |
| 92 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 98 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 93 | ··set_fact: | 99 | ··set_fact: |
| 94 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 100 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 238, 38 lines modified | Offset 248, 57 lines modified | ||
| 238 | ··-·PCI-DSS-Req-11.5 | 248 | ··-·PCI-DSS-Req-11.5 |
| 239 | ··-·high_complexity | 249 | ··-·high_complexity |
| 240 | ··-·high_severity | 250 | ··-·high_severity |
| 241 | ··-·medium_disruption | 251 | ··-·medium_disruption |
| 242 | ··-·no_reboot_needed | 252 | ··-·no_reboot_needed |
| 243 | ··-·restrict_strategy | 253 | ··-·restrict_strategy |
| 244 | ··-·rpm_verify_hashes | 254 | ··-·rpm_verify_hashes |
| 245 | Remediation_Shell_script_⇲ | ||
| 246 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 247 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 248 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 249 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 250 | dnf·reinstall·-y·$packages_to_reinstall | ||
| 251 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 255 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 252 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 256 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 253 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 257 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 254 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 258 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 255 | $·rpm·-qf·FILENAME | 259 | $·rpm·-qf·FILENAME |
| 256 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 260 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 257 | $·sudo·rpm·--setperms·PACKAGENAME | 261 | $·sudo·rpm·--setperms·PACKAGENAME |
| 258 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 262 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 259 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 263 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 260 | Severity: ················high | 264 | Severity: ················high |
| 261 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 265 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 262 | Identifiers·and·References·Identifiers: ·CCE-90840-0 | 266 | Identifiers·and·References·Identifiers: ·CCE-90840-0 |
| 263 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 267 | ···························References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 268 | Remediation_Shell_script_⇲ | ||
| 269 | Complexity:·high | ||
| 270 | Disruption:·medium | ||
| 271 | Strategy:···restrict | ||
| 272 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 273 | declare·-A·SETPERMS_RPM_DICT | ||
| 274 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 275 | #·is·expected·by·the·RPM·database | ||
| 276 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 277 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 278 | do | ||
| 279 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 280 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 281 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 282 | ········do | ||
| 283 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 284 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 285 | ········done | ||
| 286 | done | ||
| 287 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 288 | #·correct·values | ||
| 289 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 290 | do | ||
| 291 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 292 | done | ||
| 264 | Remediation_Ansible_snippet_⇲ | 293 | Remediation_Ansible_snippet_⇲ |
| 265 | Complexity:·high | 294 | Complexity:·high |
| 266 | Disruption:·medium | 295 | Disruption:·medium |
| 267 | Strategy:···restrict | 296 | Strategy:···restrict |
| 268 | -·name:·Read·list·of·files·with·incorrect·permissions | 297 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 269 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 298 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 270 | ····--nocaps·--nolinkto·--nouser·--nogroup | 299 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 346, 70 lines modified | Offset 375, 49 lines modified | ||
| 346 | ··-·PCI-DSS-Req-11.5 | 375 | ··-·PCI-DSS-Req-11.5 |
| 347 | ··-·high_complexity | 376 | ··-·high_complexity |
| 348 | ··-·high_severity | 377 | ··-·high_severity |
| 349 | ··-·medium_disruption | 378 | ··-·medium_disruption |
| 350 | ··-·no_reboot_needed | 379 | ··-·no_reboot_needed |
| 351 | ··-·restrict_strategy | 380 | ··-·restrict_strategy |
| 352 | ··-·rpm_verify_permissions | 381 | ··-·rpm_verify_permissions |
| 353 | Remediation_Shell_script_⇲ | ||
| 354 | Complexity:·high | ||
| 355 | Disruption:·medium | ||
| 356 | Strategy:···restrict | ||
| 357 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 358 | declare·-A·SETPERMS_RPM_DICT | ||
| 359 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 360 | #·is·expected·by·the·RPM·database | ||
| 361 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 1165775/1174025 bytes (99.30%) of diff not shown. | |||
| Offset 14316, 16 lines modified | Offset 14316, 16 lines modified | ||
| 00037eb0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037eb0:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037ec0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037ec0:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037ed0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037ed0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037ee0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037ee0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037ef0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037ef0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037f00:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037f00:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037f10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037f10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037f20:·2861·7320·6f66·2032·3032·3 | 00037f20:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037f30:·3 | 00037f30:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037f40:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037f40:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037f50:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037f50:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037f60:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037f60:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037f70:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037f70:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037f80:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037f80:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037f90:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037f90:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037fa0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037fa0:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15307, 190 lines modified | Offset 15307, 190 lines modified | ||
| 0003bca0:·7461·7267·6574·3d22·2369·646d·3735·3834··target="#idm7584 | 0003bca0:·7461·7267·6574·3d22·2369·646d·3735·3834··target="#idm7584 | ||
| 0003bcb0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003bcb0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003bcc0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003bcc0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003bcd0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003bcd0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003bce0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003bce0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003bcf0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003bcf0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003bd00:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003bd00:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003bd10:·696f·6e20·5075·7070·6574·2073·6e69·7070··ion·Puppet·snipp | |||
| 0003bd10:·696f·6e20·416e·6163·6f6e·6461·2073·6e69··ion·Anaconda·sni | |||
| 0003bd20:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003bd30:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bd40:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bd50:·7073·6522·2069·643d·2269·646d·3735·3834··pse"·id="idm7584 | |||
| 0003bd60:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bd70:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003bd80:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 0003bd90:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 0003bda0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003bdb0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003bdc0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003bdd0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003bde0:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003bdf0:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003be00:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003be10:·656e·6162·6c65·3c2f·7464·3e3c·2f74·723e··enable</td></tr> | |||
| 0003be20:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003be30:·6465·3e0a·7061·636b·6167·6520·2d2d·6164··de>.package·--ad | |||
| 0003be40:·643d·6169·6465·0a3c·2f63·6f64·653e·3c2f··d=aide.</code></ | |||
| 0003be50:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003be60:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003be70:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003be80:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003be90:·2d74·6172·6765·743d·2223·6964·6d37·3538··-target="#idm758 | |||
| 0003bea0:·3522·2074·6162·696e·6465·783d·2230·2220··5"·tabindex="0"· | |||
| 0003beb0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003bec0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003bed0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003bee0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003bef0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003bf00:·7469·6f6e·2050·7570·7065·7420·736e·6970··tion·Puppet·snip | |||
| 0003bf10:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003bf20:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003bf30:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003bf40:·7365·2220·6964·3d22·6964·6d37·3538·3522··se"·id="idm7585" | |||
| 0003bf50:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003bf60:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003bf70:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003bf80:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003bf90:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003bfa0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003bfb0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003bfc0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003bfd0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bfe0:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003bff0:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c000:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | |||
| 0003c010:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c020:·653e·696e·636c·7564·6520·696e·7374·616c··e>include·instal | |||
| 0003c030:·6c5f·6169·6465·0a0a·636c·6173·7320·696e··l_aide..class·in | |||
| 0003c040:·7374·616c·6c5f·6169·6465·207b·0a20·2070··stall_aide·{.··p | |||
| 0003c050:·6163·6b61·6765·207b·2027·6169·6465·273a··ackage·{·'aide': | |||
| 0003c060:·0a20·2020·2065·6e73·7572·6520·3d26·6774··.····ensure·=> | |||
| 0003c070:·3b20·2769·6e73·7461·6c6c·6564·272c·0a20··;·'installed',.· | |||
| 0003c080:·207d·0a7d·0a3c·2f63·6f64·653e·3c2f·7072···}.}.</code></pr | |||
| 0003c090:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c0a0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| 0003c0b0:·7322·2064·6174·612d·746f·6767·6c65·3d22··s"·data-toggle=" | |||
| 0003c0c0:·636f·6c6c·6170·7365·2220·6461·7461·2d74··collapse"·data-t | |||
| 0003c0d0:·6172·6765·743d·2223·6964·6d37·3538·3622··arget="#idm7586" | |||
| 0003c0e0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003c0f0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 0003c100:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 0003c110:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 0003c120:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 0003c130:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 0003c140:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003 | 0003bd20:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | ||
| 0003 | 0003bd30:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | ||
| 0003 | 0003bd40:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | ||
| 0003 | 0003bd50:·6522·2069·643d·2269·646d·3735·3834·223e··e"·id="idm7584"> | ||
| 0003 | 0003bd60:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | ||
| 0003 | 0003bd70:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | ||
| 0003 | 0003bd80:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | ||
| 0003 | 0003bd90:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | ||
| 0003 | 0003bda0:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | ||
| 0003 | 0003bdb0:·7869·7479·3a3c·2f74·683e·3c74·643e·6c6f··xity:</th><td>lo | ||
| 0003 | 0003bdc0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | ||
| 0003 | 0003bdd0:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | ||
| 0003 | 0003bde0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003 | 0003bdf0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | ||
| 0003 | 0003be00:·7465·6779·3a3c·2f74·683e·3c74·643e·656e··tegy:</th><td>en | ||
| 0003 | 0003be10:·6162·6c65·3c2f·7464·3e3c·2f74·723e·3c2f··able</td></tr></ | ||
| 0003 | 0003be20:·7461·626c·653e·3c70·7265·3e3c·636f·6465··table><pre><code | ||
| 0003be30:·3e69·6e63·6c75·6465·2069·6e73·7461·6c6c··>include·install | |||
| 0003be40:·5f61·6964·650a·0a63·6c61·7373·2069·6e73··_aide..class·ins | |||
| 0003be50:·7461·6c6c·5f61·6964·6520·7b0a·2020·7061··tall_aide·{.··pa | |||
| 0003be60:·636b·6167·6520·7b20·2761·6964·6527·3a0a··ckage·{·'aide':. | |||
| 0003be70:·2020·2020·656e·7375·7265·203d·2667·743b······ensure·=> | |||
| 0003be80:·2027·696e·7374·616c·6c65·6427·2c0a·2020···'installed',.·· | |||
| 0003be90:·7d0a·7d0a·3c2f·636f·6465·3e3c·2f70·7265··}.}.</code></pre | |||
| 0003bea0:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003beb0:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003bec0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003bed0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003bee0:·7267·6574·3d22·2369·646d·3735·3835·2220··rget="#idm7585"· | |||
| 0003bef0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003bf00:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003bf10:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003bf20:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003bf30:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| Max diff block lines reached; 31143180/31169316 bytes (99.92%) of diff not shown. | |||
| Offset 14340, 15 lines modified | Offset 14340, 15 lines modified | ||
| 00038030:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | 00038030:·746f·7279·3c2f·6832·3e3c·703e·4375·7272··tory</h2><p>Curr | ||
| 00038040:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | 00038040:·656e·7420·7665·7273·696f·6e3a·203c·7374··ent·version:·<st | ||
| 00038050:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | 00038050:·726f·6e67·3e30·2e31·2e36·353c·2f73·7472··rong>0.1.65</str | ||
| 00038060:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | 00038060:·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c·693e··ong></p><ul><li> | ||
| 00038070:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | 00038070:·3c73·7472·6f6e·673e·6472·6166·743c·2f73··<strong>draft</s | ||
| 00038080:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | 00038080:·7472·6f6e·673e·0a20·2020·2020·2020·2020··trong>.········· | ||
| 00038090:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | 00038090:·2020·2020·2020·2020·2020·2028·6173·206f·············(as·o | ||
| 000380a0:·6620·3230·323 | 000380a0:·6620·3230·3235·2d30·322d·3233·290a·2020··f·2025-02-23).·· | ||
| 000380b0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | 000380b0:·2020·2020·2020·2020·2020·2020·2020·3c2f················</ | ||
| 000380c0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | 000380c0:·6c69·3e3c·2f75·6c3e·3c2f·6469·763e·3c68··li></ul></div><h | ||
| 000380d0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | 000380d0:·323e·5461·626c·6520·6f66·2043·6f6e·7465··2>Table·of·Conte | ||
| 000380e0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | 000380e0:·6e74·733c·2f68·323e·3c6f·6c3e·3c6c·693e··nts</h2><ol><li> | ||
| 000380f0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | 000380f0:·3c61·2068·7265·663d·2223·7863·6364·665f··<a·href="#xccdf_ | ||
| 00038100:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | 00038100:·6f72·672e·7373·6770·726f·6a65·6374·2e63··org.ssgproject.c | ||
| 00038110:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | 00038110:·6f6e·7465·6e74·5f67·726f·7570·5f73·7973··ontent_group_sys | ||
| Offset 15325, 191 lines modified | Offset 15325, 191 lines modified | ||
| 0003bdc0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003bdc0:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003bdd0:·2369·646d·3735·3834·2220·7461·6269·6e64··#idm7584"·tabind | 0003bdd0:·2369·646d·3735·3834·2220·7461·6269·6e64··#idm7584"·tabind | ||
| 0003bde0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003bde0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003bdf0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003bdf0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003be00:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003be00:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003be10:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003be10:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003be20:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003be20:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003be30:·5265·6d65·6469·6174·696f·6e20· | 0003be30:·5265·6d65·6469·6174·696f·6e20·5075·7070··Remediation·Pupp | ||
| 0003be40:·6f6e·6461·2073·6e69·7070·6574·20e2·87b2··onda·snippet·... | |||
| 0003be50:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003be60:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003be70:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003be80:·2269·646d·3735·3834·223e·3c74·6162·6c65··"idm7584"><table | |||
| 0003be90:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003bea0:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003beb0:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003bec0:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003bed0:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003bee0:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bef0:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003bf00:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003bf10:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003bf20:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bf30:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003bf40:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003bf50:·3c70·7265·3e3c·636f·6465·3e0a·7061·636b··<pre><code>.pack | |||
| 0003bf60:·6167·6520·2d2d·6164·643d·6169·6465·0a3c··age·--add=aide.< | |||
| 0003bf70:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003bf80:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003bf90:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003bfa0:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003bfb0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003bfc0:·2223·6964·6d37·3538·3522·2074·6162·696e··"#idm7585"·tabin | |||
| 0003bfd0:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | |||
| 0003bfe0:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | |||
| 0003bff0:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | |||
| 0003c000:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | |||
| 0003c010:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | |||
| 0003c020:·3e52·656d·6564·6961·7469·6f6e·2050·7570··>Remediation·Pup | |||
| 0003c030:·7065·7420·736e·6970·7065·7420·e287·b23c··pet·snippet·...< | |||
| 0003c040:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003c050:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003c060:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003c070:·6964·6d37·3538·3522·3e3c·7461·626c·6520··idm7585"><table· | |||
| 0003c080:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003c090:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003c0a0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003c0b0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003c0c0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003c0d0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003c0e0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003c0f0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003c100:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c110:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c120:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003c130:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c140:·7072·653e·3c63·6f64·653e·696e·636c·7564··pre><code>includ | |||
| 0003c150:·6520·696e·7374·616c·6c5f·6169·6465·0a0a··e·install_aide.. | |||
| 0003c160:·636c·6173·7320·696e·7374·616c·6c5f·6169··class·install_ai | |||
| 0003c170:·6465·207b·0a20·2070·6163·6b61·6765·207b··de·{.··package·{ | |||
| 0003c180:·2027·6169·6465·273a·0a20·2020·2065·6e73···'aide':.····ens | |||
| 0003c190:·7572·6520·3d26·6774·3b20·2769·6e73·7461··ure·=>·'insta | |||
| 0003c1a0:·6c6c·6564·272c·0a20·207d·0a7d·0a3c·2f63··lled',.··}.}.</c | |||
| 0003c1b0:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c1c0:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c1d0:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c1e0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c1f0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c200:·6964·6d37·3538·3622·2074·6162·696e·6465··idm7586"·tabinde | |||
| 0003c210:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c220:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c230:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c240:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c250:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c260:·656d·6564·6961·7469·6f6e·2041·6e73·6962··emediation·Ansib | |||
| 0003 | 0003be40:·6574·2073·6e69·7070·6574·20e2·87b2·3c2f··et·snippet·...</ | ||
| 0003 | 0003be50:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | ||
| 0003 | 0003be60:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | ||
| 0003 | 0003be70:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | ||
| 0003 | 0003be80:·646d·3735·3834·223e·3c74·6162·6c65·2063··dm7584"><table·c | ||
| 0003 | 0003be90:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | ||
| 0003 | 0003bea0:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | ||
| 0003 | 0003beb0:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | ||
| 0003 | 0003bec0:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | ||
| 0003 | 0003bed0:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | ||
| 0003 | 0003bee0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003 | 0003bef0:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | ||
| 0003 | 0003bf00:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | ||
| 0003 | 0003bf10:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | ||
| 0003 | 0003bf20:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | ||
| 0003 | 0003bf30:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | ||
| 0003 | 0003bf40:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | ||
| 0003bf50:·7265·3e3c·636f·6465·3e69·6e63·6c75·6465··re><code>include | |||
| 0003bf60:·2069·6e73·7461·6c6c·5f61·6964·650a·0a63···install_aide..c | |||
| 0003bf70:·6c61·7373·2069·6e73·7461·6c6c·5f61·6964··lass·install_aid | |||
| 0003bf80:·6520·7b0a·2020·7061·636b·6167·6520·7b20··e·{.··package·{· | |||
| 0003bf90:·2761·6964·6527·3a0a·2020·2020·656e·7375··'aide':.····ensu | |||
| 0003bfa0:·7265·203d·2667·743b·2027·696e·7374·616c··re·=>·'instal | |||
| 0003bfb0:·6c65·6427·2c0a·2020·7d0a·7d0a·3c2f·636f··led',.··}.}.</co | |||
| 0003bfc0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bfd0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bfe0:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bff0:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003c000:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003c010:·646d·3735·3835·2220·7461·6269·6e64·6578··dm7585"·tabindex | |||
| 0003c020:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003c030:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003c040:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003c050:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003c060:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003c070:·6d65·6469·6174·696f·6e20·5368·656c·6c20··mediation·Shell· | |||
| Max diff block lines reached; 31061021/31087157 bytes (99.92%) of diff not shown. | |||
| Offset 14300, 16 lines modified | Offset 14300, 16 lines modified | ||
| 00037db0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | 00037db0:·6973·696f·6e20·4869·7374·6f72·793c·2f68··ision·History</h | ||
| 00037dc0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | 00037dc0:·323e·3c70·3e43·7572·7265·6e74·2076·6572··2><p>Current·ver | ||
| 00037dd0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | 00037dd0:·7369·6f6e·3a20·3c73·7472·6f6e·673e·302e··sion:·<strong>0. | ||
| 00037de0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | 00037de0:·312e·3635·3c2f·7374·726f·6e67·3e3c·2f70··1.65</strong></p | ||
| 00037df0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | 00037df0:·3e3c·756c·3e3c·6c69·3e3c·7374·726f·6e67··><ul><li><strong | ||
| 00037e00:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | 00037e00:·3e64·7261·6674·3c2f·7374·726f·6e67·3e0a··>draft</strong>. | ||
| 00037e10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e10:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e20:·2020·2020·2861·7320·6f66·2032·3032·3 | 00037e20:·2020·2020·2861·7320·6f66·2032·3032·352d······(as·of·2025- | ||
| 00037e30:·303 | 00037e30:·3032·2d32·3329·0a20·2020·2020·2020·2020··02-23).········· | ||
| 00037e40:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | 00037e40:·2020·2020·2020·203c·2f6c·693e·3c2f·756c·········</li></ul | ||
| 00037e50:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | 00037e50:·3e3c·2f64·6976·3e3c·6832·3e54·6162·6c65··></div><h2>Table | ||
| 00037e60:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | 00037e60:·206f·6620·436f·6e74·656e·7473·3c2f·6832···of·Contents</h2 | ||
| 00037e70:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | 00037e70:·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872·6566··><ol><li><a·href | ||
| 00037e80:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | 00037e80:·3d22·2378·6363·6466·5f6f·7267·2e73·7367··="#xccdf_org.ssg | ||
| 00037e90:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | 00037e90:·7072·6f6a·6563·742e·636f·6e74·656e·745f··project.content_ | ||
| 00037ea0:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | 00037ea0:·6772·6f75·705f·7379·7374·656d·223e·5379··group_system">Sy | ||
| Offset 15222, 323 lines modified | Offset 15222, 323 lines modified | ||
| 0003b750:·6172·6765·743d·2223·6964·6d31·3731·3822··arget="#idm1718" | 0003b750:·6172·6765·743d·2223·6964·6d31·3731·3822··arget="#idm1718" | ||
| 0003b760:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003b760:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003b770:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003b770:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003b780:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003b780:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003b790:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003b790:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003b7a0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003b7a0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003b7b0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003b7b0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003b7c0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003b7d0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003b7e0:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003b7f0:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003b800:·6522·2069·643d·2269·646d·3137·3138·223e··e"·id="idm1718"> | |||
| 0003b810:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003b820:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003b830:·6420·7461·626c·652d·626f·7264·6572·6564··d·table-bordered | |||
| 0003b840:·2074·6162·6c65·2d63·6f6e·6465·6e73·6564···table-condensed | |||
| 0003b850:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003b860:·7869·7479·3a3c·2f74·683e·3c74·643e·6869··xity:</th><td>hi | |||
| 0003b870:·6768·3c2f·7464·3e3c·2f74·723e·3c74·723e··gh</td></tr><tr> | |||
| 0003b880:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003b890:·2f74·683e·3c74·643e·6d65·6469·756d·3c2f··/th><td>medium</ | |||
| 0003b8a0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003b8b0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003b8c0:·643e·7265·7374·7269·6374·3c2f·7464·3e3c··d>restrict</td>< | |||
| 0003b8d0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003b8e0:·3e3c·636f·6465·3e2d·206e·616d·653a·2027··><code>-·name:·' | |||
| 0003b8f0:·5365·7420·6661·6374·3a20·5061·636b·6167··Set·fact:·Packag | |||
| 0003b900:·6520·6d61·6e61·6765·7220·7265·696e·7374··e·manager·reinst | |||
| 0003b910:·616c·6c20·636f·6d6d·616e·6420·2864·6e66··all·command·(dnf | |||
| 0003b920:·2927·0a20·2073·6574·5f66·6163·743a·0a20··)'.··set_fact:.· | |||
| 0003b930:·2020·2070·6163·6b61·6765·5f6d·616e·6167·····package_manag | |||
| 0003b940:·6572·5f72·6569·6e73·7461·6c6c·5f63·6d64··er_reinstall_cmd | |||
| 0003b950:·3a20·646e·6620·7265·696e·7374·616c·6c20··:·dnf·reinstall· | |||
| 0003b960:·2d79·0a20·2077·6865·6e3a·2061·6e73·6962··-y.··when:·ansib | |||
| 0003b970:·6c65·5f64·6973·7472·6962·7574·696f·6e20··le_distribution· | |||
| 0003b980:·3d3d·2022·4665·646f·7261·220a·2020·7461··==·"Fedora".··ta | |||
| 0003b990:·6773·3a0a·2020·2d20·434a·4953·2d35·2e31··gs:.··-·CJIS-5.1 | |||
| 0003b9a0:·302e·342e·310a·2020·2d20·4e49·5354·2d38··0.4.1.··-·NIST-8 | |||
| 0003b9b0:·3030·2d31·3731·2d33·2e33·2e38·0a20·202d··00-171-3.3.8.··- | |||
| 0003b9c0:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003b9d0:·342e·310a·2020·2d20·4e49·5354·2d38·3030··4.1.··-·NIST-800 | |||
| 0003b9e0:·2d35·332d·4155·2d39·2833·290a·2020·2d20··-53-AU-9(3).··-· | |||
| 0003b9f0:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003ba00:·2863·290a·2020·2d20·4e49·5354·2d38·3030··(c).··-·NIST-800 | |||
| 0003ba10:·2d35·332d·434d·2d36·2864·290a·2020·2d20··-53-CM-6(d).··-· | |||
| 0003ba20:·4e49·5354·2d38·3030·2d35·332d·5349·2d37··NIST-800-53-SI-7 | |||
| 0003ba30:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003ba40:·2d53·492d·3728·3129·0a20·202d·204e·4953··-SI-7(1).··-·NIS | |||
| 0003ba50:·542d·3830·302d·3533·2d53·492d·3728·3629··T-800-53-SI-7(6) | |||
| 0003ba60:·0a20·202d·2050·4349·2d44·5353·2d52·6571··.··-·PCI-DSS-Req | |||
| 0003ba70:·2d31·312e·350a·2020·2d20·6869·6768·5f63··-11.5.··-·high_c | |||
| 0003ba80:·6f6d·706c·6578·6974·790a·2020·2d20·6869··omplexity.··-·hi | |||
| 0003ba90:·6768·5f73·6576·6572·6974·790a·2020·2d20··gh_severity.··-· | |||
| 0003baa0:·6d65·6469·756d·5f64·6973·7275·7074·696f··medium_disruptio | |||
| 0003bab0:·6e0a·2020·2d20·6e6f·5f72·6562·6f6f·745f··n.··-·no_reboot_ | |||
| 0003bac0:·6e65·6564·6564·0a20·202d·2072·6573·7472··needed.··-·restr | |||
| 0003bad0:·6963·745f·7374·7261·7465·6779·0a20·202d··ict_strategy.··- | |||
| 0003b | 0003b7c0:·6f6e·2053·6865·6c6c·2073·6372·6970·7420··on·Shell·script· | ||
| 0003b7d0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003b7e0:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003b7f0:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003b800:·6964·3d22·6964·6d31·3731·3822·3e3c·7072··id="idm1718"><pr | |||
| 0003b810:·653e·3c63·6f64·653e·0a23·2046·696e·6420··e><code>.#·Find· | |||
| 0003b820:·7768·6963·6820·6669·6c65·7320·6861·7665··which·files·have | |||
| 0003b830:·2069·6e63·6f72·7265·6374·2068·6173·6820···incorrect·hash· | |||
| 0003b840:·286e·6f74·2069·6e20·2f65·7463·2c20·6265··(not·in·/etc,·be | |||
| 0003b850:·6361·7573·6520·6f66·2074·6865·2073·7973··cause·of·the·sys | |||
| 0003b860:·7465·6d20·7265·6c61·7465·6420·636f·6e66··tem·related·conf | |||
| 0003b870:·6967·2066·696c·6573·2920·616e·6420·7468··ig·files)·and·th | |||
| 0003b880:·656e·2067·6574·2066·696c·6573·206e·616d··en·get·files·nam | |||
| 0003b890:·6573·0a66·696c·6573·5f77·6974·685f·696e··es.files_with_in | |||
| 0003b8a0:·636f·7272·6563·745f·6861·7368·3d22·2428··correct_hash="$( | |||
| 0003b8b0:·7270·6d20·2d56·6120·2d2d·6e6f·636f·6e66··rpm·-Va·--noconf | |||
| 0003b8c0:·6967·207c·2067·7265·7020·2d45·2027·5e2e··ig·|·grep·-E·'^. | |||
| 0003b8d0:·2e35·2720·7c20·6177·6b20·277b·7072·696e··.5'·|·awk·'{prin | |||
| 0003b8e0:·7420·244e·467d·2720·2922·0a0a·2320·4672··t·$NF}'·)"..#·Fr | |||
| 0003b8f0:·6f6d·2066·696c·6573·206e·616d·6573·2067··om·files·names·g | |||
| 0003b900:·6574·2070·6163·6b61·6765·206e·616d·6573··et·package·names | |||
| 0003b910:·2061·6e64·2063·6861·6e67·6520·6e65·776c···and·change·newl | |||
| 0003b920:·696e·6520·746f·2073·7061·6365·2c20·6265··ine·to·space,·be | |||
| 0003b930:·6361·7573·6520·7270·6d20·7772·6974·6573··cause·rpm·writes | |||
| 0003b940:·2065·6163·6820·7061·636b·6167·6520·746f···each·package·to | |||
| 0003b950:·206e·6577·206c·696e·650a·7061·636b·6167···new·line.packag | |||
| 0003b960:·6573·5f74·6f5f·7265·696e·7374·616c·6c3d··es_to_reinstall= | |||
| 0003b970:·2224·2872·706d·202d·7166·2024·6669·6c65··"$(rpm·-qf·$file | |||
| 0003b980:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003b990:·5f68·6173·6820·7c20·7472·2027·5c6e·2720··_hash·|·tr·'\n'· | |||
| 0003b9a0:·2720·2729·220a·0a0a·7975·6d20·7265·696e··'·')"...yum·rein | |||
| 0003b9b0:·7374·616c·6c20·2d79·2024·7061·636b·6167··stall·-y·$packag | |||
| 0003b9c0:·6573·5f74·6f5f·7265·696e·7374·616c·6c0a··es_to_reinstall. | |||
| 0003b9d0:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003b9e0:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003b9f0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003ba00:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003ba10:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | |||
| 0003ba20:·3d22·2369·646d·3137·3139·2220·7461·6269··="#idm1719"·tabi | |||
| 0003ba30:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003ba40:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003ba50:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003ba60:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003ba70:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003ba80:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003ba90:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003baa0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003bab0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003bac0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003bad0:·3d22·6964·6d31·3731·3922·3e3c·7461·626c··="idm1719"><tabl | |||
| 0003bae0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003baf0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003bb00:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| Max diff block lines reached; 13106397/13150887 bytes (99.66%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | ··············(RHVH) | 39 | ··············(RHVH) |
| 40 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 40 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 41 | ***·CPE·Platforms·*** | 41 | ***·CPE·Platforms·*** |
| 42 | ····*·cpe:/o:redhat:enterprise_linux:8::hypervisor | 42 | ····*·cpe:/o:redhat:enterprise_linux:8::hypervisor |
| 43 | ····*·cpe:/a:redhat:enterprise_virtualization_manager:4 | 43 | ····*·cpe:/a:redhat:enterprise_virtualization_manager:4 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·Account_and_Access_Control | 50 | ·········2.·Account_and_Access_Control |
| 51 | ·········3.·System_Accounting_with_auditd | 51 | ·········3.·System_Accounting_with_auditd |
| 52 | ·········4.·GRUB2_bootloader_configuration | 52 | ·········4.·GRUB2_bootloader_configuration |
| 53 | ·········5.·Configure_Syslog | 53 | ·········5.·Configure_Syslog |
| Offset 81, 14 lines modified | Offset 81, 24 lines modified | ||
| 81 | $·sudo·yum·reinstall·PACKAGENAME | 81 | $·sudo·yum·reinstall·PACKAGENAME |
| 82 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 82 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 83 | $·sudo·rpm·-Uvh·PACKAGENAME | 83 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 84 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 84 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 85 | Severity: ················high | 85 | Severity: ················high |
| 86 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 86 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 87 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 87 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 88 | Remediation_Shell_script_⇲ | ||
| 89 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 90 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 91 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 92 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 93 | yum·reinstall·-y·$packages_to_reinstall | ||
| 88 | Remediation_Ansible_snippet_⇲ | 94 | Remediation_Ansible_snippet_⇲ |
| 89 | Complexity:·high | 95 | Complexity:·high |
| 90 | Disruption:·medium | 96 | Disruption:·medium |
| 91 | Strategy:···restrict | 97 | Strategy:···restrict |
| 92 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 98 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 93 | ··set_fact: | 99 | ··set_fact: |
| 94 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 100 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 232, 37 lines modified | Offset 242, 56 lines modified | ||
| 232 | ··-·PCI-DSS-Req-11.5 | 242 | ··-·PCI-DSS-Req-11.5 |
| 233 | ··-·high_complexity | 243 | ··-·high_complexity |
| 234 | ··-·high_severity | 244 | ··-·high_severity |
| 235 | ··-·medium_disruption | 245 | ··-·medium_disruption |
| 236 | ··-·no_reboot_needed | 246 | ··-·no_reboot_needed |
| 237 | ··-·restrict_strategy | 247 | ··-·restrict_strategy |
| 238 | ··-·rpm_verify_hashes | 248 | ··-·rpm_verify_hashes |
| 239 | Remediation_Shell_script_⇲ | ||
| 240 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 241 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 242 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 243 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 244 | yum·reinstall·-y·$packages_to_reinstall | ||
| 245 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 249 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 246 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 250 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 247 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 251 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 248 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 252 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 249 | $·rpm·-qf·FILENAME | 253 | $·rpm·-qf·FILENAME |
| 250 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 254 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 251 | $·sudo·rpm·--setperms·PACKAGENAME | 255 | $·sudo·rpm·--setperms·PACKAGENAME |
| 252 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 256 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 253 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 257 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 254 | Severity: ················high | 258 | Severity: ················high |
| 255 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 259 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 256 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | 260 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 |
| 261 | Remediation_Shell_script_⇲ | ||
| 262 | Complexity:·high | ||
| 263 | Disruption:·medium | ||
| 264 | Strategy:···restrict | ||
| 265 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 266 | declare·-A·SETPERMS_RPM_DICT | ||
| 267 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 268 | #·is·expected·by·the·RPM·database | ||
| 269 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 270 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 271 | do | ||
| 272 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 273 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 274 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 275 | ········do | ||
| 276 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 277 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 278 | ········done | ||
| 279 | done | ||
| 280 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 281 | #·correct·values | ||
| 282 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 283 | do | ||
| 284 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 285 | done | ||
| 257 | Remediation_Ansible_snippet_⇲ | 286 | Remediation_Ansible_snippet_⇲ |
| 258 | Complexity:·high | 287 | Complexity:·high |
| 259 | Disruption:·medium | 288 | Disruption:·medium |
| 260 | Strategy:···restrict | 289 | Strategy:···restrict |
| 261 | -·name:·Read·list·of·files·with·incorrect·permissions | 290 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 262 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 291 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 263 | ····--nocaps·--nolinkto·--nouser·--nogroup | 292 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 336, 69 lines modified | Offset 365, 48 lines modified | ||
| 336 | ··-·PCI-DSS-Req-11.5 | 365 | ··-·PCI-DSS-Req-11.5 |
| 337 | ··-·high_complexity | 366 | ··-·high_complexity |
| 338 | ··-·high_severity | 367 | ··-·high_severity |
| 339 | ··-·medium_disruption | 368 | ··-·medium_disruption |
| 340 | ··-·no_reboot_needed | 369 | ··-·no_reboot_needed |
| 341 | ··-·restrict_strategy | 370 | ··-·restrict_strategy |
| 342 | ··-·rpm_verify_permissions | 371 | ··-·rpm_verify_permissions |
| 343 | Remediation_Shell_script_⇲ | ||
| 344 | Complexity:·high | ||
| 345 | Disruption:·medium | ||
| 346 | Strategy:···restrict | ||
| 347 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 348 | declare·-A·SETPERMS_RPM_DICT | ||
| 349 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 350 | #·is·expected·by·the·RPM·database | ||
| 351 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 899939/908095 bytes (99.10%) of diff not shown. | |||
| Offset 14302, 15 lines modified | Offset 14302, 15 lines modified | ||
| 00037dd0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 00037dd0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 00037de0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 00037de0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00037df0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00037df0:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00037e00:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00037e00:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00037e10:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00037e10:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00037e20:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00037e20:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00037e30:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00037e30:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00037e40:·206f·6620·3230·323 | 00037e40:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e50:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e60:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00037e60:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00037e70:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00037e70:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00037e80:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00037e80:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 00037e90:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 00037e90:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 00037ea0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 00037ea0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 00037eb0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 00037eb0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15274, 324 lines modified | Offset 15274, 324 lines modified | ||
| 0003ba90:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003ba90:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003baa0:·743d·2223·6964·6d31·3731·3822·2074·6162··t="#idm1718"·tab | 0003baa0:·743d·2223·6964·6d31·3731·3822·2074·6162··t="#idm1718"·tab | ||
| 0003bab0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003bab0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003bac0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003bac0:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003bad0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003bad0:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003bae0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003bae0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003baf0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003baf0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003bb00:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003bb00:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 0003bb10:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003bb20:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bb30:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bb40:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bb50:·643d·2269·646d·3137·3138·223e·3c74·6162··d="idm1718"><tab | |||
| 0003bb60:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bb70:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bb80:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bb90:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bba0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bbb0:·3a3c·2f74·683e·3c74·643e·6869·6768·3c2f··:</th><td>high</ | |||
| 0003bbc0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003bbd0:·4469·7372·7570·7469·6f6e·3a3c·2f74·683e··Disruption:</th> | |||
| 0003bbe0:·3c74·643e·6d65·6469·756d·3c2f·7464·3e3c··<td>medium</td>< | |||
| 0003bbf0:·2f74·723e·3c74·723e·3c74·683e·5374·7261··/tr><tr><th>Stra | |||
| 0003bc00:·7465·6779·3a3c·2f74·683e·3c74·643e·7265··tegy:</th><td>re | |||
| 0003bc10:·7374·7269·6374·3c2f·7464·3e3c·2f74·723e··strict</td></tr> | |||
| 0003bc20:·3c2f·7461·626c·653e·3c70·7265·3e3c·636f··</table><pre><co | |||
| 0003bc30:·6465·3e2d·206e·616d·653a·2027·5365·7420··de>-·name:·'Set· | |||
| 0003bc40:·6661·6374·3a20·5061·636b·6167·6520·6d61··fact:·Package·ma | |||
| 0003bc50:·6e61·6765·7220·7265·696e·7374·616c·6c20··nager·reinstall· | |||
| 0003bc60:·636f·6d6d·616e·6420·2864·6e66·2927·0a20··command·(dnf)'.· | |||
| 0003bc70:·2073·6574·5f66·6163·743a·0a20·2020·2070···set_fact:.····p | |||
| 0003bc80:·6163·6b61·6765·5f6d·616e·6167·6572·5f72··ackage_manager_r | |||
| 0003bc90:·6569·6e73·7461·6c6c·5f63·6d64·3a20·646e··einstall_cmd:·dn | |||
| 0003bca0:·6620·7265·696e·7374·616c·6c20·2d79·0a20··f·reinstall·-y.· | |||
| 0003bcb0:·2077·6865·6e3a·2061·6e73·6962·6c65·5f64···when:·ansible_d | |||
| 0003bcc0:·6973·7472·6962·7574·696f·6e20·3d3d·2022··istribution·==·" | |||
| 0003bcd0:·4665·646f·7261·220a·2020·7461·6773·3a0a··Fedora".··tags:. | |||
| 0003bce0:·2020·2d20·434a·4953·2d35·2e31·302e·342e····-·CJIS-5.10.4. | |||
| 0003bcf0:·310a·2020·2d20·4e49·5354·2d38·3030·2d31··1.··-·NIST-800-1 | |||
| 0003bd00:·3731·2d33·2e33·2e38·0a20·202d·204e·4953··71-3.3.8.··-·NIS | |||
| 0003bd10:·542d·3830·302d·3137·312d·332e·342e·310a··T-800-171-3.4.1. | |||
| 0003bd20:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bd30:·4155·2d39·2833·290a·2020·2d20·4e49·5354··AU-9(3).··-·NIST | |||
| 0003bd40:·2d38·3030·2d35·332d·434d·2d36·2863·290a··-800-53-CM-6(c). | |||
| 0003bd50:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003bd60:·434d·2d36·2864·290a·2020·2d20·4e49·5354··CM-6(d).··-·NIST | |||
| 0003bd70:·2d38·3030·2d35·332d·5349·2d37·0a20·202d··-800-53-SI-7.··- | |||
| 0003bd80:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003bd90:·3728·3129·0a20·202d·204e·4953·542d·3830··7(1).··-·NIST-80 | |||
| 0003bda0:·302d·3533·2d53·492d·3728·3629·0a20·202d··0-53-SI-7(6).··- | |||
| 0003bdb0:·2050·4349·2d44·5353·2d52·6571·2d31·312e···PCI-DSS-Req-11. | |||
| 0003bdc0:·350a·2020·2d20·6869·6768·5f63·6f6d·706c··5.··-·high_compl | |||
| 0003bdd0:·6578·6974·790a·2020·2d20·6869·6768·5f73··exity.··-·high_s | |||
| 0003bde0:·6576·6572·6974·790a·2020·2d20·6d65·6469··everity.··-·medi | |||
| 0003bdf0:·756d·5f64·6973·7275·7074·696f·6e0a·2020··um_disruption.·· | |||
| 0003be00:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003be10:·6564·0a20·202d·2072·6573·7472·6963·745f··ed.··-·restrict_ | |||
| 0003be20:·7374·7261·7465·6779·0a20·202d·2072·706d··strategy.··-·rpm | |||
| 0003b | 0003bb10:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | ||
| 0003bb20:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bb30:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bb40:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bb50:·6964·6d31·3731·3822·3e3c·7072·653e·3c63··idm1718"><pre><c | |||
| 0003bb60:·6f64·653e·0a23·2046·696e·6420·7768·6963··ode>.#·Find·whic | |||
| 0003bb70:·6820·6669·6c65·7320·6861·7665·2069·6e63··h·files·have·inc | |||
| 0003bb80:·6f72·7265·6374·2068·6173·6820·286e·6f74··orrect·hash·(not | |||
| 0003bb90:·2069·6e20·2f65·7463·2c20·6265·6361·7573···in·/etc,·becaus | |||
| 0003bba0:·6520·6f66·2074·6865·2073·7973·7465·6d20··e·of·the·system· | |||
| 0003bbb0:·7265·6c61·7465·6420·636f·6e66·6967·2066··related·config·f | |||
| 0003bbc0:·696c·6573·2920·616e·6420·7468·656e·2067··iles)·and·then·g | |||
| 0003bbd0:·6574·2066·696c·6573·206e·616d·6573·0a66··et·files·names.f | |||
| 0003bbe0:·696c·6573·5f77·6974·685f·696e·636f·7272··iles_with_incorr | |||
| 0003bbf0:·6563·745f·6861·7368·3d22·2428·7270·6d20··ect_hash="$(rpm· | |||
| 0003bc00:·2d56·6120·2d2d·6e6f·636f·6e66·6967·207c··-Va·--noconfig·| | |||
| 0003bc10:·2067·7265·7020·2d45·2027·5e2e·2e35·2720···grep·-E·'^..5'· | |||
| 0003bc20:·7c20·6177·6b20·277b·7072·696e·7420·244e··|·awk·'{print·$N | |||
| 0003bc30:·467d·2720·2922·0a0a·2320·4672·6f6d·2066··F}'·)"..#·From·f | |||
| 0003bc40:·696c·6573·206e·616d·6573·2067·6574·2070··iles·names·get·p | |||
| 0003bc50:·6163·6b61·6765·206e·616d·6573·2061·6e64··ackage·names·and | |||
| 0003bc60:·2063·6861·6e67·6520·6e65·776c·696e·6520···change·newline· | |||
| 0003bc70:·746f·2073·7061·6365·2c20·6265·6361·7573··to·space,·becaus | |||
| 0003bc80:·6520·7270·6d20·7772·6974·6573·2065·6163··e·rpm·writes·eac | |||
| 0003bc90:·6820·7061·636b·6167·6520·746f·206e·6577··h·package·to·new | |||
| 0003bca0:·206c·696e·650a·7061·636b·6167·6573·5f74···line.packages_t | |||
| 0003bcb0:·6f5f·7265·696e·7374·616c·6c3d·2224·2872··o_reinstall="$(r | |||
| 0003bcc0:·706d·202d·7166·2024·6669·6c65·735f·7769··pm·-qf·$files_wi | |||
| 0003bcd0:·7468·5f69·6e63·6f72·7265·6374·5f68·6173··th_incorrect_has | |||
| 0003bce0:·6820·7c20·7472·2027·5c6e·2720·2720·2729··h·|·tr·'\n'·'·') | |||
| 0003bcf0:·220a·0a0a·7975·6d20·7265·696e·7374·616c··"...yum·reinstal | |||
| 0003bd00:·6c20·2d79·2024·7061·636b·6167·6573·5f74··l·-y·$packages_t | |||
| 0003bd10:·6f5f·7265·696e·7374·616c·6c0a·3c2f·636f··o_reinstall.</co | |||
| 0003bd20:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bd30:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bd40:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bd50:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003bd60:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003bd70:·646d·3137·3139·2220·7461·6269·6e64·6578··dm1719"·tabindex | |||
| 0003bd80:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003bd90:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003bda0:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003bdb0:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003bdc0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003bdd0:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003bde0:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003bdf0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003be00:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003be10:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003be20:·6d31·3731·3922·3e3c·7461·626c·6520·636c··m1719"><table·cl | |||
| 0003be30:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003be40:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003be50:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| Max diff block lines reached; 22685941/22730431 bytes (99.80%) of diff not shown. | |||
| Offset 14383, 15 lines modified | Offset 14383, 15 lines modified | ||
| 000382e0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | 000382e0:·6973·746f·7279·3c2f·6832·3e3c·703e·4375··istory</h2><p>Cu | ||
| 000382f0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | 000382f0:·7272·656e·7420·7665·7273·696f·6e3a·203c··rrent·version:·< | ||
| 00038300:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | 00038300:·7374·726f·6e67·3e30·2e31·2e36·353c·2f73··strong>0.1.65</s | ||
| 00038310:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | 00038310:·7472·6f6e·673e·3c2f·703e·3c75·6c3e·3c6c··trong></p><ul><l | ||
| 00038320:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | 00038320:·693e·3c73·7472·6f6e·673e·6472·6166·743c··i><strong>draft< | ||
| 00038330:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | 00038330:·2f73·7472·6f6e·673e·0a20·2020·2020·2020··/strong>.······· | ||
| 00038340:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | 00038340:·2020·2020·2020·2020·2020·2020·2028·6173···············(as | ||
| 00038350:·206f·6620·3230·323 | 00038350:·206f·6620·3230·3235·2d30·322d·3233·290a···of·2025-02-23). | ||
| 00038360:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00038360:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038370:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | 00038370:·3c2f·6c69·3e3c·2f75·6c3e·3c2f·6469·763e··</li></ul></div> | ||
| 00038380:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | 00038380:·3c68·323e·5461·626c·6520·6f66·2043·6f6e··<h2>Table·of·Con | ||
| 00038390:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | 00038390:·7465·6e74·733c·2f68·323e·3c6f·6c3e·3c6c··tents</h2><ol><l | ||
| 000383a0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | 000383a0:·693e·3c61·2068·7265·663d·2223·7863·6364··i><a·href="#xccd | ||
| 000383b0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | 000383b0:·665f·6f72·672e·7373·6770·726f·6a65·6374··f_org.ssgproject | ||
| 000383c0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | 000383c0:·2e63·6f6e·7465·6e74·5f67·726f·7570·5f73··.content_group_s | ||
| Offset 15305, 323 lines modified | Offset 15305, 323 lines modified | ||
| 0003bc80:·7461·7267·6574·3d22·2369·646d·3137·3138··target="#idm1718 | 0003bc80:·7461·7267·6574·3d22·2369·646d·3137·3138··target="#idm1718 | ||
| 0003bc90:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | 0003bc90:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | ||
| 0003bca0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | 0003bca0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | ||
| 0003bcb0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | 0003bcb0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | ||
| 0003bcc0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | 0003bcc0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | ||
| 0003bcd0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | 0003bcd0:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | ||
| 0003bce0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | 0003bce0:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | ||
| 0003bcf0:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003bd00:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003bd10:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003bd20:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003bd30:·7365·2220·6964·3d22·6964·6d31·3731·3822··se"·id="idm1718" | |||
| 0003bd40:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003bd50:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003bd60:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | |||
| 0003bd70:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003bd80:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003bd90:·6578·6974·793a·3c2f·7468·3e3c·7464·3e68··exity:</th><td>h | |||
| 0003bda0:·6967·683c·2f74·643e·3c2f·7472·3e3c·7472··igh</td></tr><tr | |||
| 0003bdb0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003bdc0:·3c2f·7468·3e3c·7464·3e6d·6564·6975·6d3c··</th><td>medium< | |||
| 0003bdd0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003bde0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003bdf0:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 0003be00:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003be10:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003be20:·2753·6574·2066·6163·743a·2050·6163·6b61··'Set·fact:·Packa | |||
| 0003be30:·6765·206d·616e·6167·6572·2072·6569·6e73··ge·manager·reins | |||
| 0003be40:·7461·6c6c·2063·6f6d·6d61·6e64·2028·646e··tall·command·(dn | |||
| 0003be50:·6629·270a·2020·7365·745f·6661·6374·3a0a··f)'.··set_fact:. | |||
| 0003be60:·2020·2020·7061·636b·6167·655f·6d61·6e61······package_mana | |||
| 0003be70:·6765·725f·7265·696e·7374·616c·6c5f·636d··ger_reinstall_cm | |||
| 0003be80:·643a·2064·6e66·2072·6569·6e73·7461·6c6c··d:·dnf·reinstall | |||
| 0003be90:·202d·790a·2020·7768·656e·3a20·616e·7369···-y.··when:·ansi | |||
| 0003bea0:·626c·655f·6469·7374·7269·6275·7469·6f6e··ble_distribution | |||
| 0003beb0:·203d·3d20·2246·6564·6f72·6122·0a20·2074···==·"Fedora".··t | |||
| 0003bec0:·6167·733a·0a20·202d·2043·4a49·532d·352e··ags:.··-·CJIS-5. | |||
| 0003bed0:·3130·2e34·2e31·0a20·202d·204e·4953·542d··10.4.1.··-·NIST- | |||
| 0003bee0:·3830·302d·3137·312d·332e·332e·380a·2020··800-171-3.3.8.·· | |||
| 0003bef0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003bf00:·2e34·2e31·0a20·202d·204e·4953·542d·3830··.4.1.··-·NIST-80 | |||
| 0003bf10:·302d·3533·2d41·552d·3928·3329·0a20·202d··0-53-AU-9(3).··- | |||
| 0003bf20:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003bf30:·3628·6329·0a20·202d·204e·4953·542d·3830··6(c).··-·NIST-80 | |||
| 0003bf40:·302d·3533·2d43·4d2d·3628·6429·0a20·202d··0-53-CM-6(d).··- | |||
| 0003bf50:·204e·4953·542d·3830·302d·3533·2d53·492d···NIST-800-53-SI- | |||
| 0003bf60:·370a·2020·2d20·4e49·5354·2d38·3030·2d35··7.··-·NIST-800-5 | |||
| 0003bf70:·332d·5349·2d37·2831·290a·2020·2d20·4e49··3-SI-7(1).··-·NI | |||
| 0003bf80:·5354·2d38·3030·2d35·332d·5349·2d37·2836··ST-800-53-SI-7(6 | |||
| 0003bf90:·290a·2020·2d20·5043·492d·4453·532d·5265··).··-·PCI-DSS-Re | |||
| 0003bfa0:·712d·3131·2e35·0a20·202d·2068·6967·685f··q-11.5.··-·high_ | |||
| 0003bfb0:·636f·6d70·6c65·7869·7479·0a20·202d·2068··complexity.··-·h | |||
| 0003bfc0:·6967·685f·7365·7665·7269·7479·0a20·202d··igh_severity.··- | |||
| 0003bfd0:·206d·6564·6975·6d5f·6469·7372·7570·7469···medium_disrupti | |||
| 0003bfe0:·6f6e·0a20·202d·206e·6f5f·7265·626f·6f74··on.··-·no_reboot | |||
| 0003bff0:·5f6e·6565·6465·640a·2020·2d20·7265·7374··_needed.··-·rest | |||
| 0003c000:·7269·6374·5f73·7472·6174·6567·790a·2020··rict_strategy.·· | |||
| 0003 | 0003bcf0:·696f·6e20·5368·656c·6c20·7363·7269·7074··ion·Shell·script | ||
| 0003bd00:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bd10:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003bd20:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003bd30:·2069·643d·2269·646d·3137·3138·223e·3c70···id="idm1718"><p | |||
| 0003bd40:·7265·3e3c·636f·6465·3e0a·2320·4669·6e64··re><code>.#·Find | |||
| 0003bd50:·2077·6869·6368·2066·696c·6573·2068·6176···which·files·hav | |||
| 0003bd60:·6520·696e·636f·7272·6563·7420·6861·7368··e·incorrect·hash | |||
| 0003bd70:·2028·6e6f·7420·696e·202f·6574·632c·2062···(not·in·/etc,·b | |||
| 0003bd80:·6563·6175·7365·206f·6620·7468·6520·7379··ecause·of·the·sy | |||
| 0003bd90:·7374·656d·2072·656c·6174·6564·2063·6f6e··stem·related·con | |||
| 0003bda0:·6669·6720·6669·6c65·7329·2061·6e64·2074··fig·files)·and·t | |||
| 0003bdb0:·6865·6e20·6765·7420·6669·6c65·7320·6e61··hen·get·files·na | |||
| 0003bdc0:·6d65·730a·6669·6c65·735f·7769·7468·5f69··mes.files_with_i | |||
| 0003bdd0:·6e63·6f72·7265·6374·5f68·6173·683d·2224··ncorrect_hash="$ | |||
| 0003bde0:·2872·706d·202d·5661·202d·2d6e·6f63·6f6e··(rpm·-Va·--nocon | |||
| 0003bdf0:·6669·6720·7c20·6772·6570·202d·4520·275e··fig·|·grep·-E·'^ | |||
| 0003be00:·2e2e·3527·207c·2061·776b·2027·7b70·7269··..5'·|·awk·'{pri | |||
| 0003be10:·6e74·2024·4e46·7d27·2029·220a·0a23·2046··nt·$NF}'·)"..#·F | |||
| 0003be20:·726f·6d20·6669·6c65·7320·6e61·6d65·7320··rom·files·names· | |||
| 0003be30:·6765·7420·7061·636b·6167·6520·6e61·6d65··get·package·name | |||
| 0003be40:·7320·616e·6420·6368·616e·6765·206e·6577··s·and·change·new | |||
| 0003be50:·6c69·6e65·2074·6f20·7370·6163·652c·2062··line·to·space,·b | |||
| 0003be60:·6563·6175·7365·2072·706d·2077·7269·7465··ecause·rpm·write | |||
| 0003be70:·7320·6561·6368·2070·6163·6b61·6765·2074··s·each·package·t | |||
| 0003be80:·6f20·6e65·7720·6c69·6e65·0a70·6163·6b61··o·new·line.packa | |||
| 0003be90:·6765·735f·746f·5f72·6569·6e73·7461·6c6c··ges_to_reinstall | |||
| 0003bea0:·3d22·2428·7270·6d20·2d71·6620·2466·696c··="$(rpm·-qf·$fil | |||
| 0003beb0:·6573·5f77·6974·685f·696e·636f·7272·6563··es_with_incorrec | |||
| 0003bec0:·745f·6861·7368·207c·2074·7220·275c·6e27··t_hash·|·tr·'\n' | |||
| 0003bed0:·2027·2027·2922·0a0a·0a79·756d·2072·6569···'·')"...yum·rei | |||
| 0003bee0:·6e73·7461·6c6c·202d·7920·2470·6163·6b61··nstall·-y·$packa | |||
| 0003bef0:·6765·735f·746f·5f72·6569·6e73·7461·6c6c··ges_to_reinstall | |||
| 0003bf00:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bf10:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bf20:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bf30:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bf40:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bf50:·743d·2223·6964·6d31·3731·3922·2074·6162··t="#idm1719"·tab | |||
| 0003bf60:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bf70:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bf80:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bf90:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bfa0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bfb0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003bfc0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003bfd0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bfe0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bff0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c000:·643d·2269·646d·3137·3139·223e·3c74·6162··d="idm1719"><tab | |||
| 0003c010:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c020:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c030:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c040:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| Max diff block lines reached; 15361861/15391033 bytes (99.81%) of diff not shown. | |||
| Offset 59, 15 lines modified | Offset 59, 15 lines modified | ||
| 59 | ··············Virtualization·Host·(RHVH) | 59 | ··············Virtualization·Host·(RHVH) |
| 60 | Profile·ID····xccdf_org.ssgproject.content_profile_rhvh-vpp | 60 | Profile·ID····xccdf_org.ssgproject.content_profile_rhvh-vpp |
| 61 | ***·CPE·Platforms·*** | 61 | ***·CPE·Platforms·*** |
| 62 | ····*·cpe:/o:redhat:enterprise_linux:8::hypervisor | 62 | ····*·cpe:/o:redhat:enterprise_linux:8::hypervisor |
| 63 | ····*·cpe:/a:redhat:enterprise_virtualization_manager:4 | 63 | ····*·cpe:/a:redhat:enterprise_virtualization_manager:4 |
| 64 | *****·Revision·History·***** | 64 | *****·Revision·History·***** |
| 65 | Current·version:·0.1.65 | 65 | Current·version:·0.1.65 |
| 66 | ····*·draft·(as·of·202 | 66 | ····*·draft·(as·of·2025-02-23) |
| 67 | *****·Table·of·Contents·***** | 67 | *****·Table·of·Contents·***** |
| 68 | ···1.·System_Settings | 68 | ···1.·System_Settings |
| 69 | ·········1.·Installing_and_Maintaining_Software | 69 | ·········1.·Installing_and_Maintaining_Software |
| 70 | ·········2.·Account_and_Access_Control | 70 | ·········2.·Account_and_Access_Control |
| 71 | ·········3.·System_Accounting_with_auditd | 71 | ·········3.·System_Accounting_with_auditd |
| 72 | ·········4.·GRUB2_bootloader_configuration | 72 | ·········4.·GRUB2_bootloader_configuration |
| 73 | ·········5.·Network_Configuration_and_Firewalls | 73 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 101, 14 lines modified | Offset 101, 24 lines modified | ||
| 101 | $·sudo·yum·reinstall·PACKAGENAME | 101 | $·sudo·yum·reinstall·PACKAGENAME |
| 102 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 102 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 103 | $·sudo·rpm·-Uvh·PACKAGENAME | 103 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 104 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 104 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 105 | Severity: ················high | 105 | Severity: ················high |
| 106 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 106 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 107 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 | 107 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227 |
| 108 | Remediation_Shell_script_⇲ | ||
| 109 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 110 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 111 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 112 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 113 | yum·reinstall·-y·$packages_to_reinstall | ||
| 108 | Remediation_Ansible_snippet_⇲ | 114 | Remediation_Ansible_snippet_⇲ |
| 109 | Complexity:·high | 115 | Complexity:·high |
| 110 | Disruption:·medium | 116 | Disruption:·medium |
| 111 | Strategy:···restrict | 117 | Strategy:···restrict |
| 112 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 118 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 113 | ··set_fact: | 119 | ··set_fact: |
| 114 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 120 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 252, 36 lines modified | Offset 262, 51 lines modified | ||
| 252 | ··-·PCI-DSS-Req-11.5 | 262 | ··-·PCI-DSS-Req-11.5 |
| 253 | ··-·high_complexity | 263 | ··-·high_complexity |
| 254 | ··-·high_severity | 264 | ··-·high_severity |
| 255 | ··-·medium_disruption | 265 | ··-·medium_disruption |
| 256 | ··-·no_reboot_needed | 266 | ··-·no_reboot_needed |
| 257 | ··-·restrict_strategy | 267 | ··-·restrict_strategy |
| 258 | ··-·rpm_verify_hashes | 268 | ··-·rpm_verify_hashes |
| 259 | Remediation_Shell_script_⇲ | ||
| 260 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 261 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 262 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 263 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 264 | yum·reinstall·-y·$packages_to_reinstall | ||
| 265 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 269 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 266 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 270 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 267 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 271 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 268 | run·the·following·command·to·determine·which·package·owns·it: | 272 | run·the·following·command·to·determine·which·package·owns·it: |
| 269 | $·rpm·-qf·FILENAME | 273 | $·rpm·-qf·FILENAME |
| 270 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 274 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 271 | $·sudo·rpm·--setugids·PACKAGENAME | 275 | $·sudo·rpm·--setugids·PACKAGENAME |
| 272 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 276 | Warning: ·Profiles·may·require·that·specific·files·be·owned·by·root·while·the·default·owner·defined·by·the·vendor·is·different.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 273 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 277 | Rationale:·················Ownership·of·binaries·and·configuration·files·that·is·incorrect·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·ownership·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 274 | Severity: ················high | 278 | Severity: ················high |
| 275 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership | 279 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_ownership |
| 276 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 | 280 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001494,·CCI-001496,·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000278-GPOS-00108 |
| 281 | Remediation_Shell_script_⇲ | ||
| 282 | Complexity:·high | ||
| 283 | Disruption:·medium | ||
| 284 | Strategy:···restrict | ||
| 285 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 286 | declare·-A·SETPERMS_RPM_DICT | ||
| 287 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 288 | #·is·expected·by·the·RPM·database | ||
| 289 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}') | ||
| 290 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 291 | do | ||
| 292 | ········RPM_PACKAGE=$(rpm·-qf·"$FILE_PATH") | ||
| 293 | » #·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 294 | » SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 295 | done | ||
| 296 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 297 | #·correct·values | ||
| 298 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 299 | do | ||
| 300 | ········rpm·--setugids·"${RPM_PACKAGE}" | ||
| 301 | done | ||
| 277 | Remediation_Ansible_snippet_⇲ | 302 | Remediation_Ansible_snippet_⇲ |
| 278 | Complexity:·high | 303 | Complexity:·high |
| 279 | Disruption:·medium | 304 | Disruption:·medium |
| 280 | Strategy:···restrict | 305 | Strategy:···restrict |
| 281 | -·name:·Read·list·of·files·with·incorrect·ownership | 306 | -·name:·Read·list·of·files·with·incorrect·ownership |
| 282 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 307 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 283 | ····--nocaps·--nolinkto·--nomode | 308 | ····--nocaps·--nolinkto·--nomode |
| Offset 352, 52 lines modified | Offset 377, 56 lines modified | ||
| 352 | ··-·PCI-DSS-Req-11.5 | 377 | ··-·PCI-DSS-Req-11.5 |
| 353 | ··-·high_complexity | 378 | ··-·high_complexity |
| 354 | ··-·high_severity | 379 | ··-·high_severity |
| 355 | ··-·medium_disruption | 380 | ··-·medium_disruption |
| 356 | ··-·no_reboot_needed | 381 | ··-·no_reboot_needed |
| 357 | ··-·restrict_strategy | 382 | ··-·restrict_strategy |
| 358 | ··-·rpm_verify_ownership | 383 | ··-·rpm_verify_ownership |
| 384 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | ||
| 385 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | ||
| 386 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | ||
| 387 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | ||
| 388 | $·rpm·-qf·FILENAME | ||
| 389 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | ||
| 390 | $·sudo·rpm·--setperms·PACKAGENAME | ||
| 391 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | ||
| 392 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | ||
| 393 | Severity: ················high | ||
| 394 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | ||
| 395 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108 | ||
| 359 | Remediation_Shell_script_⇲ | 396 | Remediation_Shell_script_⇲ |
| 360 | Complexity:·high | 397 | Complexity:·high |
| 361 | Disruption:·medium | 398 | Disruption:·medium |
| 362 | Strategy:···restrict | 399 | Strategy:···restrict |
| Max diff block lines reached; 985513/994700 bytes (99.08%) of diff not shown. | |||
| Offset 14483, 16 lines modified | Offset 14483, 16 lines modified | ||
| 00038920:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | 00038920:·7669·7369·6f6e·2048·6973·746f·7279·3c2f··vision·History</ | ||
| 00038930:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | 00038930:·6832·3e3c·703e·4375·7272·656e·7420·7665··h2><p>Current·ve | ||
| 00038940:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | 00038940:·7273·696f·6e3a·203c·7374·726f·6e67·3e30··rsion:·<strong>0 | ||
| 00038950:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | 00038950:·2e31·2e36·353c·2f73·7472·6f6e·673e·3c2f··.1.65</strong></ | ||
| 00038960:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | 00038960:·703e·3c75·6c3e·3c6c·693e·3c73·7472·6f6e··p><ul><li><stron | ||
| 00038970:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | 00038970:·673e·6472·6166·743c·2f73·7472·6f6e·673e··g>draft</strong> | ||
| 00038980:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00038980:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00038990:·2020·2020·2028·6173·206f·6620·3230·323 | 00038990:·2020·2020·2028·6173·206f·6620·3230·3235·······(as·of·2025 | ||
| 000389a0:·2d30·3 | 000389a0:·2d30·322d·3233·290a·2020·2020·2020·2020··-02-23).········ | ||
| 000389b0:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | 000389b0:·2020·2020·2020·2020·3c2f·6c69·3e3c·2f75··········</li></u | ||
| 000389c0:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | 000389c0:·6c3e·3c2f·6469·763e·3c68·323e·5461·626c··l></div><h2>Tabl | ||
| 000389d0:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | 000389d0:·6520·6f66·2043·6f6e·7465·6e74·733c·2f68··e·of·Contents</h | ||
| 000389e0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | 000389e0:·323e·3c6f·6c3e·3c6c·693e·3c61·2068·7265··2><ol><li><a·hre | ||
| 000389f0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | 000389f0:·663d·2223·7863·6364·665f·6f72·672e·7373··f="#xccdf_org.ss | ||
| 00038a00:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | 00038a00:·6770·726f·6a65·6374·2e63·6f6e·7465·6e74··gproject.content | ||
| 00038a10:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | 00038a10:·5f67·726f·7570·5f73·7973·7465·6d22·3e53··_group_system">S | ||
| Offset 15415, 335 lines modified | Offset 15415, 335 lines modified | ||
| 0003c360:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003c360:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003c370:·6964·6d31·3136·3322·2074·6162·696e·6465··idm1163"·tabinde | 0003c370:·6964·6d31·3136·3322·2074·6162·696e·6465··idm1163"·tabinde | ||
| 0003c380:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003c380:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003c390:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003c390:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003c3a0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003c3a0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003c3b0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003c3b0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003c3c0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003c3c0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003c3d0:·656d·6564·6961·7469·6f6e·20 | 0003c3d0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003c3e0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003c3f0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c400:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c410:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003c420:·646d·3131·3633·223e·3c74·6162·6c65·2063··dm1163"><table·c | |||
| 0003c430:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003c440:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003c450:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003c460:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003c470:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003c480:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003c490:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003c4a0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003c4b0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003c4c0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c4d0:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003c4e0:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003c | 0003c3e0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | ||
| 0003c3f0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c400:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c410:·6c6c·6170·7365·2220·6964·3d22·6964·6d31··llapse"·id="idm1 | |||
| 0003c420:·3136·3322·3e3c·7072·653e·3c63·6f64·653e··163"><pre><code> | |||
| 0003c430:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003c440:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003c450:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003c460:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003c470:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003c480:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003c490:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003c4a0:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003c4b0:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003c4c0:·6861·7368·3d22·2428·7270·6d20·2d56·6120··hash="$(rpm·-Va· | |||
| 0003c4d0:·2d2d·6e6f·636f·6e66·6967·207c·2067·7265··--noconfig·|·gre | |||
| 0003c4e0:·7020·2d45·2027·5e2e·2e35·2720·7c20·6177··p·-E·'^..5'·|·aw | |||
| 0003c4f0:·6b20·277b·7072·696e·7420·244e·467d·2720··k·'{print·$NF}'· | |||
| 0003c500:·2922·0a0a·2320·4672·6f6d·2066·696c·6573··)"..#·From·files | |||
| 0003c5 | 0003c510:·206e·616d·6573·2067·6574·2070·6163·6b61···names·get·packa | ||
| 0003c5 | 0003c520:·6765·206e·616d·6573·2061·6e64·2063·6861··ge·names·and·cha | ||
| 0003c530:·6e67·6520·6e65·776c·696e·6520·746f·2073··nge·newline·to·s | |||
| 0003c540:·7061·6365·2c20·6265·6361·7573·6520·7270··pace,·because·rp | |||
| 0003c550:·6d20·7772·6974·6573·2065·6163·6820·7061··m·writes·each·pa | |||
| 0003c560:·636b·6167·6520·746f·206e·6577·206c·696e··ckage·to·new·lin | |||
| 0003c570:·650a·7061·636b·6167·6573·5f74·6f5f·7265··e.packages_to_re | |||
| 0003c580:·696e·7374·616c·6c3d·2224·2872·706d·202d··install="$(rpm·- | |||
| 0003c590:·7166·2024·6669·6c65·735f·7769·7468·5f69··qf·$files_with_i | |||
| 0003c5a0:·6e63·6f72·7265·6374·5f68·6173·6820·7c20··ncorrect_hash·|· | |||
| 0003c5b0:·7472·2027·5c6e·2720·2720·2729·220a·0a0a··tr·'\n'·'·')"... | |||
| 0003c5 | 0003c5c0:·7975·6d20·7265·696e·7374·616c·6c20·2d79··yum·reinstall·-y | ||
| 0003c530:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003c5 | 0003c5d0:·2024·7061·636b·6167·6573·5f74·6f5f·7265···$packages_to_re | ||
| 0003c5e0:·696e·7374·616c·6c0a·3c2f·636f·6465·3e3c··install.</code>< | |||
| 0003c5f0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c600:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c610:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c620:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c630:·612d·7461·7267·6574·3d22·2369·646d·3131··a-target="#idm11 | |||
| 0003c640:·3634·2220·7461·6269·6e64·6578·3d22·3022··64"·tabindex="0" | |||
| 0003c650:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c660:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c670:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c680:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c690:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c6a0:·6174·696f·6e20·416e·7369·626c·6520·736e··ation·Ansible·sn | |||
| 0003c6b0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c6c0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c6d0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c6e0:·6170·7365·2220·6964·3d22·6964·6d31·3136··apse"·id="idm116 | |||
| 0003c6f0:·3422·3e3c·7461·626c·6520·636c·6173·733d··4"><table·class= | |||
| 0003c700:·2274·6162·6c65·2074·6162·6c65·2d73·7472··"table·table-str | |||
| 0003c710:·6970·6564·2074·6162·6c65·2d62·6f72·6465··iped·table-borde | |||
| 0003c720:·7265·6420·7461·626c·652d·636f·6e64·656e··red·table-conden | |||
| 0003c730:·7365·6422·3e3c·7472·3e3c·7468·3e43·6f6d··sed"><tr><th>Com | |||
| 0003c740:·706c·6578·6974·793a·3c2f·7468·3e3c·7464··plexity:</th><td | |||
| 0003c750:·3e68·6967·683c·2f74·643e·3c2f·7472·3e3c··>high</td></tr>< | |||
| 0003c760:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003c770:·6e3a·3c2f·7468·3e3c·7464·3e6d·6564·6975··n:</th><td>mediu | |||
| 0003c780:·6d3c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··m</td></tr><tr>< | |||
| 0003c790:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003c7a0:·3e3c·7464·3e72·6573·7472·6963·743c·2f74··><td>restrict</t | |||
| 0003c7b0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c7c0:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003c7d0:·3a20·2753·6574·2066·6163·743a·2050·6163··:·'Set·fact:·Pac | |||
| 0003c | 0003c7e0:·6b61·6765·206d·616e·6167·6572·2072·6569··kage·manager·rei | ||
| 0003c560:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003c570:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003c580:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003c590:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003c5a0:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003c5b0:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003c5c0:·2d20·4449·5341·2d53·5449·472d·5248·454c··-·DISA-STIG-RHEL | |||
| 0003c | 0003c7f0:·6e73·7461·6c6c·2063·6f6d·6d61·6e64·2028··nstall·command·( | ||
| 0003c800:·646e·6629·270a·2020·7365·745f·6661·6374··dnf)'.··set_fact | |||
| 0003c810:·3a0a·2020·2020·7061·636b·6167·655f·6d61··:.····package_ma | |||
| 0003c820:·6e61·6765·725f·7265·696e·7374·616c·6c5f··nager_reinstall_ | |||
| 0003c830:·636d·643a·2064·6e66·2072·6569·6e73·7461··cmd:·dnf·reinsta | |||
| 0003c840:·6c6c·202d·790a·2020·7768·656e·3a20·616e··ll·-y.··when:·an | |||
| 0003c850:·7369·626c·655f·6469·7374·7269·6275·7469··sible_distributi | |||
| 0003c860:·6f6e·203d·3d20·2246·6564·6f72·6122·0a20··on·==·"Fedora".· | |||
| 0003c870:·2074·6167·733a·0a20·202d·2043·4a49·532d···tags:.··-·CJIS- | |||
| 0003c880:·352e·3130·2e34·2e31·0a20·202d·2044·4953··5.10.4.1.··-·DIS | |||
| 0003c890:·412d·5354·4947·2d52·4845·4c2d·3037·2d30··A-STIG-RHEL-07-0 | |||
| 0003c8a0:·3130·3032·300a·2020·2d20·4e49·5354·2d38··10020.··-·NIST-8 | |||
| Max diff block lines reached; 8717073/8740725 bytes (99.73%) of diff not shown. | |||
| Offset 66, 15 lines modified | Offset 66, 15 lines modified | ||
| 66 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 66 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 67 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 67 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 68 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 68 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 69 | ····*·cpe:/o:redhat:enterprise_linux:7 | 69 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 70 | ····*·cpe:/o:scientificlinux:scientificlinux:7 | 70 | ····*·cpe:/o:scientificlinux:scientificlinux:7 |
| 71 | *****·Revision·History·***** | 71 | *****·Revision·History·***** |
| 72 | Current·version:·0.1.65 | 72 | Current·version:·0.1.65 |
| 73 | ····*·draft·(as·of·202 | 73 | ····*·draft·(as·of·2025-02-23) |
| 74 | *****·Table·of·Contents·***** | 74 | *****·Table·of·Contents·***** |
| 75 | ···1.·System_Settings | 75 | ···1.·System_Settings |
| 76 | ·········1.·Installing_and_Maintaining_Software | 76 | ·········1.·Installing_and_Maintaining_Software |
| 77 | ·········2.·Account_and_Access_Control | 77 | ·········2.·Account_and_Access_Control |
| 78 | ·········3.·System_Accounting_with_auditd | 78 | ·········3.·System_Accounting_with_auditd |
| 79 | ·········4.·GRUB2_bootloader_configuration | 79 | ·········4.·GRUB2_bootloader_configuration |
| 80 | ·········5.·Configure_Syslog | 80 | ·········5.·Configure_Syslog |
| Offset 108, 14 lines modified | Offset 108, 24 lines modified | ||
| 108 | $·sudo·yum·reinstall·PACKAGENAME | 108 | $·sudo·yum·reinstall·PACKAGENAME |
| 109 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 109 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 110 | $·sudo·rpm·-Uvh·PACKAGENAME | 110 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 111 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 111 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 112 | Severity: ················high | 112 | Severity: ················high |
| 113 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 113 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 114 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule | 114 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule |
| 115 | Remediation_Shell_script_⇲ | ||
| 116 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 117 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 118 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 119 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 120 | yum·reinstall·-y·$packages_to_reinstall | ||
| 115 | Remediation_Ansible_snippet_⇲ | 121 | Remediation_Ansible_snippet_⇲ |
| 116 | Complexity:·high | 122 | Complexity:·high |
| 117 | Disruption:·medium | 123 | Disruption:·medium |
| 118 | Strategy:···restrict | 124 | Strategy:···restrict |
| 119 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 125 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 120 | ··set_fact: | 126 | ··set_fact: |
| 121 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 127 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 265, 37 lines modified | Offset 275, 56 lines modified | ||
| 265 | ··-·PCI-DSS-Req-11.5 | 275 | ··-·PCI-DSS-Req-11.5 |
| 266 | ··-·high_complexity | 276 | ··-·high_complexity |
| 267 | ··-·high_severity | 277 | ··-·high_severity |
| 268 | ··-·medium_disruption | 278 | ··-·medium_disruption |
| 269 | ··-·no_reboot_needed | 279 | ··-·no_reboot_needed |
| 270 | ··-·restrict_strategy | 280 | ··-·restrict_strategy |
| 271 | ··-·rpm_verify_hashes | 281 | ··-·rpm_verify_hashes |
| 272 | Remediation_Shell_script_⇲ | ||
| 273 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 274 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 275 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 276 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 277 | yum·reinstall·-y·$packages_to_reinstall | ||
| 278 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 282 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 279 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 283 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 280 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 284 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 281 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 285 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 282 | $·rpm·-qf·FILENAME | 286 | $·rpm·-qf·FILENAME |
| 283 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 287 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 284 | $·sudo·rpm·--setperms·PACKAGENAME | 288 | $·sudo·rpm·--setperms·PACKAGENAME |
| 285 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 289 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 286 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 290 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 287 | Severity: ················high | 291 | Severity: ················high |
| 288 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 292 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 289 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 293 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 294 | Remediation_Shell_script_⇲ | ||
| 295 | Complexity:·high | ||
| 296 | Disruption:·medium | ||
| 297 | Strategy:···restrict | ||
| 298 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 299 | declare·-A·SETPERMS_RPM_DICT | ||
| 300 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 301 | #·is·expected·by·the·RPM·database | ||
| 302 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 303 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 304 | do | ||
| 305 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 306 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 307 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 308 | ········do | ||
| 309 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 310 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 311 | ········done | ||
| 312 | done | ||
| 313 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 314 | #·correct·values | ||
| 315 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 316 | do | ||
| 317 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 318 | done | ||
| 290 | Remediation_Ansible_snippet_⇲ | 319 | Remediation_Ansible_snippet_⇲ |
| 291 | Complexity:·high | 320 | Complexity:·high |
| 292 | Disruption:·medium | 321 | Disruption:·medium |
| 293 | Strategy:···restrict | 322 | Strategy:···restrict |
| 294 | -·name:·Read·list·of·files·with·incorrect·permissions | 323 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 295 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 324 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 296 | ····--nocaps·--nolinkto·--nouser·--nogroup | 325 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 372, 69 lines modified | Offset 401, 48 lines modified | ||
| 372 | ··-·PCI-DSS-Req-11.5 | 401 | ··-·PCI-DSS-Req-11.5 |
| 373 | ··-·high_complexity | 402 | ··-·high_complexity |
| 374 | ··-·high_severity | 403 | ··-·high_severity |
| 375 | ··-·medium_disruption | 404 | ··-·medium_disruption |
| 376 | ··-·no_reboot_needed | 405 | ··-·no_reboot_needed |
| 377 | ··-·restrict_strategy | 406 | ··-·restrict_strategy |
| 378 | ··-·rpm_verify_permissions | 407 | ··-·rpm_verify_permissions |
| 379 | Remediation_Shell_script_⇲ | ||
| 380 | Complexity:·high | ||
| 381 | Disruption:·medium | ||
| 382 | Strategy:···restrict | ||
| 383 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 384 | declare·-A·SETPERMS_RPM_DICT | ||
| 385 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 386 | #·is·expected·by·the·RPM·database | ||
| 387 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 865722/874051 bytes (99.05%) of diff not shown. | |||
| Offset 14490, 16 lines modified | Offset 14490, 16 lines modified | ||
| 00038990:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038990:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 000389a0:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 000389a0:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 000389b0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 000389b0:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 000389c0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 000389c0:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 000389d0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 000389d0:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 000389e0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 000389e0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 000389f0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000389f0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00038a00:·2020·2028·6173·206f·6620·3230·323 | 00038a00:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 00038a10:·3 | 00038a10:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 00038a20:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 00038a20:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 00038a30:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 00038a30:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00038a40:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00038a40:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00038a50:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00038a50:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00038a60:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00038a60:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00038a70:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00038a70:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00038a80:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00038a80:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15410, 334 lines modified | Offset 15410, 334 lines modified | ||
| 0003c310:·6765·743d·2223·6964·6d31·3136·3322·2074··get="#idm1163"·t | 0003c310:·6765·743d·2223·6964·6d31·3136·3322·2074··get="#idm1163"·t | ||
| 0003c320:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003c320:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003c330:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003c330:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003c340:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003c340:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003c350:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003c350:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003c360:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003c360:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003c370:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003c370:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003c380:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | |||
| 0003c390:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c3a0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c3b0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c3c0:·3d22·6964·6d31·3136·3322·3e3c·7072·653e··="idm1163"><pre> | |||
| 0003c3d0:·3c63·6f64·653e·0a23·2046·696e·6420·7768··<code>.#·Find·wh | |||
| 0003c3e0:·6963·6820·6669·6c65·7320·6861·7665·2069··ich·files·have·i | |||
| 0003c3f0:·6e63·6f72·7265·6374·2068·6173·6820·286e··ncorrect·hash·(n | |||
| 0003c400:·6f74·2069·6e20·2f65·7463·2c20·6265·6361··ot·in·/etc,·beca | |||
| 0003c410:·7573·6520·6f66·2074·6865·2073·7973·7465··use·of·the·syste | |||
| 0003c420:·6d20·7265·6c61·7465·6420·636f·6e66·6967··m·related·config | |||
| 0003c430:·2066·696c·6573·2920·616e·6420·7468·656e···files)·and·then | |||
| 0003c440:·2067·6574·2066·696c·6573·206e·616d·6573···get·files·names | |||
| 0003c450:·0a66·696c·6573·5f77·6974·685f·696e·636f··.files_with_inco | |||
| 0003c460:·7272·6563·745f·6861·7368·3d22·2428·7270··rrect_hash="$(rp | |||
| 0003c470:·6d20·2d56·6120·2d2d·6e6f·636f·6e66·6967··m·-Va·--noconfig | |||
| 0003c480:·207c·2067·7265·7020·2d45·2027·5e2e·2e35···|·grep·-E·'^..5 | |||
| 0003c490:·2720·7c20·6177·6b20·277b·7072·696e·7420··'·|·awk·'{print· | |||
| 0003c4a0:·244e·467d·2720·2922·0a0a·2320·4672·6f6d··$NF}'·)"..#·From | |||
| 0003c4b0:·2066·696c·6573·206e·616d·6573·2067·6574···files·names·get | |||
| 0003c380:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003c390:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003c3a0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003c3b0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003c3c0:·2069·643d·2269·646d·3131·3633·223e·3c74···id="idm1163"><t | |||
| 0003c3d0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003c3e0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003c3f0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003c400:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c410:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c420:·7479·3a3c·2f74·683e·3c74·643e·6869·6768··ty:</th><td>high | |||
| 0003c430:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003c440:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c450:·683e·3c74·643e·6d65·6469·756d·3c2f·7464··h><td>medium</td | |||
| 0003c460:·3e3c·2f74·723e·3c74·723e·3c74·683e·5374··></tr><tr><th>St | |||
| 0003c470:·7261·7465·6779·3a3c·2f74·683e·3c74·643e··rategy:</th><td> | |||
| 0003c480:·7265·7374·7269·6374·3c2f·7464·3e3c·2f74··restrict</td></t | |||
| 0003c490:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c4a0:·636f·6465·3e2d·206e·616d·653a·2027·5365··code>-·name:·'Se | |||
| 0003c4b0:·7420·6661·6374·3a20·5061·636b·6167·6520··t·fact:·Package· | |||
| 0003c4c0:·6d61·6e61·6765·7220·7265·696e·7374·616c··manager·reinstal | |||
| 0003c4d0:·6c20·636f·6d6d·616e·6420·2864·6e66·2927··l·command·(dnf)' | |||
| 0003c4e0:·0a20·2073·6574·5f66·6163·743a·0a20·2020··.··set_fact:.··· | |||
| 0003c4 | 0003c4c0:·2070·6163·6b61·6765·206e·616d·6573·2061···package·names·a | ||
| 0003c4d0:·6e64·2063·6861·6e67·6520·6e65·776c·696e··nd·change·newlin | |||
| 0003c4e0:·6520·746f·2073·7061·6365·2c20·6265·6361··e·to·space,·beca | |||
| 0003c4f0:·7573·6520·7270·6d20·7772·6974·6573·2065··use·rpm·writes·e | |||
| 0003c500:·6163·6820·7061·636b·6167·6520·746f·206e··ach·package·to·n | |||
| 0003c510:·6577·206c·696e·650a·7061·636b·6167·6573··ew·line.packages | |||
| 0003c520:·5f74·6f5f·7265·696e·7374·616c·6c3d·2224··_to_reinstall="$ | |||
| 0003c530:·2872·706d·202d·7166·2024·6669·6c65·735f··(rpm·-qf·$files_ | |||
| 0003c500:·5f72·6569·6e73·7461·6c6c·5f63·6d64·3a20··_reinstall_cmd:· | |||
| 0003c510:·646e·6620·7265·696e·7374·616c·6c20·2d79··dnf·reinstall·-y | |||
| 0003c520:·0a20·2077·6865·6e3a·2061·6e73·6962·6c65··.··when:·ansible | |||
| 0003c530:·5f64·6973·7472·6962·7574·696f·6e20·3d3d··_distribution·== | |||
| 0003c540:·2022·4665·646f·7261·220a·2020·7461·6773···"Fedora".··tags | |||
| 0003c550:·3a0a·2020·2d20·434a·4953·2d35·2e31·302e··:.··-·CJIS-5.10. | |||
| 0003c560:·342e·310a·2020·2d20·4449·5341·2d53·5449··4.1.··-·DISA-STI | |||
| 0003c570:·472d·5248·454c·2d30·372d·3031·3030·3230··G-RHEL-07-010020 | |||
| 0003c580:·0a20·202d·204e·4953·542d·3830·302d·3137··.··-·NIST-800-17 | |||
| 0003c590:·312d·332e·332e·380a·2020·2d20·4e49·5354··1-3.3.8.··-·NIST | |||
| 0003c5a0:·2d38·3030·2d31·3731·2d33·2e34·2e31·0a20··-800-171-3.4.1.· | |||
| 0003c5b0:·202d·204e·4953·542d·3830·302d·3533·2d41···-·NIST-800-53-A | |||
| 0003c5c0:·552d·3928·3329·0a20·202d·204e·4953·542d··U-9(3).··-·NIST- | |||
| 0003c5d0:·3830·302d·3533·2d43·4d2d·3628·6329·0a20··800-53-CM-6(c).· | |||
| 0003c5e0:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 0003c5f0:·4d2d·3628·6429·0a20·202d·204e·4953·542d··M-6(d).··-·NIST- | |||
| 0003c600:·3830·302d·3533·2d53·492d·370a·2020·2d20··800-53-SI-7.··-· | |||
| 0003c610:·4e49·5354·2d38·3030·2d35·332d·5349·2d37··NIST-800-53-SI-7 | |||
| 0003c620:·2831·290a·2020·2d20·4e49·5354·2d38·3030··(1).··-·NIST-800 | |||
| 0003c630:·2d35·332d·5349·2d37·2836·290a·2020·2d20··-53-SI-7(6).··-· | |||
| 0003c640:·5043·492d·4453·532d·5265·712d·3131·2e35··PCI-DSS-Req-11.5 | |||
| 0003c650:·0a20·202d·2068·6967·685f·636f·6d70·6c65··.··-·high_comple | |||
| 0003c660:·7869·7479·0a20·202d·2068·6967·685f·7365··xity.··-·high_se | |||
| 0003c670:·7665·7269·7479·0a20·202d·206d·6564·6975··verity.··-·mediu | |||
| 0003c680:·6d5f·6469·7372·7570·7469·6f6e·0a20·202d··m_disruption.··- | |||
| 0003c690:·206e·6f5f·7265·626f·6f74·5f6e·6565·6465···no_reboot_neede | |||
| 0003c6a0:·640a·2020·2d20·7265·7374·7269·6374·5f73··d.··-·restrict_s | |||
| 0003c6b0:·7472·6174·6567·790a·2020·2d20·7270·6d5f··trategy.··-·rpm_ | |||
| 0003c6c0:·7665·7269·6679·5f68·6173·6865·730a·0a2d··verify_hashes..- | |||
| 0003c6d0:·206e·616d·653a·2027·5365·7420·6661·6374···name:·'Set·fact | |||
| 0003c6e0:·3a20·5061·636b·6167·6520·6d61·6e61·6765··:·Package·manage | |||
| 0003c6f0:·7220·7265·696e·7374·616c·6c20·636f·6d6d··r·reinstall·comm | |||
| 0003c700:·616e·6420·2879·756d·2927·0a20·2073·6574··and·(yum)'.··set | |||
| 0003c710:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003c720:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003c730:·7461·6c6c·5f63·6d64·3a20·7975·6d20·7265··tall_cmd:·yum·re | |||
| 0003c740:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003c750:·6e3a·2028·616e·7369·626c·655f·6469·7374··n:·(ansible_dist | |||
| 0003c760:·7269·6275·7469·6f6e·203d·3d20·2252·6564··ribution·==·"Red | |||
| 0003c770:·4861·7422·206f·7220·616e·7369·626c·655f··Hat"·or·ansible_ | |||
| 0003c780:·6469·7374·7269·6275·7469·6f6e·203d·3d20··distribution·==· | |||
| 0003c790:·2243·656e·744f·5322·206f·7220·616e·7369··"CentOS"·or·ansi | |||
| 0003c7a0:·626c·655f·6469·7374·7269·6275·7469·6f6e··ble_distribution | |||
| 0003c7b0:·0a20·2020·203d·3d20·224f·7261·636c·654c··.····==·"OracleL | |||
| 0003c7c0:·696e·7578·2229·0a20·2074·6167·733a·0a20··inux").··tags:.· | |||
| 0003c7d0:·202d·2043·4a49·532d·352e·3130·2e34·2e31···-·CJIS-5.10.4.1 | |||
| 0003c7e0:·0a20·202d·2044·4953·412d·5354·4947·2d52··.··-·DISA-STIG-R | |||
| 0003c7f0:·4845·4c2d·3037·2d30·3130·3032·300a·2020··HEL-07-010020.·· | |||
| 0003c800:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003c810:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003c820:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003c830:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| Max diff block lines reached; 6199736/6223250 bytes (99.62%) of diff not shown. | |||
| Offset 68, 15 lines modified | Offset 68, 15 lines modified | ||
| 68 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode | 68 | ····*·cpe:/o:redhat:enterprise_linux:7::computenode |
| 69 | ····*·cpe:/o:redhat:enterprise_linux:7::server | 69 | ····*·cpe:/o:redhat:enterprise_linux:7::server |
| 70 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation | 70 | ····*·cpe:/o:redhat:enterprise_linux:7::workstation |
| 71 | ····*·cpe:/o:redhat:enterprise_linux:7 | 71 | ····*·cpe:/o:redhat:enterprise_linux:7 |
| 72 | ····*·cpe:/o:scientificlinux:scientificlinux:7 | 72 | ····*·cpe:/o:scientificlinux:scientificlinux:7 |
| 73 | *****·Revision·History·***** | 73 | *****·Revision·History·***** |
| 74 | Current·version:·0.1.65 | 74 | Current·version:·0.1.65 |
| 75 | ····*·draft·(as·of·202 | 75 | ····*·draft·(as·of·2025-02-23) |
| 76 | *****·Table·of·Contents·***** | 76 | *****·Table·of·Contents·***** |
| 77 | ···1.·System_Settings | 77 | ···1.·System_Settings |
| 78 | ·········1.·Installing_and_Maintaining_Software | 78 | ·········1.·Installing_and_Maintaining_Software |
| 79 | ·········2.·Account_and_Access_Control | 79 | ·········2.·Account_and_Access_Control |
| 80 | ·········3.·System_Accounting_with_auditd | 80 | ·········3.·System_Accounting_with_auditd |
| 81 | ·········4.·Configure_Syslog | 81 | ·········4.·Configure_Syslog |
| 82 | ·········5.·File_Permissions_and_Masks | 82 | ·········5.·File_Permissions_and_Masks |
| Offset 108, 14 lines modified | Offset 108, 24 lines modified | ||
| 108 | $·sudo·yum·reinstall·PACKAGENAME | 108 | $·sudo·yum·reinstall·PACKAGENAME |
| 109 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: | 109 | Alternatively,·the·package·can·be·reinstalled·from·trusted·media·using·the·command: |
| 110 | $·sudo·rpm·-Uvh·PACKAGENAME | 110 | $·sudo·rpm·-Uvh·PACKAGENAME |
| 111 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. | 111 | Rationale:·················The·hashes·of·important·files·like·system·executables·should·match·the·information·given·by·the·RPM·database.·Executables·with·erroneous·hashes·could·be·a·sign·of·nefarious·activity·on·the·system. |
| 112 | Severity: ················high | 112 | Severity: ················high |
| 113 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes | 113 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_hashes |
| 114 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule | 114 | Identifiers·and·References·References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS-00227,·6.1.1,·SV-214799r854001_rule |
| 115 | Remediation_Shell_script_⇲ | ||
| 116 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 117 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 118 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 119 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 120 | yum·reinstall·-y·$packages_to_reinstall | ||
| 115 | Remediation_Ansible_snippet_⇲ | 121 | Remediation_Ansible_snippet_⇲ |
| 116 | Complexity:·high | 122 | Complexity:·high |
| 117 | Disruption:·medium | 123 | Disruption:·medium |
| 118 | Strategy:···restrict | 124 | Strategy:···restrict |
| 119 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 125 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 120 | ··set_fact: | 126 | ··set_fact: |
| 121 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 127 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 265, 37 lines modified | Offset 275, 56 lines modified | ||
| 265 | ··-·PCI-DSS-Req-11.5 | 275 | ··-·PCI-DSS-Req-11.5 |
| 266 | ··-·high_complexity | 276 | ··-·high_complexity |
| 267 | ··-·high_severity | 277 | ··-·high_severity |
| 268 | ··-·medium_disruption | 278 | ··-·medium_disruption |
| 269 | ··-·no_reboot_needed | 279 | ··-·no_reboot_needed |
| 270 | ··-·restrict_strategy | 280 | ··-·restrict_strategy |
| 271 | ··-·rpm_verify_hashes | 281 | ··-·rpm_verify_hashes |
| 272 | Remediation_Shell_script_⇲ | ||
| 273 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files·names | ||
| 274 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 275 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 276 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 277 | yum·reinstall·-y·$packages_to_reinstall | ||
| 278 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 282 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 279 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: | 283 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many·that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor·values.·Check·the·file·permissions·with·the·following·command: |
| 280 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 284 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 281 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: | 285 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the·following·command·to·determine·which·package·owns·it: |
| 282 | $·rpm·-qf·FILENAME | 286 | $·rpm·-qf·FILENAME |
| 283 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 287 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| 284 | $·sudo·rpm·--setperms·PACKAGENAME | 288 | $·sudo·rpm·--setperms·PACKAGENAME |
| 285 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. | 289 | Warning: ·Profiles·may·require·that·specific·files·have·stricter·file·permissions·than·defined·by·the·vendor.·Such·files·will·be·reported·as·a·finding·and·need·to·be·evaluated·according·to·your·policy·and·deployment·environment. |
| 286 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. | 290 | Rationale:·················Permissions·on·system·binaries·and·configuration·files·that·are·too·generous·could·allow·an·unauthorized·user·to·gain·privileges·that·they·should·not·have.·The·permissions·set·by·the·vendor·should·be·maintained.·Any·deviations·from·this·baseline·should·be·investigated. |
| 287 | Severity: ················high | 291 | Severity: ················high |
| 288 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions | 292 | Rule·ID:···················xccdf_org.ssgproject.content_rule_rpm_verify_permissions |
| 289 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule | 293 | Identifiers·and·References·References: ·1,·11,·12,·13,·14,·15,·16,·18,·3,·5,·6,·9,·5.10.4.1,·APO01.06,·APO11.04,·BAI03.05,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS05.04,·DSS05.07,·DSS06.02,·MEA02.01,·3.3.8,·3.4.1,·CCI-001493,·CCI-001494,·CCI-001495,·CCI-001496,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312(c)(2),·164.312(e)(2)(i),·4.3.3.3.9,·4.3.3.5.8,·4.3.3.7.3,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.7,·4.4.2.1,·4.4.2.2,·4.4.2.4,·SR_2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1,·A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003-8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM-6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098,·SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·1.7.1.4,·1.7.1.5,·1.7.1.6,·6.1.1,·6.1.2,·6.1.3,·6.1.4,·6.1.5,·6.1.6,·6.1.7,·6.1.8,·6.1.9,·SV-204392r853878_rule |
| 294 | Remediation_Shell_script_⇲ | ||
| 295 | Complexity:·high | ||
| 296 | Disruption:·medium | ||
| 297 | Strategy:···restrict | ||
| 298 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 299 | declare·-A·SETPERMS_RPM_DICT | ||
| 300 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 301 | #·is·expected·by·the·RPM·database | ||
| 302 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 303 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 304 | do | ||
| 305 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 306 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 307 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 308 | ········do | ||
| 309 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 310 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 311 | ········done | ||
| 312 | done | ||
| 313 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 314 | #·correct·values | ||
| 315 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 316 | do | ||
| 317 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 318 | done | ||
| 290 | Remediation_Ansible_snippet_⇲ | 319 | Remediation_Ansible_snippet_⇲ |
| 291 | Complexity:·high | 320 | Complexity:·high |
| 292 | Disruption:·medium | 321 | Disruption:·medium |
| 293 | Strategy:···restrict | 322 | Strategy:···restrict |
| 294 | -·name:·Read·list·of·files·with·incorrect·permissions | 323 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 295 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 324 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 296 | ····--nocaps·--nolinkto·--nouser·--nogroup | 325 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 372, 96 lines modified | Offset 401, 101 lines modified | ||
| 372 | ··-·PCI-DSS-Req-11.5 | 401 | ··-·PCI-DSS-Req-11.5 |
| 373 | ··-·high_complexity | 402 | ··-·high_complexity |
| 374 | ··-·high_severity | 403 | ··-·high_severity |
| 375 | ··-·medium_disruption | 404 | ··-·medium_disruption |
| 376 | ··-·no_reboot_needed | 405 | ··-·no_reboot_needed |
| 377 | ··-·restrict_strategy | 406 | ··-·restrict_strategy |
| 378 | ··-·rpm_verify_permissions | 407 | ··-·rpm_verify_permissions |
| 379 | Remediation_Shell_script_⇲ | ||
| 380 | Complexity:·high | ||
| 381 | Disruption:·medium | ||
| 382 | Strategy:···restrict | ||
| 383 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 384 | declare·-A·SETPERMS_RPM_DICT | ||
| 385 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 386 | #·is·expected·by·the·RPM·database | ||
| 387 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| Max diff block lines reached; 576293/584610 bytes (98.58%) of diff not shown. | |||
| Offset 14343, 15 lines modified | Offset 14343, 15 lines modified | ||
| 00038060:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00038060:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00038070:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00038070:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00038080:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00038080:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00038090:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00038090:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 000380a0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 000380a0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 000380b0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 000380b0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 000380c0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 000380c0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 000380d0:·323 | 000380d0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 000380e0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 000380e0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 000380f0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 000380f0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00038100:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00038100:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00038110:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00038110:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00038120:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00038120:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00038130:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00038130:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00038140:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00038140:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15336, 123 lines modified | Offset 15336, 123 lines modified | ||
| 0003be70:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003be70:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003be80:·2369·646d·3534·3134·2220·7461·6269·6e64··#idm5414"·tabind | 0003be80:·2369·646d·3534·3134·2220·7461·6269·6e64··#idm5414"·tabind | ||
| 0003be90:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003be90:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003bea0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003bea0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003beb0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003beb0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003bec0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003bec0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003bed0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003bed0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003bee0:·5265·6d65·6469·6174·696f·6e20· | 0003bee0:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003bef0:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | |||
| 0003bf00:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bf10:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bf20:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bf30:·3534·3134·223e·3c74·6162·6c65·2063·6c61··5414"><table·cla | |||
| 0003bf40:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bf50:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bf60:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bf70:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bf80:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bef0:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003bf00:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bf10:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bf20:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bf30:·6964·6d35·3431·3422·3e3c·7461·626c·6520··idm5414"><table· | |||
| 0003bf40:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bf50:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bf60:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bf70:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bf80:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bf90:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bfa0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bfb0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bf | 0003bf90:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003bfa0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003bfb0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003bfc0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bfd0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bfe0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003bff0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c000:·3e3c·636f·6465·3e23·2052·656d·6564·6961··><code>#·Remedia | |||
| 0003c010:·7469·6f6e·2069·7320·6170·706c·6963·6162··tion·is·applicab | |||
| 0003c020:·6c65·206f·6e6c·7920·696e·2063·6572·7461··le·only·in·certa | |||
| 0003c030:·696e·2070·6c61·7466·6f72·6d73·0a69·6620··in·platforms.if· | |||
| 0003c040:·5b20·2120·2d66·202f·2e64·6f63·6b65·7265··[·!·-f·/.dockere | |||
| 0003c050:·6e76·205d·2026·616d·703b·2661·6d70·3b20··nv·]·&&· | |||
| 0003c060:·5b20·2120·2d66·202f·7275·6e2f·2e63·6f6e··[·!·-f·/run/.con | |||
| 0003c070:·7461·696e·6572·656e·7620·5d3b·2074·6865··tainerenv·];·the | |||
| 0003c080:·6e0a·0a7a·7970·7065·7220·696e·7374·616c··n..zypper·instal | |||
| 0003c090:·6c20·2d79·2022·6169·6465·220a·0a65·6c73··l·-y·"aide"..els | |||
| 0003c0a0:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003c0b0:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003c0c0:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003c0d0:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003c0e0:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003c0f0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c100:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c110:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bfd0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003bfe0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003bff0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c000:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003c010:·3a20·456e·7375·7265·2061·6964·6520·6973··:·Ensure·aide·is | |||
| 0003c020:·2069·6e73·7461·6c6c·6564·0a20·2070·6163···installed.··pac | |||
| 0003c030:·6b61·6765·3a0a·2020·2020·6e61·6d65·3a20··kage:.····name:· | |||
| 0003c040:·6169·6465·0a20·2020·2073·7461·7465·3a20··aide.····state:· | |||
| 0003c050:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 0003c060:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003c070:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003c080:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003c090:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003c0a0:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003c0b0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0003c0c0:·2d20·4343·452d·3833·3036·372d·390a·2020··-·CCE-83067-9.·· | |||
| 0003c0d0:·2d20·434a·4953·2d35·2e31·302e·312e·330a··-·CJIS-5.10.1.3. | |||
| 0003c0e0:·2020·2d20·4449·5341·2d53·5449·472d·534c····-·DISA-STIG-SL | |||
| 0003c0f0:·4553·2d31·322d·3031·3035·3030·0a20·202d··ES-12-010500.··- | |||
| 0003c100:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003c110:·3628·6129·0a20·202d·2050·4349·2d44·5353··6(a).··-·PCI-DSS | |||
| 0003c120:·2d52·6571·2d31·312e·350a·2020·2d20·656e··-Req-11.5.··-·en | |||
| 0003c130:·6162·6c65·5f73·7472·6174·6567·790a·2020··able_strategy.·· | |||
| 0003c140:·2d20·6c6f·775f·636f·6d70·6c65·7869·7479··-·low_complexity | |||
| 0003c150:·0a20·202d·206c·6f77·5f64·6973·7275·7074··.··-·low_disrupt | |||
| 0003c160:·696f·6e0a·2020·2d20·6d65·6469·756d·5f73··ion.··-·medium_s | |||
| 0003c170:·6576·6572·6974·790a·2020·2d20·6e6f·5f72··everity.··-·no_r | |||
| 0003c180:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 0003c190:·2070·6163·6b61·6765·5f61·6964·655f·696e···package_aide_in | |||
| 0003c1a0:·7374·616c·6c65·640a·3c2f·636f·6465·3e3c··stalled.</code>< | |||
| 0003c1b0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c1c0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c1d0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c1e0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c1f0:·612d·7461·7267·6574·3d22·2369·646d·3534··a-target="#idm54 | |||
| 0003c200:·3135·2220·7461·6269·6e64·6578·3d22·3022··15"·tabindex="0" | |||
| 0003c210:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c220:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c230:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c240:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c250:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c260:·6174·696f·6e20·4f53·4275·696c·6420·426c··ation·OSBuild·Bl | |||
| 0003c270:·7565·7072·696e·7420·736e·6970·7065·7420··ueprint·snippet· | |||
| 0003c280:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c290:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c | 0003c120:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003c2b0:·6964·3d22·6964·6d35·3431·3522·3e3c·7072··id="idm5415"><pr | |||
| 0003c2c0:·653e·3c63·6f64·653e·0a5b·5b70·6163·6b61··e><code>.[[packa | |||
| 0003c2d0:·6765·735d·5d0a·6e61·6d65·203d·2022·6169··ges]].name·=·"ai | |||
| 0003c2e0:·6465·220a·7665·7273·696f·6e20·3d20·222a··de".version·=·"* | |||
| 0003c2f0:·220a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··".</code></pre>< | |||
| 0003c300:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c310:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c | 0003c130:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c330:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| Max diff block lines reached; 5526010/5542762 bytes (99.70%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(enhanced) | 49 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·System_Accounting_with_auditd | 61 | ·········3.·System_Accounting_with_auditd |
| 62 | ·········4.·GRUB2_bootloader_configuration | 62 | ·········4.·GRUB2_bootloader_configuration |
| 63 | ·········5.·Configure_Syslog | 63 | ·········5.·Configure_Syslog |
| Offset 121, 14 lines modified | Offset 121, 26 lines modified | ||
| 121 | include·install_aide | 121 | include·install_aide |
| 122 | class·install_aide·{ | 122 | class·install_aide·{ |
| 123 | ··package·{·'aide': | 123 | ··package·{·'aide': |
| 124 | ····ensure·=>·'installed', | 124 | ····ensure·=>·'installed', |
| 125 | ··} | 125 | ··} |
| 126 | } | 126 | } |
| 127 | Remediation_Shell_script_⇲ | ||
| 128 | Complexity:·low | ||
| 129 | Disruption:·low | ||
| 130 | Strategy:···enable | ||
| 131 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 132 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 133 | zypper·install·-y·"aide" | ||
| 134 | else | ||
| 135 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 136 | fi | ||
| 127 | Remediation_Ansible_snippet_⇲ | 137 | Remediation_Ansible_snippet_⇲ |
| 128 | Complexity:·low | 138 | Complexity:·low |
| 129 | Disruption:·low | 139 | Disruption:·low |
| 130 | Strategy:···enable | 140 | Strategy:···enable |
| 131 | -·name:·Ensure·aide·is·installed | 141 | -·name:·Ensure·aide·is·installed |
| 132 | ··package: | 142 | ··package: |
| 133 | ····name:·aide | 143 | ····name:·aide |
| Offset 147, 26 lines modified | Offset 159, 14 lines modified | ||
| 147 | ··-·no_reboot_needed | 159 | ··-·no_reboot_needed |
| 148 | ··-·package_aide_installed | 160 | ··-·package_aide_installed |
| 149 | Remediation_OSBuild_Blueprint_snippet_⇲ | 161 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 150 | [[packages]] | 162 | [[packages]] |
| 151 | name·=·"aide" | 163 | name·=·"aide" |
| 152 | version·=·"*" | 164 | version·=·"*" |
| 153 | Remediation_Shell_script_⇲ | ||
| 154 | Complexity:·low | ||
| 155 | Disruption:·low | ||
| 156 | Strategy:···enable | ||
| 157 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 158 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | zypper·install·-y·"aide" | ||
| 160 | else | ||
| 161 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 162 | fi | ||
| 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 165 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 164 | Run·the·following·command·to·generate·a·new·database: | 166 | Run·the·following·command·to·generate·a·new·database: |
| 165 | $·sudo·/usr/bin/aide·--init | 167 | $·sudo·/usr/bin/aide·--init |
| 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 168 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 169 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 170 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 169 | database·can·be·installed·as·follows: | 171 | database·can·be·installed·as·follows: |
| Offset 181, 14 lines modified | Offset 181, 26 lines modified | ||
| 181 | ············Identifiers: ·CCE-91483-8 | 181 | ············Identifiers: ·CCE-91483-8 |
| 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | zypper·install·-y·"aide" | ||
| 192 | /usr/bin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 188 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 189 | Complexity:·low | 198 | Complexity:·low |
| 190 | Disruption:·low | 199 | Disruption:·low |
| 191 | Strategy:···restrict | 200 | Strategy:···restrict |
| 192 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 193 | ··package: | 202 | ··package: |
| 194 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 257, 26 lines modified | Offset 269, 14 lines modified | ||
| 257 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 258 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 259 | ··-·low_complexity | 271 | ··-·low_complexity |
| 260 | ··-·low_disruption | 272 | ··-·low_disruption |
| 261 | ··-·medium_severity | 273 | ··-·medium_severity |
| 262 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 263 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 264 | Remediation_Shell_script_⇲ | ||
| 265 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 266 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 267 | zypper·install·-y·"aide" | ||
| 268 | /usr/bin/aide·--init | ||
| 269 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 270 | else | ||
| 271 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 272 | fi | ||
| 273 | Group ·Disk·Partitioning· Group·contains·10·rules | 276 | Group ·Disk·Partitioning· Group·contains·10·rules |
| 274 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which | 277 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which |
| 275 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default | 278 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default |
| 276 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 279 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 277 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify | 280 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify |
| 278 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the | 281 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the |
| 279 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create | 282 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create |
| Offset 437, 14 lines modified | Offset 437, 26 lines modified | ||
| 437 | include·install_sudo | 437 | include·install_sudo |
| 438 | class·install_sudo·{ | 438 | class·install_sudo·{ |
| Max diff block lines reached; 642879/647456 bytes (99.29%) of diff not shown. | |||
| Offset 14342, 15 lines modified | Offset 14342, 15 lines modified | ||
| 00038050:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00038050:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00038060:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00038060:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00038070:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00038070:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00038080:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00038080:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00038090:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00038090:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 000380a0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 000380a0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 000380b0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 000380b0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 000380c0:·323 | 000380c0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 000380d0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 000380d0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 000380e0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 000380e0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 000380f0:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 000380f0:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00038100:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00038100:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00038110:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00038110:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00038120:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00038120:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00038130:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00038130:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15335, 123 lines modified | Offset 15335, 123 lines modified | ||
| 0003be60:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003be60:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003be70:·2369·646d·3534·3134·2220·7461·6269·6e64··#idm5414"·tabind | 0003be70:·2369·646d·3534·3134·2220·7461·6269·6e64··#idm5414"·tabind | ||
| 0003be80:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003be80:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003be90:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003be90:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003bea0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003bea0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003beb0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003beb0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003bec0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003bec0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003bed0:·5265·6d65·6469·6174·696f·6e20· | 0003bed0:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003bee0:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | |||
| 0003bef0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bf00:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bf10:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bf20:·3534·3134·223e·3c74·6162·6c65·2063·6c61··5414"><table·cla | |||
| 0003bf30:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bf40:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bf50:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bf60:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bf70:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bee0:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003bef0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bf00:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bf10:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bf20:·6964·6d35·3431·3422·3e3c·7461·626c·6520··idm5414"><table· | |||
| 0003bf30:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bf40:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bf50:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bf60:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bf70:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bf80:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bf90:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bfa0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bf | 0003bf80:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003bf90:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003bfa0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003bfb0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bfc0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bfd0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003bfe0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003bff0:·3e3c·636f·6465·3e23·2052·656d·6564·6961··><code>#·Remedia | |||
| 0003c000:·7469·6f6e·2069·7320·6170·706c·6963·6162··tion·is·applicab | |||
| 0003c010:·6c65·206f·6e6c·7920·696e·2063·6572·7461··le·only·in·certa | |||
| 0003c020:·696e·2070·6c61·7466·6f72·6d73·0a69·6620··in·platforms.if· | |||
| 0003c030:·5b20·2120·2d66·202f·2e64·6f63·6b65·7265··[·!·-f·/.dockere | |||
| 0003c040:·6e76·205d·2026·616d·703b·2661·6d70·3b20··nv·]·&&· | |||
| 0003c050:·5b20·2120·2d66·202f·7275·6e2f·2e63·6f6e··[·!·-f·/run/.con | |||
| 0003c060:·7461·696e·6572·656e·7620·5d3b·2074·6865··tainerenv·];·the | |||
| 0003c070:·6e0a·0a7a·7970·7065·7220·696e·7374·616c··n..zypper·instal | |||
| 0003c080:·6c20·2d79·2022·6169·6465·220a·0a65·6c73··l·-y·"aide"..els | |||
| 0003c090:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003c0a0:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003c0b0:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003c0c0:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003c0d0:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003c0e0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c0f0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c100:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bfc0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003bfd0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003bfe0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003bff0:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003c000:·3a20·456e·7375·7265·2061·6964·6520·6973··:·Ensure·aide·is | |||
| 0003c010:·2069·6e73·7461·6c6c·6564·0a20·2070·6163···installed.··pac | |||
| 0003c020:·6b61·6765·3a0a·2020·2020·6e61·6d65·3a20··kage:.····name:· | |||
| 0003c030:·6169·6465·0a20·2020·2073·7461·7465·3a20··aide.····state:· | |||
| 0003c040:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 0003c050:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003c060:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003c070:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003c080:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003c090:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003c0a0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0003c0b0:·2d20·4343·452d·3833·3036·372d·390a·2020··-·CCE-83067-9.·· | |||
| 0003c0c0:·2d20·434a·4953·2d35·2e31·302e·312e·330a··-·CJIS-5.10.1.3. | |||
| 0003c0d0:·2020·2d20·4449·5341·2d53·5449·472d·534c····-·DISA-STIG-SL | |||
| 0003c0e0:·4553·2d31·322d·3031·3035·3030·0a20·202d··ES-12-010500.··- | |||
| 0003c0f0:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003c100:·3628·6129·0a20·202d·2050·4349·2d44·5353··6(a).··-·PCI-DSS | |||
| 0003c110:·2d52·6571·2d31·312e·350a·2020·2d20·656e··-Req-11.5.··-·en | |||
| 0003c120:·6162·6c65·5f73·7472·6174·6567·790a·2020··able_strategy.·· | |||
| 0003c130:·2d20·6c6f·775f·636f·6d70·6c65·7869·7479··-·low_complexity | |||
| 0003c140:·0a20·202d·206c·6f77·5f64·6973·7275·7074··.··-·low_disrupt | |||
| 0003c150:·696f·6e0a·2020·2d20·6d65·6469·756d·5f73··ion.··-·medium_s | |||
| 0003c160:·6576·6572·6974·790a·2020·2d20·6e6f·5f72··everity.··-·no_r | |||
| 0003c170:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 0003c180:·2070·6163·6b61·6765·5f61·6964·655f·696e···package_aide_in | |||
| 0003c190:·7374·616c·6c65·640a·3c2f·636f·6465·3e3c··stalled.</code>< | |||
| 0003c1a0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c1b0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c1c0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c1d0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c1e0:·612d·7461·7267·6574·3d22·2369·646d·3534··a-target="#idm54 | |||
| 0003c1f0:·3135·2220·7461·6269·6e64·6578·3d22·3022··15"·tabindex="0" | |||
| 0003c200:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c210:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c220:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c230:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c240:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c250:·6174·696f·6e20·4f53·4275·696c·6420·426c··ation·OSBuild·Bl | |||
| 0003c260:·7565·7072·696e·7420·736e·6970·7065·7420··ueprint·snippet· | |||
| 0003c270:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c280:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c | 0003c110:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003c2a0:·6964·3d22·6964·6d35·3431·3522·3e3c·7072··id="idm5415"><pr | |||
| 0003c2b0:·653e·3c63·6f64·653e·0a5b·5b70·6163·6b61··e><code>.[[packa | |||
| 0003c2c0:·6765·735d·5d0a·6e61·6d65·203d·2022·6169··ges]].name·=·"ai | |||
| 0003c2d0:·6465·220a·7665·7273·696f·6e20·3d20·222a··de".version·=·"* | |||
| 0003c2e0:·220a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··".</code></pre>< | |||
| 0003c2f0:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c300:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c | 0003c120:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c320:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| Max diff block lines reached; 5711931/5728683 bytes (99.71%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(high) | 49 | Profile·Title·ANSSI-BP-028·(high) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·System_Accounting_with_auditd | 61 | ·········3.·System_Accounting_with_auditd |
| 62 | ·········4.·GRUB2_bootloader_configuration | 62 | ·········4.·GRUB2_bootloader_configuration |
| 63 | ·········5.·Configure_Syslog | 63 | ·········5.·Configure_Syslog |
| Offset 121, 14 lines modified | Offset 121, 26 lines modified | ||
| 121 | include·install_aide | 121 | include·install_aide |
| 122 | class·install_aide·{ | 122 | class·install_aide·{ |
| 123 | ··package·{·'aide': | 123 | ··package·{·'aide': |
| 124 | ····ensure·=>·'installed', | 124 | ····ensure·=>·'installed', |
| 125 | ··} | 125 | ··} |
| 126 | } | 126 | } |
| 127 | Remediation_Shell_script_⇲ | ||
| 128 | Complexity:·low | ||
| 129 | Disruption:·low | ||
| 130 | Strategy:···enable | ||
| 131 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 132 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 133 | zypper·install·-y·"aide" | ||
| 134 | else | ||
| 135 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 136 | fi | ||
| 127 | Remediation_Ansible_snippet_⇲ | 137 | Remediation_Ansible_snippet_⇲ |
| 128 | Complexity:·low | 138 | Complexity:·low |
| 129 | Disruption:·low | 139 | Disruption:·low |
| 130 | Strategy:···enable | 140 | Strategy:···enable |
| 131 | -·name:·Ensure·aide·is·installed | 141 | -·name:·Ensure·aide·is·installed |
| 132 | ··package: | 142 | ··package: |
| 133 | ····name:·aide | 143 | ····name:·aide |
| Offset 147, 26 lines modified | Offset 159, 14 lines modified | ||
| 147 | ··-·no_reboot_needed | 159 | ··-·no_reboot_needed |
| 148 | ··-·package_aide_installed | 160 | ··-·package_aide_installed |
| 149 | Remediation_OSBuild_Blueprint_snippet_⇲ | 161 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 150 | [[packages]] | 162 | [[packages]] |
| 151 | name·=·"aide" | 163 | name·=·"aide" |
| 152 | version·=·"*" | 164 | version·=·"*" |
| 153 | Remediation_Shell_script_⇲ | ||
| 154 | Complexity:·low | ||
| 155 | Disruption:·low | ||
| 156 | Strategy:···enable | ||
| 157 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 158 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | zypper·install·-y·"aide" | ||
| 160 | else | ||
| 161 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 162 | fi | ||
| 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 165 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 164 | Run·the·following·command·to·generate·a·new·database: | 166 | Run·the·following·command·to·generate·a·new·database: |
| 165 | $·sudo·/usr/bin/aide·--init | 167 | $·sudo·/usr/bin/aide·--init |
| 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 168 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 169 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 170 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 169 | database·can·be·installed·as·follows: | 171 | database·can·be·installed·as·follows: |
| Offset 181, 14 lines modified | Offset 181, 26 lines modified | ||
| 181 | ············Identifiers: ·CCE-91483-8 | 181 | ············Identifiers: ·CCE-91483-8 |
| 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | zypper·install·-y·"aide" | ||
| 192 | /usr/bin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 188 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 189 | Complexity:·low | 198 | Complexity:·low |
| 190 | Disruption:·low | 199 | Disruption:·low |
| 191 | Strategy:···restrict | 200 | Strategy:···restrict |
| 192 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 193 | ··package: | 202 | ··package: |
| 194 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 257, 26 lines modified | Offset 269, 14 lines modified | ||
| 257 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 258 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 259 | ··-·low_complexity | 271 | ··-·low_complexity |
| 260 | ··-·low_disruption | 272 | ··-·low_disruption |
| 261 | ··-·medium_severity | 273 | ··-·medium_severity |
| 262 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 263 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 264 | Remediation_Shell_script_⇲ | ||
| 265 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 266 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 267 | zypper·install·-y·"aide" | ||
| 268 | /usr/bin/aide·--init | ||
| 269 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 270 | else | ||
| 271 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 272 | fi | ||
| 273 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 276 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 274 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 277 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 275 | using·cron,·add·the·following·line·to·/etc/crontab: | 278 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 276 | 05·4·*·*·*·root·/usr/bin/aide·--check | 279 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 277 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 280 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 278 | 05·4·*·*·0·root·/usr/bin/aide·--check | 281 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 279 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 282 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 300, 14 lines modified | Offset 300, 30 lines modified | ||
| 300 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 300 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 301 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 301 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 302 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 302 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 663702/668557 bytes (99.27%) of diff not shown. | |||
| Offset 14344, 15 lines modified | Offset 14344, 15 lines modified | ||
| 00038070:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00038070:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00038080:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00038080:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00038090:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00038090:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 000380a0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 000380a0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 000380b0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 000380b0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 000380c0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 000380c0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 000380d0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 000380d0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 000380e0:·323 | 000380e0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 000380f0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 000380f0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00038100:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00038100:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00038110:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00038110:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00038120:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00038120:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00038130:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00038130:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00038140:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00038140:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00038150:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00038150:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15331, 123 lines modified | Offset 15331, 123 lines modified | ||
| 0003be20:·7267·6574·3d22·2369·646d·3534·3134·2220··rget="#idm5414"· | 0003be20:·7267·6574·3d22·2369·646d·3534·3134·2220··rget="#idm5414"· | ||
| 0003be30:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003be30:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003be40:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003be40:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003be50:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003be50:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003be60:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003be60:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003be70:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003be70:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003be80:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003be80:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003be90:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bea0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003beb0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bec0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bed0:·2220·6964·3d22·6964·6d35·3431·3422·3e3c··"·id="idm5414">< | |||
| 0003bee0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bef0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bf00:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bf10:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bf20:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003b | 0003be90:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | ||
| 0003bea0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003beb0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bec0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bed0:·643d·2269·646d·3534·3134·223e·3c74·6162··d="idm5414"><tab | |||
| 0003bee0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bef0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bf00:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bf10:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bf20:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bf30:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bf40:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bf50:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bf60:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bf70:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bf80:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003bf | 0003bf90:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003bfa0:·653e·3c70·7265·3e3c·636f·6465·3e23·2052··e><pre><code>#·R | |||
| 0003bfb0:·656d·6564·6961·7469·6f6e·2069·7320·6170··emediation·is·ap | |||
| 0003bfc0:·706c·6963·6162·6c65·206f·6e6c·7920·696e··plicable·only·in | |||
| 0003bfd0:·2063·6572·7461·696e·2070·6c61·7466·6f72···certain·platfor | |||
| 0003bfe0:·6d73·0a69·6620·5b20·2120·2d66·202f·2e64··ms.if·[·!·-f·/.d | |||
| 0003bff0:·6f63·6b65·7265·6e76·205d·2026·616d·703b··ockerenv·]·& | |||
| 0003c000:·2661·6d70·3b20·5b20·2120·2d66·202f·7275··&·[·!·-f·/ru | |||
| 0003c010:·6e2f·2e63·6f6e·7461·696e·6572·656e·7620··n/.containerenv· | |||
| 0003c020:·5d3b·2074·6865·6e0a·0a7a·7970·7065·7220··];·then..zypper· | |||
| 0003c030:·696e·7374·616c·6c20·2d79·2022·6169·6465··install·-y·"aide | |||
| 0003c040:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 0003c050:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 0003c060:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 0003c070:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 0003c080:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 0003c090:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c0a0:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c0b0:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c0c0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bf50:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bf60:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bf70:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003bf80:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003bf90:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003bfa0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003bfb0:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003bfc0:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003bfd0:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003bfe0:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003bff0:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003c000:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003c010:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003c020:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003c030:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003c040:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003c050:·636f·6e74·6169·6e65·7222·5d0a·2020·7461··container"].··ta | |||
| 0003c060:·6773·3a0a·2020·2d20·4343·452d·3833·3036··gs:.··-·CCE-8306 | |||
| 0003c070:·372d·390a·2020·2d20·434a·4953·2d35·2e31··7-9.··-·CJIS-5.1 | |||
| 0003c080:·302e·312e·330a·2020·2d20·4449·5341·2d53··0.1.3.··-·DISA-S | |||
| 0003c090:·5449·472d·534c·4553·2d31·322d·3031·3035··TIG-SLES-12-0105 | |||
| 0003c0a0:·3030·0a20·202d·204e·4953·542d·3830·302d··00.··-·NIST-800- | |||
| 0003c0b0:·3533·2d43·4d2d·3628·6129·0a20·202d·2050··53-CM-6(a).··-·P | |||
| 0003c0c0:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003c0d0:·2020·2d20·656e·6162·6c65·5f73·7472·6174····-·enable_strat | |||
| 0003c0e0:·6567·790a·2020·2d20·6c6f·775f·636f·6d70··egy.··-·low_comp | |||
| 0003c0f0:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003c100:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003c110:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003c120:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003c130:·6564·0a20·202d·2070·6163·6b61·6765·5f61··ed.··-·package_a | |||
| 0003c140:·6964·655f·696e·7374·616c·6c65·640a·3c2f··ide_installed.</ | |||
| 0003c150:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c160:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c170:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c180:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c190:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c1a0:·2369·646d·3534·3135·2220·7461·6269·6e64··#idm5415"·tabind | |||
| 0003c1b0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c1c0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c1d0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c1e0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c1f0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c200:·5265·6d65·6469·6174·696f·6e20·4f53·4275··Remediation·OSBu | |||
| 0003c210:·696c·6420·426c·7565·7072·696e·7420·736e··ild·Blueprint·sn | |||
| 0003c220:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c230:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c240:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c250:·6170·7365·2220·6964·3d22·6964·6d35·3431··apse"·id="idm541 | |||
| 0003c260:·3522·3e3c·7072·653e·3c63·6f64·653e·0a5b··5"><pre><code>.[ | |||
| 0003c270:·5b70·6163·6b61·6765·735d·5d0a·6e61·6d65··[packages]].name | |||
| 0003c280:·203d·2022·6169·6465·220a·7665·7273·696f···=·"aide".versio | |||
| 0003c290:·6e20·3d20·222a·220a·3c2f·636f·6465·3e3c··n·=·"*".</code>< | |||
| 0003c2a0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c2b0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c | 0003c0d0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c0e0:·743d·2223·6964·6d35·3431·3522·2074·6162··t="#idm5415"·tab | |||
| 0003c0f0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| Max diff block lines reached; 5293477/5310229 bytes (99.68%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(intermediary) | 49 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·System_Accounting_with_auditd | 61 | ·········3.·System_Accounting_with_auditd |
| 62 | ·········4.·Configure_Syslog | 62 | ·········4.·Configure_Syslog |
| 63 | ·········5.·Network_Configuration_and_Firewalls | 63 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 120, 14 lines modified | Offset 120, 26 lines modified | ||
| 120 | include·install_aide | 120 | include·install_aide |
| 121 | class·install_aide·{ | 121 | class·install_aide·{ |
| 122 | ··package·{·'aide': | 122 | ··package·{·'aide': |
| 123 | ····ensure·=>·'installed', | 123 | ····ensure·=>·'installed', |
| 124 | ··} | 124 | ··} |
| 125 | } | 125 | } |
| 126 | Remediation_Shell_script_⇲ | ||
| 127 | Complexity:·low | ||
| 128 | Disruption:·low | ||
| 129 | Strategy:···enable | ||
| 130 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 131 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 132 | zypper·install·-y·"aide" | ||
| 133 | else | ||
| 134 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 135 | fi | ||
| 126 | Remediation_Ansible_snippet_⇲ | 136 | Remediation_Ansible_snippet_⇲ |
| 127 | Complexity:·low | 137 | Complexity:·low |
| 128 | Disruption:·low | 138 | Disruption:·low |
| 129 | Strategy:···enable | 139 | Strategy:···enable |
| 130 | -·name:·Ensure·aide·is·installed | 140 | -·name:·Ensure·aide·is·installed |
| 131 | ··package: | 141 | ··package: |
| 132 | ····name:·aide | 142 | ····name:·aide |
| Offset 146, 26 lines modified | Offset 158, 14 lines modified | ||
| 146 | ··-·no_reboot_needed | 158 | ··-·no_reboot_needed |
| 147 | ··-·package_aide_installed | 159 | ··-·package_aide_installed |
| 148 | Remediation_OSBuild_Blueprint_snippet_⇲ | 160 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 149 | [[packages]] | 161 | [[packages]] |
| 150 | name·=·"aide" | 162 | name·=·"aide" |
| 151 | version·=·"*" | 163 | version·=·"*" |
| 152 | Remediation_Shell_script_⇲ | ||
| 153 | Complexity:·low | ||
| 154 | Disruption:·low | ||
| 155 | Strategy:···enable | ||
| 156 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 157 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 158 | zypper·install·-y·"aide" | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 164 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 165 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/bin/aide·--init | 166 | $·sudo·/usr/bin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 167 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 168 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 169 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 168 | database·can·be·installed·as·follows: | 170 | database·can·be·installed·as·follows: |
| Offset 180, 14 lines modified | Offset 180, 26 lines modified | ||
| 180 | ············Identifiers: ·CCE-91483-8 | 180 | ············Identifiers: ·CCE-91483-8 |
| 181 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 181 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 182 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 182 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 183 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 183 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 184 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 184 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 185 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 185 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 186 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 186 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 187 | Remediation_Shell_script_⇲ | ||
| 188 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 189 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 190 | zypper·install·-y·"aide" | ||
| 191 | /usr/bin/aide·--init | ||
| 192 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 193 | else | ||
| 194 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 195 | fi | ||
| 187 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 197 | Complexity:·low |
| 189 | Disruption:·low | 198 | Disruption:·low |
| 190 | Strategy:···restrict | 199 | Strategy:···restrict |
| 191 | -·name:·Ensure·AIDE·is·installed | 200 | -·name:·Ensure·AIDE·is·installed |
| 192 | ··package: | 201 | ··package: |
| 193 | ····name:·'{{·item·}}' | 202 | ····name:·'{{·item·}}' |
| Offset 256, 26 lines modified | Offset 268, 14 lines modified | ||
| 256 | ··-·PCI-DSS-Req-11.5 | 268 | ··-·PCI-DSS-Req-11.5 |
| 257 | ··-·aide_build_database | 269 | ··-·aide_build_database |
| 258 | ··-·low_complexity | 270 | ··-·low_complexity |
| 259 | ··-·low_disruption | 271 | ··-·low_disruption |
| 260 | ··-·medium_severity | 272 | ··-·medium_severity |
| 261 | ··-·no_reboot_needed | 273 | ··-·no_reboot_needed |
| 262 | ··-·restrict_strategy | 274 | ··-·restrict_strategy |
| 263 | Remediation_Shell_script_⇲ | ||
| 264 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 265 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 266 | zypper·install·-y·"aide" | ||
| 267 | /usr/bin/aide·--init | ||
| 268 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 269 | else | ||
| 270 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 271 | fi | ||
| 272 | Group ·Disk·Partitioning· Group·contains·10·rules | 275 | Group ·Disk·Partitioning· Group·contains·10·rules |
| 273 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which | 276 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which |
| 274 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default | 277 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default |
| 275 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 278 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 276 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify | 279 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify |
| 277 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the | 280 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the |
| 278 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create | 281 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create |
| Offset 436, 14 lines modified | Offset 436, 26 lines modified | ||
| 436 | include·install_sudo | 436 | include·install_sudo |
| 437 | class·install_sudo·{ | 437 | class·install_sudo·{ |
| Max diff block lines reached; 614470/619060 bytes (99.26%) of diff not shown. | |||
| Offset 14342, 16 lines modified | Offset 14342, 16 lines modified | ||
| 00038050:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038050:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00038060:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00038060:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00038070:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00038070:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00038080:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00038080:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00038090:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00038090:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 000380a0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 000380a0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 000380b0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000380b0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000380c0:·2020·2028·6173·206f·6620·3230·323 | 000380c0:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 000380d0:·3 | 000380d0:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 000380e0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 000380e0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 000380f0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 000380f0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00038100:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00038100:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00038110:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00038110:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00038120:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00038120:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00038130:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00038130:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00038140:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00038140:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15063, 144 lines modified | Offset 15063, 144 lines modified | ||
| 0003ad60:·6574·3d22·2369·646d·3734·3932·2220·7461··et="#idm7492"·ta | 0003ad60:·6574·3d22·2369·646d·3734·3932·2220·7461··et="#idm7492"·ta | ||
| 0003ad70:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003ad70:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003ad80:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003ad80:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003ad90:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003ad90:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003ada0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003ada0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003adb0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003adb0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003adc0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003adc0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003add0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003ade0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003ad | 0003add0:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | ||
| 0003ade0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003adf0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003ae00:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003ae10:·2269·646d·3734·3932·223e·3c74·6162·6c65··"idm7492"><table | |||
| 0003ae20:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003ae30:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003ae40:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003ae50:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003ae60:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003ae70:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003ae80:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003ae90:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003aea0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003aeb0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003aec0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003aed0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003aee0:·653e·3c70·7265·3e3c·636f·6465·3e0a·666f··e><pre><code>.fo | |||
| 0003aef0:·7220·6620·696e·202f·6574·632f·7375·646f··r·f·in·/etc/sudo | |||
| 0003af00:·6572·7320·2f65·7463·2f73·7564·6f65·7273··ers·/etc/sudoers | |||
| 0003af10:·2e64·2f2a·203b·2064·6f0a·2020·6966·205b··.d/*·;·do.··if·[ | |||
| 0003af20:·2021·202d·6520·2224·6622·205d·203b·2074···!·-e·"$f"·]·;·t | |||
| 0003af30:·6865·6e0a·2020·2020·636f·6e74·696e·7565··hen.····continue | |||
| 0003af40:·0a20·2066·690a·2020·6d61·7463·6869·6e67··.··fi.··matching | |||
| 0003af50:·5f6c·6973·743d·2428·6772·6570·202d·5020··_list=$(grep·-P· | |||
| 0003af60:·275e·283f·2123·292e·2a5b·5c73·5d2b·5c21··'^(?!#).*[\s]+\! | |||
| 0003af70:·6175·7468·656e·7469·6361·7465·2e2a·2427··authenticate.*$' | |||
| 0003af80:·2024·6620·7c20·756e·6971·2029·0a20·2069···$f·|·uniq·).··i | |||
| 0003af90:·6620·2120·7465·7374·202d·7a20·2224·6d61··f·!·test·-z·"$ma | |||
| 0003afa0:·7463·6869·6e67·5f6c·6973·7422·3b20·7468··tching_list";·th | |||
| 0003afb0:·656e·0a20·2020·2077·6869·6c65·2049·4653··en.····while·IFS | |||
| 0003afc0:·3d20·7265·6164·202d·7220·656e·7472·793b··=·read·-r·entry; | |||
| 0003afd0:·2064·6f0a·2020·2020·2020·2320·636f·6d6d···do.······#·comm | |||
| 0003afe0:·656e·7420·6f75·7420·2221·6175·7468·656e··ent·out·"!authen | |||
| 0003aff0:·7469·6361·7465·2220·6d61·7463·6865·7320··ticate"·matches· | |||
| 0003b000:·746f·2070·7265·7365·7276·6520·7573·6572··to·preserve·user | |||
| 0003b010:·2064·6174·610a·2020·2020·2020·7365·6420···data.······sed· | |||
| 0003b020:·2d69·2022·732f·5e24·7b65·6e74·7279·7d24··-i·"s/^${entry}$ | |||
| 0003b030:·2f23·2026·616d·703b·2f67·2220·2466·0a20··/#·&/g"·$f.· | |||
| 0003b040:·2020·2064·6f6e·6520·266c·743b·266c·743b·····done·<< | |||
| 0003b050:·266c·743b·2022·246d·6174·6368·696e·675f··<·"$matching_ | |||
| 0003b060:·6c69·7374·220a·0a20·2020·202f·7573·722f··list"..····/usr/ | |||
| 0003b070:·7362·696e·2f76·6973·7564·6f20·2d63·6620··sbin/visudo·-cf· | |||
| 0003b080:·2466·2026·616d·703b·2667·743b·202f·6465··$f·&>·/de | |||
| 0003b090:·762f·6e75·6c6c·207c·7c20·6563·686f·2022··v/null·||·echo·" | |||
| 0003b0a0:·4661·696c·2074·6f20·7661·6c69·6461·7465··Fail·to·validate | |||
| 0003b0b0:·2024·6620·7769·7468·2076·6973·7564·6f22···$f·with·visudo" | |||
| 0003b0c0:·0a20·2066·690a·646f·6e65·0a3c·2f63·6f64··.··fi.done.</cod | |||
| 0003b0d0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003b0e0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003b0f0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003 | 0003b100:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003ae10:·6964·3d22·6964·6d37·3439·3222·3e3c·7461··id="idm7492"><ta | |||
| 0003ae20:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003ae30:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003ae40:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003ae50:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003ae60:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003ae70:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003ae80:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003 | 0003b110:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003b120:·6d37·3439·3322·2074·6162·696e·6465·783d··m7493"·tabindex= | |||
| 0003b130:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003b140:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003b150:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003b160:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003b170:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003b180:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b190:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b1a0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b1b0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b1c0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b1d0:·3734·3933·223e·3c74·6162·6c65·2063·6c61··7493"><table·cla | |||
| 0003b1e0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b1f0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b200:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b210:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b220:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003 | 0003b230:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003aeb0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003aec0:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003aed0:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003aee0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003aef0:·2d20·6e61·6d65·3a20·4669·6e64·202f·6574··-·name:·Find·/et | |||
| 0003af00:·632f·7375·646f·6572·732e·642f·2066·696c··c/sudoers.d/·fil | |||
| 0003af10:·6573·0a20·2066·696e·643a·0a20·2020·2070··es.··find:.····p | |||
| 0003af20:·6174·6873·3a0a·2020·2020·2d20·2f65·7463··aths:.····-·/etc | |||
| 0003af30:·2f73·7564·6f65·7273·2e64·2f0a·2020·7265··/sudoers.d/.··re | |||
| 0003af40:·6769·7374·6572·3a20·7375·646f·6572·730a··gister:·sudoers. | |||
| 0003af50:·2020·7461·6773·3a0a·2020·2d20·4343·452d····tags:.··-·CCE- | |||
| 0003af60:·3833·3031·332d·330a·2020·2d20·4449·5341··83013-3.··-·DISA | |||
| 0003af70:·2d53·5449·472d·534c·4553·2d31·322d·3031··-STIG-SLES-12-01 | |||
| 0003af80:·3031·3130·0a20·202d·204e·4953·542d·3830··0110.··-·NIST-80 | |||
| 0003af90:·302d·3533·2d43·4d2d·3628·6129·0a20·202d··0-53-CM-6(a).··- | |||
| 0003afa0:·204e·4953·542d·3830·302d·3533·2d49·412d···NIST-800-53-IA- | |||
| 0003 | 0003b240:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003b250:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003b260:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003b270:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003b280:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003b290:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| Max diff block lines reached; 1556058/1575846 bytes (98.74%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(minimal) | 49 | Profile·Title·ANSSI-BP-028·(minimal) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·Configure_Syslog | 61 | ·········3.·Configure_Syslog |
| 62 | ·········4.·File_Permissions_and_Masks | 62 | ·········4.·File_Permissions_and_Masks |
| 63 | ···2.·Services | 63 | ···2.·Services |
| Offset 95, 14 lines modified | Offset 95, 33 lines modified | ||
| 95 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 95 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 96 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 96 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 97 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 97 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 98 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 98 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 99 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 99 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 100 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 100 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 101 | ············000373-VMM-001490,·SLES-12-010110,·SV-217112r646686_rule | 101 | ············000373-VMM-001490,·SLES-12-010110,·SV-217112r646686_rule |
| 102 | Remediation_Shell_script_⇲ | ||
| 103 | Complexity:·low | ||
| 104 | Disruption:·low | ||
| 105 | Strategy:···restrict | ||
| 106 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 107 | ··if·[·!·-e·"$f"·]·;·then | ||
| 108 | ····continue | ||
| 109 | ··fi | ||
| 110 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 111 | ··if·!·test·-z·"$matching_list";·then | ||
| 112 | ····while·IFS=·read·-r·entry;·do | ||
| 113 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 114 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 115 | ····done·<<<·"$matching_list" | ||
| 116 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 117 | ··fi | ||
| 118 | done | ||
| 102 | Remediation_Ansible_snippet_⇲ | 119 | Remediation_Ansible_snippet_⇲ |
| 103 | Complexity:·low | 120 | Complexity:·low |
| 104 | Disruption:·low | 121 | Disruption:·low |
| 105 | Strategy:···restrict | 122 | Strategy:···restrict |
| 106 | -·name:·Find·/etc/sudoers.d/·files | 123 | -·name:·Find·/etc/sudoers.d/·files |
| 107 | ··find: | 124 | ··find: |
| 108 | ····paths: | 125 | ····paths: |
| Offset 136, 33 lines modified | Offset 155, 14 lines modified | ||
| 136 | ··-·NIST-800-53-IA-11 | 155 | ··-·NIST-800-53-IA-11 |
| 137 | ··-·low_complexity | 156 | ··-·low_complexity |
| 138 | ··-·low_disruption | 157 | ··-·low_disruption |
| 139 | ··-·medium_severity | 158 | ··-·medium_severity |
| 140 | ··-·no_reboot_needed | 159 | ··-·no_reboot_needed |
| 141 | ··-·restrict_strategy | 160 | ··-·restrict_strategy |
| 142 | ··-·sudo_remove_no_authenticate | 161 | ··-·sudo_remove_no_authenticate |
| 143 | Remediation_Shell_script_⇲ | ||
| 144 | Complexity:·low | ||
| 145 | Disruption:·low | ||
| 146 | Strategy:···restrict | ||
| 147 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 148 | ··if·[·!·-e·"$f"·]·;·then | ||
| 149 | ····continue | ||
| 150 | ··fi | ||
| 151 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 152 | ··if·!·test·-z·"$matching_list";·then | ||
| 153 | ····while·IFS=·read·-r·entry;·do | ||
| 154 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 155 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 156 | ····done·<<<·"$matching_list" | ||
| 157 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 158 | ··fi | ||
| 159 | done | ||
| 160 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 162 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 161 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 163 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 162 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 164 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 163 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 165 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 164 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 166 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 165 | ············have·authorization. | 167 | ············have·authorization. |
| 166 | Rationale: | 168 | Rationale: |
| Offset 174, 14 lines modified | Offset 174, 33 lines modified | ||
| 174 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 174 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 175 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 175 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 176 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 176 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 177 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 177 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 178 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 178 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 179 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 179 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 180 | ············000373-VMM-001490,·SLES-12-010110,·SV-217112r646686_rule | 180 | ············000373-VMM-001490,·SLES-12-010110,·SV-217112r646686_rule |
| 181 | Remediation_Shell_script_⇲ | ||
| 182 | Complexity:·low | ||
| 183 | Disruption:·low | ||
| 184 | Strategy:···restrict | ||
| 185 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 186 | ··if·[·!·-e·"$f"·]·;·then | ||
| 187 | ····continue | ||
| 188 | ··fi | ||
| 189 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 190 | ··if·!·test·-z·"$matching_list";·then | ||
| 191 | ····while·IFS=·read·-r·entry;·do | ||
| 192 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 193 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 194 | ····done·<<<·"$matching_list" | ||
| 195 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 196 | ··fi | ||
| 197 | done | ||
| 181 | Remediation_Ansible_snippet_⇲ | 198 | Remediation_Ansible_snippet_⇲ |
| 182 | Complexity:·low | 199 | Complexity:·low |
| 183 | Disruption:·low | 200 | Disruption:·low |
| 184 | Strategy:···restrict | 201 | Strategy:···restrict |
| 185 | -·name:·Find·/etc/sudoers.d/·files | 202 | -·name:·Find·/etc/sudoers.d/·files |
| 186 | ··find: | 203 | ··find: |
| 187 | ····paths: | 204 | ····paths: |
| Offset 215, 33 lines modified | Offset 234, 14 lines modified | ||
| 215 | ··-·NIST-800-53-IA-11 | 234 | ··-·NIST-800-53-IA-11 |
| 216 | ··-·low_complexity | 235 | ··-·low_complexity |
| 217 | ··-·low_disruption | 236 | ··-·low_disruption |
| 218 | ··-·medium_severity | 237 | ··-·medium_severity |
| 219 | ··-·no_reboot_needed | 238 | ··-·no_reboot_needed |
| 220 | ··-·restrict_strategy | 239 | ··-·restrict_strategy |
| 221 | ··-·sudo_remove_nopasswd | 240 | ··-·sudo_remove_nopasswd |
| 222 | Remediation_Shell_script_⇲ | ||
| 223 | Complexity:·low | ||
| Max diff block lines reached; 123210/128677 bytes (95.75%) of diff not shown. | |||
| Offset 14311, 16 lines modified | Offset 14311, 16 lines modified | ||
| 00037e60:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037e60:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037e70:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037e70:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037e80:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037e80:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037e90:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037e90:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037ea0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037ea0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037eb0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037eb0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037ec0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037ec0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ed0:·2861·7320·6f66·2032·3032·3 | 00037ed0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037ee0:·3 | 00037ee0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037ef0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037ef0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037f00:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037f00:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037f10:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037f10:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037f20:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037f20:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037f30:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037f30:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037f40:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037f40:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037f50:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037f50:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15365, 124 lines modified | Offset 15365, 124 lines modified | ||
| 0003c040:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003c040:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c050:·743d·2223·6964·6d35·3431·3422·2074·6162··t="#idm5414"·tab | 0003c050:·743d·2223·6964·6d35·3431·3422·2074·6162··t="#idm5414"·tab | ||
| 0003c060:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003c060:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003c070:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003c070:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003c080:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003c080:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003c090:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003c090:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003c0a0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003c0a0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003c0b0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003c0b0:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 0003c0c0:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | |||
| 0003c0d0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003c0e0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003c0f0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003c100:·6964·6d35·3431·3422·3e3c·7461·626c·6520··idm5414"><table· | |||
| 0003c110:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003c120:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003c130:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003c140:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003c150:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003c0c0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003c0d0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c0e0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c0f0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c100:·643d·2269·646d·3534·3134·223e·3c74·6162··d="idm5414"><tab | |||
| 0003c110:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c120:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c130:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c140:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c150:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c160:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c170:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c180:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c1 | 0003c160:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c170:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003c180:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003c190:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c1a0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c1b0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003c1c0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c1d0:·7072·653e·3c63·6f64·653e·2320·5265·6d65··pre><code>#·Reme | |||
| 0003c1e0:·6469·6174·696f·6e20·6973·2061·7070·6c69··diation·is·appli | |||
| 0003c1f0:·6361·626c·6520·6f6e·6c79·2069·6e20·6365··cable·only·in·ce | |||
| 0003c200:·7274·6169·6e20·706c·6174·666f·726d·730a··rtain·platforms. | |||
| 0003c210:·6966·205b·2021·202d·6620·2f2e·646f·636b··if·[·!·-f·/.dock | |||
| 0003c220:·6572·656e·7620·5d20·2661·6d70·3b26·616d··erenv·]·&&am | |||
| 0003c230:·703b·205b·2021·202d·6620·2f72·756e·2f2e··p;·[·!·-f·/run/. | |||
| 0003c240:·636f·6e74·6169·6e65·7265·6e76·205d·3b20··containerenv·];· | |||
| 0003c250:·7468·656e·0a0a·7a79·7070·6572·2069·6e73··then..zypper·ins | |||
| 0003c260:·7461·6c6c·202d·7920·2261·6964·6522·0a0a··tall·-y·"aide".. | |||
| 0003c270:·656c·7365·0a20·2020·2026·6774·3b26·616d··else.····>&am | |||
| 0003c280:·703b·3220·6563·686f·2027·5265·6d65·6469··p;2·echo·'Remedi | |||
| 0003c290:·6174·696f·6e20·6973·206e·6f74·2061·7070··ation·is·not·app | |||
| 0003c2a0:·6c69·6361·626c·652c·206e·6f74·6869·6e67··licable,·nothing | |||
| 0003c2b0:·2077·6173·2064·6f6e·6527·0a66·690a·3c2f···was·done'.fi.</ | |||
| 0003c2c0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c2d0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c2e0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c2f0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c1a0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c1b0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c1c0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c1d0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003c1e0:·616d·653a·2045·6e73·7572·6520·6169·6465··ame:·Ensure·aide | |||
| 0003c1f0:·2069·7320·696e·7374·616c·6c65·640a·2020···is·installed.·· | |||
| 0003c200:·7061·636b·6167·653a·0a20·2020·206e·616d··package:.····nam | |||
| 0003c210:·653a·2061·6964·650a·2020·2020·7374·6174··e:·aide.····stat | |||
| 0003c220:·653a·2070·7265·7365·6e74·0a20·2077·6865··e:·present.··whe | |||
| 0003c230:·6e3a·2061·6e73·6962·6c65·5f76·6972·7475··n:·ansible_virtu | |||
| 0003c240:·616c·697a·6174·696f·6e5f·7479·7065·206e··alization_type·n | |||
| 0003c250:·6f74·2069·6e20·5b22·646f·636b·6572·222c··ot·in·["docker", | |||
| 0003c260:·2022·6c78·6322·2c20·226f·7065·6e76·7a22···"lxc",·"openvz" | |||
| 0003c270:·2c20·2270·6f64·6d61·6e22·2c20·2263·6f6e··,·"podman",·"con | |||
| 0003c280:·7461·696e·6572·225d·0a20·2074·6167·733a··tainer"].··tags: | |||
| 0003c290:·0a20·202d·2043·4345·2d38·3330·3637·2d39··.··-·CCE-83067-9 | |||
| 0003c2a0:·0a20·202d·2043·4a49·532d·352e·3130·2e31··.··-·CJIS-5.10.1 | |||
| 0003c2b0:·2e33·0a20·202d·2044·4953·412d·5354·4947··.3.··-·DISA-STIG | |||
| 0003c2c0:·2d53·4c45·532d·3132·2d30·3130·3530·300a··-SLES-12-010500. | |||
| 0003c2d0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c2e0:·434d·2d36·2861·290a·2020·2d20·5043·492d··CM-6(a).··-·PCI- | |||
| 0003c2f0:·4453·532d·5265·712d·3131·2e35·0a20·202d··DSS-Req-11.5.··- | |||
| 0003c300:·2065·6e61·626c·655f·7374·7261·7465·6779···enable_strategy | |||
| 0003c310:·0a20·202d·206c·6f77·5f63·6f6d·706c·6578··.··-·low_complex | |||
| 0003c320:·6974·790a·2020·2d20·6c6f·775f·6469·7372··ity.··-·low_disr | |||
| 0003c330:·7570·7469·6f6e·0a20·202d·206d·6564·6975··uption.··-·mediu | |||
| 0003c340:·6d5f·7365·7665·7269·7479·0a20·202d·206e··m_severity.··-·n | |||
| 0003c350:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 0003c360:·2020·2d20·7061·636b·6167·655f·6169·6465····-·package_aide | |||
| 0003c370:·5f69·6e73·7461·6c6c·6564·0a3c·2f63·6f64··_installed.</cod | |||
| 0003c380:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c390:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c3a0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003c3b0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003c3c0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003c3d0:·6d35·3431·3522·2074·6162·696e·6465·783d··m5415"·tabindex= | |||
| 0003c3e0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003c3f0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003c400:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003c410:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003c420:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003c430:·6564·6961·7469·6f6e·204f·5342·7569·6c64··ediation·OSBuild | |||
| 0003c440:·2042·6c75·6570·7269·6e74·2073·6e69·7070···Blueprint·snipp | |||
| 0003c450:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c460:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c470:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c480:·6522·2069·643d·2269·646d·3534·3135·223e··e"·id="idm5415"> | |||
| 0003c490:·3c70·7265·3e3c·636f·6465·3e0a·5b5b·7061··<pre><code>.[[pa | |||
| 0003c4a0:·636b·6167·6573·5d5d·0a6e·616d·6520·3d20··ckages]].name·=· | |||
| 0003c4b0:·2261·6964·6522·0a76·6572·7369·6f6e·203d··"aide".version·= | |||
| 0003c4c0:·2022·2a22·0a3c·2f63·6f64·653e·3c2f·7072···"*".</code></pr | |||
| 0003c4d0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c4e0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| Max diff block lines reached; 14807136/14824164 bytes (99.89%) of diff not shown. | |||
| Offset 14312, 15 lines modified | Offset 14312, 15 lines modified | ||
| 00037e70:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00037e70:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00037e80:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00037e80:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00037e90:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00037e90:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00037ea0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00037ea0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00037eb0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00037eb0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00037ec0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00037ec0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 00037ed0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 00037ed0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00037ee0:·2032·3032·3 | 00037ee0:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 00037ef0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 00037ef0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 00037f00:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 00037f00:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 00037f10:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 00037f10:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 00037f20:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 00037f20:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00037f30:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00037f30:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00037f40:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00037f40:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00037f50:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00037f50:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 15360, 123 lines modified | Offset 15360, 123 lines modified | ||
| 0003bff0:·7461·2d74·6172·6765·743d·2223·6964·6d35··ta-target="#idm5 | 0003bff0:·7461·2d74·6172·6765·743d·2223·6964·6d35··ta-target="#idm5 | ||
| 0003c000:·3431·3422·2074·6162·696e·6465·783d·2230··414"·tabindex="0 | 0003c000:·3431·3422·2074·6162·696e·6465·783d·2230··414"·tabindex="0 | ||
| 0003c010:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 0003c010:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 0003c020:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 0003c020:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 0003c030:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 0003c030:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 0003c040:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 0003c040:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 0003c050:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 0003c050:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 0003c060:·6961·7469·6f6e·20 | 0003c060:·6961·7469·6f6e·2053·6865·6c6c·2073·6372··iation·Shell·scr | ||
| 0003c070:·6970·7420·e287·b23c·2f61·3e3c·6272·3e3c··ipt·...</a><br>< | |||
| 0003c080:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c090:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c0a0:·7365·2220·6964·3d22·6964·6d35·3431·3422··se"·id="idm5414" | |||
| 0003c0b0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c0c0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c070:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c080:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c090:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c0a0:·6c61·7073·6522·2069·643d·2269·646d·3534··lapse"·id="idm54 | |||
| 0003c0b0:·3134·223e·3c74·6162·6c65·2063·6c61·7373··14"><table·class | |||
| 0003c0c0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c0d0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c0 | 0003c0d0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003c0f0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c | 0003c0e0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003c0f0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c100:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c110:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c120:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c130:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c140:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c150:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c1 | 0003c160:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003c170:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c180:·653e·2320·5265·6d65·6469·6174·696f·6e20··e>#·Remediation· | |||
| 0003c190:·6973·2061·7070·6c69·6361·626c·6520·6f6e··is·applicable·on | |||
| 0003c1a0:·6c79·2069·6e20·6365·7274·6169·6e20·706c··ly·in·certain·pl | |||
| 0003c1b0:·6174·666f·726d·730a·6966·205b·2021·202d··atforms.if·[·!·- | |||
| 0003c1c0:·6620·2f2e·646f·636b·6572·656e·7620·5d20··f·/.dockerenv·]· | |||
| 0003c1d0:·2661·6d70·3b26·616d·703b·205b·2021·202d··&&·[·!·- | |||
| 0003c1e0:·6620·2f72·756e·2f2e·636f·6e74·6169·6e65··f·/run/.containe | |||
| 0003c1f0:·7265·6e76·205d·3b20·7468·656e·0a0a·7a79··renv·];·then..zy | |||
| 0003c200:·7070·6572·2069·6e73·7461·6c6c·202d·7920··pper·install·-y· | |||
| 0003c210:·2261·6964·6522·0a0a·656c·7365·0a20·2020··"aide"..else.··· | |||
| 0003c220:·2026·6774·3b26·616d·703b·3220·6563·686f···>&2·echo | |||
| 0003c230:·2027·5265·6d65·6469·6174·696f·6e20·6973···'Remediation·is | |||
| 0003c240:·206e·6f74·2061·7070·6c69·6361·626c·652c···not·applicable, | |||
| 0003c250:·206e·6f74·6869·6e67·2077·6173·2064·6f6e···nothing·was·don | |||
| 0003c260:·6527·0a66·690a·3c2f·636f·6465·3e3c·2f70··e'.fi.</code></p | |||
| 0003c270:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c280:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c290:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c120:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003c130:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003c140:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c150:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003c160:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003c170:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c180:·636f·6465·3e2d·206e·616d·653a·2045·6e73··code>-·name:·Ens | |||
| 0003c190:·7572·6520·6169·6465·2069·7320·696e·7374··ure·aide·is·inst | |||
| 0003c1a0:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 0003c1b0:·0a20·2020·206e·616d·653a·2061·6964·650a··.····name:·aide. | |||
| 0003c1c0:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | |||
| 0003c1d0:·6e74·0a20·2077·6865·6e3a·2061·6e73·6962··nt.··when:·ansib | |||
| 0003c1e0:·6c65·5f76·6972·7475·616c·697a·6174·696f··le_virtualizatio | |||
| 0003c1f0:·6e5f·7479·7065·206e·6f74·2069·6e20·5b22··n_type·not·in·[" | |||
| 0003c200:·646f·636b·6572·222c·2022·6c78·6322·2c20··docker",·"lxc",· | |||
| 0003c210:·226f·7065·6e76·7a22·2c20·2270·6f64·6d61··"openvz",·"podma | |||
| 0003c220:·6e22·2c20·2263·6f6e·7461·696e·6572·225d··n",·"container"] | |||
| 0003c230:·0a20·2074·6167·733a·0a20·202d·2043·4345··.··tags:.··-·CCE | |||
| 0003c240:·2d38·3330·3637·2d39·0a20·202d·2043·4a49··-83067-9.··-·CJI | |||
| 0003c250:·532d·352e·3130·2e31·2e33·0a20·202d·2044··S-5.10.1.3.··-·D | |||
| 0003c260:·4953·412d·5354·4947·2d53·4c45·532d·3132··ISA-STIG-SLES-12 | |||
| 0003c270:·2d30·3130·3530·300a·2020·2d20·4e49·5354··-010500.··-·NIST | |||
| 0003c280:·2d38·3030·2d35·332d·434d·2d36·2861·290a··-800-53-CM-6(a). | |||
| 0003c290:·2020·2d20·5043·492d·4453·532d·5265·712d····-·PCI-DSS-Req- | |||
| 0003c2a0:·3131·2e35·0a20·202d·2065·6e61·626c·655f··11.5.··-·enable_ | |||
| 0003c2b0:·7374·7261·7465·6779·0a20·202d·206c·6f77··strategy.··-·low | |||
| 0003c2c0:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003c2d0:·6c6f·775f·6469·7372·7570·7469·6f6e·0a20··low_disruption.· | |||
| 0003c2e0:·202d·206d·6564·6975·6d5f·7365·7665·7269···-·medium_severi | |||
| 0003c2f0:·7479·0a20·202d·206e·6f5f·7265·626f·6f74··ty.··-·no_reboot | |||
| 0003c300:·5f6e·6565·6465·640a·2020·2d20·7061·636b··_needed.··-·pack | |||
| 0003c310:·6167·655f·6169·6465·5f69·6e73·7461·6c6c··age_aide_install | |||
| 0003c320:·6564·0a3c·2f63·6f64·653e·3c2f·7072·653e··ed.</code></pre> | |||
| 0003c330:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c340:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003c350:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003c360:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003c370:·6765·743d·2223·6964·6d35·3431·3522·2074··get="#idm5415"·t | |||
| 0003c380:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c390:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c3a0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c3b0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c3c0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003c3d0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003c3e0:·204f·5342·7569·6c64·2042·6c75·6570·7269···OSBuild·Bluepri | |||
| 0003c3f0:·6e74·2073·6e69·7070·6574·20e2·87b2·3c2f··nt·snippet·...</ | |||
| 0003c400:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c410:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c | 0003c2a0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | ||
| 0003c430:·646d·3534·3135·223e·3c70·7265·3e3c·636f··dm5415"><pre><co | |||
| 0003c440:·6465·3e0a·5b5b·7061·636b·6167·6573·5d5d··de>.[[packages]] | |||
| 0003c450:·0a6e·616d·6520·3d20·2261·6964·6522·0a76··.name·=·"aide".v | |||
| 0003c460:·6572·7369·6f6e·203d·2022·2a22·0a3c·2f63··ersion·=·"*".</c | |||
| 0003c470:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c480:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c490:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c4a0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c4b0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c4c0:·6964·6d35·3431·3622·2074·6162·696e·6465··idm5416"·tabinde | |||
| 0003c4d0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| Max diff block lines reached; 4764946/4781698 bytes (99.65%) of diff not shown. | |||
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·12·Benchmark·for·Level·1·-·Server | 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·12·Benchmark·for·Level·1·-·Server |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 46 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 46 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·AppArmor | 54 | ·········3.·AppArmor |
| 55 | ·········4.·GRUB2_bootloader_configuration | 55 | ·········4.·GRUB2_bootloader_configuration |
| 56 | ·········5.·Configure_Syslog | 56 | ·········5.·Configure_Syslog |
| Offset 125, 14 lines modified | Offset 125, 26 lines modified | ||
| 125 | include·install_aide | 125 | include·install_aide |
| 126 | class·install_aide·{ | 126 | class·install_aide·{ |
| 127 | ··package·{·'aide': | 127 | ··package·{·'aide': |
| 128 | ····ensure·=>·'installed', | 128 | ····ensure·=>·'installed', |
| 129 | ··} | 129 | ··} |
| 130 | } | 130 | } |
| 131 | Remediation_Shell_script_⇲ | ||
| 132 | Complexity:·low | ||
| 133 | Disruption:·low | ||
| 134 | Strategy:···enable | ||
| 135 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 136 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 137 | zypper·install·-y·"aide" | ||
| 138 | else | ||
| 139 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 140 | fi | ||
| 131 | Remediation_Ansible_snippet_⇲ | 141 | Remediation_Ansible_snippet_⇲ |
| 132 | Complexity:·low | 142 | Complexity:·low |
| 133 | Disruption:·low | 143 | Disruption:·low |
| 134 | Strategy:···enable | 144 | Strategy:···enable |
| 135 | -·name:·Ensure·aide·is·installed | 145 | -·name:·Ensure·aide·is·installed |
| 136 | ··package: | 146 | ··package: |
| 137 | ····name:·aide | 147 | ····name:·aide |
| Offset 151, 26 lines modified | Offset 163, 14 lines modified | ||
| 151 | ··-·no_reboot_needed | 163 | ··-·no_reboot_needed |
| 152 | ··-·package_aide_installed | 164 | ··-·package_aide_installed |
| 153 | Remediation_OSBuild_Blueprint_snippet_⇲ | 165 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 154 | [[packages]] | 166 | [[packages]] |
| 155 | name·=·"aide" | 167 | name·=·"aide" |
| 156 | version·=·"*" | 168 | version·=·"*" |
| 157 | Remediation_Shell_script_⇲ | ||
| 158 | Complexity:·low | ||
| 159 | Disruption:·low | ||
| 160 | Strategy:···enable | ||
| 161 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 162 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 163 | zypper·install·-y·"aide" | ||
| 164 | else | ||
| 165 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 166 | fi | ||
| 167 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 169 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 168 | Run·the·following·command·to·generate·a·new·database: | 170 | Run·the·following·command·to·generate·a·new·database: |
| 169 | $·sudo·/usr/bin/aide·--init | 171 | $·sudo·/usr/bin/aide·--init |
| 170 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 172 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 171 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 173 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 172 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 174 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 173 | database·can·be·installed·as·follows: | 175 | database·can·be·installed·as·follows: |
| Offset 185, 14 lines modified | Offset 185, 26 lines modified | ||
| 185 | ············Identifiers: ·CCE-91483-8 | 185 | ············Identifiers: ·CCE-91483-8 |
| 186 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 186 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 187 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 187 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 188 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 188 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 189 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 189 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 190 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 190 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 191 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 191 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 192 | Remediation_Shell_script_⇲ | ||
| 193 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 194 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 195 | zypper·install·-y·"aide" | ||
| 196 | /usr/bin/aide·--init | ||
| 197 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 198 | else | ||
| 199 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 200 | fi | ||
| 192 | Remediation_Ansible_snippet_⇲ | 201 | Remediation_Ansible_snippet_⇲ |
| 193 | Complexity:·low | 202 | Complexity:·low |
| 194 | Disruption:·low | 203 | Disruption:·low |
| 195 | Strategy:···restrict | 204 | Strategy:···restrict |
| 196 | -·name:·Ensure·AIDE·is·installed | 205 | -·name:·Ensure·AIDE·is·installed |
| 197 | ··package: | 206 | ··package: |
| 198 | ····name:·'{{·item·}}' | 207 | ····name:·'{{·item·}}' |
| Offset 261, 26 lines modified | Offset 273, 14 lines modified | ||
| 261 | ··-·PCI-DSS-Req-11.5 | 273 | ··-·PCI-DSS-Req-11.5 |
| 262 | ··-·aide_build_database | 274 | ··-·aide_build_database |
| 263 | ··-·low_complexity | 275 | ··-·low_complexity |
| 264 | ··-·low_disruption | 276 | ··-·low_disruption |
| 265 | ··-·medium_severity | 277 | ··-·medium_severity |
| 266 | ··-·no_reboot_needed | 278 | ··-·no_reboot_needed |
| 267 | ··-·restrict_strategy | 279 | ··-·restrict_strategy |
| 268 | Remediation_Shell_script_⇲ | ||
| 269 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 270 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 271 | zypper·install·-y·"aide" | ||
| 272 | /usr/bin/aide·--init | ||
| 273 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 274 | else | ||
| 275 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 276 | fi | ||
| 277 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 280 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 278 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 281 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 279 | using·cron,·add·the·following·line·to·/etc/crontab: | 282 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 280 | 05·4·*·*·*·root·/usr/bin/aide·--check | 283 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 281 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 284 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 282 | 05·4·*·*·0·root·/usr/bin/aide·--check | 285 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 283 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 286 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 304, 14 lines modified | Offset 304, 30 lines modified | ||
| 304 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 304 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 305 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 305 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 306 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 306 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 614592/619464 bytes (99.21%) of diff not shown. | |||
| Offset 14313, 15 lines modified | Offset 14313, 15 lines modified | ||
| 00037e80:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037e80:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037e90:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037e90:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037ea0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037ea0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037eb0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037eb0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037ec0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037ec0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037ed0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037ed0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037ef0:·7320·6f66·2032·3032·3 | 00037ef0:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037f00:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037f00:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037f10:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037f10:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037f20:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037f20:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037f30:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037f30:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037f40:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037f40:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037f50:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037f50:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037f60:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037f60:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15351, 123 lines modified | Offset 15351, 123 lines modified | ||
| 0003bf60:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003bf60:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003bf70:·6964·6d35·3431·3422·2074·6162·696e·6465··idm5414"·tabinde | 0003bf70:·6964·6d35·3431·3422·2074·6162·696e·6465··idm5414"·tabinde | ||
| 0003bf80:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003bf80:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003bf90:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003bf90:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003bfa0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003bfa0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003bfb0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003bfb0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003bfc0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003bfc0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003bfd0:·656d·6564·6961·7469·6f6e·20 | 0003bfd0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003bfe0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003bff0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c000:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c010:·6c6c·6170·7365·2220·6964·3d22·6964·6d35··llapse"·id="idm5 | |||
| 0003c020:·3431·3422·3e3c·7461·626c·6520·636c·6173··414"><table·clas | |||
| 0003c030:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c040:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c050:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c060:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c070:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bfe0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bff0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c000:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c010:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003c020:·646d·3534·3134·223e·3c74·6162·6c65·2063··dm5414"><table·c | |||
| 0003c030:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003c040:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003c050:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003c060:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003c070:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003c080:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c090:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c0a0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003c0 | 0003c080:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003c090:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c0a0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c0b0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c0c0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c0d0:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003c0e0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c0f0:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003c100:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003c110:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003c120:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003c130:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003c140:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003c150:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003c160:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003c170:·0a0a·7a79·7070·6572·2069·6e73·7461·6c6c··..zypper·install | |||
| 0003c180:·202d·7920·2261·6964·6522·0a0a·656c·7365···-y·"aide"..else | |||
| 0003c190:·0a20·2020·2026·6774·3b26·616d·703b·3220··.····>&2· | |||
| 0003c1a0:·6563·686f·2027·5265·6d65·6469·6174·696f··echo·'Remediatio | |||
| 0003c1b0:·6e20·6973·206e·6f74·2061·7070·6c69·6361··n·is·not·applica | |||
| 0003c1c0:·626c·652c·206e·6f74·6869·6e67·2077·6173··ble,·nothing·was | |||
| 0003c1d0:·2064·6f6e·6527·0a66·690a·3c2f·636f·6465···done'.fi.</code | |||
| 0003c1e0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c1f0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c200:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c0c0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c0d0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003c0e0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003c0f0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003c100:·2045·6e73·7572·6520·6169·6465·2069·7320···Ensure·aide·is· | |||
| 0003c110:·696e·7374·616c·6c65·640a·2020·7061·636b··installed.··pack | |||
| 0003c120:·6167·653a·0a20·2020·206e·616d·653a·2061··age:.····name:·a | |||
| 0003c130:·6964·650a·2020·2020·7374·6174·653a·2070··ide.····state:·p | |||
| 0003c140:·7265·7365·6e74·0a20·2077·6865·6e3a·2061··resent.··when:·a | |||
| 0003c150:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| 0003c160:·6174·696f·6e5f·7479·7065·206e·6f74·2069··ation_type·not·i | |||
| 0003c170:·6e20·5b22·646f·636b·6572·222c·2022·6c78··n·["docker",·"lx | |||
| 0003c180:·6322·2c20·226f·7065·6e76·7a22·2c20·2270··c",·"openvz",·"p | |||
| 0003c190:·6f64·6d61·6e22·2c20·2263·6f6e·7461·696e··odman",·"contain | |||
| 0003c1a0:·6572·225d·0a20·2074·6167·733a·0a20·202d··er"].··tags:.··- | |||
| 0003c1b0:·2043·4345·2d38·3330·3637·2d39·0a20·202d···CCE-83067-9.··- | |||
| 0003c1c0:·2043·4a49·532d·352e·3130·2e31·2e33·0a20···CJIS-5.10.1.3.· | |||
| 0003c1d0:·202d·2044·4953·412d·5354·4947·2d53·4c45···-·DISA-STIG-SLE | |||
| 0003c1e0:·532d·3132·2d30·3130·3530·300a·2020·2d20··S-12-010500.··-· | |||
| 0003c1f0:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c200:·2861·290a·2020·2d20·5043·492d·4453·532d··(a).··-·PCI-DSS- | |||
| 0003c210:·5265·712d·3131·2e35·0a20·202d·2065·6e61··Req-11.5.··-·ena | |||
| 0003c220:·626c·655f·7374·7261·7465·6779·0a20·202d··ble_strategy.··- | |||
| 0003c230:·206c·6f77·5f63·6f6d·706c·6578·6974·790a···low_complexity. | |||
| 0003c240:·2020·2d20·6c6f·775f·6469·7372·7570·7469····-·low_disrupti | |||
| 0003c250:·6f6e·0a20·202d·206d·6564·6975·6d5f·7365··on.··-·medium_se | |||
| 0003c260:·7665·7269·7479·0a20·202d·206e·6f5f·7265··verity.··-·no_re | |||
| 0003c270:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003c280:·7061·636b·6167·655f·6169·6465·5f69·6e73··package_aide_ins | |||
| 0003c290:·7461·6c6c·6564·0a3c·2f63·6f64·653e·3c2f··talled.</code></ | |||
| 0003c2a0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c2b0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c2c0:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c2d0:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c2e0:·2d74·6172·6765·743d·2223·6964·6d35·3431··-target="#idm541 | |||
| 0003c2f0:·3522·2074·6162·696e·6465·783d·2230·2220··5"·tabindex="0"· | |||
| 0003c300:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c310:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c320:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c330:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c340:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c350:·7469·6f6e·204f·5342·7569·6c64·2042·6c75··tion·OSBuild·Blu | |||
| 0003c360:·6570·7269·6e74·2073·6e69·7070·6574·20e2··eprint·snippet·. | |||
| 0003c370:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c380:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c | 0003c210:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | ||
| 0003c3a0:·643d·2269·646d·3534·3135·223e·3c70·7265··d="idm5415"><pre | |||
| 0003c3b0:·3e3c·636f·6465·3e0a·5b5b·7061·636b·6167··><code>.[[packag | |||
| 0003c3c0:·6573·5d5d·0a6e·616d·6520·3d20·2261·6964··es]].name·=·"aid | |||
| 0003c3d0:·6522·0a76·6572·7369·6f6e·203d·2022·2a22··e".version·=·"*" | |||
| 0003c3e0:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c3f0:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c400:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c410:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c420:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| Max diff block lines reached; 4697506/4714258 bytes (99.64%) of diff not shown. | |||
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·12·Benchmark·for·Level·1·-·Workstation | 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·12·Benchmark·for·Level·1·-·Workstation |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 46 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 46 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·AppArmor | 54 | ·········3.·AppArmor |
| 55 | ·········4.·GRUB2_bootloader_configuration | 55 | ·········4.·GRUB2_bootloader_configuration |
| 56 | ·········5.·Configure_Syslog | 56 | ·········5.·Configure_Syslog |
| Offset 123, 14 lines modified | Offset 123, 26 lines modified | ||
| 123 | include·install_aide | 123 | include·install_aide |
| 124 | class·install_aide·{ | 124 | class·install_aide·{ |
| 125 | ··package·{·'aide': | 125 | ··package·{·'aide': |
| 126 | ····ensure·=>·'installed', | 126 | ····ensure·=>·'installed', |
| 127 | ··} | 127 | ··} |
| 128 | } | 128 | } |
| 129 | Remediation_Shell_script_⇲ | ||
| 130 | Complexity:·low | ||
| 131 | Disruption:·low | ||
| 132 | Strategy:···enable | ||
| 133 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 134 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 135 | zypper·install·-y·"aide" | ||
| 136 | else | ||
| 137 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 138 | fi | ||
| 129 | Remediation_Ansible_snippet_⇲ | 139 | Remediation_Ansible_snippet_⇲ |
| 130 | Complexity:·low | 140 | Complexity:·low |
| 131 | Disruption:·low | 141 | Disruption:·low |
| 132 | Strategy:···enable | 142 | Strategy:···enable |
| 133 | -·name:·Ensure·aide·is·installed | 143 | -·name:·Ensure·aide·is·installed |
| 134 | ··package: | 144 | ··package: |
| 135 | ····name:·aide | 145 | ····name:·aide |
| Offset 149, 26 lines modified | Offset 161, 14 lines modified | ||
| 149 | ··-·no_reboot_needed | 161 | ··-·no_reboot_needed |
| 150 | ··-·package_aide_installed | 162 | ··-·package_aide_installed |
| 151 | Remediation_OSBuild_Blueprint_snippet_⇲ | 163 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 152 | [[packages]] | 164 | [[packages]] |
| 153 | name·=·"aide" | 165 | name·=·"aide" |
| 154 | version·=·"*" | 166 | version·=·"*" |
| 155 | Remediation_Shell_script_⇲ | ||
| 156 | Complexity:·low | ||
| 157 | Disruption:·low | ||
| 158 | Strategy:···enable | ||
| 159 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 160 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | zypper·install·-y·"aide" | ||
| 162 | else | ||
| 163 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 164 | fi | ||
| 165 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 167 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 166 | Run·the·following·command·to·generate·a·new·database: | 168 | Run·the·following·command·to·generate·a·new·database: |
| 167 | $·sudo·/usr/bin/aide·--init | 169 | $·sudo·/usr/bin/aide·--init |
| 168 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 170 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 169 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 171 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 170 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 172 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 171 | database·can·be·installed·as·follows: | 173 | database·can·be·installed·as·follows: |
| Offset 183, 14 lines modified | Offset 183, 26 lines modified | ||
| 183 | ············Identifiers: ·CCE-91483-8 | 183 | ············Identifiers: ·CCE-91483-8 |
| 184 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 184 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 185 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 185 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 186 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 186 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 187 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 187 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 188 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 188 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 189 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 189 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 190 | Remediation_Shell_script_⇲ | ||
| 191 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 192 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 193 | zypper·install·-y·"aide" | ||
| 194 | /usr/bin/aide·--init | ||
| 195 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 196 | else | ||
| 197 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 198 | fi | ||
| 190 | Remediation_Ansible_snippet_⇲ | 199 | Remediation_Ansible_snippet_⇲ |
| 191 | Complexity:·low | 200 | Complexity:·low |
| 192 | Disruption:·low | 201 | Disruption:·low |
| 193 | Strategy:···restrict | 202 | Strategy:···restrict |
| 194 | -·name:·Ensure·AIDE·is·installed | 203 | -·name:·Ensure·AIDE·is·installed |
| 195 | ··package: | 204 | ··package: |
| 196 | ····name:·'{{·item·}}' | 205 | ····name:·'{{·item·}}' |
| Offset 259, 26 lines modified | Offset 271, 14 lines modified | ||
| 259 | ··-·PCI-DSS-Req-11.5 | 271 | ··-·PCI-DSS-Req-11.5 |
| 260 | ··-·aide_build_database | 272 | ··-·aide_build_database |
| 261 | ··-·low_complexity | 273 | ··-·low_complexity |
| 262 | ··-·low_disruption | 274 | ··-·low_disruption |
| 263 | ··-·medium_severity | 275 | ··-·medium_severity |
| 264 | ··-·no_reboot_needed | 276 | ··-·no_reboot_needed |
| 265 | ··-·restrict_strategy | 277 | ··-·restrict_strategy |
| 266 | Remediation_Shell_script_⇲ | ||
| 267 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 268 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 269 | zypper·install·-y·"aide" | ||
| 270 | /usr/bin/aide·--init | ||
| 271 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 272 | else | ||
| 273 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 274 | fi | ||
| 275 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 278 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 276 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 279 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 277 | using·cron,·add·the·following·line·to·/etc/crontab: | 280 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 278 | 05·4·*·*·*·root·/usr/bin/aide·--check | 281 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 279 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 282 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 280 | 05·4·*·*·0·root·/usr/bin/aide·--check | 283 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 281 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 284 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 302, 14 lines modified | Offset 302, 30 lines modified | ||
| 302 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 302 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 303 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 303 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 304 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 304 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 609300/614182 bytes (99.21%) of diff not shown. | |||
| Offset 14313, 15 lines modified | Offset 14313, 15 lines modified | ||
| 00037e80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037e80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037e90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037e90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037ea0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037ea0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037eb0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037eb0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037ec0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037ec0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037ed0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037ed0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037ee0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037ee0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037ef0:·3 | 00037ef0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037f00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037f00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037f10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037f10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037f20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037f20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037f30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037f30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037f40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037f40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037f50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037f50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037f60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037f60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15362, 123 lines modified | Offset 15362, 123 lines modified | ||
| 0003c010:·6765·743d·2223·6964·6d35·3431·3422·2074··get="#idm5414"·t | 0003c010:·6765·743d·2223·6964·6d35·3431·3422·2074··get="#idm5414"·t | ||
| 0003c020:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | 0003c020:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | ||
| 0003c030:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | 0003c030:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | ||
| 0003c040:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | 0003c040:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | ||
| 0003c050:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | 0003c050:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | ||
| 0003c060:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | 0003c060:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | ||
| 0003c070:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | 0003c070:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | ||
| 0003c080:·2041·6e73·6962·6c65·2073·6e69·7070·6574···Ansible·snippet | |||
| 0003c090:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003c0a0:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003c0b0:·6c6c·6170·7365·2063·6f6c·6c61·7073·6522··llapse·collapse" | |||
| 0003c0c0:·2069·643d·2269·646d·3534·3134·223e·3c74···id="idm5414"><t | |||
| 0003c0d0:·6162·6c65·2063·6c61·7373·3d22·7461·626c··able·class="tabl | |||
| 0003c0e0:·6520·7461·626c·652d·7374·7269·7065·6420··e·table-striped· | |||
| 0003c0f0:·7461·626c·652d·626f·7264·6572·6564·2074··table-bordered·t | |||
| 0003c100:·6162·6c65·2d63·6f6e·6465·6e73·6564·223e··able-condensed"> | |||
| 0003c110:·3c74·723e·3c74·683e·436f·6d70·6c65·7869··<tr><th>Complexi | |||
| 0003c | 0003c080:·2053·6865·6c6c·2073·6372·6970·7420·e287···Shell·script·.. | ||
| 0003c090:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003c0a0:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003c0b0:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003c0c0:·3d22·6964·6d35·3431·3422·3e3c·7461·626c··="idm5414"><tabl | |||
| 0003c0d0:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003c0e0:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003c0f0:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003c100:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003c110:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003c120:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003c130:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003c140:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003c150:·643e·6c6f·773c·2f74·643e·3c2f·7472·3e3c··d>low</td></tr>< | |||
| 0003c160:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003c170:·3c2f·7468·3e3c·7464·3e65·6e61·626c·653c··</th><td>enable< | |||
| 0003c1 | 0003c180:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | ||
| 0003c190:·3e3c·7072·653e·3c63·6f64·653e·2320·5265··><pre><code>#·Re | |||
| 0003c1a0:·6d65·6469·6174·696f·6e20·6973·2061·7070··mediation·is·app | |||
| 0003c1b0:·6c69·6361·626c·6520·6f6e·6c79·2069·6e20··licable·only·in· | |||
| 0003c1c0:·6365·7274·6169·6e20·706c·6174·666f·726d··certain·platform | |||
| 0003c1d0:·730a·6966·205b·2021·202d·6620·2f2e·646f··s.if·[·!·-f·/.do | |||
| 0003c1e0:·636b·6572·656e·7620·5d20·2661·6d70·3b26··ckerenv·]·&& | |||
| 0003c1f0:·616d·703b·205b·2021·202d·6620·2f72·756e··amp;·[·!·-f·/run | |||
| 0003c200:·2f2e·636f·6e74·6169·6e65·7265·6e76·205d··/.containerenv·] | |||
| 0003c210:·3b20·7468·656e·0a0a·7a79·7070·6572·2069··;·then..zypper·i | |||
| 0003c220:·6e73·7461·6c6c·202d·7920·2261·6964·6522··nstall·-y·"aide" | |||
| 0003c230:·0a0a·656c·7365·0a20·2020·2026·6774·3b26··..else.····>& | |||
| 0003c240:·616d·703b·3220·6563·686f·2027·5265·6d65··amp;2·echo·'Reme | |||
| 0003c250:·6469·6174·696f·6e20·6973·206e·6f74·2061··diation·is·not·a | |||
| 0003c260:·7070·6c69·6361·626c·652c·206e·6f74·6869··pplicable,·nothi | |||
| 0003c270:·6e67·2077·6173·2064·6f6e·6527·0a66·690a··ng·was·done'.fi. | |||
| 0003c280:·3c2f·636f·6465·3e3c·2f70·7265·3e3c·2f64··</code></pre></d | |||
| 0003c290:·6976·3e3c·6120·636c·6173·733d·2262·746e··iv><a·class="btn | |||
| 0003c2a0:·2062·746e·2d73·7563·6365·7373·2220·6461···btn-success"·da | |||
| 0003c2b0:·7461·2d74·6f67·676c·653d·2263·6f6c·6c61··ta-toggle="colla | |||
| 0003c140:·3e44·6973·7275·7074·696f·6e3a·3c2f·7468··>Disruption:</th | |||
| 0003c150:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | |||
| 0003c160:·723e·3c74·723e·3c74·683e·5374·7261·7465··r><tr><th>Strate | |||
| 0003c170:·6779·3a3c·2f74·683e·3c74·643e·656e·6162··gy:</th><td>enab | |||
| 0003c180:·6c65·3c2f·7464·3e3c·2f74·723e·3c2f·7461··le</td></tr></ta | |||
| 0003c190:·626c·653e·3c70·7265·3e3c·636f·6465·3e2d··ble><pre><code>- | |||
| 0003c1a0:·206e·616d·653a·2045·6e73·7572·6520·6169···name:·Ensure·ai | |||
| 0003c1b0:·6465·2069·7320·696e·7374·616c·6c65·640a··de·is·installed. | |||
| 0003c1c0:·2020·7061·636b·6167·653a·0a20·2020·206e····package:.····n | |||
| 0003c1d0:·616d·653a·2061·6964·650a·2020·2020·7374··ame:·aide.····st | |||
| 0003c1e0:·6174·653a·2070·7265·7365·6e74·0a20·2077··ate:·present.··w | |||
| 0003c1f0:·6865·6e3a·2061·6e73·6962·6c65·5f76·6972··hen:·ansible_vir | |||
| 0003c200:·7475·616c·697a·6174·696f·6e5f·7479·7065··tualization_type | |||
| 0003c210:·206e·6f74·2069·6e20·5b22·646f·636b·6572···not·in·["docker | |||
| 0003c220:·222c·2022·6c78·6322·2c20·226f·7065·6e76··",·"lxc",·"openv | |||
| 0003c230:·7a22·2c20·2270·6f64·6d61·6e22·2c20·2263··z",·"podman",·"c | |||
| 0003c240:·6f6e·7461·696e·6572·225d·0a20·2074·6167··ontainer"].··tag | |||
| 0003c250:·733a·0a20·202d·2043·4345·2d38·3330·3637··s:.··-·CCE-83067 | |||
| 0003c260:·2d39·0a20·202d·2043·4a49·532d·352e·3130··-9.··-·CJIS-5.10 | |||
| 0003c270:·2e31·2e33·0a20·202d·2044·4953·412d·5354··.1.3.··-·DISA-ST | |||
| 0003c280:·4947·2d53·4c45·532d·3132·2d30·3130·3530··IG-SLES-12-01050 | |||
| 0003c290:·300a·2020·2d20·4e49·5354·2d38·3030·2d35··0.··-·NIST-800-5 | |||
| 0003c2a0:·332d·434d·2d36·2861·290a·2020·2d20·5043··3-CM-6(a).··-·PC | |||
| 0003c2b0:·492d·4453·532d·5265·712d·3131·2e35·0a20··I-DSS-Req-11.5.· | |||
| 0003c2c0:·202d·2065·6e61·626c·655f·7374·7261·7465···-·enable_strate | |||
| 0003c2d0:·6779·0a20·202d·206c·6f77·5f63·6f6d·706c··gy.··-·low_compl | |||
| 0003c2e0:·6578·6974·790a·2020·2d20·6c6f·775f·6469··exity.··-·low_di | |||
| 0003c2f0:·7372·7570·7469·6f6e·0a20·202d·206d·6564··sruption.··-·med | |||
| 0003c300:·6975·6d5f·7365·7665·7269·7479·0a20·202d··ium_severity.··- | |||
| 0003c310:·206e·6f5f·7265·626f·6f74·5f6e·6565·6465···no_reboot_neede | |||
| 0003c320:·640a·2020·2d20·7061·636b·6167·655f·6169··d.··-·package_ai | |||
| 0003c330:·6465·5f69·6e73·7461·6c6c·6564·0a3c·2f63··de_installed.</c | |||
| 0003c340:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c350:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c360:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c370:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c380:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c390:·6964·6d35·3431·3522·2074·6162·696e·6465··idm5415"·tabinde | |||
| 0003c3a0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| 0003c3b0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | |||
| 0003c3c0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | |||
| 0003c3d0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | |||
| 0003c3e0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | |||
| 0003c3f0:·656d·6564·6961·7469·6f6e·204f·5342·7569··emediation·OSBui | |||
| 0003c400:·6c64·2042·6c75·6570·7269·6e74·2073·6e69··ld·Blueprint·sni | |||
| 0003c410:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003c420:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003c430:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003c440:·7073·6522·2069·643d·2269·646d·3534·3135··pse"·id="idm5415 | |||
| 0003c450:·223e·3c70·7265·3e3c·636f·6465·3e0a·5b5b··"><pre><code>.[[ | |||
| 0003c460:·7061·636b·6167·6573·5d5d·0a6e·616d·6520··packages]].name· | |||
| 0003c470:·3d20·2261·6964·6522·0a76·6572·7369·6f6e··=·"aide".version | |||
| 0003c480:·203d·2022·2a22·0a3c·2f63·6f64·653e·3c2f···=·"*".</code></ | |||
| 0003c490:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c4a0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c | 0003c2c0:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003c2d0:·3d22·2369·646d·3534·3135·2220·7461·6269··="#idm5415"·tabi | |||
| 0003c2e0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| Max diff block lines reached; 14798761/14815513 bytes (99.89%) of diff not shown. | |||
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·12·Benchmark·Level·2·-·Workstation | 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·12·Benchmark·Level·2·-·Workstation |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l2 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l2 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 46 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 46 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·System_Accounting_with_auditd | 54 | ·········3.·System_Accounting_with_auditd |
| 55 | ·········4.·AppArmor | 55 | ·········4.·AppArmor |
| 56 | ·········5.·GRUB2_bootloader_configuration | 56 | ·········5.·GRUB2_bootloader_configuration |
| Offset 125, 14 lines modified | Offset 125, 26 lines modified | ||
| 125 | include·install_aide | 125 | include·install_aide |
| 126 | class·install_aide·{ | 126 | class·install_aide·{ |
| 127 | ··package·{·'aide': | 127 | ··package·{·'aide': |
| 128 | ····ensure·=>·'installed', | 128 | ····ensure·=>·'installed', |
| 129 | ··} | 129 | ··} |
| 130 | } | 130 | } |
| 131 | Remediation_Shell_script_⇲ | ||
| 132 | Complexity:·low | ||
| 133 | Disruption:·low | ||
| 134 | Strategy:···enable | ||
| 135 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 136 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 137 | zypper·install·-y·"aide" | ||
| 138 | else | ||
| 139 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 140 | fi | ||
| 131 | Remediation_Ansible_snippet_⇲ | 141 | Remediation_Ansible_snippet_⇲ |
| 132 | Complexity:·low | 142 | Complexity:·low |
| 133 | Disruption:·low | 143 | Disruption:·low |
| 134 | Strategy:···enable | 144 | Strategy:···enable |
| 135 | -·name:·Ensure·aide·is·installed | 145 | -·name:·Ensure·aide·is·installed |
| 136 | ··package: | 146 | ··package: |
| 137 | ····name:·aide | 147 | ····name:·aide |
| Offset 151, 26 lines modified | Offset 163, 14 lines modified | ||
| 151 | ··-·no_reboot_needed | 163 | ··-·no_reboot_needed |
| 152 | ··-·package_aide_installed | 164 | ··-·package_aide_installed |
| 153 | Remediation_OSBuild_Blueprint_snippet_⇲ | 165 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 154 | [[packages]] | 166 | [[packages]] |
| 155 | name·=·"aide" | 167 | name·=·"aide" |
| 156 | version·=·"*" | 168 | version·=·"*" |
| 157 | Remediation_Shell_script_⇲ | ||
| 158 | Complexity:·low | ||
| 159 | Disruption:·low | ||
| 160 | Strategy:···enable | ||
| 161 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 162 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 163 | zypper·install·-y·"aide" | ||
| 164 | else | ||
| 165 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 166 | fi | ||
| 167 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 169 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 168 | Run·the·following·command·to·generate·a·new·database: | 170 | Run·the·following·command·to·generate·a·new·database: |
| 169 | $·sudo·/usr/bin/aide·--init | 171 | $·sudo·/usr/bin/aide·--init |
| 170 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 172 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 171 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 173 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 172 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 174 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 173 | database·can·be·installed·as·follows: | 175 | database·can·be·installed·as·follows: |
| Offset 185, 14 lines modified | Offset 185, 26 lines modified | ||
| 185 | ············Identifiers: ·CCE-91483-8 | 185 | ············Identifiers: ·CCE-91483-8 |
| 186 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 186 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 187 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 187 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 188 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 188 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 189 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 189 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 190 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 190 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 191 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 | 191 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.3.1 |
| 192 | Remediation_Shell_script_⇲ | ||
| 193 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 194 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 195 | zypper·install·-y·"aide" | ||
| 196 | /usr/bin/aide·--init | ||
| 197 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 198 | else | ||
| 199 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 200 | fi | ||
| 192 | Remediation_Ansible_snippet_⇲ | 201 | Remediation_Ansible_snippet_⇲ |
| 193 | Complexity:·low | 202 | Complexity:·low |
| 194 | Disruption:·low | 203 | Disruption:·low |
| 195 | Strategy:···restrict | 204 | Strategy:···restrict |
| 196 | -·name:·Ensure·AIDE·is·installed | 205 | -·name:·Ensure·AIDE·is·installed |
| 197 | ··package: | 206 | ··package: |
| 198 | ····name:·'{{·item·}}' | 207 | ····name:·'{{·item·}}' |
| Offset 261, 26 lines modified | Offset 273, 14 lines modified | ||
| 261 | ··-·PCI-DSS-Req-11.5 | 273 | ··-·PCI-DSS-Req-11.5 |
| 262 | ··-·aide_build_database | 274 | ··-·aide_build_database |
| 263 | ··-·low_complexity | 275 | ··-·low_complexity |
| 264 | ··-·low_disruption | 276 | ··-·low_disruption |
| 265 | ··-·medium_severity | 277 | ··-·medium_severity |
| 266 | ··-·no_reboot_needed | 278 | ··-·no_reboot_needed |
| 267 | ··-·restrict_strategy | 279 | ··-·restrict_strategy |
| 268 | Remediation_Shell_script_⇲ | ||
| 269 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 270 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 271 | zypper·install·-y·"aide" | ||
| 272 | /usr/bin/aide·--init | ||
| 273 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 274 | else | ||
| 275 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 276 | fi | ||
| 277 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 280 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 278 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 281 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 279 | using·cron,·add·the·following·line·to·/etc/crontab: | 282 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 280 | 05·4·*·*·*·root·/usr/bin/aide·--check | 283 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 281 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 284 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 282 | 05·4·*·*·0·root·/usr/bin/aide·--check | 285 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 283 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 286 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 304, 14 lines modified | Offset 304, 30 lines modified | ||
| 304 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 304 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 305 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 305 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 306 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 306 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 1274415/1279306 bytes (99.62%) of diff not shown. | |||
| Offset 14297, 15 lines modified | Offset 14297, 15 lines modified | ||
| 00037d80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037d80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037d90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037d90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037da0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037da0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037db0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037db0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037dc0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037dc0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037dd0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037dd0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037de0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037de0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037df0:·3 | 00037df0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037e00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037e00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037e10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037e10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037e20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037e20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037e30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037e30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037e40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037e40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037e50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037e50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037e60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037e60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15311, 330 lines modified | Offset 15311, 330 lines modified | ||
| 0003bce0:·2d74·6172·6765·743d·2223·6964·6d35·3037··-target="#idm507 | 0003bce0:·2d74·6172·6765·743d·2223·6964·6d35·3037··-target="#idm507 | ||
| 0003bcf0:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | 0003bcf0:·3622·2074·6162·696e·6465·783d·2230·2220··6"·tabindex="0"· | ||
| 0003bd00:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 0003bd00:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 0003bd10:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 0003bd10:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 0003bd20:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 0003bd20:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 0003bd30:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 0003bd30:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 0003bd40:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 0003bd40:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 0003bd50:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 0003bd60:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 0003bd70:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 0003bd80:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 0003bd90:·7073·6522·2069·643d·2269·646d·3530·3736··pse"·id="idm5076 | |||
| 0003bda0:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 0003bdb0:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 0003bd | 0003bd50:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 0003bd60:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bd70:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bd80:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bd90:·2220·6964·3d22·6964·6d35·3037·3622·3e3c··"·id="idm5076">< | |||
| 0003bda0:·7072·653e·3c63·6f64·653e·0a23·2046·696e··pre><code>.#·Fin | |||
| 0003bdb0:·6420·7768·6963·6820·6669·6c65·7320·6861··d·which·files·ha | |||
| 0003bdc0:·7665·2069·6e63·6f72·7265·6374·2068·6173··ve·incorrect·has | |||
| 0003bdd0:·6820·286e·6f74·2069·6e20·2f65·7463·2c20··h·(not·in·/etc,· | |||
| 0003bde0:·6265·6361·7573·6520·6f66·2074·6865·2073··because·of·the·s | |||
| 0003bdf0:·7973·7465·6d20·7265·6c61·7465·6420·636f··ystem·related·co | |||
| 0003be00:·6e66·6967·2066·696c·6573·2920·616e·6420··nfig·files)·and· | |||
| 0003be10:·7468·656e·2067·6574·2066·696c·6573·206e··then·get·files·n | |||
| 0003be20:·616d·6573·0a66·696c·6573·5f77·6974·685f··ames.files_with_ | |||
| 0003be30:·696e·636f·7272·6563·745f·6861·7368·3d22··incorrect_hash=" | |||
| 0003be40:·2428·7270·6d20·2d56·6120·2d2d·6e6f·636f··$(rpm·-Va·--noco | |||
| 0003be50:·6e66·6967·207c·2067·7265·7020·2d45·2027··nfig·|·grep·-E·' | |||
| 0003be60:·5e2e·2e35·2720·7c20·6177·6b20·277b·7072··^..5'·|·awk·'{pr | |||
| 0003be70:·696e·7420·244e·467d·2720·2922·0a0a·2320··int·$NF}'·)"..#· | |||
| 0003be80:·4672·6f6d·2066·696c·6573·206e·616d·6573··From·files·names | |||
| 0003be90:·2067·6574·2070·6163·6b61·6765·206e·616d···get·package·nam | |||
| 0003bea0:·6573·2061·6e64·2063·6861·6e67·6520·6e65··es·and·change·ne | |||
| 0003beb0:·776c·696e·6520·746f·2073·7061·6365·2c20··wline·to·space,· | |||
| 0003bec0:·6265·6361·7573·6520·7270·6d20·7772·6974··because·rpm·writ | |||
| 0003bed0:·6573·2065·6163·6820·7061·636b·6167·6520··es·each·package· | |||
| 0003bee0:·746f·206e·6577·206c·696e·650a·7061·636b··to·new·line.pack | |||
| 0003bef0:·6167·6573·5f74·6f5f·7265·696e·7374·616c··ages_to_reinstal | |||
| 0003bf00:·6c3d·2224·2872·706d·202d·7166·2024·6669··l="$(rpm·-qf·$fi | |||
| 0003bf10:·6c65·735f·7769·7468·5f69·6e63·6f72·7265··les_with_incorre | |||
| 0003bf20:·6374·5f68·6173·6820·7c20·7472·2027·5c6e··ct_hash·|·tr·'\n | |||
| 0003bf30:·2720·2720·2729·220a·0a0a·7a79·7070·6572··'·'·')"...zypper | |||
| 0003bf40:·2069·6e73·7461·6c6c·202d·6620·2d79·2024···install·-f·-y·$ | |||
| 0003bf50:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003bf60:·7374·616c·6c0a·3c2f·636f·6465·3e3c·2f70··stall.</code></p | |||
| 0003bf70:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003bf80:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003bf90:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003bfa0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 0003bfb0:·7461·7267·6574·3d22·2369·646d·3530·3737··target="#idm5077 | |||
| 0003bfc0:·2220·7461·6269·6e64·6578·3d22·3022·2072··"·tabindex="0"·r | |||
| 0003bfd0:·6f6c·653d·2262·7574·746f·6e22·2061·7269··ole="button"·ari | |||
| 0003bfe0:·612d·6578·7061·6e64·6564·3d22·6661·6c73··a-expanded="fals | |||
| 0003bff0:·6522·2074·6974·6c65·3d22·4163·7469·7661··e"·title="Activa | |||
| 0003c000:·7465·2074·6f20·7265·7665·616c·2220·6872··te·to·reveal"·hr | |||
| 0003c010:·6566·3d22·2321·223e·5265·6d65·6469·6174··ef="#!">Remediat | |||
| 0003c020:·696f·6e20·416e·7369·626c·6520·736e·6970··ion·Ansible·snip | |||
| 0003c030:·7065·7420·e287·b23c·2f61·3e3c·6272·3e3c··pet·...</a><br>< | |||
| 0003c040:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c050:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c060:·7365·2220·6964·3d22·6964·6d35·3037·3722··se"·id="idm5077" | |||
| 0003c070:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c080:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003 | 0003c090:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003c0a0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | |||
| 0003c0b0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c0c0:·6578·6974·793a·3c2f·7468·3e3c·7464·3e68··exity:</th><td>h | |||
| 0003c0d0:·6967·683c·2f74·643e·3c2f·7472·3e3c·7472··igh</td></tr><tr | |||
| 0003c0e0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 0003c0f0:·3c2f·7468·3e3c·7464·3e6d·6564·6975·6d3c··</th><td>medium< | |||
| 0003c100:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c110:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c120:·7464·3e72·6573·7472·6963·743c·2f74·643e··td>restrict</td> | |||
| 0003c130:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003c140:·653e·3c63·6f64·653e·2d20·6e61·6d65·3a20··e><code>-·name:· | |||
| 0003bde0:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 0003bdf0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 0003be00:·6869·6768·3c2f·7464·3e3c·2f74·723e·3c74··high</td></tr><t | |||
| 0003be10:·723e·3c74·683e·4469·7372·7570·7469·6f6e··r><th>Disruption | |||
| 0003be20:·3a3c·2f74·683e·3c74·643e·6d65·6469·756d··:</th><td>medium | |||
| 0003be30:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003be40:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003be50:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003be60:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003be70:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003be80:·2027·5365·7420·6661·6374·3a20·5061·636b···'Set·fact:·Pack | |||
| 0003be90:·6167·6520·6d61·6e61·6765·7220·7265·696e··age·manager·rein | |||
| 0003bea0:·7374·616c·6c20·636f·6d6d·616e·6420·2864··stall·command·(d | |||
| 0003beb0:·6e66·2927·0a20·2073·6574·5f66·6163·743a··nf)'.··set_fact: | |||
| 0003bec0:·0a20·2020·2070·6163·6b61·6765·5f6d·616e··.····package_man | |||
| 0003bed0:·6167·6572·5f72·6569·6e73·7461·6c6c·5f63··ager_reinstall_c | |||
| 0003bee0:·6d64·3a20·646e·6620·7265·696e·7374·616c··md:·dnf·reinstal | |||
| 0003bef0:·6c20·2d79·0a20·2077·6865·6e3a·2061·6e73··l·-y.··when:·ans | |||
| 0003bf00:·6962·6c65·5f64·6973·7472·6962·7574·696f··ible_distributio | |||
| 0003bf10:·6e20·3d3d·2022·4665·646f·7261·220a·2020··n·==·"Fedora".·· | |||
| 0003bf20:·7461·6773·3a0a·2020·2d20·4343·452d·3931··tags:.··-·CCE-91 | |||
| 0003bf30:·3633·322d·300a·2020·2d20·434a·4953·2d35··632-0.··-·CJIS-5 | |||
| 0003bf40:·2e31·302e·342e·310a·2020·2d20·4e49·5354··.10.4.1.··-·NIST | |||
| 0003bf50:·2d38·3030·2d31·3731·2d33·2e33·2e38·0a20··-800-171-3.3.8.· | |||
| 0003bf60:·202d·204e·4953·542d·3830·302d·3137·312d···-·NIST-800-171- | |||
| 0003bf70:·332e·342e·310a·2020·2d20·4e49·5354·2d38··3.4.1.··-·NIST-8 | |||
| 0003bf80:·3030·2d35·332d·4155·2d39·2833·290a·2020··00-53-AU-9(3).·· | |||
| 0003bf90:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003bfa0:·2d36·2863·290a·2020·2d20·4e49·5354·2d38··-6(c).··-·NIST-8 | |||
| 0003bfb0:·3030·2d35·332d·434d·2d36·2864·290a·2020··00-53-CM-6(d).·· | |||
| 0003bfc0:·2d20·4e49·5354·2d38·3030·2d35·332d·5349··-·NIST-800-53-SI | |||
| 0003bfd0:·2d37·0a20·202d·204e·4953·542d·3830·302d··-7.··-·NIST-800- | |||
| 0003bfe0:·3533·2d53·492d·3728·3129·0a20·202d·204e··53-SI-7(1).··-·N | |||
| Max diff block lines reached; 16466484/16511802 bytes (99.73%) of diff not shown. | |||
| Offset 37, 15 lines modified | Offset 37, 15 lines modified | ||
| 37 | Profile·Title·PCI-DSS·v4·Control·Baseline·for·SUSE·Linux·enterprise·12 | 37 | Profile·Title·PCI-DSS·v4·Control·Baseline·for·SUSE·Linux·enterprise·12 |
| 38 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss-4 | 38 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss-4 |
| 39 | ***·CPE·Platforms·*** | 39 | ***·CPE·Platforms·*** |
| 40 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 40 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 41 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 41 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 42 | *****·Revision·History·***** | 42 | *****·Revision·History·***** |
| 43 | Current·version:·0.1.65 | 43 | Current·version:·0.1.65 |
| 44 | ····*·draft·(as·of·202 | 44 | ····*·draft·(as·of·2025-02-23) |
| 45 | *****·Table·of·Contents·***** | 45 | *****·Table·of·Contents·***** |
| 46 | ···1.·System_Settings | 46 | ···1.·System_Settings |
| 47 | ·········1.·Installing_and_Maintaining_Software | 47 | ·········1.·Installing_and_Maintaining_Software |
| 48 | ·········2.·Account_and_Access_Control | 48 | ·········2.·Account_and_Access_Control |
| 49 | ·········3.·System_Accounting_with_auditd | 49 | ·········3.·System_Accounting_with_auditd |
| 50 | ·········4.·GRUB2_bootloader_configuration | 50 | ·········4.·GRUB2_bootloader_configuration |
| 51 | ·········5.·Configure_Syslog | 51 | ·········5.·Configure_Syslog |
| Offset 119, 14 lines modified | Offset 119, 25 lines modified | ||
| 119 | ············Identifiers: ·CCE-91632-0 | 119 | ············Identifiers: ·CCE-91632-0 |
| 120 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, | 120 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, |
| 121 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 | 121 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 |
| 122 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, | 122 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, |
| 123 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 | 123 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 |
| 124 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- | 124 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- |
| 125 | ············00227 | 125 | ············00227 |
| 126 | Remediation_Shell_script_⇲ | ||
| 127 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 128 | names | ||
| 129 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 130 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 131 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 132 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 126 | Remediation_Ansible_snippet_⇲ | 133 | Remediation_Ansible_snippet_⇲ |
| 127 | Complexity:·high | 134 | Complexity:·high |
| 128 | Disruption:·medium | 135 | Disruption:·medium |
| 129 | Strategy:···restrict | 136 | Strategy:···restrict |
| 130 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 137 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 131 | ··set_fact: | 138 | ··set_fact: |
| 132 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 139 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 276, 25 lines modified | Offset 287, 14 lines modified | ||
| 276 | ··-·PCI-DSS-Req-11.5 | 287 | ··-·PCI-DSS-Req-11.5 |
| 277 | ··-·high_complexity | 288 | ··-·high_complexity |
| 278 | ··-·high_severity | 289 | ··-·high_severity |
| 279 | ··-·medium_disruption | 290 | ··-·medium_disruption |
| 280 | ··-·no_reboot_needed | 291 | ··-·no_reboot_needed |
| 281 | ··-·restrict_strategy | 292 | ··-·restrict_strategy |
| 282 | ··-·rpm_verify_hashes | 293 | ··-·rpm_verify_hashes |
| 283 | Remediation_Shell_script_⇲ | ||
| 284 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 285 | names | ||
| 286 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 287 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 288 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 289 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 290 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 294 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 291 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many | 295 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many |
| 292 | that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 296 | that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 293 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 297 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 294 | run·the·following·command·to·determine·which·package·owns·it: | 298 | run·the·following·command·to·determine·which·package·owns·it: |
| 295 | $·rpm·-qf·FILENAME | 299 | $·rpm·-qf·FILENAME |
| 296 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 300 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| Offset 344, 14 lines modified | Offset 344, 43 lines modified | ||
| 344 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 344 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 345 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, | 345 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, |
| 346 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, | 346 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, |
| 347 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- | 347 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- |
| 348 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- | 348 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- |
| 349 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, | 349 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, |
| 350 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 | 350 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 |
| 351 | Remediation_Shell_script_⇲ | ||
| 352 | Complexity:·high | ||
| 353 | Disruption:·medium | ||
| 354 | Strategy:···restrict | ||
| 355 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 356 | declare·-A·SETPERMS_RPM_DICT | ||
| 357 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 358 | #·is·expected·by·the·RPM·database | ||
| 359 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 360 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 361 | do | ||
| 362 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 363 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 364 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 365 | ········do | ||
| 366 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 367 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 368 | ········done | ||
| 369 | done | ||
| 370 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 371 | #·correct·values | ||
| 372 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 373 | do | ||
| 374 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 375 | done | ||
| 351 | Remediation_Ansible_snippet_⇲ | 376 | Remediation_Ansible_snippet_⇲ |
| 352 | Complexity:·high | 377 | Complexity:·high |
| 353 | Disruption:·medium | 378 | Disruption:·medium |
| 354 | Strategy:···restrict | 379 | Strategy:···restrict |
| 355 | -·name:·Read·list·of·files·with·incorrect·permissions | 380 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 356 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 381 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 357 | ····--nocaps·--nolinkto·--nouser·--nogroup | 382 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 428, 43 lines modified | Offset 457, 14 lines modified | ||
| 428 | ··-·PCI-DSS-Req-11.5 | 457 | ··-·PCI-DSS-Req-11.5 |
| 429 | ··-·high_complexity | 458 | ··-·high_complexity |
| 430 | ··-·high_severity | 459 | ··-·high_severity |
| 431 | ··-·medium_disruption | 460 | ··-·medium_disruption |
| 432 | ··-·no_reboot_needed | 461 | ··-·no_reboot_needed |
| 433 | ··-·restrict_strategy | 462 | ··-·restrict_strategy |
| 434 | ··-·rpm_verify_permissions | 463 | ··-·rpm_verify_permissions |
| 435 | Remediation_Shell_script_⇲ | ||
| 436 | Complexity:·high | ||
| 437 | Disruption:·medium | ||
| 438 | Strategy:···restrict | ||
| 439 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 440 | declare·-A·SETPERMS_RPM_DICT | ||
| Max diff block lines reached; 1206025/1212673 bytes (99.45%) of diff not shown. | |||
| Offset 14297, 16 lines modified | Offset 14297, 16 lines modified | ||
| 00037d80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037d80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037d90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037d90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037da0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037da0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037db0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037db0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037dc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037dc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037dd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037dd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037df0:·2861·7320·6f66·2032·3032·3 | 00037df0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037e00:·3 | 00037e00:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037e10:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037e10:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037e20:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037e20:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037e30:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037e30:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037e40:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037e40:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037e50:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037e50:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037e60:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037e60:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037e70:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037e70:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15256, 330 lines modified | Offset 15256, 330 lines modified | ||
| 0003b970:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003b970:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003b980:·6964·6d35·3037·3622·2074·6162·696e·6465··idm5076"·tabinde | 0003b980:·6964·6d35·3037·3622·2074·6162·696e·6465··idm5076"·tabinde | ||
| 0003b990:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003b990:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003b9a0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003b9a0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003b9b0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003b9b0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003b9c0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003b9c0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003b9d0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003b9d0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003b9e0:·656d·6564·6961·7469·6f6e·20 | 0003b9e0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003b9f0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003ba00:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003ba10:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003ba20:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003ba30:·646d·3530·3736·223e·3c74·6162·6c65·2063··dm5076"><table·c | |||
| 0003ba40:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003ba50:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003ba60:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003ba70:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003ba80:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003ba90:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003baa0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bab0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bac0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003bad0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bae0:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003baf0:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003b | 0003b9f0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | ||
| 0003ba00:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003ba10:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003ba20:·6c6c·6170·7365·2220·6964·3d22·6964·6d35··llapse"·id="idm5 | |||
| 0003ba30:·3037·3622·3e3c·7072·653e·3c63·6f64·653e··076"><pre><code> | |||
| 0003ba40:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003ba50:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003ba60:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003ba70:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003ba80:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003ba90:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003baa0:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003bab0:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003bac0:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003bad0:·6861·7368·3d22·2428·7270·6d20·2d56·6120··hash="$(rpm·-Va· | |||
| 0003bae0:·2d2d·6e6f·636f·6e66·6967·207c·2067·7265··--noconfig·|·gre | |||
| 0003baf0:·7020·2d45·2027·5e2e·2e35·2720·7c20·6177··p·-E·'^..5'·|·aw | |||
| 0003bb00:·6b20·277b·7072·696e·7420·244e·467d·2720··k·'{print·$NF}'· | |||
| 0003bb10:·2922·0a0a·2320·4672·6f6d·2066·696c·6573··)"..#·From·files | |||
| 0003bb | 0003bb20:·206e·616d·6573·2067·6574·2070·6163·6b61···names·get·packa | ||
| 0003bb | 0003bb30:·6765·206e·616d·6573·2061·6e64·2063·6861··ge·names·and·cha | ||
| 0003bb40:·6e67·6520·6e65·776c·696e·6520·746f·2073··nge·newline·to·s | |||
| 0003bb50:·7061·6365·2c20·6265·6361·7573·6520·7270··pace,·because·rp | |||
| 0003bb60:·6d20·7772·6974·6573·2065·6163·6820·7061··m·writes·each·pa | |||
| 0003bb70:·636b·6167·6520·746f·206e·6577·206c·696e··ckage·to·new·lin | |||
| 0003bb80:·650a·7061·636b·6167·6573·5f74·6f5f·7265··e.packages_to_re | |||
| 0003bb90:·696e·7374·616c·6c3d·2224·2872·706d·202d··install="$(rpm·- | |||
| 0003bba0:·7166·2024·6669·6c65·735f·7769·7468·5f69··qf·$files_with_i | |||
| 0003bbb0:·6e63·6f72·7265·6374·5f68·6173·6820·7c20··ncorrect_hash·|· | |||
| 0003bbc0:·7472·2027·5c6e·2720·2720·2729·220a·0a0a··tr·'\n'·'·')"... | |||
| 0003bbd0:·7a79·7070·6572·2069·6e73·7461·6c6c·202d··zypper·install·- | |||
| 0003bbe0:·6620·2d79·2024·7061·636b·6167·6573·5f74··f·-y·$packages_t | |||
| 0003bb | 0003bbf0:·6f5f·7265·696e·7374·616c·6c0a·3c2f·636f··o_reinstall.</co | ||
| 0003bc00:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bc10:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bc20:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bc30:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003bc40:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003bc50:·646d·3530·3737·2220·7461·6269·6e64·6578··dm5077"·tabindex | |||
| 0003bc60:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003bc70:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003bc80:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003bc90:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003bca0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003bcb0:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003bcc0:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003bcd0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003bce0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003bcf0:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003bd00:·6d35·3037·3722·3e3c·7461·626c·6520·636c··m5077"><table·cl | |||
| 0003bd10:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003bd20:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003bd30:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003bd40:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003bd50:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003bd60:·3e3c·7464·3e68·6967·683c·2f74·643e·3c2f··><td>high</td></ | |||
| 0003bd70:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bd80:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6d··ption:</th><td>m | |||
| 0003bd90:·6564·6975·6d3c·2f74·643e·3c2f·7472·3e3c··edium</td></tr>< | |||
| 0003bda0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003bdb0:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003bdc0:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003bdd0:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003bb40:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003bb50:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003bb60:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003bb70:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003bb80:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003bb90:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003bba0:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003bbb0:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003bbc0:·4343·452d·3931·3633·322d·300a·2020·2d20··CCE-91632-0.··-· | |||
| 0003bbd0:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003bbe0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003bbf0:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003bc00:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003bc10:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003bc20:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003bc30:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003bc40:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003bc50:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003bc60:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003bc70:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003bc80:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003bc90:·2d53·492d·3728·3629·0a20·202d·2050·4349··-SI-7(6).··-·PCI | |||
| Max diff block lines reached; 15462480/15507936 bytes (99.71%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·SUSE·Linux·enterprise·12 | 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·SUSE·Linux·enterprise·12 |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 41 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 42 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 42 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·GRUB2_bootloader_configuration | 51 | ·········4.·GRUB2_bootloader_configuration |
| 52 | ·········5.·Configure_Syslog | 52 | ·········5.·Configure_Syslog |
| Offset 109, 14 lines modified | Offset 109, 25 lines modified | ||
| 109 | ············Identifiers: ·CCE-91632-0 | 109 | ············Identifiers: ·CCE-91632-0 |
| 110 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, | 110 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, |
| 111 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 | 111 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 |
| 112 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, | 112 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, |
| 113 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 | 113 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 |
| 114 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- | 114 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- |
| 115 | ············00227 | 115 | ············00227 |
| 116 | Remediation_Shell_script_⇲ | ||
| 117 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 118 | names | ||
| 119 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 120 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 121 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 122 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 116 | Remediation_Ansible_snippet_⇲ | 123 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·high | 124 | Complexity:·high |
| 118 | Disruption:·medium | 125 | Disruption:·medium |
| 119 | Strategy:···restrict | 126 | Strategy:···restrict |
| 120 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 127 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 121 | ··set_fact: | 128 | ··set_fact: |
| 122 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 129 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 266, 25 lines modified | Offset 277, 14 lines modified | ||
| 266 | ··-·PCI-DSS-Req-11.5 | 277 | ··-·PCI-DSS-Req-11.5 |
| 267 | ··-·high_complexity | 278 | ··-·high_complexity |
| 268 | ··-·high_severity | 279 | ··-·high_severity |
| 269 | ··-·medium_disruption | 280 | ··-·medium_disruption |
| 270 | ··-·no_reboot_needed | 281 | ··-·no_reboot_needed |
| 271 | ··-·restrict_strategy | 282 | ··-·restrict_strategy |
| 272 | ··-·rpm_verify_hashes | 283 | ··-·rpm_verify_hashes |
| 273 | Remediation_Shell_script_⇲ | ||
| 274 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 275 | names | ||
| 276 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 277 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 278 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 279 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 280 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 284 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 281 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many | 285 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many |
| 282 | that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 286 | that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 283 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 287 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 284 | run·the·following·command·to·determine·which·package·owns·it: | 288 | run·the·following·command·to·determine·which·package·owns·it: |
| 285 | $·rpm·-qf·FILENAME | 289 | $·rpm·-qf·FILENAME |
| 286 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 290 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| Offset 334, 14 lines modified | Offset 334, 43 lines modified | ||
| 334 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 334 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 335 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, | 335 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, |
| 336 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, | 336 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, |
| 337 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- | 337 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- |
| 338 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- | 338 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- |
| 339 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, | 339 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, |
| 340 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 | 340 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 |
| 341 | Remediation_Shell_script_⇲ | ||
| 342 | Complexity:·high | ||
| 343 | Disruption:·medium | ||
| 344 | Strategy:···restrict | ||
| 345 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 346 | declare·-A·SETPERMS_RPM_DICT | ||
| 347 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 348 | #·is·expected·by·the·RPM·database | ||
| 349 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 350 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 351 | do | ||
| 352 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 353 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 354 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 355 | ········do | ||
| 356 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 357 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 358 | ········done | ||
| 359 | done | ||
| 360 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 361 | #·correct·values | ||
| 362 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 363 | do | ||
| 364 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 365 | done | ||
| 341 | Remediation_Ansible_snippet_⇲ | 366 | Remediation_Ansible_snippet_⇲ |
| 342 | Complexity:·high | 367 | Complexity:·high |
| 343 | Disruption:·medium | 368 | Disruption:·medium |
| 344 | Strategy:···restrict | 369 | Strategy:···restrict |
| 345 | -·name:·Read·list·of·files·with·incorrect·permissions | 370 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 346 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 371 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 347 | ····--nocaps·--nolinkto·--nouser·--nogroup | 372 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 418, 43 lines modified | Offset 447, 14 lines modified | ||
| 418 | ··-·PCI-DSS-Req-11.5 | 447 | ··-·PCI-DSS-Req-11.5 |
| 419 | ··-·high_complexity | 448 | ··-·high_complexity |
| 420 | ··-·high_severity | 449 | ··-·high_severity |
| 421 | ··-·medium_disruption | 450 | ··-·medium_disruption |
| 422 | ··-·no_reboot_needed | 451 | ··-·no_reboot_needed |
| 423 | ··-·restrict_strategy | 452 | ··-·restrict_strategy |
| 424 | ··-·rpm_verify_permissions | 453 | ··-·rpm_verify_permissions |
| 425 | Remediation_Shell_script_⇲ | ||
| 426 | Complexity:·high | ||
| 427 | Disruption:·medium | ||
| 428 | Strategy:···restrict | ||
| 429 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 430 | declare·-A·SETPERMS_RPM_DICT | ||
| Max diff block lines reached; 1074802/1081452 bytes (99.39%) of diff not shown. | |||
| Offset 14304, 15 lines modified | Offset 14304, 15 lines modified | ||
| 00037df0:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | 00037df0:·7374·6f72·793c·2f68·323e·3c70·3e43·7572··story</h2><p>Cur | ||
| 00037e00:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | 00037e00:·7265·6e74·2076·6572·7369·6f6e·3a20·3c73··rent·version:·<s | ||
| 00037e10:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | 00037e10:·7472·6f6e·673e·302e·312e·3635·3c2f·7374··trong>0.1.65</st | ||
| 00037e20:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | 00037e20:·726f·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69··rong></p><ul><li | ||
| 00037e30:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | 00037e30:·3e3c·7374·726f·6e67·3e64·7261·6674·3c2f··><strong>draft</ | ||
| 00037e40:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | 00037e40:·7374·726f·6e67·3e0a·2020·2020·2020·2020··strong>.········ | ||
| 00037e50:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | 00037e50:·2020·2020·2020·2020·2020·2020·2861·7320··············(as· | ||
| 00037e60:·6f66·2032·3032·3 | 00037e60:·6f66·2032·3032·352d·3032·2d32·3329·0a20··of·2025-02-23).· | ||
| 00037e70:·2020·2020·2020·2020·2020·2020·2020·203c·················< | 00037e70:·2020·2020·2020·2020·2020·2020·2020·203c·················< | ||
| 00037e80:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | 00037e80:·2f6c·693e·3c2f·756c·3e3c·2f64·6976·3e3c··/li></ul></div>< | ||
| 00037e90:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | 00037e90:·6832·3e54·6162·6c65·206f·6620·436f·6e74··h2>Table·of·Cont | ||
| 00037ea0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | 00037ea0:·656e·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69··ents</h2><ol><li | ||
| 00037eb0:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | 00037eb0:·3e3c·6120·6872·6566·3d22·2378·6363·6466··><a·href="#xccdf | ||
| 00037ec0:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | 00037ec0:·5f6f·7267·2e73·7367·7072·6f6a·6563·742e··_org.ssgproject. | ||
| 00037ed0:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | 00037ed0:·636f·6e74·656e·745f·6772·6f75·705f·7379··content_group_sy | ||
| Offset 15085, 111 lines modified | Offset 15085, 111 lines modified | ||
| 0003aec0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003aec0:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003aed0:·2223·6964·6d33·3538·3834·2220·7461·6269··"#idm35884"·tabi | 0003aed0:·2223·6964·6d33·3538·3834·2220·7461·6269··"#idm35884"·tabi | ||
| 0003aee0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003aee0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003aef0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003aef0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003af00:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003af00:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003af10:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003af10:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003af20:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003af20:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003af30:·223e·5265·6d65·6469·6174·696f·6e20·416e··">Remediation·An | |||
| 0003af40:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003af50:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003af60:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003af70:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003af80:·3d22·6964·6d33·3538·3834·223e·3c74·6162··="idm35884"><tab | |||
| 0003af90:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003afa0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003afb0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003afc0:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003afd0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003afe0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003aff0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003b000:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003b010:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003b020:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003b030:·3a3c·2f74·683e·3c74·643e·636f·6e66·6967··:</th><td>config | |||
| 0003b040:·7572·653c·2f74·643e·3c2f·7472·3e3c·2f74··ure</td></tr></t | |||
| 0003b050:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003b060:·2d20·6e61·6d65·3a20·5465·7374·2066·6f72··-·name:·Test·for | |||
| 0003b070:·2065·7869·7374·656e·6365·202f·6574·632f···existence·/etc/ | |||
| 0003b080:·7061·7373·7764·0a20·2073·7461·743a·0a20··passwd.··stat:.· | |||
| 0003b090:·2020·2070·6174·683a·202f·6574·632f·7061·····path:·/etc/pa | |||
| 0003b0a0:·7373·7764·0a20·2072·6567·6973·7465·723a··sswd.··register: | |||
| 0003b0b0:·2066·696c·655f·6578·6973·7473·0a20·2074···file_exists.··t | |||
| 0003b0c0:·6167·733a·0a20·202d·2043·4345·2d39·3136··ags:.··-·CCE-916 | |||
| 0003b0d0:·3237·2d30·0a20·202d·2043·4a49·532d·352e··27-0.··-·CJIS-5. | |||
| 0003b0e0:·352e·322e·320a·2020·2d20·4e49·5354·2d38··5.2.2.··-·NIST-8 | |||
| 0003b0f0:·3030·2d35·332d·4143·2d36·2831·290a·2020··00-53-AC-6(1).·· | |||
| 0003b100:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003b110:·2d36·2861·290a·2020·2d20·5043·492d·4453··-6(a).··-·PCI-DS | |||
| 0003b120:·532d·5265·712d·382e·372e·630a·2020·2d20··S-Req-8.7.c.··-· | |||
| 0003b130:·636f·6e66·6967·7572·655f·7374·7261·7465··configure_strate | |||
| 0003b140:·6779·0a20·202d·2066·696c·655f·6772·6f75··gy.··-·file_grou | |||
| 0003b150:·706f·776e·6572·5f65·7463·5f70·6173·7377··powner_etc_passw | |||
| 0003b160:·640a·2020·2d20·6c6f·775f·636f·6d70·6c65··d.··-·low_comple | |||
| 0003b170:·7869·7479·0a20·202d·206c·6f77·5f64·6973··xity.··-·low_dis | |||
| 0003b180:·7275·7074·696f·6e0a·2020·2d20·6d65·6469··ruption.··-·medi | |||
| 0003b190:·756d·5f73·6576·6572·6974·790a·2020·2d20··um_severity.··-· | |||
| 0003b1a0:·6e6f·5f72·6562·6f6f·745f·6e65·6564·6564··no_reboot_needed | |||
| 0003b1b0:·0a0a·2d20·6e61·6d65·3a20·456e·7375·7265··..-·name:·Ensure | |||
| 0003b1c0:·2067·726f·7570·206f·776e·6572·2030·206f···group·owner·0·o | |||
| 0003b1d0:·6e20·2f65·7463·2f70·6173·7377·640a·2020··n·/etc/passwd.·· | |||
| 0003b1e0:·6669·6c65·3a0a·2020·2020·7061·7468·3a20··file:.····path:· | |||
| 0003b1f0:·2f65·7463·2f70·6173·7377·640a·2020·2020··/etc/passwd.···· | |||
| 0003b200:·6772·6f75·703a·2027·3027·0a20·2077·6865··group:·'0'.··whe | |||
| 0003b210:·6e3a·2066·696c·655f·6578·6973·7473·2e73··n:·file_exists.s | |||
| 0003b220:·7461·7420·6973·2064·6566·696e·6564·2061··tat·is·defined·a | |||
| 0003b230:·6e64·2066·696c·655f·6578·6973·7473·2e73··nd·file_exists.s | |||
| 0003b240:·7461·742e·6578·6973·7473·0a20·2074·6167··tat.exists.··tag | |||
| 0003b250:·733a·0a20·202d·2043·4345·2d39·3136·3237··s:.··-·CCE-91627 | |||
| 0003b260:·2d30·0a20·202d·2043·4a49·532d·352e·352e··-0.··-·CJIS-5.5. | |||
| 0003b270:·322e·320a·2020·2d20·4e49·5354·2d38·3030··2.2.··-·NIST-800 | |||
| 0003b280:·2d35·332d·4143·2d36·2831·290a·2020·2d20··-53-AC-6(1).··-· | |||
| 0003b290:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003b2a0:·2861·290a·2020·2d20·5043·492d·4453·532d··(a).··-·PCI-DSS- | |||
| 0003b2b0:·5265·712d·382e·372e·630a·2020·2d20·636f··Req-8.7.c.··-·co | |||
| 0003b2c0:·6e66·6967·7572·655f·7374·7261·7465·6779··nfigure_strategy | |||
| 0003b2d0:·0a20·202d·2066·696c·655f·6772·6f75·706f··.··-·file_groupo | |||
| 0003b2e0:·776e·6572·5f65·7463·5f70·6173·7377·640a··wner_etc_passwd. | |||
| 0003b2f0:·2020·2d20·6c6f·775f·636f·6d70·6c65·7869····-·low_complexi | |||
| 0003b300:·7479·0a20·202d·206c·6f77·5f64·6973·7275··ty.··-·low_disru | |||
| 0003b310:·7074·696f·6e0a·2020·2d20·6d65·6469·756d··ption.··-·medium | |||
| 0003b320:·5f73·6576·6572·6974·790a·2020·2d20·6e6f··_severity.··-·no | |||
| 0003b330:·5f72·6562·6f6f·745f·6e65·6564·6564·0a3c··_reboot_needed.< | |||
| 0003b340:·2f63·6f64·653e·3c2f·7072·653e·3c2f·6469··/code></pre></di | |||
| 0003b350:·763e·3c61·2063·6c61·7373·3d22·6274·6e20··v><a·class="btn· | |||
| 0003b360:·6274·6e2d·7375·6363·6573·7322·2064·6174··btn-success"·dat | |||
| 0003b370:·612d·746f·6767·6c65·3d22·636f·6c6c·6170··a-toggle="collap | |||
| 0003b380:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | |||
| 0003b390:·2223·6964·6d33·3538·3835·2220·7461·6269··"#idm35885"·tabi | |||
| 0003b3a0:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | |||
| 0003b3b0:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | |||
| 0003b3c0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | |||
| 0003b3d0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | |||
| 0003b3e0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | |||
| 0003 | 0003af30:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003 | 0003af40:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | ||
| 0003 | 0003af50:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | ||
| 0003 | 0003af60:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | ||
| 0003 | 0003af70:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | ||
| 0003 | 0003af80:·646d·3335·3838·3422·3e3c·7461·626c·6520··dm35884"><table· | ||
| 0003 | 0003af90:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | ||
| 0003 | 0003afa0:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | ||
| 0003 | 0003afb0:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | ||
| 0003 | 0003afc0:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | ||
| 0003 | 0003afd0:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | ||
| 0003 | 0003afe0:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003 | 0003aff0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | ||
| 0003b | 0003b000:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | ||
| 0003b | 0003b010:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | ||
| 0003b | 0003b020:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | ||
| 0003b | 0003b030:·7468·3e3c·7464·3e63·6f6e·6669·6775·7265··th><td>configure | ||
| 0003b | 0003b040:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003b | 0003b050:·653e·3c70·7265·3e3c·636f·6465·3e0a·0a0a··e><pre><code>... | ||
| 0003b | 0003b060:·6368·6772·7020·3020·2f65·7463·2f70·6173··chgrp·0·/etc/pas | ||
| 0003b | 0003b070:·7377·640a·3c2f·636f·6465·3e3c·2f70·7265··swd.</code></pre | ||
| 0003b080:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003b090:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003b0a0:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003b0b0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003b0c0:·7267·6574·3d22·2369·646d·3335·3838·3522··rget="#idm35885" | |||
| 0003b0d0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 0003b0e0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| Max diff block lines reached; 29174/44270 bytes (65.90%) of diff not shown. | |||
| Offset 40, 15 lines modified | Offset 40, 15 lines modified | ||
| 40 | Profile·Title·Standard·System·Security·Profile·for·SUSE·Linux·Enterprise·12 | 40 | Profile·Title·Standard·System·Security·Profile·for·SUSE·Linux·Enterprise·12 |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 | 43 | ····*·cpe:/o:suse:linux_enterprise_desktop:12 |
| 44 | ····*·cpe:/o:suse:linux_enterprise_server:12 | 44 | ····*·cpe:/o:suse:linux_enterprise_server:12 |
| 45 | *****·Revision·History·***** | 45 | *****·Revision·History·***** |
| 46 | Current·version:·0.1.65 | 46 | Current·version:·0.1.65 |
| 47 | ····*·draft·(as·of·202 | 47 | ····*·draft·(as·of·2025-02-23) |
| 48 | *****·Table·of·Contents·***** | 48 | *****·Table·of·Contents·***** |
| 49 | ···1.·System_Settings | 49 | ···1.·System_Settings |
| 50 | ·········1.·File_Permissions_and_Masks | 50 | ·········1.·File_Permissions_and_Masks |
| 51 | *****·Checklist·***** | 51 | *****·Checklist·***** |
| 52 | Group ·Guide·to·the·Secure·Configuration·of·SUSE·Linux·Enterprise·12· Group | 52 | Group ·Guide·to·the·Secure·Configuration·of·SUSE·Linux·Enterprise·12· Group |
| 53 | contains·4·groups·and·3·rules | 53 | contains·4·groups·and·3·rules |
| 54 | Group ·System·Settings· Group·contains·3·groups·and·3·rules | 54 | Group ·System·Settings· Group·contains·3·groups·and·3·rules |
| Offset 94, 14 lines modified | Offset 94, 22 lines modified | ||
| 94 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 94 | ············DSS06.02,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 95 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, | 95 | Identifiers·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.6.1.2, |
| 96 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, | 96 | and·········A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1, |
| 97 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- | 97 | References··A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP-007- |
| 98 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- | 98 | ············3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP-007- |
| 99 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227, | 99 | ············3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS-00227, |
| 100 | ············6.1.2 | 100 | ············6.1.2 |
| 101 | Remediation_Shell_script_⇲ | ||
| 102 | Complexity:·low | ||
| 103 | Disruption:·low | ||
| 104 | Strategy:···configure | ||
| 105 | chgrp·0·/etc/passwd | ||
| 101 | Remediation_Ansible_snippet_⇲ | 106 | Remediation_Ansible_snippet_⇲ |
| 102 | Complexity:·low | 107 | Complexity:·low |
| 103 | Disruption:·low | 108 | Disruption:·low |
| 104 | Strategy:···configure | 109 | Strategy:···configure |
| 105 | -·name:·Test·for·existence·/etc/passwd | 110 | -·name:·Test·for·existence·/etc/passwd |
| 106 | ··stat: | 111 | ··stat: |
| 107 | ····path:·/etc/passwd | 112 | ····path:·/etc/passwd |
| Offset 132, 22 lines modified | Offset 140, 14 lines modified | ||
| 132 | ··-·PCI-DSS-Req-8.7.c | 140 | ··-·PCI-DSS-Req-8.7.c |
| 133 | ··-·configure_strategy | 141 | ··-·configure_strategy |
| 134 | ··-·file_groupowner_etc_passwd | 142 | ··-·file_groupowner_etc_passwd |
| 135 | ··-·low_complexity | 143 | ··-·low_complexity |
| 136 | ··-·low_disruption | 144 | ··-·low_disruption |
| 137 | ··-·medium_severity | 145 | ··-·medium_severity |
| 138 | ··-·no_reboot_needed | 146 | ··-·no_reboot_needed |
| 139 | Remediation_Shell_script_⇲ | ||
| 140 | Complexity:·low | ||
| 141 | Disruption:·low | ||
| 142 | Strategy:···configure | ||
| 143 | chgrp·0·/etc/passwd | ||
| 144 | ***·Rule ·Verify·User·Who·Owns·passwd·File· [ref]·*** | 147 | ***·Rule ·Verify·User·Who·Owns·passwd·File· [ref]·*** |
| 145 | To·properly·set·the·owner·of·/etc/passwd,·run·the·command: | 148 | To·properly·set·the·owner·of·/etc/passwd,·run·the·command: |
| 146 | $·sudo·chown·root·/etc/passwd | 149 | $·sudo·chown·root·/etc/passwd |
| 147 | Rationale:··The·/etc/passwd·file·contains·information·about·the·users·that·are·configured·on | 150 | Rationale:··The·/etc/passwd·file·contains·information·about·the·users·that·are·configured·on |
| 148 | ············the·system.·Protection·of·this·file·is·critical·for·system·security. | 151 | ············the·system.·Protection·of·this·file·is·critical·for·system·security. |
| 149 | Severity: ·medium | 152 | Severity: ·medium |
| 150 | Rule·ID:····xccdf_org.ssgproject.content_rule_file_owner_etc_passwd | 153 | Rule·ID:····xccdf_org.ssgproject.content_rule_file_owner_etc_passwd |
| Offset 156, 14 lines modified | Offset 156, 22 lines modified | ||
| 156 | ············DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5, | 156 | ············DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4,·A.11.1.5, |
| 157 | Identifiers·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3, | 157 | Identifiers·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3, |
| 158 | and·········A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3, | 158 | and·········A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3, |
| 159 | References··A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP- | 159 | References··A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004-6_R2.3,·CIP- |
| 160 | ············007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP- | 160 | ············007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007-3_R5.1.1,·CIP- |
| 161 | ············007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS- | 161 | ············007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS-000480-GPOS- |
| 162 | ············00227,·6.1.2 | 162 | ············00227,·6.1.2 |
| 163 | Remediation_Shell_script_⇲ | ||
| 164 | Complexity:·low | ||
| 165 | Disruption:·low | ||
| 166 | Strategy:···configure | ||
| 167 | chown·0·/etc/passwd | ||
| 163 | Remediation_Ansible_snippet_⇲ | 168 | Remediation_Ansible_snippet_⇲ |
| 164 | Complexity:·low | 169 | Complexity:·low |
| 165 | Disruption:·low | 170 | Disruption:·low |
| 166 | Strategy:···configure | 171 | Strategy:···configure |
| 167 | -·name:·Test·for·existence·/etc/passwd | 172 | -·name:·Test·for·existence·/etc/passwd |
| 168 | ··stat: | 173 | ··stat: |
| 169 | ····path:·/etc/passwd | 174 | ····path:·/etc/passwd |
| Offset 194, 22 lines modified | Offset 202, 14 lines modified | ||
| 194 | ··-·PCI-DSS-Req-8.7.c | 202 | ··-·PCI-DSS-Req-8.7.c |
| 195 | ··-·configure_strategy | 203 | ··-·configure_strategy |
| 196 | ··-·file_owner_etc_passwd | 204 | ··-·file_owner_etc_passwd |
| 197 | ··-·low_complexity | 205 | ··-·low_complexity |
| 198 | ··-·low_disruption | 206 | ··-·low_disruption |
| 199 | ··-·medium_severity | 207 | ··-·medium_severity |
| 200 | ··-·no_reboot_needed | 208 | ··-·no_reboot_needed |
| 201 | Remediation_Shell_script_⇲ | ||
| 202 | Complexity:·low | ||
| 203 | Disruption:·low | ||
| 204 | Strategy:···configure | ||
| 205 | chown·0·/etc/passwd | ||
| 206 | ***·Rule ·Verify·Permissions·on·passwd·File· [ref]·*** | 209 | ***·Rule ·Verify·Permissions·on·passwd·File· [ref]·*** |
| 207 | To·properly·set·the·permissions·of·/etc/passwd,·run·the·command: | 210 | To·properly·set·the·permissions·of·/etc/passwd,·run·the·command: |
| 208 | $·sudo·chmod·0644·/etc/passwd | 211 | $·sudo·chmod·0644·/etc/passwd |
| 209 | ············If·the·/etc/passwd·file·is·writable·by·a·group-owner·or·the·world·the·risk·of·its | 212 | ············If·the·/etc/passwd·file·is·writable·by·a·group-owner·or·the·world·the·risk·of·its |
| 210 | Rationale:··compromise·is·increased.·The·file·contains·the·list·of·accounts·on·the·system·and | 213 | Rationale:··compromise·is·increased.·The·file·contains·the·list·of·accounts·on·the·system·and |
| 211 | ············associated·information,·and·protection·of·this·file·is·critical·for·system | 214 | ············associated·information,·and·protection·of·this·file·is·critical·for·system |
| 212 | ············security. | 215 | ············security. |
| Offset 220, 14 lines modified | Offset 220, 23 lines modified | ||
| 220 | ············DSS05.07,·DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4, | 220 | ············DSS05.07,·DSS06.02,·CCI-002223,·4.3.3.7.3,·SR_2.1,·SR_5.2,·A.10.1.1,·A.11.1.4, |
| 221 | Identifiers·A.11.1.5,·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2, | 221 | Identifiers·A.11.1.5,·A.11.2.1,·A.13.1.1,·A.13.1.3,·A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2, |
| 222 | and·········A.14.1.3,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2, | 222 | and·········A.14.1.3,·A.6.1.2,·A.7.1.1,·A.7.1.2,·A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2, |
| 223 | References··A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004- | 223 | References··A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R5.1.1,·CIP-003-8_R5.3,·CIP-004- |
| 224 | ············6_R2.3,·CIP-007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007- | 224 | ············6_R2.3,·CIP-007-3_R2.1,·CIP-007-3_R2.2,·CIP-007-3_R2.3,·CIP-007-3_R5.1,·CIP-007- |
| 225 | ············3_R5.1.1,·CIP-007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS- | 225 | ············3_R5.1.1,·CIP-007-3_R5.1.2,·CM-6(a),·AC-6(1),·PR.AC-4,·PR.DS-5,·Req-8.7.c,·SRG-OS- |
| 226 | ············000480-GPOS-00227,·6.1.2 | 226 | ············000480-GPOS-00227,·6.1.2 |
| 227 | Remediation_Shell_script_⇲ | ||
| 228 | Complexity:·low | ||
| 229 | Disruption:·low | ||
| 230 | Strategy:···configure | ||
| 231 | chmod·u-xs,g-xws,o-xwt·/etc/passwd | ||
| 227 | Remediation_Ansible_snippet_⇲ | 232 | Remediation_Ansible_snippet_⇲ |
| 228 | Complexity:·low | 233 | Complexity:·low |
| 229 | Disruption:·low | 234 | Disruption:·low |
| Max diff block lines reached; 651/5381 bytes (12.10%) of diff not shown. | |||
| Offset 14297, 15 lines modified | Offset 14297, 15 lines modified | ||
| 00037d80:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00037d80:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00037d90:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00037d90:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00037da0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00037da0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00037db0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00037db0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00037dc0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00037dc0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 00037dd0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 00037dd0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 00037de0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 00037de0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 00037df0:·323 | 00037df0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 00037e00:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 00037e00:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00037e10:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00037e10:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00037e20:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00037e20:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00037e30:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00037e30:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00037e40:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00037e40:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00037e50:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00037e50:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00037e60:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00037e60:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15307, 123 lines modified | Offset 15307, 123 lines modified | ||
| 0003bca0:·7267·6574·3d22·2369·646d·3534·3134·2220··rget="#idm5414"· | 0003bca0:·7267·6574·3d22·2369·646d·3534·3134·2220··rget="#idm5414"· | ||
| 0003bcb0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003bcb0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003bcc0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003bcc0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003bcd0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003bcd0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003bce0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003bce0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003bcf0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003bcf0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003bd00:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003bd00:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003bd10:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bd20:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bd30:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bd40:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bd50:·2220·6964·3d22·6964·6d35·3431·3422·3e3c··"·id="idm5414">< | |||
| 0003bd60:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bd70:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bd80:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bd90:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bda0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bd | 0003bd10:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | ||
| 0003bd20:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bd30:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bd40:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bd50:·643d·2269·646d·3534·3134·223e·3c74·6162··d="idm5414"><tab | |||
| 0003bd60:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bd70:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bd80:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bd90:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bda0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bdb0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bdc0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bdd0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bde0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bdf0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003be00:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003b | 0003be10:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003be20:·653e·3c70·7265·3e3c·636f·6465·3e23·2052··e><pre><code>#·R | |||
| 0003be30:·656d·6564·6961·7469·6f6e·2069·7320·6170··emediation·is·ap | |||
| 0003be40:·706c·6963·6162·6c65·206f·6e6c·7920·696e··plicable·only·in | |||
| 0003be50:·2063·6572·7461·696e·2070·6c61·7466·6f72···certain·platfor | |||
| 0003be60:·6d73·0a69·6620·5b20·2120·2d66·202f·2e64··ms.if·[·!·-f·/.d | |||
| 0003be70:·6f63·6b65·7265·6e76·205d·2026·616d·703b··ockerenv·]·& | |||
| 0003be80:·2661·6d70·3b20·5b20·2120·2d66·202f·7275··&·[·!·-f·/ru | |||
| 0003be90:·6e2f·2e63·6f6e·7461·696e·6572·656e·7620··n/.containerenv· | |||
| 0003bea0:·5d3b·2074·6865·6e0a·0a7a·7970·7065·7220··];·then..zypper· | |||
| 0003beb0:·696e·7374·616c·6c20·2d79·2022·6169·6465··install·-y·"aide | |||
| 0003bec0:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 0003bed0:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 0003bee0:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 0003bef0:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 0003bf00:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 0003bf10:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bf20:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bf30:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bf40:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bf50:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bf60:·743d·2223·6964·6d35·3431·3522·2074·6162··t="#idm5415"·tab | |||
| 0003bf70:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bf80:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bf90:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bfa0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bfb0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bfc0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003bfd0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003bfe0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bff0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bdd0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bde0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bdf0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003be00:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003be10:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003be20:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003be30:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003be40:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003be50:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003be60:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003be70:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003be80:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003be90:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003bea0:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003beb0:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003bec0:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003bed0:·636f·6e74·6169·6e65·7222·5d0a·2020·7461··container"].··ta | |||
| 0003bee0:·6773·3a0a·2020·2d20·4343·452d·3833·3036··gs:.··-·CCE-8306 | |||
| 0003bef0:·372d·390a·2020·2d20·434a·4953·2d35·2e31··7-9.··-·CJIS-5.1 | |||
| 0003bf00:·302e·312e·330a·2020·2d20·4449·5341·2d53··0.1.3.··-·DISA-S | |||
| 0003bf10:·5449·472d·534c·4553·2d31·322d·3031·3035··TIG-SLES-12-0105 | |||
| 0003bf20:·3030·0a20·202d·204e·4953·542d·3830·302d··00.··-·NIST-800- | |||
| 0003bf30:·3533·2d43·4d2d·3628·6129·0a20·202d·2050··53-CM-6(a).··-·P | |||
| 0003bf40:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003bf50:·2020·2d20·656e·6162·6c65·5f73·7472·6174····-·enable_strat | |||
| 0003bf60:·6567·790a·2020·2d20·6c6f·775f·636f·6d70··egy.··-·low_comp | |||
| 0003bf70:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003bf80:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003bf90:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003bfa0:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003bfb0:·6564·0a20·202d·2070·6163·6b61·6765·5f61··ed.··-·package_a | |||
| 0003bfc0:·6964·655f·696e·7374·616c·6c65·640a·3c2f··ide_installed.</ | |||
| 0003bfd0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bfe0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003bff0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c000:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c010:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c020:·2369·646d·3534·3135·2220·7461·6269·6e64··#idm5415"·tabind | |||
| 0003c030:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c040:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c050:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c060:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c070:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c080:·5265·6d65·6469·6174·696f·6e20·4f53·4275··Remediation·OSBu | |||
| 0003c090:·696c·6420·426c·7565·7072·696e·7420·736e··ild·Blueprint·sn | |||
| 0003c0a0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c0b0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| Max diff block lines reached; 18558221/18574973 bytes (99.91%) of diff not shown. | |||
| Offset 14343, 15 lines modified | Offset 14343, 15 lines modified | ||
| 00038060:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00038060:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00038070:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00038070:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00038080:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00038080:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00038090:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00038090:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 000380a0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 000380a0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 000380b0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 000380b0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 000380c0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 000380c0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 000380d0:·323 | 000380d0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 000380e0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 000380e0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 000380f0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 000380f0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00038100:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00038100:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00038110:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00038110:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00038120:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00038120:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00038130:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00038130:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00038140:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00038140:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15336, 123 lines modified | Offset 15336, 123 lines modified | ||
| 0003be70:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003be70:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003be80:·2369·646d·3637·3734·2220·7461·6269·6e64··#idm6774"·tabind | 0003be80:·2369·646d·3637·3734·2220·7461·6269·6e64··#idm6774"·tabind | ||
| 0003be90:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003be90:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003bea0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003bea0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003beb0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003beb0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003bec0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003bec0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003bed0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003bed0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003bee0:·5265·6d65·6469·6174·696f·6e20· | 0003bee0:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003bef0:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | |||
| 0003bf00:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bf10:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bf20:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bf30:·3637·3734·223e·3c74·6162·6c65·2063·6c61··6774"><table·cla | |||
| 0003bf40:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bf50:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bf60:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bf70:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bf80:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bef0:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003bf00:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bf10:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bf20:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bf30:·6964·6d36·3737·3422·3e3c·7461·626c·6520··idm6774"><table· | |||
| 0003bf40:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bf50:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bf60:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bf70:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bf80:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bf90:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bfa0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bfb0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bf | 0003bf90:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003bfa0:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003bfb0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003bfc0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bfd0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bfe0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003bff0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003c000:·3e3c·636f·6465·3e23·2052·656d·6564·6961··><code>#·Remedia | |||
| 0003c010:·7469·6f6e·2069·7320·6170·706c·6963·6162··tion·is·applicab | |||
| 0003c020:·6c65·206f·6e6c·7920·696e·2063·6572·7461··le·only·in·certa | |||
| 0003c030:·696e·2070·6c61·7466·6f72·6d73·0a69·6620··in·platforms.if· | |||
| 0003c040:·5b20·2120·2d66·202f·2e64·6f63·6b65·7265··[·!·-f·/.dockere | |||
| 0003c050:·6e76·205d·2026·616d·703b·2661·6d70·3b20··nv·]·&&· | |||
| 0003c060:·5b20·2120·2d66·202f·7275·6e2f·2e63·6f6e··[·!·-f·/run/.con | |||
| 0003c070:·7461·696e·6572·656e·7620·5d3b·2074·6865··tainerenv·];·the | |||
| 0003c080:·6e0a·0a7a·7970·7065·7220·696e·7374·616c··n..zypper·instal | |||
| 0003c090:·6c20·2d79·2022·6169·6465·220a·0a65·6c73··l·-y·"aide"..els | |||
| 0003c0a0:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003c0b0:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003c0c0:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003c0d0:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003c0e0:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003c0f0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c100:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c110:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bfd0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003bfe0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003bff0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c000:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003c010:·3a20·456e·7375·7265·2061·6964·6520·6973··:·Ensure·aide·is | |||
| 0003c020:·2069·6e73·7461·6c6c·6564·0a20·2070·6163···installed.··pac | |||
| 0003c030:·6b61·6765·3a0a·2020·2020·6e61·6d65·3a20··kage:.····name:· | |||
| 0003c040:·6169·6465·0a20·2020·2073·7461·7465·3a20··aide.····state:· | |||
| 0003c050:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 0003c060:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003c070:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003c080:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003c090:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003c0a0:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003c0b0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0003c0c0:·2d20·4343·452d·3833·3238·392d·390a·2020··-·CCE-83289-9.·· | |||
| 0003c0d0:·2d20·434a·4953·2d35·2e31·302e·312e·330a··-·CJIS-5.10.1.3. | |||
| 0003c0e0:·2020·2d20·4449·5341·2d53·5449·472d·534c····-·DISA-STIG-SL | |||
| 0003c0f0:·4553·2d31·352d·3031·3034·3230·0a20·202d··ES-15-010420.··- | |||
| 0003c100:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003c110:·3628·6129·0a20·202d·2050·4349·2d44·5353··6(a).··-·PCI-DSS | |||
| 0003c120:·2d52·6571·2d31·312e·350a·2020·2d20·656e··-Req-11.5.··-·en | |||
| 0003c130:·6162·6c65·5f73·7472·6174·6567·790a·2020··able_strategy.·· | |||
| 0003c140:·2d20·6c6f·775f·636f·6d70·6c65·7869·7479··-·low_complexity | |||
| 0003c150:·0a20·202d·206c·6f77·5f64·6973·7275·7074··.··-·low_disrupt | |||
| 0003c160:·696f·6e0a·2020·2d20·6d65·6469·756d·5f73··ion.··-·medium_s | |||
| 0003c170:·6576·6572·6974·790a·2020·2d20·6e6f·5f72··everity.··-·no_r | |||
| 0003c180:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 0003c190:·2070·6163·6b61·6765·5f61·6964·655f·696e···package_aide_in | |||
| 0003c1a0:·7374·616c·6c65·640a·3c2f·636f·6465·3e3c··stalled.</code>< | |||
| 0003c1b0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c1c0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c1d0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c1e0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c1f0:·612d·7461·7267·6574·3d22·2369·646d·3637··a-target="#idm67 | |||
| 0003c200:·3735·2220·7461·6269·6e64·6578·3d22·3022··75"·tabindex="0" | |||
| 0003c210:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c220:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c230:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c240:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c250:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c260:·6174·696f·6e20·4f53·4275·696c·6420·426c··ation·OSBuild·Bl | |||
| 0003c270:·7565·7072·696e·7420·736e·6970·7065·7420··ueprint·snippet· | |||
| 0003c280:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c290:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c | 0003c120:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003c2b0:·6964·3d22·6964·6d36·3737·3522·3e3c·7072··id="idm6775"><pr | |||
| 0003c2c0:·653e·3c63·6f64·653e·0a5b·5b70·6163·6b61··e><code>.[[packa | |||
| 0003c2d0:·6765·735d·5d0a·6e61·6d65·203d·2022·6169··ges]].name·=·"ai | |||
| 0003c2e0:·6465·220a·7665·7273·696f·6e20·3d20·222a··de".version·=·"* | |||
| 0003c2f0:·220a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··".</code></pre>< | |||
| 0003c300:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c310:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c | 0003c130:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c330:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| Max diff block lines reached; 6488684/6505436 bytes (99.74%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(enhanced) | 49 | Profile·Title·ANSSI-BP-028·(enhanced) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_enhanced |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·System_Accounting_with_auditd | 61 | ·········3.·System_Accounting_with_auditd |
| 62 | ·········4.·GRUB2_bootloader_configuration | 62 | ·········4.·GRUB2_bootloader_configuration |
| 63 | ·········5.·Configure_Syslog | 63 | ·········5.·Configure_Syslog |
| Offset 121, 14 lines modified | Offset 121, 26 lines modified | ||
| 121 | include·install_aide | 121 | include·install_aide |
| 122 | class·install_aide·{ | 122 | class·install_aide·{ |
| 123 | ··package·{·'aide': | 123 | ··package·{·'aide': |
| 124 | ····ensure·=>·'installed', | 124 | ····ensure·=>·'installed', |
| 125 | ··} | 125 | ··} |
| 126 | } | 126 | } |
| 127 | Remediation_Shell_script_⇲ | ||
| 128 | Complexity:·low | ||
| 129 | Disruption:·low | ||
| 130 | Strategy:···enable | ||
| 131 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 132 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 133 | zypper·install·-y·"aide" | ||
| 134 | else | ||
| 135 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 136 | fi | ||
| 127 | Remediation_Ansible_snippet_⇲ | 137 | Remediation_Ansible_snippet_⇲ |
| 128 | Complexity:·low | 138 | Complexity:·low |
| 129 | Disruption:·low | 139 | Disruption:·low |
| 130 | Strategy:···enable | 140 | Strategy:···enable |
| 131 | -·name:·Ensure·aide·is·installed | 141 | -·name:·Ensure·aide·is·installed |
| 132 | ··package: | 142 | ··package: |
| 133 | ····name:·aide | 143 | ····name:·aide |
| Offset 147, 26 lines modified | Offset 159, 14 lines modified | ||
| 147 | ··-·no_reboot_needed | 159 | ··-·no_reboot_needed |
| 148 | ··-·package_aide_installed | 160 | ··-·package_aide_installed |
| 149 | Remediation_OSBuild_Blueprint_snippet_⇲ | 161 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 150 | [[packages]] | 162 | [[packages]] |
| 151 | name·=·"aide" | 163 | name·=·"aide" |
| 152 | version·=·"*" | 164 | version·=·"*" |
| 153 | Remediation_Shell_script_⇲ | ||
| 154 | Complexity:·low | ||
| 155 | Disruption:·low | ||
| 156 | Strategy:···enable | ||
| 157 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 158 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | zypper·install·-y·"aide" | ||
| 160 | else | ||
| 161 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 162 | fi | ||
| 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 165 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 164 | Run·the·following·command·to·generate·a·new·database: | 166 | Run·the·following·command·to·generate·a·new·database: |
| 165 | $·sudo·/usr/bin/aide·--init | 167 | $·sudo·/usr/bin/aide·--init |
| 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 168 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 169 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 170 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 169 | database·can·be·installed·as·follows: | 171 | database·can·be·installed·as·follows: |
| Offset 181, 14 lines modified | Offset 181, 26 lines modified | ||
| 181 | ············Identifiers: ·CCE-85787-0 | 181 | ············Identifiers: ·CCE-85787-0 |
| 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | zypper·install·-y·"aide" | ||
| 192 | /usr/bin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 188 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 189 | Complexity:·low | 198 | Complexity:·low |
| 190 | Disruption:·low | 199 | Disruption:·low |
| 191 | Strategy:···restrict | 200 | Strategy:···restrict |
| 192 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 193 | ··package: | 202 | ··package: |
| 194 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 257, 26 lines modified | Offset 269, 14 lines modified | ||
| 257 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 258 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 259 | ··-·low_complexity | 271 | ··-·low_complexity |
| 260 | ··-·low_disruption | 272 | ··-·low_disruption |
| 261 | ··-·medium_severity | 273 | ··-·medium_severity |
| 262 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 263 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 264 | Remediation_Shell_script_⇲ | ||
| 265 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 266 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 267 | zypper·install·-y·"aide" | ||
| 268 | /usr/bin/aide·--init | ||
| 269 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 270 | else | ||
| 271 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 272 | fi | ||
| 273 | Group ·Disk·Partitioning· Group·contains·10·rules | 276 | Group ·Disk·Partitioning· Group·contains·10·rules |
| 274 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which | 277 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which |
| 275 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default | 278 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default |
| 276 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 279 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 277 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify | 280 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify |
| 278 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the | 281 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the |
| 279 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create | 282 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create |
| Offset 437, 14 lines modified | Offset 437, 26 lines modified | ||
| 437 | include·install_sudo | 437 | include·install_sudo |
| 438 | class·install_sudo·{ | 438 | class·install_sudo·{ |
| Max diff block lines reached; 707448/712025 bytes (99.36%) of diff not shown. | |||
| Offset 14342, 15 lines modified | Offset 14342, 15 lines modified | ||
| 00038050:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00038050:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00038060:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00038060:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00038070:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00038070:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00038080:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00038080:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00038090:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00038090:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 000380a0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 000380a0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 000380b0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 000380b0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 000380c0:·323 | 000380c0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 000380d0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 000380d0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 000380e0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 000380e0:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 000380f0:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 000380f0:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00038100:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00038100:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00038110:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00038110:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00038120:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00038120:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00038130:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00038130:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15335, 123 lines modified | Offset 15335, 123 lines modified | ||
| 0003be60:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | 0003be60:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | ||
| 0003be70:·2369·646d·3637·3734·2220·7461·6269·6e64··#idm6774"·tabind | 0003be70:·2369·646d·3637·3734·2220·7461·6269·6e64··#idm6774"·tabind | ||
| 0003be80:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | 0003be80:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | ||
| 0003be90:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | 0003be90:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | ||
| 0003bea0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | 0003bea0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | ||
| 0003beb0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | 0003beb0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | ||
| 0003bec0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | 0003bec0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | ||
| 0003bed0:·5265·6d65·6469·6174·696f·6e20· | 0003bed0:·5265·6d65·6469·6174·696f·6e20·5368·656c··Remediation·Shel | ||
| 0003bee0:·6c20·7363·7269·7074·20e2·87b2·3c2f·613e··l·script·...</a> | |||
| 0003bef0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bf00:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bf10:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bf20:·3637·3734·223e·3c74·6162·6c65·2063·6c61··6774"><table·cla | |||
| 0003bf30:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bf40:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bf50:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bf60:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bf70:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bee0:·626c·6520·736e·6970·7065·7420·e287·b23c··ble·snippet·...< | |||
| 0003bef0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003bf00:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003bf10:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003bf20:·6964·6d36·3737·3422·3e3c·7461·626c·6520··idm6774"><table· | |||
| 0003bf30:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003bf40:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003bf50:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003bf60:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003bf70:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003bf80:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | |||
| 0003bf90:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bfa0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bf | 0003bf80:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003bf90:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003bfa0:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003bfb0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003bfc0:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003bfd0:·3c74·643e·656e·6162·6c65·3c2f·7464·3e3c··<td>enable</td>< | |||
| 0003bfe0:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003bff0:·3e3c·636f·6465·3e23·2052·656d·6564·6961··><code>#·Remedia | |||
| 0003c000:·7469·6f6e·2069·7320·6170·706c·6963·6162··tion·is·applicab | |||
| 0003c010:·6c65·206f·6e6c·7920·696e·2063·6572·7461··le·only·in·certa | |||
| 0003c020:·696e·2070·6c61·7466·6f72·6d73·0a69·6620··in·platforms.if· | |||
| 0003c030:·5b20·2120·2d66·202f·2e64·6f63·6b65·7265··[·!·-f·/.dockere | |||
| 0003c040:·6e76·205d·2026·616d·703b·2661·6d70·3b20··nv·]·&&· | |||
| 0003c050:·5b20·2120·2d66·202f·7275·6e2f·2e63·6f6e··[·!·-f·/run/.con | |||
| 0003c060:·7461·696e·6572·656e·7620·5d3b·2074·6865··tainerenv·];·the | |||
| 0003c070:·6e0a·0a7a·7970·7065·7220·696e·7374·616c··n..zypper·instal | |||
| 0003c080:·6c20·2d79·2022·6169·6465·220a·0a65·6c73··l·-y·"aide"..els | |||
| 0003c090:·650a·2020·2020·2667·743b·2661·6d70·3b32··e.····>&2 | |||
| 0003c0a0:·2065·6368·6f20·2752·656d·6564·6961·7469···echo·'Remediati | |||
| 0003c0b0:·6f6e·2069·7320·6e6f·7420·6170·706c·6963··on·is·not·applic | |||
| 0003c0c0:·6162·6c65·2c20·6e6f·7468·696e·6720·7761··able,·nothing·wa | |||
| 0003c0d0:·7320·646f·6e65·270a·6669·0a3c·2f63·6f64··s·done'.fi.</cod | |||
| 0003c0e0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c0f0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c100:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003bfc0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003bfd0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003bfe0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003bff0:·7072·653e·3c63·6f64·653e·2d20·6e61·6d65··pre><code>-·name | |||
| 0003c000:·3a20·456e·7375·7265·2061·6964·6520·6973··:·Ensure·aide·is | |||
| 0003c010:·2069·6e73·7461·6c6c·6564·0a20·2070·6163···installed.··pac | |||
| 0003c020:·6b61·6765·3a0a·2020·2020·6e61·6d65·3a20··kage:.····name:· | |||
| 0003c030:·6169·6465·0a20·2020·2073·7461·7465·3a20··aide.····state:· | |||
| 0003c040:·7072·6573·656e·740a·2020·7768·656e·3a20··present.··when:· | |||
| 0003c050:·616e·7369·626c·655f·7669·7274·7561·6c69··ansible_virtuali | |||
| 0003c060:·7a61·7469·6f6e·5f74·7970·6520·6e6f·7420··zation_type·not· | |||
| 0003c070:·696e·205b·2264·6f63·6b65·7222·2c20·226c··in·["docker",·"l | |||
| 0003c080:·7863·222c·2022·6f70·656e·767a·222c·2022··xc",·"openvz",·" | |||
| 0003c090:·706f·646d·616e·222c·2022·636f·6e74·6169··podman",·"contai | |||
| 0003c0a0:·6e65·7222·5d0a·2020·7461·6773·3a0a·2020··ner"].··tags:.·· | |||
| 0003c0b0:·2d20·4343·452d·3833·3238·392d·390a·2020··-·CCE-83289-9.·· | |||
| 0003c0c0:·2d20·434a·4953·2d35·2e31·302e·312e·330a··-·CJIS-5.10.1.3. | |||
| 0003c0d0:·2020·2d20·4449·5341·2d53·5449·472d·534c····-·DISA-STIG-SL | |||
| 0003c0e0:·4553·2d31·352d·3031·3034·3230·0a20·202d··ES-15-010420.··- | |||
| 0003c0f0:·204e·4953·542d·3830·302d·3533·2d43·4d2d···NIST-800-53-CM- | |||
| 0003c100:·3628·6129·0a20·202d·2050·4349·2d44·5353··6(a).··-·PCI-DSS | |||
| 0003c110:·2d52·6571·2d31·312e·350a·2020·2d20·656e··-Req-11.5.··-·en | |||
| 0003c120:·6162·6c65·5f73·7472·6174·6567·790a·2020··able_strategy.·· | |||
| 0003c130:·2d20·6c6f·775f·636f·6d70·6c65·7869·7479··-·low_complexity | |||
| 0003c140:·0a20·202d·206c·6f77·5f64·6973·7275·7074··.··-·low_disrupt | |||
| 0003c150:·696f·6e0a·2020·2d20·6d65·6469·756d·5f73··ion.··-·medium_s | |||
| 0003c160:·6576·6572·6974·790a·2020·2d20·6e6f·5f72··everity.··-·no_r | |||
| 0003c170:·6562·6f6f·745f·6e65·6564·6564·0a20·202d··eboot_needed.··- | |||
| 0003c180:·2070·6163·6b61·6765·5f61·6964·655f·696e···package_aide_in | |||
| 0003c190:·7374·616c·6c65·640a·3c2f·636f·6465·3e3c··stalled.</code>< | |||
| 0003c1a0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c1b0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c1c0:·6365·7373·2220·6461·7461·2d74·6f67·676c··cess"·data-toggl | |||
| 0003c1d0:·653d·2263·6f6c·6c61·7073·6522·2064·6174··e="collapse"·dat | |||
| 0003c1e0:·612d·7461·7267·6574·3d22·2369·646d·3637··a-target="#idm67 | |||
| 0003c1f0:·3735·2220·7461·6269·6e64·6578·3d22·3022··75"·tabindex="0" | |||
| 0003c200:·2072·6f6c·653d·2262·7574·746f·6e22·2061···role="button"·a | |||
| 0003c210:·7269·612d·6578·7061·6e64·6564·3d22·6661··ria-expanded="fa | |||
| 0003c220:·6c73·6522·2074·6974·6c65·3d22·4163·7469··lse"·title="Acti | |||
| 0003c230:·7661·7465·2074·6f20·7265·7665·616c·2220··vate·to·reveal"· | |||
| 0003c240:·6872·6566·3d22·2321·223e·5265·6d65·6469··href="#!">Remedi | |||
| 0003c250:·6174·696f·6e20·4f53·4275·696c·6420·426c··ation·OSBuild·Bl | |||
| 0003c260:·7565·7072·696e·7420·736e·6970·7065·7420··ueprint·snippet· | |||
| 0003c270:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003c280:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003c | 0003c110:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003c2a0:·6964·3d22·6964·6d36·3737·3522·3e3c·7072··id="idm6775"><pr | |||
| 0003c2b0:·653e·3c63·6f64·653e·0a5b·5b70·6163·6b61··e><code>.[[packa | |||
| 0003c2c0:·6765·735d·5d0a·6e61·6d65·203d·2022·6169··ges]].name·=·"ai | |||
| 0003c2d0:·6465·220a·7665·7273·696f·6e20·3d20·222a··de".version·=·"* | |||
| 0003c2e0:·220a·3c2f·636f·6465·3e3c·2f70·7265·3e3c··".</code></pre>< | |||
| 0003c2f0:·2f64·6976·3e3c·6120·636c·6173·733d·2262··/div><a·class="b | |||
| 0003c300:·746e·2062·746e·2d73·7563·6365·7373·2220··tn·btn-success"· | |||
| 0003c | 0003c120:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003c320:·6c61·7073·6522·2064·6174·612d·7461·7267··lapse"·data-targ | |||
| Max diff block lines reached; 6753793/6770545 bytes (99.75%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(high) | 49 | Profile·Title·ANSSI-BP-028·(high) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_high |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·System_Accounting_with_auditd | 61 | ·········3.·System_Accounting_with_auditd |
| 62 | ·········4.·GRUB2_bootloader_configuration | 62 | ·········4.·GRUB2_bootloader_configuration |
| 63 | ·········5.·Configure_Syslog | 63 | ·········5.·Configure_Syslog |
| Offset 121, 14 lines modified | Offset 121, 26 lines modified | ||
| 121 | include·install_aide | 121 | include·install_aide |
| 122 | class·install_aide·{ | 122 | class·install_aide·{ |
| 123 | ··package·{·'aide': | 123 | ··package·{·'aide': |
| 124 | ····ensure·=>·'installed', | 124 | ····ensure·=>·'installed', |
| 125 | ··} | 125 | ··} |
| 126 | } | 126 | } |
| 127 | Remediation_Shell_script_⇲ | ||
| 128 | Complexity:·low | ||
| 129 | Disruption:·low | ||
| 130 | Strategy:···enable | ||
| 131 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 132 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 133 | zypper·install·-y·"aide" | ||
| 134 | else | ||
| 135 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 136 | fi | ||
| 127 | Remediation_Ansible_snippet_⇲ | 137 | Remediation_Ansible_snippet_⇲ |
| 128 | Complexity:·low | 138 | Complexity:·low |
| 129 | Disruption:·low | 139 | Disruption:·low |
| 130 | Strategy:···enable | 140 | Strategy:···enable |
| 131 | -·name:·Ensure·aide·is·installed | 141 | -·name:·Ensure·aide·is·installed |
| 132 | ··package: | 142 | ··package: |
| 133 | ····name:·aide | 143 | ····name:·aide |
| Offset 147, 26 lines modified | Offset 159, 14 lines modified | ||
| 147 | ··-·no_reboot_needed | 159 | ··-·no_reboot_needed |
| 148 | ··-·package_aide_installed | 160 | ··-·package_aide_installed |
| 149 | Remediation_OSBuild_Blueprint_snippet_⇲ | 161 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 150 | [[packages]] | 162 | [[packages]] |
| 151 | name·=·"aide" | 163 | name·=·"aide" |
| 152 | version·=·"*" | 164 | version·=·"*" |
| 153 | Remediation_Shell_script_⇲ | ||
| 154 | Complexity:·low | ||
| 155 | Disruption:·low | ||
| 156 | Strategy:···enable | ||
| 157 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 158 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 159 | zypper·install·-y·"aide" | ||
| 160 | else | ||
| 161 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 162 | fi | ||
| 163 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 165 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 164 | Run·the·following·command·to·generate·a·new·database: | 166 | Run·the·following·command·to·generate·a·new·database: |
| 165 | $·sudo·/usr/bin/aide·--init | 167 | $·sudo·/usr/bin/aide·--init |
| 166 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 168 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 167 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 169 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 168 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 170 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 169 | database·can·be·installed·as·follows: | 171 | database·can·be·installed·as·follows: |
| Offset 181, 14 lines modified | Offset 181, 26 lines modified | ||
| 181 | ············Identifiers: ·CCE-85787-0 | 181 | ············Identifiers: ·CCE-85787-0 |
| 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 182 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 183 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 184 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 185 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 186 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 187 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 188 | Remediation_Shell_script_⇲ | ||
| 189 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 190 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 191 | zypper·install·-y·"aide" | ||
| 192 | /usr/bin/aide·--init | ||
| 193 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 194 | else | ||
| 195 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 196 | fi | ||
| 188 | Remediation_Ansible_snippet_⇲ | 197 | Remediation_Ansible_snippet_⇲ |
| 189 | Complexity:·low | 198 | Complexity:·low |
| 190 | Disruption:·low | 199 | Disruption:·low |
| 191 | Strategy:···restrict | 200 | Strategy:···restrict |
| 192 | -·name:·Ensure·AIDE·is·installed | 201 | -·name:·Ensure·AIDE·is·installed |
| 193 | ··package: | 202 | ··package: |
| 194 | ····name:·'{{·item·}}' | 203 | ····name:·'{{·item·}}' |
| Offset 257, 26 lines modified | Offset 269, 14 lines modified | ||
| 257 | ··-·PCI-DSS-Req-11.5 | 269 | ··-·PCI-DSS-Req-11.5 |
| 258 | ··-·aide_build_database | 270 | ··-·aide_build_database |
| 259 | ··-·low_complexity | 271 | ··-·low_complexity |
| 260 | ··-·low_disruption | 272 | ··-·low_disruption |
| 261 | ··-·medium_severity | 273 | ··-·medium_severity |
| 262 | ··-·no_reboot_needed | 274 | ··-·no_reboot_needed |
| 263 | ··-·restrict_strategy | 275 | ··-·restrict_strategy |
| 264 | Remediation_Shell_script_⇲ | ||
| 265 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 266 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 267 | zypper·install·-y·"aide" | ||
| 268 | /usr/bin/aide·--init | ||
| 269 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 270 | else | ||
| 271 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 272 | fi | ||
| 273 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 276 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 274 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 277 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 275 | using·cron,·add·the·following·line·to·/etc/crontab: | 278 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 276 | 05·4·*·*·*·root·/usr/bin/aide·--check | 279 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 277 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 280 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 278 | 05·4·*·*·0·root·/usr/bin/aide·--check | 281 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 279 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 282 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 300, 14 lines modified | Offset 300, 30 lines modified | ||
| 300 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 300 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 301 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 301 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 302 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 302 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 737428/742283 bytes (99.35%) of diff not shown. | |||
| Offset 14344, 15 lines modified | Offset 14344, 15 lines modified | ||
| 00038070:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00038070:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00038080:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00038080:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00038090:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00038090:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 000380a0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 000380a0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 000380b0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 000380b0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 000380c0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 000380c0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 000380d0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 000380d0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 000380e0:·323 | 000380e0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 000380f0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 000380f0:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00038100:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00038100:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00038110:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00038110:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00038120:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00038120:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00038130:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00038130:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00038140:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00038140:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00038150:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00038150:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15331, 123 lines modified | Offset 15331, 123 lines modified | ||
| 0003be20:·7267·6574·3d22·2369·646d·3637·3734·2220··rget="#idm6774"· | 0003be20:·7267·6574·3d22·2369·646d·3637·3734·2220··rget="#idm6774"· | ||
| 0003be30:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003be30:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003be40:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003be40:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003be50:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003be50:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003be60:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003be60:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003be70:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003be70:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003be80:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003be80:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003be90:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bea0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003beb0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bec0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bed0:·2220·6964·3d22·6964·6d36·3737·3422·3e3c··"·id="idm6774">< | |||
| 0003bee0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bef0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bf00:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bf10:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bf20:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003b | 0003be90:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | ||
| 0003bea0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003beb0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bec0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bed0:·643d·2269·646d·3637·3734·223e·3c74·6162··d="idm6774"><tab | |||
| 0003bee0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bef0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bf00:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bf10:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bf20:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bf30:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bf40:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bf50:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bf60:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bf70:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bf80:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003bf | 0003bf90:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003bfa0:·653e·3c70·7265·3e3c·636f·6465·3e23·2052··e><pre><code>#·R | |||
| 0003bfb0:·656d·6564·6961·7469·6f6e·2069·7320·6170··emediation·is·ap | |||
| 0003bfc0:·706c·6963·6162·6c65·206f·6e6c·7920·696e··plicable·only·in | |||
| 0003bfd0:·2063·6572·7461·696e·2070·6c61·7466·6f72···certain·platfor | |||
| 0003bfe0:·6d73·0a69·6620·5b20·2120·2d66·202f·2e64··ms.if·[·!·-f·/.d | |||
| 0003bff0:·6f63·6b65·7265·6e76·205d·2026·616d·703b··ockerenv·]·& | |||
| 0003c000:·2661·6d70·3b20·5b20·2120·2d66·202f·7275··&·[·!·-f·/ru | |||
| 0003c010:·6e2f·2e63·6f6e·7461·696e·6572·656e·7620··n/.containerenv· | |||
| 0003c020:·5d3b·2074·6865·6e0a·0a7a·7970·7065·7220··];·then..zypper· | |||
| 0003c030:·696e·7374·616c·6c20·2d79·2022·6169·6465··install·-y·"aide | |||
| 0003c040:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 0003c050:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 0003c060:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 0003c070:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 0003c080:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 0003c090:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c0a0:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c0b0:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c0c0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bf50:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bf60:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bf70:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003bf80:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003bf90:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003bfa0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003bfb0:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003bfc0:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003bfd0:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003bfe0:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003bff0:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003c000:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003c010:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003c020:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003c030:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003c040:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003c050:·636f·6e74·6169·6e65·7222·5d0a·2020·7461··container"].··ta | |||
| 0003c060:·6773·3a0a·2020·2d20·4343·452d·3833·3238··gs:.··-·CCE-8328 | |||
| 0003c070:·392d·390a·2020·2d20·434a·4953·2d35·2e31··9-9.··-·CJIS-5.1 | |||
| 0003c080:·302e·312e·330a·2020·2d20·4449·5341·2d53··0.1.3.··-·DISA-S | |||
| 0003c090:·5449·472d·534c·4553·2d31·352d·3031·3034··TIG-SLES-15-0104 | |||
| 0003c0a0:·3230·0a20·202d·204e·4953·542d·3830·302d··20.··-·NIST-800- | |||
| 0003c0b0:·3533·2d43·4d2d·3628·6129·0a20·202d·2050··53-CM-6(a).··-·P | |||
| 0003c0c0:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003c0d0:·2020·2d20·656e·6162·6c65·5f73·7472·6174····-·enable_strat | |||
| 0003c0e0:·6567·790a·2020·2d20·6c6f·775f·636f·6d70··egy.··-·low_comp | |||
| 0003c0f0:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003c100:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003c110:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003c120:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003c130:·6564·0a20·202d·2070·6163·6b61·6765·5f61··ed.··-·package_a | |||
| 0003c140:·6964·655f·696e·7374·616c·6c65·640a·3c2f··ide_installed.</ | |||
| 0003c150:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c160:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c170:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c180:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c190:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c1a0:·2369·646d·3637·3735·2220·7461·6269·6e64··#idm6775"·tabind | |||
| 0003c1b0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c1c0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c1d0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c1e0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c1f0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c200:·5265·6d65·6469·6174·696f·6e20·4f53·4275··Remediation·OSBu | |||
| 0003c210:·696c·6420·426c·7565·7072·696e·7420·736e··ild·Blueprint·sn | |||
| 0003c220:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c230:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c240:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c250:·6170·7365·2220·6964·3d22·6964·6d36·3737··apse"·id="idm677 | |||
| 0003c260:·3522·3e3c·7072·653e·3c63·6f64·653e·0a5b··5"><pre><code>.[ | |||
| 0003c270:·5b70·6163·6b61·6765·735d·5d0a·6e61·6d65··[packages]].name | |||
| 0003c280:·203d·2022·6169·6465·220a·7665·7273·696f···=·"aide".versio | |||
| 0003c290:·6e20·3d20·222a·220a·3c2f·636f·6465·3e3c··n·=·"*".</code>< | |||
| 0003c2a0:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c2b0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c | 0003c0d0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c0e0:·743d·2223·6964·6d36·3737·3522·2074·6162··t="#idm6775"·tab | |||
| 0003c0f0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| Max diff block lines reached; 6252839/6269591 bytes (99.73%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(intermediary) | 49 | Profile·Title·ANSSI-BP-028·(intermediary) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_intermediary |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·System_Accounting_with_auditd | 61 | ·········3.·System_Accounting_with_auditd |
| 62 | ·········4.·Configure_Syslog | 62 | ·········4.·Configure_Syslog |
| 63 | ·········5.·Network_Configuration_and_Firewalls | 63 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 120, 14 lines modified | Offset 120, 26 lines modified | ||
| 120 | include·install_aide | 120 | include·install_aide |
| 121 | class·install_aide·{ | 121 | class·install_aide·{ |
| 122 | ··package·{·'aide': | 122 | ··package·{·'aide': |
| 123 | ····ensure·=>·'installed', | 123 | ····ensure·=>·'installed', |
| 124 | ··} | 124 | ··} |
| 125 | } | 125 | } |
| 126 | Remediation_Shell_script_⇲ | ||
| 127 | Complexity:·low | ||
| 128 | Disruption:·low | ||
| 129 | Strategy:···enable | ||
| 130 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 131 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 132 | zypper·install·-y·"aide" | ||
| 133 | else | ||
| 134 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 135 | fi | ||
| 126 | Remediation_Ansible_snippet_⇲ | 136 | Remediation_Ansible_snippet_⇲ |
| 127 | Complexity:·low | 137 | Complexity:·low |
| 128 | Disruption:·low | 138 | Disruption:·low |
| 129 | Strategy:···enable | 139 | Strategy:···enable |
| 130 | -·name:·Ensure·aide·is·installed | 140 | -·name:·Ensure·aide·is·installed |
| 131 | ··package: | 141 | ··package: |
| 132 | ····name:·aide | 142 | ····name:·aide |
| Offset 146, 26 lines modified | Offset 158, 14 lines modified | ||
| 146 | ··-·no_reboot_needed | 158 | ··-·no_reboot_needed |
| 147 | ··-·package_aide_installed | 159 | ··-·package_aide_installed |
| 148 | Remediation_OSBuild_Blueprint_snippet_⇲ | 160 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 149 | [[packages]] | 161 | [[packages]] |
| 150 | name·=·"aide" | 162 | name·=·"aide" |
| 151 | version·=·"*" | 163 | version·=·"*" |
| 152 | Remediation_Shell_script_⇲ | ||
| 153 | Complexity:·low | ||
| 154 | Disruption:·low | ||
| 155 | Strategy:···enable | ||
| 156 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 157 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 158 | zypper·install·-y·"aide" | ||
| 159 | else | ||
| 160 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 161 | fi | ||
| 162 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 164 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 163 | Run·the·following·command·to·generate·a·new·database: | 165 | Run·the·following·command·to·generate·a·new·database: |
| 164 | $·sudo·/usr/bin/aide·--init | 166 | $·sudo·/usr/bin/aide·--init |
| 165 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 167 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 166 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 168 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 167 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 169 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 168 | database·can·be·installed·as·follows: | 170 | database·can·be·installed·as·follows: |
| Offset 180, 14 lines modified | Offset 180, 26 lines modified | ||
| 180 | ············Identifiers: ·CCE-85787-0 | 180 | ············Identifiers: ·CCE-85787-0 |
| 181 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 181 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 182 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 182 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 183 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 183 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 184 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 184 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 185 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 185 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 186 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 186 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 187 | Remediation_Shell_script_⇲ | ||
| 188 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 189 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 190 | zypper·install·-y·"aide" | ||
| 191 | /usr/bin/aide·--init | ||
| 192 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 193 | else | ||
| 194 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 195 | fi | ||
| 187 | Remediation_Ansible_snippet_⇲ | 196 | Remediation_Ansible_snippet_⇲ |
| 188 | Complexity:·low | 197 | Complexity:·low |
| 189 | Disruption:·low | 198 | Disruption:·low |
| 190 | Strategy:···restrict | 199 | Strategy:···restrict |
| 191 | -·name:·Ensure·AIDE·is·installed | 200 | -·name:·Ensure·AIDE·is·installed |
| 192 | ··package: | 201 | ··package: |
| 193 | ····name:·'{{·item·}}' | 202 | ····name:·'{{·item·}}' |
| Offset 256, 26 lines modified | Offset 268, 14 lines modified | ||
| 256 | ··-·PCI-DSS-Req-11.5 | 268 | ··-·PCI-DSS-Req-11.5 |
| 257 | ··-·aide_build_database | 269 | ··-·aide_build_database |
| 258 | ··-·low_complexity | 270 | ··-·low_complexity |
| 259 | ··-·low_disruption | 271 | ··-·low_disruption |
| 260 | ··-·medium_severity | 272 | ··-·medium_severity |
| 261 | ··-·no_reboot_needed | 273 | ··-·no_reboot_needed |
| 262 | ··-·restrict_strategy | 274 | ··-·restrict_strategy |
| 263 | Remediation_Shell_script_⇲ | ||
| 264 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 265 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 266 | zypper·install·-y·"aide" | ||
| 267 | /usr/bin/aide·--init | ||
| 268 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 269 | else | ||
| 270 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 271 | fi | ||
| 272 | Group ·Disk·Partitioning· Group·contains·10·rules | 275 | Group ·Disk·Partitioning· Group·contains·10·rules |
| 273 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which | 276 | [ref] ·To·ensure·separation·and·protection·of·data,·there·are·top-level·system·directories·which |
| 274 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default | 277 | should·be·placed·on·their·own·physical·partition·or·logical·volume.·The·installer's·default |
| 275 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. | 278 | partitioning·scheme·creates·separate·logical·volumes·for·/,·/boot,·and·swap. |
| 276 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify | 279 | ····*·If·starting·with·any·of·the·default·layouts,·check·the·box·to·\"Review·and·modify |
| 277 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the | 280 | ······partitioning.\"·This·allows·for·the·easy·creation·of·additional·logical·volumes·inside·the |
| 278 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create | 281 | ······volume·group·already·created,·though·it·may·require·making·/'s·logical·volume·smaller·to·create |
| Offset 436, 14 lines modified | Offset 436, 26 lines modified | ||
| 436 | include·install_sudo | 436 | include·install_sudo |
| 437 | class·install_sudo·{ | 437 | class·install_sudo·{ |
| Max diff block lines reached; 679316/683906 bytes (99.33%) of diff not shown. | |||
| Offset 14342, 16 lines modified | Offset 14342, 16 lines modified | ||
| 00038050:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | 00038050:·7369·6f6e·2048·6973·746f·7279·3c2f·6832··sion·History</h2 | ||
| 00038060:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | 00038060:·3e3c·703e·4375·7272·656e·7420·7665·7273··><p>Current·vers | ||
| 00038070:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | 00038070:·696f·6e3a·203c·7374·726f·6e67·3e30·2e31··ion:·<strong>0.1 | ||
| 00038080:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | 00038080:·2e36·353c·2f73·7472·6f6e·673e·3c2f·703e··.65</strong></p> | ||
| 00038090:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | 00038090:·3c75·6c3e·3c6c·693e·3c73·7472·6f6e·673e··<ul><li><strong> | ||
| 000380a0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | 000380a0:·6472·6166·743c·2f73·7472·6f6e·673e·0a20··draft</strong>.· | ||
| 000380b0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 000380b0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 000380c0:·2020·2028·6173·206f·6620·3230·323 | 000380c0:·2020·2028·6173·206f·6620·3230·3235·2d30·····(as·of·2025-0 | ||
| 000380d0:·3 | 000380d0:·322d·3233·290a·2020·2020·2020·2020·2020··2-23).·········· | ||
| 000380e0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | 000380e0:·2020·2020·2020·3c2f·6c69·3e3c·2f75·6c3e········</li></ul> | ||
| 000380f0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | 000380f0:·3c2f·6469·763e·3c68·323e·5461·626c·6520··</div><h2>Table· | ||
| 00038100:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | 00038100:·6f66·2043·6f6e·7465·6e74·733c·2f68·323e··of·Contents</h2> | ||
| 00038110:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | 00038110:·3c6f·6c3e·3c6c·693e·3c61·2068·7265·663d··<ol><li><a·href= | ||
| 00038120:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | 00038120:·2223·7863·6364·665f·6f72·672e·7373·6770··"#xccdf_org.ssgp | ||
| 00038130:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | 00038130:·726f·6a65·6374·2e63·6f6e·7465·6e74·5f67··roject.content_g | ||
| 00038140:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | 00038140:·726f·7570·5f73·7973·7465·6d22·3e53·7973··roup_system">Sys | ||
| Offset 15063, 144 lines modified | Offset 15063, 144 lines modified | ||
| 0003ad60:·6574·3d22·2369·646d·3839·3930·2220·7461··et="#idm8990"·ta | 0003ad60:·6574·3d22·2369·646d·3839·3930·2220·7461··et="#idm8990"·ta | ||
| 0003ad70:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | 0003ad70:·6269·6e64·6578·3d22·3022·2072·6f6c·653d··bindex="0"·role= | ||
| 0003ad80:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | 0003ad80:·2262·7574·746f·6e22·2061·7269·612d·6578··"button"·aria-ex | ||
| 0003ad90:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | 0003ad90:·7061·6e64·6564·3d22·6661·6c73·6522·2074··panded="false"·t | ||
| 0003ada0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | 0003ada0:·6974·6c65·3d22·4163·7469·7661·7465·2074··itle="Activate·t | ||
| 0003adb0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | 0003adb0:·6f20·7265·7665·616c·2220·6872·6566·3d22··o·reveal"·href=" | ||
| 0003adc0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | 0003adc0:·2321·223e·5265·6d65·6469·6174·696f·6e20··#!">Remediation· | ||
| 0003add0:·416e·7369·626c·6520·736e·6970·7065·7420··Ansible·snippet· | |||
| 0003ade0:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003ad | 0003add0:·5368·656c·6c20·7363·7269·7074·20e2·87b2··Shell·script·... | ||
| 0003ade0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003adf0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003ae00:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003ae10:·2269·646d·3839·3930·223e·3c74·6162·6c65··"idm8990"><table | |||
| 0003ae20:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003ae30:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003ae40:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003ae50:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003ae60:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003ae70:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003ae80:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003ae90:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003aea0:·3e6c·6f77·3c2f·7464·3e3c·2f74·723e·3c74··>low</td></tr><t | |||
| 0003aeb0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003aec0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003aed0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003aee0:·653e·3c70·7265·3e3c·636f·6465·3e0a·666f··e><pre><code>.fo | |||
| 0003aef0:·7220·6620·696e·202f·6574·632f·7375·646f··r·f·in·/etc/sudo | |||
| 0003af00:·6572·7320·2f65·7463·2f73·7564·6f65·7273··ers·/etc/sudoers | |||
| 0003af10:·2e64·2f2a·203b·2064·6f0a·2020·6966·205b··.d/*·;·do.··if·[ | |||
| 0003af20:·2021·202d·6520·2224·6622·205d·203b·2074···!·-e·"$f"·]·;·t | |||
| 0003af30:·6865·6e0a·2020·2020·636f·6e74·696e·7565··hen.····continue | |||
| 0003af40:·0a20·2066·690a·2020·6d61·7463·6869·6e67··.··fi.··matching | |||
| 0003af50:·5f6c·6973·743d·2428·6772·6570·202d·5020··_list=$(grep·-P· | |||
| 0003af60:·275e·283f·2123·292e·2a5b·5c73·5d2b·5c21··'^(?!#).*[\s]+\! | |||
| 0003af70:·6175·7468·656e·7469·6361·7465·2e2a·2427··authenticate.*$' | |||
| 0003af80:·2024·6620·7c20·756e·6971·2029·0a20·2069···$f·|·uniq·).··i | |||
| 0003af90:·6620·2120·7465·7374·202d·7a20·2224·6d61··f·!·test·-z·"$ma | |||
| 0003afa0:·7463·6869·6e67·5f6c·6973·7422·3b20·7468··tching_list";·th | |||
| 0003afb0:·656e·0a20·2020·2077·6869·6c65·2049·4653··en.····while·IFS | |||
| 0003afc0:·3d20·7265·6164·202d·7220·656e·7472·793b··=·read·-r·entry; | |||
| 0003afd0:·2064·6f0a·2020·2020·2020·2320·636f·6d6d···do.······#·comm | |||
| 0003afe0:·656e·7420·6f75·7420·2221·6175·7468·656e··ent·out·"!authen | |||
| 0003aff0:·7469·6361·7465·2220·6d61·7463·6865·7320··ticate"·matches· | |||
| 0003b000:·746f·2070·7265·7365·7276·6520·7573·6572··to·preserve·user | |||
| 0003b010:·2064·6174·610a·2020·2020·2020·7365·6420···data.······sed· | |||
| 0003b020:·2d69·2022·732f·5e24·7b65·6e74·7279·7d24··-i·"s/^${entry}$ | |||
| 0003b030:·2f23·2026·616d·703b·2f67·2220·2466·0a20··/#·&/g"·$f.· | |||
| 0003b040:·2020·2064·6f6e·6520·266c·743b·266c·743b·····done·<< | |||
| 0003b050:·266c·743b·2022·246d·6174·6368·696e·675f··<·"$matching_ | |||
| 0003b060:·6c69·7374·220a·0a20·2020·202f·7573·722f··list"..····/usr/ | |||
| 0003b070:·7362·696e·2f76·6973·7564·6f20·2d63·6620··sbin/visudo·-cf· | |||
| 0003b080:·2466·2026·616d·703b·2667·743b·202f·6465··$f·&>·/de | |||
| 0003b090:·762f·6e75·6c6c·207c·7c20·6563·686f·2022··v/null·||·echo·" | |||
| 0003b0a0:·4661·696c·2074·6f20·7661·6c69·6461·7465··Fail·to·validate | |||
| 0003b0b0:·2024·6620·7769·7468·2076·6973·7564·6f22···$f·with·visudo" | |||
| 0003b0c0:·0a20·2066·690a·646f·6e65·0a3c·2f63·6f64··.··fi.done.</cod | |||
| 0003b0d0:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003b0e0:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003b0f0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003 | 0003b100:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | ||
| 0003ae10:·6964·3d22·6964·6d38·3939·3022·3e3c·7461··id="idm8990"><ta | |||
| 0003ae20:·626c·6520·636c·6173·733d·2274·6162·6c65··ble·class="table | |||
| 0003ae30:·2074·6162·6c65·2d73·7472·6970·6564·2074···table-striped·t | |||
| 0003ae40:·6162·6c65·2d62·6f72·6465·7265·6420·7461··able-bordered·ta | |||
| 0003ae50:·626c·652d·636f·6e64·656e·7365·6422·3e3c··ble-condensed">< | |||
| 0003ae60:·7472·3e3c·7468·3e43·6f6d·706c·6578·6974··tr><th>Complexit | |||
| 0003ae70:·793a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··y:</th><td>low</ | |||
| 0003ae80:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003 | 0003b110:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003b120:·6d38·3939·3122·2074·6162·696e·6465·783d··m8991"·tabindex= | |||
| 0003b130:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003b140:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003b150:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003b160:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003b170:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003b180:·6564·6961·7469·6f6e·2041·6e73·6962·6c65··ediation·Ansible | |||
| 0003b190:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003b1a0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003b1b0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003b1c0:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003b1d0:·3839·3931·223e·3c74·6162·6c65·2063·6c61··8991"><table·cla | |||
| 0003b1e0:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003b1f0:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003b200:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003b210:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003b220:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003 | 0003b230:·3c74·643e·6c6f·773c·2f74·643e·3c2f·7472··<td>low</td></tr | ||
| 0003aeb0:·3e3c·7472·3e3c·7468·3e53·7472·6174·6567··><tr><th>Strateg | |||
| 0003aec0:·793a·3c2f·7468·3e3c·7464·3e72·6573·7472··y:</th><td>restr | |||
| 0003aed0:·6963·743c·2f74·643e·3c2f·7472·3e3c·2f74··ict</td></tr></t | |||
| 0003aee0:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003aef0:·2d20·6e61·6d65·3a20·4669·6e64·202f·6574··-·name:·Find·/et | |||
| 0003af00:·632f·7375·646f·6572·732e·642f·2066·696c··c/sudoers.d/·fil | |||
| 0003af10:·6573·0a20·2066·696e·643a·0a20·2020·2070··es.··find:.····p | |||
| 0003af20:·6174·6873·3a0a·2020·2020·2d20·2f65·7463··aths:.····-·/etc | |||
| 0003af30:·2f73·7564·6f65·7273·2e64·2f0a·2020·7265··/sudoers.d/.··re | |||
| 0003af40:·6769·7374·6572·3a20·7375·646f·6572·730a··gister:·sudoers. | |||
| 0003af50:·2020·7461·6773·3a0a·2020·2d20·4343·452d····tags:.··-·CCE- | |||
| 0003af60:·3833·3239·312d·350a·2020·2d20·4449·5341··83291-5.··-·DISA | |||
| 0003af70:·2d53·5449·472d·534c·4553·2d31·352d·3031··-STIG-SLES-15-01 | |||
| 0003af80:·3034·3530·0a20·202d·204e·4953·542d·3830··0450.··-·NIST-80 | |||
| 0003af90:·302d·3533·2d43·4d2d·3628·6129·0a20·202d··0-53-CM-6(a).··- | |||
| 0003afa0:·204e·4953·542d·3830·302d·3533·2d49·412d···NIST-800-53-IA- | |||
| 0003 | 0003b240:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | ||
| 0003b250:·696f·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77··ion:</th><td>low | |||
| 0003b260:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 0003b270:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | |||
| 0003b280:·3c74·643e·7265·7374·7269·6374·3c2f·7464··<td>restrict</td | |||
| 0003b290:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| Max diff block lines reached; 2497696/2517484 bytes (99.21%) of diff not shown. | |||
| Offset 49, 15 lines modified | Offset 49, 15 lines modified | ||
| 49 | Profile·Title·ANSSI-BP-028·(minimal) | 49 | Profile·Title·ANSSI-BP-028·(minimal) |
| 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal | 50 | Profile·ID····xccdf_org.ssgproject.content_profile_anssi_bp28_minimal |
| 51 | ***·CPE·Platforms·*** | 51 | ***·CPE·Platforms·*** |
| 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 52 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 53 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 54 | *****·Revision·History·***** | 54 | *****·Revision·History·***** |
| 55 | Current·version:·0.1.65 | 55 | Current·version:·0.1.65 |
| 56 | ····*·draft·(as·of·202 | 56 | ····*·draft·(as·of·2025-02-23) |
| 57 | *****·Table·of·Contents·***** | 57 | *****·Table·of·Contents·***** |
| 58 | ···1.·System_Settings | 58 | ···1.·System_Settings |
| 59 | ·········1.·Installing_and_Maintaining_Software | 59 | ·········1.·Installing_and_Maintaining_Software |
| 60 | ·········2.·Account_and_Access_Control | 60 | ·········2.·Account_and_Access_Control |
| 61 | ·········3.·Configure_Syslog | 61 | ·········3.·Configure_Syslog |
| 62 | ·········4.·File_Permissions_and_Masks | 62 | ·········4.·File_Permissions_and_Masks |
| 63 | ···2.·Services | 63 | ···2.·Services |
| Offset 95, 14 lines modified | Offset 95, 33 lines modified | ||
| 95 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 95 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 96 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 96 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 97 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 97 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 98 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 98 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 99 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 99 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 100 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 100 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 101 | ············000373-VMM-001490,·SLES-15-010450,·SV-234853r622137_rule | 101 | ············000373-VMM-001490,·SLES-15-010450,·SV-234853r622137_rule |
| 102 | Remediation_Shell_script_⇲ | ||
| 103 | Complexity:·low | ||
| 104 | Disruption:·low | ||
| 105 | Strategy:···restrict | ||
| 106 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 107 | ··if·[·!·-e·"$f"·]·;·then | ||
| 108 | ····continue | ||
| 109 | ··fi | ||
| 110 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 111 | ··if·!·test·-z·"$matching_list";·then | ||
| 112 | ····while·IFS=·read·-r·entry;·do | ||
| 113 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 114 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 115 | ····done·<<<·"$matching_list" | ||
| 116 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 117 | ··fi | ||
| 118 | done | ||
| 102 | Remediation_Ansible_snippet_⇲ | 119 | Remediation_Ansible_snippet_⇲ |
| 103 | Complexity:·low | 120 | Complexity:·low |
| 104 | Disruption:·low | 121 | Disruption:·low |
| 105 | Strategy:···restrict | 122 | Strategy:···restrict |
| 106 | -·name:·Find·/etc/sudoers.d/·files | 123 | -·name:·Find·/etc/sudoers.d/·files |
| 107 | ··find: | 124 | ··find: |
| 108 | ····paths: | 125 | ····paths: |
| Offset 136, 33 lines modified | Offset 155, 14 lines modified | ||
| 136 | ··-·NIST-800-53-IA-11 | 155 | ··-·NIST-800-53-IA-11 |
| 137 | ··-·low_complexity | 156 | ··-·low_complexity |
| 138 | ··-·low_disruption | 157 | ··-·low_disruption |
| 139 | ··-·medium_severity | 158 | ··-·medium_severity |
| 140 | ··-·no_reboot_needed | 159 | ··-·no_reboot_needed |
| 141 | ··-·restrict_strategy | 160 | ··-·restrict_strategy |
| 142 | ··-·sudo_remove_no_authenticate | 161 | ··-·sudo_remove_no_authenticate |
| 143 | Remediation_Shell_script_⇲ | ||
| 144 | Complexity:·low | ||
| 145 | Disruption:·low | ||
| 146 | Strategy:···restrict | ||
| 147 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 148 | ··if·[·!·-e·"$f"·]·;·then | ||
| 149 | ····continue | ||
| 150 | ··fi | ||
| 151 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+\!authenticate.*$'·$f·|·uniq·) | ||
| 152 | ··if·!·test·-z·"$matching_list";·then | ||
| 153 | ····while·IFS=·read·-r·entry;·do | ||
| 154 | ······#·comment·out·"!authenticate"·matches·to·preserve·user·data | ||
| 155 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 156 | ····done·<<<·"$matching_list" | ||
| 157 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 158 | ··fi | ||
| 159 | done | ||
| 160 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** | 162 | ***·Rule ·Ensure·Users·Re-Authenticate·for·Privilege·Escalation·-·sudo·NOPASSWD· [ref]·*** |
| 161 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to | 163 | The·sudo·NOPASSWD·tag,·when·specified,·allows·a·user·to·execute·commands·using·sudo·without·having·to |
| 162 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ | 164 | authenticate.·This·should·be·disabled·by·making·sure·that·the·NOPASSWD·tag·does·not·exist·in·/etc/ |
| 163 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. | 165 | sudoers·configuration·file·or·any·sudo·configuration·snippets·in·/etc/sudoers.d/. |
| 164 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not | 166 | ············Without·re-authentication,·users·may·access·resources·or·perform·tasks·for·which·they·do·not |
| 165 | ············have·authorization. | 167 | ············have·authorization. |
| 166 | Rationale: | 168 | Rationale: |
| Offset 174, 14 lines modified | Offset 174, 33 lines modified | ||
| 174 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, | 174 | ············References: ·BP28(R5),·BP28(R59),·1,·12,·15,·16,·5,·DSS05.04,·DSS05.10,·DSS06.03,·DSS06.10, |
| 175 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 175 | Identifiers·CCI-002038,·4.3.3.5.1,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 176 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR | 176 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.3,·SR_1.4,·SR_1.5,·SR_1.7,·SR |
| 177 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, | 177 | References··1.8,·SR_1.9,·A.18.1.4,·A.9.2.1,·A.9.2.2,·A.9.2.3,·A.9.2.4,·A.9.2.6,·A.9.3.1,·A.9.4.2, |
| 178 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- | 178 | ············A.9.4.3,·IA-11,·CM-6(a),·PR.AC-1,·PR.AC-7,·SRG-OS-000373-GPOS-00156,·SRG-OS-000373-GPOS- |
| 179 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- | 179 | ············00157,·SRG-OS-000373-GPOS-00158,·SRG-OS-000373-VMM-001470,·SRG-OS-000373-VMM-001480,·SRG-OS- |
| 180 | ············000373-VMM-001490,·SLES-15-010450,·SV-234853r622137_rule | 180 | ············000373-VMM-001490,·SLES-15-010450,·SV-234853r622137_rule |
| 181 | Remediation_Shell_script_⇲ | ||
| 182 | Complexity:·low | ||
| 183 | Disruption:·low | ||
| 184 | Strategy:···restrict | ||
| 185 | for·f·in·/etc/sudoers·/etc/sudoers.d/*·;·do | ||
| 186 | ··if·[·!·-e·"$f"·]·;·then | ||
| 187 | ····continue | ||
| 188 | ··fi | ||
| 189 | ··matching_list=$(grep·-P·'^(?!#).*[\s]+NOPASSWD[\s]*\:.*$'·$f·|·uniq·) | ||
| 190 | ··if·!·test·-z·"$matching_list";·then | ||
| 191 | ····while·IFS=·read·-r·entry;·do | ||
| 192 | ······#·comment·out·"NOPASSWD"·matches·to·preserve·user·data | ||
| 193 | ······sed·-i·"s/^${entry}$/#·&/g"·$f | ||
| 194 | ····done·<<<·"$matching_list" | ||
| 195 | ····/usr/sbin/visudo·-cf·$f·&>·/dev/null·||·echo·"Fail·to·validate·$f·with·visudo" | ||
| 196 | ··fi | ||
| 197 | done | ||
| 181 | Remediation_Ansible_snippet_⇲ | 198 | Remediation_Ansible_snippet_⇲ |
| 182 | Complexity:·low | 199 | Complexity:·low |
| 183 | Disruption:·low | 200 | Disruption:·low |
| 184 | Strategy:···restrict | 201 | Strategy:···restrict |
| 185 | -·name:·Find·/etc/sudoers.d/·files | 202 | -·name:·Find·/etc/sudoers.d/·files |
| 186 | ··find: | 203 | ··find: |
| 187 | ····paths: | 204 | ····paths: |
| Offset 215, 33 lines modified | Offset 234, 14 lines modified | ||
| 215 | ··-·NIST-800-53-IA-11 | 234 | ··-·NIST-800-53-IA-11 |
| 216 | ··-·low_complexity | 235 | ··-·low_complexity |
| 217 | ··-·low_disruption | 236 | ··-·low_disruption |
| 218 | ··-·medium_severity | 237 | ··-·medium_severity |
| 219 | ··-·no_reboot_needed | 238 | ··-·no_reboot_needed |
| 220 | ··-·restrict_strategy | 239 | ··-·restrict_strategy |
| 221 | ··-·sudo_remove_nopasswd | 240 | ··-·sudo_remove_nopasswd |
| 222 | Remediation_Shell_script_⇲ | ||
| 223 | Complexity:·low | ||
| Max diff block lines reached; 180287/185754 bytes (97.06%) of diff not shown. | |||
| Offset 14311, 16 lines modified | Offset 14311, 16 lines modified | ||
| 00037e60:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037e60:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037e70:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037e70:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037e80:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037e80:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037e90:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037e90:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037ea0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037ea0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037eb0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037eb0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037ec0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037ec0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ed0:·2861·7320·6f66·2032·3032·3 | 00037ed0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037ee0:·3 | 00037ee0:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037ef0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037ef0:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037f00:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037f00:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037f10:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037f10:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037f20:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037f20:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037f30:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037f30:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037f40:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037f40:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037f50:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037f50:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15365, 124 lines modified | Offset 15365, 124 lines modified | ||
| 0003c040:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | 0003c040:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c050:·743d·2223·6964·6d36·3737·3422·2074·6162··t="#idm6774"·tab | 0003c050:·743d·2223·6964·6d36·3737·3422·2074·6162··t="#idm6774"·tab | ||
| 0003c060:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | 0003c060:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | ||
| 0003c070:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | 0003c070:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | ||
| 0003c080:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | 0003c080:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | ||
| 0003c090:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | 0003c090:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | ||
| 0003c0a0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | 0003c0a0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | ||
| 0003c0b0:·2122·3e52·656d·6564·6961·7469·6f6e·20 | 0003c0b0:·2122·3e52·656d·6564·6961·7469·6f6e·2053··!">Remediation·S | ||
| 0003c0c0:·6865·6c6c·2073·6372·6970·7420·e287·b23c··hell·script·...< | |||
| 0003c0d0:·2f61·3e3c·6272·3e3c·6469·7620·636c·6173··/a><br><div·clas | |||
| 0003c0e0:·733d·2270·616e·656c·2d63·6f6c·6c61·7073··s="panel-collaps | |||
| 0003c0f0:·6520·636f·6c6c·6170·7365·2220·6964·3d22··e·collapse"·id=" | |||
| 0003c100:·6964·6d36·3737·3422·3e3c·7461·626c·6520··idm6774"><table· | |||
| 0003c110:·636c·6173·733d·2274·6162·6c65·2074·6162··class="table·tab | |||
| 0003c120:·6c65·2d73·7472·6970·6564·2074·6162·6c65··le-striped·table | |||
| 0003c130:·2d62·6f72·6465·7265·6420·7461·626c·652d··-bordered·table- | |||
| 0003c140:·636f·6e64·656e·7365·6422·3e3c·7472·3e3c··condensed"><tr>< | |||
| 0003c150:·7468·3e43·6f6d·706c·6578·6974·793a·3c2f··th>Complexity:</ | |||
| 0003c0c0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003c0d0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c0e0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c0f0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c100:·643d·2269·646d·3637·3734·223e·3c74·6162··d="idm6774"><tab | |||
| 0003c110:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c120:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c130:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c140:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c150:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c160:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c170:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c180:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c1 | 0003c160:·7468·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c··th><td>low</td>< | ||
| 0003c170:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003c180:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003c190:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 0003c1a0:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c1b0:·7468·3e3c·7464·3e65·6e61·626c·653c·2f74··th><td>enable</t | |||
| 0003c1c0:·643e·3c2f·7472·3e3c·2f74·6162·6c65·3e3c··d></tr></table>< | |||
| 0003c1d0:·7072·653e·3c63·6f64·653e·2320·5265·6d65··pre><code>#·Reme | |||
| 0003c1e0:·6469·6174·696f·6e20·6973·2061·7070·6c69··diation·is·appli | |||
| 0003c1f0:·6361·626c·6520·6f6e·6c79·2069·6e20·6365··cable·only·in·ce | |||
| 0003c200:·7274·6169·6e20·706c·6174·666f·726d·730a··rtain·platforms. | |||
| 0003c210:·6966·205b·2021·202d·6620·2f2e·646f·636b··if·[·!·-f·/.dock | |||
| 0003c220:·6572·656e·7620·5d20·2661·6d70·3b26·616d··erenv·]·&&am | |||
| 0003c230:·703b·205b·2021·202d·6620·2f72·756e·2f2e··p;·[·!·-f·/run/. | |||
| 0003c240:·636f·6e74·6169·6e65·7265·6e76·205d·3b20··containerenv·];· | |||
| 0003c250:·7468·656e·0a0a·7a79·7070·6572·2069·6e73··then..zypper·ins | |||
| 0003c260:·7461·6c6c·202d·7920·2261·6964·6522·0a0a··tall·-y·"aide".. | |||
| 0003c270:·656c·7365·0a20·2020·2026·6774·3b26·616d··else.····>&am | |||
| 0003c280:·703b·3220·6563·686f·2027·5265·6d65·6469··p;2·echo·'Remedi | |||
| 0003c290:·6174·696f·6e20·6973·206e·6f74·2061·7070··ation·is·not·app | |||
| 0003c2a0:·6c69·6361·626c·652c·206e·6f74·6869·6e67··licable,·nothing | |||
| 0003c2b0:·2077·6173·2064·6f6e·6527·0a66·690a·3c2f···was·done'.fi.</ | |||
| 0003c2c0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c2d0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c2e0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c2f0:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c1a0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c1b0:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c1c0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003c1d0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003c1e0:·616d·653a·2045·6e73·7572·6520·6169·6465··ame:·Ensure·aide | |||
| 0003c1f0:·2069·7320·696e·7374·616c·6c65·640a·2020···is·installed.·· | |||
| 0003c200:·7061·636b·6167·653a·0a20·2020·206e·616d··package:.····nam | |||
| 0003c210:·653a·2061·6964·650a·2020·2020·7374·6174··e:·aide.····stat | |||
| 0003c220:·653a·2070·7265·7365·6e74·0a20·2077·6865··e:·present.··whe | |||
| 0003c230:·6e3a·2061·6e73·6962·6c65·5f76·6972·7475··n:·ansible_virtu | |||
| 0003c240:·616c·697a·6174·696f·6e5f·7479·7065·206e··alization_type·n | |||
| 0003c250:·6f74·2069·6e20·5b22·646f·636b·6572·222c··ot·in·["docker", | |||
| 0003c260:·2022·6c78·6322·2c20·226f·7065·6e76·7a22···"lxc",·"openvz" | |||
| 0003c270:·2c20·2270·6f64·6d61·6e22·2c20·2263·6f6e··,·"podman",·"con | |||
| 0003c280:·7461·696e·6572·225d·0a20·2074·6167·733a··tainer"].··tags: | |||
| 0003c290:·0a20·202d·2043·4345·2d38·3332·3839·2d39··.··-·CCE-83289-9 | |||
| 0003c2a0:·0a20·202d·2043·4a49·532d·352e·3130·2e31··.··-·CJIS-5.10.1 | |||
| 0003c2b0:·2e33·0a20·202d·2044·4953·412d·5354·4947··.3.··-·DISA-STIG | |||
| 0003c2c0:·2d53·4c45·532d·3135·2d30·3130·3432·300a··-SLES-15-010420. | |||
| 0003c2d0:·2020·2d20·4e49·5354·2d38·3030·2d35·332d····-·NIST-800-53- | |||
| 0003c2e0:·434d·2d36·2861·290a·2020·2d20·5043·492d··CM-6(a).··-·PCI- | |||
| 0003c2f0:·4453·532d·5265·712d·3131·2e35·0a20·202d··DSS-Req-11.5.··- | |||
| 0003c300:·2065·6e61·626c·655f·7374·7261·7465·6779···enable_strategy | |||
| 0003c310:·0a20·202d·206c·6f77·5f63·6f6d·706c·6578··.··-·low_complex | |||
| 0003c320:·6974·790a·2020·2d20·6c6f·775f·6469·7372··ity.··-·low_disr | |||
| 0003c330:·7570·7469·6f6e·0a20·202d·206d·6564·6975··uption.··-·mediu | |||
| 0003c340:·6d5f·7365·7665·7269·7479·0a20·202d·206e··m_severity.··-·n | |||
| 0003c350:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 0003c360:·2020·2d20·7061·636b·6167·655f·6169·6465····-·package_aide | |||
| 0003c370:·5f69·6e73·7461·6c6c·6564·0a3c·2f63·6f64··_installed.</cod | |||
| 0003c380:·653e·3c2f·7072·653e·3c2f·6469·763e·3c61··e></pre></div><a | |||
| 0003c390:·2063·6c61·7373·3d22·6274·6e20·6274·6e2d···class="btn·btn- | |||
| 0003c3a0:·7375·6363·6573·7322·2064·6174·612d·746f··success"·data-to | |||
| 0003c3b0:·6767·6c65·3d22·636f·6c6c·6170·7365·2220··ggle="collapse"· | |||
| 0003c3c0:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | |||
| 0003c3d0:·6d36·3737·3522·2074·6162·696e·6465·783d··m6775"·tabindex= | |||
| 0003c3e0:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | |||
| 0003c3f0:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | |||
| 0003c400:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | |||
| 0003c410:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | |||
| 0003c420:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | |||
| 0003c430:·6564·6961·7469·6f6e·204f·5342·7569·6c64··ediation·OSBuild | |||
| 0003c440:·2042·6c75·6570·7269·6e74·2073·6e69·7070···Blueprint·snipp | |||
| 0003c450:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003c460:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003c470:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003c480:·6522·2069·643d·2269·646d·3637·3735·223e··e"·id="idm6775"> | |||
| 0003c490:·3c70·7265·3e3c·636f·6465·3e0a·5b5b·7061··<pre><code>.[[pa | |||
| 0003c4a0:·636b·6167·6573·5d5d·0a6e·616d·6520·3d20··ckages]].name·=· | |||
| 0003c4b0:·2261·6964·6522·0a76·6572·7369·6f6e·203d··"aide".version·= | |||
| 0003c4c0:·2022·2a22·0a3c·2f63·6f64·653e·3c2f·7072···"*".</code></pr | |||
| 0003c4d0:·653e·3c2f·6469·763e·3c61·2063·6c61·7373··e></div><a·class | |||
| 0003c4e0:·3d22·6274·6e20·6274·6e2d·7375·6363·6573··="btn·btn-succes | |||
| Max diff block lines reached; 15238911/15255939 bytes (99.89%) of diff not shown. | |||
| Offset 14312, 15 lines modified | Offset 14312, 15 lines modified | ||
| 00037e70:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00037e70:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00037e80:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00037e80:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00037e90:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00037e90:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00037ea0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00037ea0:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00037eb0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00037eb0:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00037ec0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00037ec0:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 00037ed0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 00037ed0:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00037ee0:·2032·3032·3 | 00037ee0:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 00037ef0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 00037ef0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 00037f00:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 00037f00:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 00037f10:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 00037f10:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 00037f20:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 00037f20:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00037f30:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00037f30:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00037f40:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00037f40:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00037f50:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00037f50:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 15360, 123 lines modified | Offset 15360, 123 lines modified | ||
| 0003bff0:·7461·2d74·6172·6765·743d·2223·6964·6d36··ta-target="#idm6 | 0003bff0:·7461·2d74·6172·6765·743d·2223·6964·6d36··ta-target="#idm6 | ||
| 0003c000:·3737·3422·2074·6162·696e·6465·783d·2230··774"·tabindex="0 | 0003c000:·3737·3422·2074·6162·696e·6465·783d·2230··774"·tabindex="0 | ||
| 0003c010:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | 0003c010:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | ||
| 0003c020:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | 0003c020:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | ||
| 0003c030:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | 0003c030:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | ||
| 0003c040:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | 0003c040:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | ||
| 0003c050:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | 0003c050:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | ||
| 0003c060:·6961·7469·6f6e·20 | 0003c060:·6961·7469·6f6e·2053·6865·6c6c·2073·6372··iation·Shell·scr | ||
| 0003c070:·6970·7420·e287·b23c·2f61·3e3c·6272·3e3c··ipt·...</a><br>< | |||
| 0003c080:·6469·7620·636c·6173·733d·2270·616e·656c··div·class="panel | |||
| 0003c090:·2d63·6f6c·6c61·7073·6520·636f·6c6c·6170··-collapse·collap | |||
| 0003c0a0:·7365·2220·6964·3d22·6964·6d36·3737·3422··se"·id="idm6774" | |||
| 0003c0b0:·3e3c·7461·626c·6520·636c·6173·733d·2274··><table·class="t | |||
| 0003c0c0:·6162·6c65·2074·6162·6c65·2d73·7472·6970··able·table-strip | |||
| 0003c070:·6e69·7070·6574·20e2·87b2·3c2f·613e·3c62··nippet·...</a><b | |||
| 0003c080:·723e·3c64·6976·2063·6c61·7373·3d22·7061··r><div·class="pa | |||
| 0003c090:·6e65·6c2d·636f·6c6c·6170·7365·2063·6f6c··nel-collapse·col | |||
| 0003c0a0:·6c61·7073·6522·2069·643d·2269·646d·3637··lapse"·id="idm67 | |||
| 0003c0b0:·3734·223e·3c74·6162·6c65·2063·6c61·7373··74"><table·class | |||
| 0003c0c0:·3d22·7461·626c·6520·7461·626c·652d·7374··="table·table-st | |||
| 0003c0d0:·7269·7065·6420·7461·626c·652d·626f·7264··riped·table-bord | |||
| 0003c0 | 0003c0d0:·6564·2074·6162·6c65·2d62·6f72·6465·7265··ed·table-bordere | ||
| 0003c0f0:·6e73·6564·223e·3c74·723e·3c74·683e·436f··nsed"><tr><th>Co | |||
| 0003c | 0003c0e0:·6420·7461·626c·652d·636f·6e64·656e·7365··d·table-condense | ||
| 0003c0f0:·6422·3e3c·7472·3e3c·7468·3e43·6f6d·706c··d"><tr><th>Compl | |||
| 0003c100:·6578·6974·793a·3c2f·7468·3e3c·7464·3e6c··exity:</th><td>l | |||
| 0003c110:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003c120:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003c130:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003c140:·3c2f·7472·3e3c·7472·3e3c·7468·3e53·7472··</tr><tr><th>Str | |||
| 0003c150:·6174·6567·793a·3c2f·7468·3e3c·7464·3e65··ategy:</th><td>e | |||
| 0003c1 | 0003c160:·6e61·626c·653c·2f74·643e·3c2f·7472·3e3c··nable</td></tr>< | ||
| 0003c170:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 0003c180:·653e·2320·5265·6d65·6469·6174·696f·6e20··e>#·Remediation· | |||
| 0003c190:·6973·2061·7070·6c69·6361·626c·6520·6f6e··is·applicable·on | |||
| 0003c1a0:·6c79·2069·6e20·6365·7274·6169·6e20·706c··ly·in·certain·pl | |||
| 0003c1b0:·6174·666f·726d·730a·6966·205b·2021·202d··atforms.if·[·!·- | |||
| 0003c1c0:·6620·2f2e·646f·636b·6572·656e·7620·5d20··f·/.dockerenv·]· | |||
| 0003c1d0:·2661·6d70·3b26·616d·703b·205b·2021·202d··&&·[·!·- | |||
| 0003c1e0:·6620·2f72·756e·2f2e·636f·6e74·6169·6e65··f·/run/.containe | |||
| 0003c1f0:·7265·6e76·205d·3b20·7468·656e·0a0a·7a79··renv·];·then..zy | |||
| 0003c200:·7070·6572·2069·6e73·7461·6c6c·202d·7920··pper·install·-y· | |||
| 0003c210:·2261·6964·6522·0a0a·656c·7365·0a20·2020··"aide"..else.··· | |||
| 0003c220:·2026·6774·3b26·616d·703b·3220·6563·686f···>&2·echo | |||
| 0003c230:·2027·5265·6d65·6469·6174·696f·6e20·6973···'Remediation·is | |||
| 0003c240:·206e·6f74·2061·7070·6c69·6361·626c·652c···not·applicable, | |||
| 0003c250:·206e·6f74·6869·6e67·2077·6173·2064·6f6e···nothing·was·don | |||
| 0003c260:·6527·0a66·690a·3c2f·636f·6465·3e3c·2f70··e'.fi.</code></p | |||
| 0003c270:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 0003c280:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 0003c290:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 0003c120:·7472·3e3c·7468·3e44·6973·7275·7074·696f··tr><th>Disruptio | |||
| 0003c130:·6e3a·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f··n:</th><td>low</ | |||
| 0003c140:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003c150:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003c160:·643e·656e·6162·6c65·3c2f·7464·3e3c·2f74··d>enable</td></t | |||
| 0003c170:·723e·3c2f·7461·626c·653e·3c70·7265·3e3c··r></table><pre>< | |||
| 0003c180:·636f·6465·3e2d·206e·616d·653a·2045·6e73··code>-·name:·Ens | |||
| 0003c190:·7572·6520·6169·6465·2069·7320·696e·7374··ure·aide·is·inst | |||
| 0003c1a0:·616c·6c65·640a·2020·7061·636b·6167·653a··alled.··package: | |||
| 0003c1b0:·0a20·2020·206e·616d·653a·2061·6964·650a··.····name:·aide. | |||
| 0003c1c0:·2020·2020·7374·6174·653a·2070·7265·7365······state:·prese | |||
| 0003c1d0:·6e74·0a20·2077·6865·6e3a·2061·6e73·6962··nt.··when:·ansib | |||
| 0003c1e0:·6c65·5f76·6972·7475·616c·697a·6174·696f··le_virtualizatio | |||
| 0003c1f0:·6e5f·7479·7065·206e·6f74·2069·6e20·5b22··n_type·not·in·[" | |||
| 0003c200:·646f·636b·6572·222c·2022·6c78·6322·2c20··docker",·"lxc",· | |||
| 0003c210:·226f·7065·6e76·7a22·2c20·2270·6f64·6d61··"openvz",·"podma | |||
| 0003c220:·6e22·2c20·2263·6f6e·7461·696e·6572·225d··n",·"container"] | |||
| 0003c230:·0a20·2074·6167·733a·0a20·202d·2043·4345··.··tags:.··-·CCE | |||
| 0003c240:·2d38·3332·3839·2d39·0a20·202d·2043·4a49··-83289-9.··-·CJI | |||
| 0003c250:·532d·352e·3130·2e31·2e33·0a20·202d·2044··S-5.10.1.3.··-·D | |||
| 0003c260:·4953·412d·5354·4947·2d53·4c45·532d·3135··ISA-STIG-SLES-15 | |||
| 0003c270:·2d30·3130·3432·300a·2020·2d20·4e49·5354··-010420.··-·NIST | |||
| 0003c280:·2d38·3030·2d35·332d·434d·2d36·2861·290a··-800-53-CM-6(a). | |||
| 0003c290:·2020·2d20·5043·492d·4453·532d·5265·712d····-·PCI-DSS-Req- | |||
| 0003c2a0:·3131·2e35·0a20·202d·2065·6e61·626c·655f··11.5.··-·enable_ | |||
| 0003c2b0:·7374·7261·7465·6779·0a20·202d·206c·6f77··strategy.··-·low | |||
| 0003c2c0:·5f63·6f6d·706c·6578·6974·790a·2020·2d20··_complexity.··-· | |||
| 0003c2d0:·6c6f·775f·6469·7372·7570·7469·6f6e·0a20··low_disruption.· | |||
| 0003c2e0:·202d·206d·6564·6975·6d5f·7365·7665·7269···-·medium_severi | |||
| 0003c2f0:·7479·0a20·202d·206e·6f5f·7265·626f·6f74··ty.··-·no_reboot | |||
| 0003c300:·5f6e·6565·6465·640a·2020·2d20·7061·636b··_needed.··-·pack | |||
| 0003c310:·6167·655f·6169·6465·5f69·6e73·7461·6c6c··age_aide_install | |||
| 0003c320:·6564·0a3c·2f63·6f64·653e·3c2f·7072·653e··ed.</code></pre> | |||
| 0003c330:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003c340:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003c350:·2064·6174·612d·746f·6767·6c65·3d22·636f···data-toggle="co | |||
| 0003c360:·6c6c·6170·7365·2220·6461·7461·2d74·6172··llapse"·data-tar | |||
| 0003c370:·6765·743d·2223·6964·6d36·3737·3522·2074··get="#idm6775"·t | |||
| 0003c380:·6162·696e·6465·783d·2230·2220·726f·6c65··abindex="0"·role | |||
| 0003c390:·3d22·6275·7474·6f6e·2220·6172·6961·2d65··="button"·aria-e | |||
| 0003c3a0:·7870·616e·6465·643d·2266·616c·7365·2220··xpanded="false"· | |||
| 0003c3b0:·7469·746c·653d·2241·6374·6976·6174·6520··title="Activate· | |||
| 0003c3c0:·746f·2072·6576·6561·6c22·2068·7265·663d··to·reveal"·href= | |||
| 0003c3d0:·2223·2122·3e52·656d·6564·6961·7469·6f6e··"#!">Remediation | |||
| 0003c3e0:·204f·5342·7569·6c64·2042·6c75·6570·7269···OSBuild·Bluepri | |||
| 0003c3f0:·6e74·2073·6e69·7070·6574·20e2·87b2·3c2f··nt·snippet·...</ | |||
| 0003c400:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c410:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c | 0003c2a0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | ||
| 0003c430:·646d·3637·3735·223e·3c70·7265·3e3c·636f··dm6775"><pre><co | |||
| 0003c440:·6465·3e0a·5b5b·7061·636b·6167·6573·5d5d··de>.[[packages]] | |||
| 0003c450:·0a6e·616d·6520·3d20·2261·6964·6522·0a76··.name·=·"aide".v | |||
| 0003c460:·6572·7369·6f6e·203d·2022·2a22·0a3c·2f63··ersion·=·"*".</c | |||
| 0003c470:·6f64·653e·3c2f·7072·653e·3c2f·6469·763e··ode></pre></div> | |||
| 0003c480:·3c61·2063·6c61·7373·3d22·6274·6e20·6274··<a·class="btn·bt | |||
| 0003c490:·6e2d·7375·6363·6573·7322·2064·6174·612d··n-success"·data- | |||
| 0003c4a0:·746f·6767·6c65·3d22·636f·6c6c·6170·7365··toggle="collapse | |||
| 0003c4b0:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | |||
| 0003c4c0:·6964·6d36·3737·3622·2074·6162·696e·6465··idm6776"·tabinde | |||
| 0003c4d0:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | |||
| Max diff block lines reached; 5186142/5202894 bytes (99.68%) of diff not shown. | |||
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·15·Benchmark·for·Level·1·-·Server | 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·15·Benchmark·for·Level·1·-·Server |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_server_l1 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 46 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 46 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·AppArmor | 54 | ·········3.·AppArmor |
| 55 | ·········4.·GRUB2_bootloader_configuration | 55 | ·········4.·GRUB2_bootloader_configuration |
| 56 | ·········5.·Configure_Syslog | 56 | ·········5.·Configure_Syslog |
| Offset 125, 14 lines modified | Offset 125, 26 lines modified | ||
| 125 | include·install_aide | 125 | include·install_aide |
| 126 | class·install_aide·{ | 126 | class·install_aide·{ |
| 127 | ··package·{·'aide': | 127 | ··package·{·'aide': |
| 128 | ····ensure·=>·'installed', | 128 | ····ensure·=>·'installed', |
| 129 | ··} | 129 | ··} |
| 130 | } | 130 | } |
| 131 | Remediation_Shell_script_⇲ | ||
| 132 | Complexity:·low | ||
| 133 | Disruption:·low | ||
| 134 | Strategy:···enable | ||
| 135 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 136 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 137 | zypper·install·-y·"aide" | ||
| 138 | else | ||
| 139 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 140 | fi | ||
| 131 | Remediation_Ansible_snippet_⇲ | 141 | Remediation_Ansible_snippet_⇲ |
| 132 | Complexity:·low | 142 | Complexity:·low |
| 133 | Disruption:·low | 143 | Disruption:·low |
| 134 | Strategy:···enable | 144 | Strategy:···enable |
| 135 | -·name:·Ensure·aide·is·installed | 145 | -·name:·Ensure·aide·is·installed |
| 136 | ··package: | 146 | ··package: |
| 137 | ····name:·aide | 147 | ····name:·aide |
| Offset 151, 26 lines modified | Offset 163, 14 lines modified | ||
| 151 | ··-·no_reboot_needed | 163 | ··-·no_reboot_needed |
| 152 | ··-·package_aide_installed | 164 | ··-·package_aide_installed |
| 153 | Remediation_OSBuild_Blueprint_snippet_⇲ | 165 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 154 | [[packages]] | 166 | [[packages]] |
| 155 | name·=·"aide" | 167 | name·=·"aide" |
| 156 | version·=·"*" | 168 | version·=·"*" |
| 157 | Remediation_Shell_script_⇲ | ||
| 158 | Complexity:·low | ||
| 159 | Disruption:·low | ||
| 160 | Strategy:···enable | ||
| 161 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 162 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 163 | zypper·install·-y·"aide" | ||
| 164 | else | ||
| 165 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 166 | fi | ||
| 167 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 169 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 168 | Run·the·following·command·to·generate·a·new·database: | 170 | Run·the·following·command·to·generate·a·new·database: |
| 169 | $·sudo·/usr/bin/aide·--init | 171 | $·sudo·/usr/bin/aide·--init |
| 170 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 172 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 171 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 173 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 172 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 174 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 173 | database·can·be·installed·as·follows: | 175 | database·can·be·installed·as·follows: |
| Offset 185, 14 lines modified | Offset 185, 26 lines modified | ||
| 185 | ············Identifiers: ·CCE-85787-0 | 185 | ············Identifiers: ·CCE-85787-0 |
| 186 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 186 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 187 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 187 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 188 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 188 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 189 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 189 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 190 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 190 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 191 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 191 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 192 | Remediation_Shell_script_⇲ | ||
| 193 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 194 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 195 | zypper·install·-y·"aide" | ||
| 196 | /usr/bin/aide·--init | ||
| 197 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 198 | else | ||
| 199 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 200 | fi | ||
| 192 | Remediation_Ansible_snippet_⇲ | 201 | Remediation_Ansible_snippet_⇲ |
| 193 | Complexity:·low | 202 | Complexity:·low |
| 194 | Disruption:·low | 203 | Disruption:·low |
| 195 | Strategy:···restrict | 204 | Strategy:···restrict |
| 196 | -·name:·Ensure·AIDE·is·installed | 205 | -·name:·Ensure·AIDE·is·installed |
| 197 | ··package: | 206 | ··package: |
| 198 | ····name:·'{{·item·}}' | 207 | ····name:·'{{·item·}}' |
| Offset 261, 26 lines modified | Offset 273, 14 lines modified | ||
| 261 | ··-·PCI-DSS-Req-11.5 | 273 | ··-·PCI-DSS-Req-11.5 |
| 262 | ··-·aide_build_database | 274 | ··-·aide_build_database |
| 263 | ··-·low_complexity | 275 | ··-·low_complexity |
| 264 | ··-·low_disruption | 276 | ··-·low_disruption |
| 265 | ··-·medium_severity | 277 | ··-·medium_severity |
| 266 | ··-·no_reboot_needed | 278 | ··-·no_reboot_needed |
| 267 | ··-·restrict_strategy | 279 | ··-·restrict_strategy |
| 268 | Remediation_Shell_script_⇲ | ||
| 269 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 270 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 271 | zypper·install·-y·"aide" | ||
| 272 | /usr/bin/aide·--init | ||
| 273 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 274 | else | ||
| 275 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 276 | fi | ||
| 277 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 280 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 278 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 281 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 279 | using·cron,·add·the·following·line·to·/etc/crontab: | 282 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 280 | 05·4·*·*·*·root·/usr/bin/aide·--check | 283 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 281 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 284 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 282 | 05·4·*·*·0·root·/usr/bin/aide·--check | 285 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 283 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 286 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 304, 14 lines modified | Offset 304, 30 lines modified | ||
| 304 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 304 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 305 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 305 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 306 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 306 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 677345/682217 bytes (99.29%) of diff not shown. | |||
| Offset 14313, 15 lines modified | Offset 14313, 15 lines modified | ||
| 00037e80:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037e80:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037e90:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037e90:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037ea0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037ea0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037eb0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037eb0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037ec0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037ec0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037ed0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037ed0:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037ef0:·7320·6f66·2032·3032·3 | 00037ef0:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037f00:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037f00:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037f10:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037f10:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037f20:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037f20:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037f30:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037f30:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037f40:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037f40:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037f50:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037f50:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037f60:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037f60:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 15351, 123 lines modified | Offset 15351, 123 lines modified | ||
| 0003bf60:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003bf60:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003bf70:·6964·6d36·3737·3422·2074·6162·696e·6465··idm6774"·tabinde | 0003bf70:·6964·6d36·3737·3422·2074·6162·696e·6465··idm6774"·tabinde | ||
| 0003bf80:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003bf80:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003bf90:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003bf90:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003bfa0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003bfa0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003bfb0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003bfb0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003bfc0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003bfc0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003bfd0:·656d·6564·6961·7469·6f6e·20 | 0003bfd0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003bfe0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | |||
| 0003bff0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003c000:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003c010:·6c6c·6170·7365·2220·6964·3d22·6964·6d36··llapse"·id="idm6 | |||
| 0003c020:·3737·3422·3e3c·7461·626c·6520·636c·6173··774"><table·clas | |||
| 0003c030:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c040:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c050:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c060:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c070:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003bfe0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003bff0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003c000:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003c010:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003c020:·646d·3637·3734·223e·3c74·6162·6c65·2063··dm6774"><table·c | |||
| 0003c030:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003c040:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003c050:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003c060:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003c070:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003c080:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c090:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003c0a0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003c0 | 0003c080:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | ||
| 0003c090:·3c74·723e·3c74·683e·4469·7372·7570·7469··<tr><th>Disrupti | |||
| 0003c0a0:·6f6e·3a3c·2f74·683e·3c74·643e·6c6f·773c··on:</th><td>low< | |||
| 0003c0b0:·2f74·643e·3c2f·7472·3e3c·7472·3e3c·7468··/td></tr><tr><th | |||
| 0003c0c0:·3e53·7472·6174·6567·793a·3c2f·7468·3e3c··>Strategy:</th>< | |||
| 0003c0d0:·7464·3e65·6e61·626c·653c·2f74·643e·3c2f··td>enable</td></ | |||
| 0003c0e0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c0f0:·3c63·6f64·653e·2320·5265·6d65·6469·6174··<code>#·Remediat | |||
| 0003c100:·696f·6e20·6973·2061·7070·6c69·6361·626c··ion·is·applicabl | |||
| 0003c110:·6520·6f6e·6c79·2069·6e20·6365·7274·6169··e·only·in·certai | |||
| 0003c120:·6e20·706c·6174·666f·726d·730a·6966·205b··n·platforms.if·[ | |||
| 0003c130:·2021·202d·6620·2f2e·646f·636b·6572·656e···!·-f·/.dockeren | |||
| 0003c140:·7620·5d20·2661·6d70·3b26·616d·703b·205b··v·]·&&·[ | |||
| 0003c150:·2021·202d·6620·2f72·756e·2f2e·636f·6e74···!·-f·/run/.cont | |||
| 0003c160:·6169·6e65·7265·6e76·205d·3b20·7468·656e··ainerenv·];·then | |||
| 0003c170:·0a0a·7a79·7070·6572·2069·6e73·7461·6c6c··..zypper·install | |||
| 0003c180:·202d·7920·2261·6964·6522·0a0a·656c·7365···-y·"aide"..else | |||
| 0003c190:·0a20·2020·2026·6774·3b26·616d·703b·3220··.····>&2· | |||
| 0003c1a0:·6563·686f·2027·5265·6d65·6469·6174·696f··echo·'Remediatio | |||
| 0003c1b0:·6e20·6973·206e·6f74·2061·7070·6c69·6361··n·is·not·applica | |||
| 0003c1c0:·626c·652c·206e·6f74·6869·6e67·2077·6173··ble,·nothing·was | |||
| 0003c1d0:·2064·6f6e·6527·0a66·690a·3c2f·636f·6465···done'.fi.</code | |||
| 0003c1e0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003c1f0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003c200:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003c0c0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003c0d0:·683e·3c74·643e·656e·6162·6c65·3c2f·7464··h><td>enable</td | |||
| 0003c0e0:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 0003c0f0:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 0003c100:·2045·6e73·7572·6520·6169·6465·2069·7320···Ensure·aide·is· | |||
| 0003c110:·696e·7374·616c·6c65·640a·2020·7061·636b··installed.··pack | |||
| 0003c120:·6167·653a·0a20·2020·206e·616d·653a·2061··age:.····name:·a | |||
| 0003c130:·6964·650a·2020·2020·7374·6174·653a·2070··ide.····state:·p | |||
| 0003c140:·7265·7365·6e74·0a20·2077·6865·6e3a·2061··resent.··when:·a | |||
| 0003c150:·6e73·6962·6c65·5f76·6972·7475·616c·697a··nsible_virtualiz | |||
| 0003c160:·6174·696f·6e5f·7479·7065·206e·6f74·2069··ation_type·not·i | |||
| 0003c170:·6e20·5b22·646f·636b·6572·222c·2022·6c78··n·["docker",·"lx | |||
| 0003c180:·6322·2c20·226f·7065·6e76·7a22·2c20·2270··c",·"openvz",·"p | |||
| 0003c190:·6f64·6d61·6e22·2c20·2263·6f6e·7461·696e··odman",·"contain | |||
| 0003c1a0:·6572·225d·0a20·2074·6167·733a·0a20·202d··er"].··tags:.··- | |||
| 0003c1b0:·2043·4345·2d38·3332·3839·2d39·0a20·202d···CCE-83289-9.··- | |||
| 0003c1c0:·2043·4a49·532d·352e·3130·2e31·2e33·0a20···CJIS-5.10.1.3.· | |||
| 0003c1d0:·202d·2044·4953·412d·5354·4947·2d53·4c45···-·DISA-STIG-SLE | |||
| 0003c1e0:·532d·3135·2d30·3130·3432·300a·2020·2d20··S-15-010420.··-· | |||
| 0003c1f0:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c200:·2861·290a·2020·2d20·5043·492d·4453·532d··(a).··-·PCI-DSS- | |||
| 0003c210:·5265·712d·3131·2e35·0a20·202d·2065·6e61··Req-11.5.··-·ena | |||
| 0003c220:·626c·655f·7374·7261·7465·6779·0a20·202d··ble_strategy.··- | |||
| 0003c230:·206c·6f77·5f63·6f6d·706c·6578·6974·790a···low_complexity. | |||
| 0003c240:·2020·2d20·6c6f·775f·6469·7372·7570·7469····-·low_disrupti | |||
| 0003c250:·6f6e·0a20·202d·206d·6564·6975·6d5f·7365··on.··-·medium_se | |||
| 0003c260:·7665·7269·7479·0a20·202d·206e·6f5f·7265··verity.··-·no_re | |||
| 0003c270:·626f·6f74·5f6e·6565·6465·640a·2020·2d20··boot_needed.··-· | |||
| 0003c280:·7061·636b·6167·655f·6169·6465·5f69·6e73··package_aide_ins | |||
| 0003c290:·7461·6c6c·6564·0a3c·2f63·6f64·653e·3c2f··talled.</code></ | |||
| 0003c2a0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 0003c2b0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 0003c2c0:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 0003c2d0:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 0003c2e0:·2d74·6172·6765·743d·2223·6964·6d36·3737··-target="#idm677 | |||
| 0003c2f0:·3522·2074·6162·696e·6465·783d·2230·2220··5"·tabindex="0"· | |||
| 0003c300:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 0003c310:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 0003c320:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 0003c330:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 0003c340:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 0003c350:·7469·6f6e·204f·5342·7569·6c64·2042·6c75··tion·OSBuild·Blu | |||
| 0003c360:·6570·7269·6e74·2073·6e69·7070·6574·20e2··eprint·snippet·. | |||
| 0003c370:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c380:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c | 0003c210:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | ||
| 0003c3a0:·643d·2269·646d·3637·3735·223e·3c70·7265··d="idm6775"><pre | |||
| 0003c3b0:·3e3c·636f·6465·3e0a·5b5b·7061·636b·6167··><code>.[[packag | |||
| 0003c3c0:·6573·5d5d·0a6e·616d·6520·3d20·2261·6964··es]].name·=·"aid | |||
| 0003c3d0:·6522·0a76·6572·7369·6f6e·203d·2022·2a22··e".version·=·"*" | |||
| 0003c3e0:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c3f0:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c400:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c410:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c420:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| Max diff block lines reached; 5114083/5130835 bytes (99.67%) of diff not shown. | |||
| Offset 42, 15 lines modified | Offset 42, 15 lines modified | ||
| 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·15·Benchmark·for·Level·1·-·Workstation | 42 | Profile·Title·CIS·SUSE·Linux·Enterprise·15·Benchmark·for·Level·1·-·Workstation |
| 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 | 43 | Profile·ID····xccdf_org.ssgproject.content_profile_cis_workstation_l1 |
| 44 | ***·CPE·Platforms·*** | 44 | ***·CPE·Platforms·*** |
| 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 45 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 46 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 46 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 47 | *****·Revision·History·***** | 47 | *****·Revision·History·***** |
| 48 | Current·version:·0.1.65 | 48 | Current·version:·0.1.65 |
| 49 | ····*·draft·(as·of·202 | 49 | ····*·draft·(as·of·2025-02-23) |
| 50 | *****·Table·of·Contents·***** | 50 | *****·Table·of·Contents·***** |
| 51 | ···1.·System_Settings | 51 | ···1.·System_Settings |
| 52 | ·········1.·Installing_and_Maintaining_Software | 52 | ·········1.·Installing_and_Maintaining_Software |
| 53 | ·········2.·Account_and_Access_Control | 53 | ·········2.·Account_and_Access_Control |
| 54 | ·········3.·AppArmor | 54 | ·········3.·AppArmor |
| 55 | ·········4.·GRUB2_bootloader_configuration | 55 | ·········4.·GRUB2_bootloader_configuration |
| 56 | ·········5.·Configure_Syslog | 56 | ·········5.·Configure_Syslog |
| Offset 123, 14 lines modified | Offset 123, 26 lines modified | ||
| 123 | include·install_aide | 123 | include·install_aide |
| 124 | class·install_aide·{ | 124 | class·install_aide·{ |
| 125 | ··package·{·'aide': | 125 | ··package·{·'aide': |
| 126 | ····ensure·=>·'installed', | 126 | ····ensure·=>·'installed', |
| 127 | ··} | 127 | ··} |
| 128 | } | 128 | } |
| 129 | Remediation_Shell_script_⇲ | ||
| 130 | Complexity:·low | ||
| 131 | Disruption:·low | ||
| 132 | Strategy:···enable | ||
| 133 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 134 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 135 | zypper·install·-y·"aide" | ||
| 136 | else | ||
| 137 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 138 | fi | ||
| 129 | Remediation_Ansible_snippet_⇲ | 139 | Remediation_Ansible_snippet_⇲ |
| 130 | Complexity:·low | 140 | Complexity:·low |
| 131 | Disruption:·low | 141 | Disruption:·low |
| 132 | Strategy:···enable | 142 | Strategy:···enable |
| 133 | -·name:·Ensure·aide·is·installed | 143 | -·name:·Ensure·aide·is·installed |
| 134 | ··package: | 144 | ··package: |
| 135 | ····name:·aide | 145 | ····name:·aide |
| Offset 149, 26 lines modified | Offset 161, 14 lines modified | ||
| 149 | ··-·no_reboot_needed | 161 | ··-·no_reboot_needed |
| 150 | ··-·package_aide_installed | 162 | ··-·package_aide_installed |
| 151 | Remediation_OSBuild_Blueprint_snippet_⇲ | 163 | Remediation_OSBuild_Blueprint_snippet_⇲ |
| 152 | [[packages]] | 164 | [[packages]] |
| 153 | name·=·"aide" | 165 | name·=·"aide" |
| 154 | version·=·"*" | 166 | version·=·"*" |
| 155 | Remediation_Shell_script_⇲ | ||
| 156 | Complexity:·low | ||
| 157 | Disruption:·low | ||
| 158 | Strategy:···enable | ||
| 159 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 160 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 161 | zypper·install·-y·"aide" | ||
| 162 | else | ||
| 163 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 164 | fi | ||
| 165 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** | 167 | ***·Rule ·Build·and·Test·AIDE·Database· [ref]·*** |
| 166 | Run·the·following·command·to·generate·a·new·database: | 168 | Run·the·following·command·to·generate·a·new·database: |
| 167 | $·sudo·/usr/bin/aide·--init | 169 | $·sudo·/usr/bin/aide·--init |
| 168 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the | 170 | By·default,·the·database·will·be·written·to·the·file·/var/lib/aide/aide.db.new.·Storing·the·database,·the |
| 169 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure | 171 | configuration·file·/etc/aide.conf,·and·the·binary·/usr/bin/aide·(or·hashes·of·these·files),·in·a·secure |
| 170 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated | 172 | location·(such·as·on·read-only·media)·provides·additional·assurance·about·their·integrity.·The·newly-generated |
| 171 | database·can·be·installed·as·follows: | 173 | database·can·be·installed·as·follows: |
| Offset 183, 14 lines modified | Offset 183, 26 lines modified | ||
| 183 | ············Identifiers: ·CCE-85787-0 | 183 | ············Identifiers: ·CCE-85787-0 |
| 184 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, | 184 | ············References: ·BP28(R51),·1,·11,·12,·13,·14,·15,·16,·2,·3,·5,·7,·8,·9,·5.10.1.3,·APO01.06,·BAI01.06, |
| 185 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 185 | Identifiers·BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 186 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR | 186 | and·········DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR |
| 187 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, | 187 | References··3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.4.1, |
| 188 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, | 188 | ············A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.14.2.7,·A.15.2.1,·A.8.2.3, |
| 189 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 | 189 | ············CM-6(a),·DE.CM-1,·DE.CM-7,·PR.DS-1,·PR.DS-6,·PR.DS-8,·PR.IP-1,·PR.IP-3,·Req-11.5,·1.4.1 |
| 190 | Remediation_Shell_script_⇲ | ||
| 191 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 192 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 193 | zypper·install·-y·"aide" | ||
| 194 | /usr/bin/aide·--init | ||
| 195 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 196 | else | ||
| 197 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 198 | fi | ||
| 190 | Remediation_Ansible_snippet_⇲ | 199 | Remediation_Ansible_snippet_⇲ |
| 191 | Complexity:·low | 200 | Complexity:·low |
| 192 | Disruption:·low | 201 | Disruption:·low |
| 193 | Strategy:···restrict | 202 | Strategy:···restrict |
| 194 | -·name:·Ensure·AIDE·is·installed | 203 | -·name:·Ensure·AIDE·is·installed |
| 195 | ··package: | 204 | ··package: |
| 196 | ····name:·'{{·item·}}' | 205 | ····name:·'{{·item·}}' |
| Offset 259, 26 lines modified | Offset 271, 14 lines modified | ||
| 259 | ··-·PCI-DSS-Req-11.5 | 271 | ··-·PCI-DSS-Req-11.5 |
| 260 | ··-·aide_build_database | 272 | ··-·aide_build_database |
| 261 | ··-·low_complexity | 273 | ··-·low_complexity |
| 262 | ··-·low_disruption | 274 | ··-·low_disruption |
| 263 | ··-·medium_severity | 275 | ··-·medium_severity |
| 264 | ··-·no_reboot_needed | 276 | ··-·no_reboot_needed |
| 265 | ··-·restrict_strategy | 277 | ··-·restrict_strategy |
| 266 | Remediation_Shell_script_⇲ | ||
| 267 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 268 | if·[·!·-f·/.dockerenv·]·&&·[·!·-f·/run/.containerenv·];·then | ||
| 269 | zypper·install·-y·"aide" | ||
| 270 | /usr/bin/aide·--init | ||
| 271 | /bin/cp·-p·/var/lib/aide/aide.db.new·/var/lib/aide/aide.db | ||
| 272 | else | ||
| 273 | ····>&2·echo·'Remediation·is·not·applicable,·nothing·was·done' | ||
| 274 | fi | ||
| 275 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** | 278 | ***·Rule ·Configure·Periodic·Execution·of·AIDE· [ref]·*** |
| 276 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am | 279 | At·a·minimum,·AIDE·should·be·configured·to·run·a·weekly·scan.·To·implement·a·daily·execution·of·AIDE·at·4:05am |
| 277 | using·cron,·add·the·following·line·to·/etc/crontab: | 280 | using·cron,·add·the·following·line·to·/etc/crontab: |
| 278 | 05·4·*·*·*·root·/usr/bin/aide·--check | 281 | 05·4·*·*·*·root·/usr/bin/aide·--check |
| 279 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: | 282 | To·implement·a·weekly·execution·of·AIDE·at·4:05am·using·cron,·add·the·following·line·to·/etc/crontab: |
| 280 | 05·4·*·*·0·root·/usr/bin/aide·--check | 283 | 05·4·*·*·0·root·/usr/bin/aide·--check |
| 281 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special | 284 | AIDE·can·be·executed·periodically·through·other·means;·this·is·merely·one·example.·The·usage·of·cron's·special |
| Offset 302, 14 lines modified | Offset 302, 30 lines modified | ||
| 302 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, | 302 | ············BAI02.01,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05,·DSS01.03,·DSS03.05,·DSS04.07, |
| 303 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, | 303 | Identifiers·DSS05.02,·DSS05.03,·DSS05.05,·DSS05.07,·DSS06.02,·DSS06.06,·CCI-001744,·CCI-002699,·CCI-002702, |
| 304 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, | 304 | and·········4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_4.1,·SR_6.2,·SR_7.6,·A.11.2.4, |
| Max diff block lines reached; 671931/676813 bytes (99.28%) of diff not shown. | |||
| Offset 14313, 15 lines modified | Offset 14313, 15 lines modified | ||
| 00037e80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037e80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037e90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037e90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037ea0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037ea0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037eb0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037eb0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037ec0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037ec0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037ed0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037ed0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037ee0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037ee0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037ef0:·3 | 00037ef0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037f00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037f00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037f10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037f10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037f20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037f20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037f30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037f30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037f40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037f40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037f50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037f50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037f60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037f60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15362, 123 lines modified | Offset 15362, 123 lines modified | ||
| 0003c010:·7267·6574·3d22·2369·646d·3637·3734·2220··rget="#idm6774"· | 0003c010:·7267·6574·3d22·2369·646d·3637·3734·2220··rget="#idm6774"· | ||
| 0003c020:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003c020:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003c030:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003c030:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003c040:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003c040:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003c050:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003c050:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003c060:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003c060:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003c070:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003c070:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003c080:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c090:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c0a0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c0b0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c0c0:·2220·6964·3d22·6964·6d36·3737·3422·3e3c··"·id="idm6774">< | |||
| 0003c0d0:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c0e0:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003c0f0:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003c100:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c110:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c | 0003c080:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | ||
| 0003c090:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003c0a0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003c0b0:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003c0c0:·643d·2269·646d·3637·3734·223e·3c74·6162··d="idm6774"><tab | |||
| 0003c0d0:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003c0e0:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003c0f0:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003c100:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003c110:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003c120:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003c130:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003c140:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003c150:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003c160:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003c170:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003c1 | 0003c180:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003c190:·653e·3c70·7265·3e3c·636f·6465·3e23·2052··e><pre><code>#·R | |||
| 0003c1a0:·656d·6564·6961·7469·6f6e·2069·7320·6170··emediation·is·ap | |||
| 0003c1b0:·706c·6963·6162·6c65·206f·6e6c·7920·696e··plicable·only·in | |||
| 0003c1c0:·2063·6572·7461·696e·2070·6c61·7466·6f72···certain·platfor | |||
| 0003c1d0:·6d73·0a69·6620·5b20·2120·2d66·202f·2e64··ms.if·[·!·-f·/.d | |||
| 0003c1e0:·6f63·6b65·7265·6e76·205d·2026·616d·703b··ockerenv·]·& | |||
| 0003c1f0:·2661·6d70·3b20·5b20·2120·2d66·202f·7275··&·[·!·-f·/ru | |||
| 0003c200:·6e2f·2e63·6f6e·7461·696e·6572·656e·7620··n/.containerenv· | |||
| 0003c210:·5d3b·2074·6865·6e0a·0a7a·7970·7065·7220··];·then..zypper· | |||
| 0003c220:·696e·7374·616c·6c20·2d79·2022·6169·6465··install·-y·"aide | |||
| 0003c230:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 0003c240:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 0003c250:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 0003c260:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 0003c270:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 0003c280:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003c290:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003c2a0:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003c2b0:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003c140:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003c150:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003c160:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003c170:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003c180:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003c190:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003c1a0:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003c1b0:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003c1c0:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003c1d0:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003c1e0:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003c1f0:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003c200:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003c210:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003c220:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003c230:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003c240:·636f·6e74·6169·6e65·7222·5d0a·2020·7461··container"].··ta | |||
| 0003c250:·6773·3a0a·2020·2d20·4343·452d·3833·3238··gs:.··-·CCE-8328 | |||
| 0003c260:·392d·390a·2020·2d20·434a·4953·2d35·2e31··9-9.··-·CJIS-5.1 | |||
| 0003c270:·302e·312e·330a·2020·2d20·4449·5341·2d53··0.1.3.··-·DISA-S | |||
| 0003c280:·5449·472d·534c·4553·2d31·352d·3031·3034··TIG-SLES-15-0104 | |||
| 0003c290:·3230·0a20·202d·204e·4953·542d·3830·302d··20.··-·NIST-800- | |||
| 0003c2a0:·3533·2d43·4d2d·3628·6129·0a20·202d·2050··53-CM-6(a).··-·P | |||
| 0003c2b0:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003c2c0:·2020·2d20·656e·6162·6c65·5f73·7472·6174····-·enable_strat | |||
| 0003c2d0:·6567·790a·2020·2d20·6c6f·775f·636f·6d70··egy.··-·low_comp | |||
| 0003c2e0:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003c2f0:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003c300:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003c310:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003c320:·6564·0a20·202d·2070·6163·6b61·6765·5f61··ed.··-·package_a | |||
| 0003c330:·6964·655f·696e·7374·616c·6c65·640a·3c2f··ide_installed.</ | |||
| 0003c340:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003c350:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003c360:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c370:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c380:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c390:·2369·646d·3637·3735·2220·7461·6269·6e64··#idm6775"·tabind | |||
| 0003c3a0:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c3b0:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c3c0:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c3d0:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c3e0:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c3f0:·5265·6d65·6469·6174·696f·6e20·4f53·4275··Remediation·OSBu | |||
| 0003c400:·696c·6420·426c·7565·7072·696e·7420·736e··ild·Blueprint·sn | |||
| 0003c410:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c420:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003c430:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003c440:·6170·7365·2220·6964·3d22·6964·6d36·3737··apse"·id="idm677 | |||
| 0003c450:·3522·3e3c·7072·653e·3c63·6f64·653e·0a5b··5"><pre><code>.[ | |||
| 0003c460:·5b70·6163·6b61·6765·735d·5d0a·6e61·6d65··[packages]].name | |||
| 0003c470:·203d·2022·6169·6465·220a·7665·7273·696f···=·"aide".versio | |||
| 0003c480:·6e20·3d20·222a·220a·3c2f·636f·6465·3e3c··n·=·"*".</code>< | |||
| 0003c490:·2f70·7265·3e3c·2f64·6976·3e3c·6120·636c··/pre></div><a·cl | |||
| 0003c4a0:·6173·733d·2262·746e·2062·746e·2d73·7563··ass="btn·btn-suc | |||
| 0003c | 0003c2c0:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | ||
| 0003c2d0:·743d·2223·6964·6d36·3737·3522·2074·6162··t="#idm6775"·tab | |||
| 0003c2e0:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| Max diff block lines reached; 15229773/15246525 bytes (99.89%) of diff not shown. | |||
| Offset 14324, 15 lines modified | Offset 14324, 15 lines modified | ||
| 00037f30:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | 00037f30:·6f72·793c·2f68·323e·3c70·3e43·7572·7265··ory</h2><p>Curre | ||
| 00037f40:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | 00037f40:·6e74·2076·6572·7369·6f6e·3a20·3c73·7472··nt·version:·<str | ||
| 00037f50:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | 00037f50:·6f6e·673e·302e·312e·3635·3c2f·7374·726f··ong>0.1.65</stro | ||
| 00037f60:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | 00037f60:·6e67·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c··ng></p><ul><li>< | ||
| 00037f70:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | 00037f70:·7374·726f·6e67·3e64·7261·6674·3c2f·7374··strong>draft</st | ||
| 00037f80:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | 00037f80:·726f·6e67·3e0a·2020·2020·2020·2020·2020··rong>.·········· | ||
| 00037f90:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | 00037f90:·2020·2020·2020·2020·2020·2861·7320·6f66············(as·of | ||
| 00037fa0:·2032·3032·3 | 00037fa0:·2032·3032·352d·3032·2d32·3329·0a20·2020···2025-02-23).··· | ||
| 00037fb0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | 00037fb0:·2020·2020·2020·2020·2020·2020·203c·2f6c···············</l | ||
| 00037fc0:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | 00037fc0:·693e·3c2f·756c·3e3c·2f64·6976·3e3c·6832··i></ul></div><h2 | ||
| 00037fd0:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | 00037fd0:·3e54·6162·6c65·206f·6620·436f·6e74·656e··>Table·of·Conten | ||
| 00037fe0:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | 00037fe0:·7473·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c··ts</h2><ol><li>< | ||
| 00037ff0:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | 00037ff0:·6120·6872·6566·3d22·2378·6363·6466·5f6f··a·href="#xccdf_o | ||
| 00038000:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | 00038000:·7267·2e73·7367·7072·6f6a·6563·742e·636f··rg.ssgproject.co | ||
| 00038010:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | 00038010:·6e74·656e·745f·6772·6f75·705f·7379·7374··ntent_group_syst | ||
| Offset 15302, 330 lines modified | Offset 15302, 330 lines modified | ||
| 0003bc50:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | 0003bc50:·6461·7461·2d74·6172·6765·743d·2223·6964··data-target="#id | ||
| 0003bc60:·6d36·3433·3622·2074·6162·696e·6465·783d··m6436"·tabindex= | 0003bc60:·6d36·3433·3622·2074·6162·696e·6465·783d··m6436"·tabindex= | ||
| 0003bc70:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | 0003bc70:·2230·2220·726f·6c65·3d22·6275·7474·6f6e··"0"·role="button | ||
| 0003bc80:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | 0003bc80:·2220·6172·6961·2d65·7870·616e·6465·643d··"·aria-expanded= | ||
| 0003bc90:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | 0003bc90:·2266·616c·7365·2220·7469·746c·653d·2241··"false"·title="A | ||
| 0003bca0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | 0003bca0:·6374·6976·6174·6520·746f·2072·6576·6561··ctivate·to·revea | ||
| 0003bcb0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | 0003bcb0:·6c22·2068·7265·663d·2223·2122·3e52·656d··l"·href="#!">Rem | ||
| 0003bcc0:·6564·6961·7469·6f6e·20 | 0003bcc0:·6564·6961·7469·6f6e·2053·6865·6c6c·2073··ediation·Shell·s | ||
| 0003bcd0:·2073·6e69·7070·6574·20e2·87b2·3c2f·613e···snippet·...</a> | |||
| 0003bce0:·3c62·723e·3c64·6976·2063·6c61·7373·3d22··<br><div·class=" | |||
| 0003bcf0:·7061·6e65·6c2d·636f·6c6c·6170·7365·2063··panel-collapse·c | |||
| 0003bd00:·6f6c·6c61·7073·6522·2069·643d·2269·646d··ollapse"·id="idm | |||
| 0003bd10:·3634·3336·223e·3c74·6162·6c65·2063·6c61··6436"><table·cla | |||
| 0003bd20:·7373·3d22·7461·626c·6520·7461·626c·652d··ss="table·table- | |||
| 0003bd30:·7374·7269·7065·6420·7461·626c·652d·626f··striped·table-bo | |||
| 0003bd40:·7264·6572·6564·2074·6162·6c65·2d63·6f6e··rdered·table-con | |||
| 0003bd50:·6465·6e73·6564·223e·3c74·723e·3c74·683e··densed"><tr><th> | |||
| 0003bd60:·436f·6d70·6c65·7869·7479·3a3c·2f74·683e··Complexity:</th> | |||
| 0003bd70:·3c74·643e·6869·6768·3c2f·7464·3e3c·2f74··<td>high</td></t | |||
| 0003bd80:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bd90:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6d65··tion:</th><td>me | |||
| 0003bda0:·6469·756d·3c2f·7464·3e3c·2f74·723e·3c74··dium</td></tr><t | |||
| 0003bdb0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bdc0:·2f74·683e·3c74·643e·7265·7374·7269·6374··/th><td>restrict | |||
| 0003bdd0:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | |||
| 0003bde0:·653e·3c70·7265·3e3c·636f·6465·3e2d·206e··e><pre><code>-·n | |||
| 0003bdf0:·616d·653a·2027·5365·7420·6661·6374·3a20··ame:·'Set·fact:· | |||
| 0003b | 0003bcd0:·6372·6970·7420·e287·b23c·2f61·3e3c·6272··cript·...</a><br | ||
| 0003bce0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| 0003bcf0:·656c·2d63·6f6c·6c61·7073·6520·636f·6c6c··el-collapse·coll | |||
| 0003bd00:·6170·7365·2220·6964·3d22·6964·6d36·3433··apse"·id="idm643 | |||
| 0003bd10:·3622·3e3c·7072·653e·3c63·6f64·653e·0a23··6"><pre><code>.# | |||
| 0003bd20:·2046·696e·6420·7768·6963·6820·6669·6c65···Find·which·file | |||
| 0003bd30:·7320·6861·7665·2069·6e63·6f72·7265·6374··s·have·incorrect | |||
| 0003bd40:·2068·6173·6820·286e·6f74·2069·6e20·2f65···hash·(not·in·/e | |||
| 0003bd50:·7463·2c20·6265·6361·7573·6520·6f66·2074··tc,·because·of·t | |||
| 0003bd60:·6865·2073·7973·7465·6d20·7265·6c61·7465··he·system·relate | |||
| 0003bd70:·6420·636f·6e66·6967·2066·696c·6573·2920··d·config·files)· | |||
| 0003bd80:·616e·6420·7468·656e·2067·6574·2066·696c··and·then·get·fil | |||
| 0003bd90:·6573·206e·616d·6573·0a66·696c·6573·5f77··es·names.files_w | |||
| 0003bda0:·6974·685f·696e·636f·7272·6563·745f·6861··ith_incorrect_ha | |||
| 0003bdb0:·7368·3d22·2428·7270·6d20·2d56·6120·2d2d··sh="$(rpm·-Va·-- | |||
| 0003bdc0:·6e6f·636f·6e66·6967·207c·2067·7265·7020··noconfig·|·grep· | |||
| 0003bdd0:·2d45·2027·5e2e·2e35·2720·7c20·6177·6b20··-E·'^..5'·|·awk· | |||
| 0003bde0:·277b·7072·696e·7420·244e·467d·2720·2922··'{print·$NF}'·)" | |||
| 0003bdf0:·0a0a·2320·4672·6f6d·2066·696c·6573·206e··..#·From·files·n | |||
| 0003be00:·616d·6573·2067·6574·2070·6163·6b61·6765··ames·get·package | |||
| 0003be10:·206e·616d·6573·2061·6e64·2063·6861·6e67···names·and·chang | |||
| 0003be20:·6520·6e65·776c·696e·6520·746f·2073·7061··e·newline·to·spa | |||
| 0003be30:·6365·2c20·6265·6361·7573·6520·7270·6d20··ce,·because·rpm· | |||
| 0003be40:·7772·6974·6573·2065·6163·6820·7061·636b··writes·each·pack | |||
| 0003be50:·6167·6520·746f·206e·6577·206c·696e·650a··age·to·new·line. | |||
| 0003be60:·7061·636b·6167·6573·5f74·6f5f·7265·696e··packages_to_rein | |||
| 0003be70:·7374·616c·6c3d·2224·2872·706d·202d·7166··stall="$(rpm·-qf | |||
| 0003be80:·2024·6669·6c65·735f·7769·7468·5f69·6e63···$files_with_inc | |||
| 0003be90:·6f72·7265·6374·5f68·6173·6820·7c20·7472··orrect_hash·|·tr | |||
| 0003bea0:·2027·5c6e·2720·2720·2729·220a·0a0a·7a79···'\n'·'·')"...zy | |||
| 0003beb0:·7070·6572·2069·6e73·7461·6c6c·202d·6620··pper·install·-f· | |||
| 0003bec0:·2d79·2024·7061·636b·6167·6573·5f74·6f5f··-y·$packages_to_ | |||
| 0003be | 0003bed0:·7265·696e·7374·616c·6c0a·3c2f·636f·6465··reinstall.</code | ||
| 0003bee0:·3e3c·2f70·7265·3e3c·2f64·6976·3e3c·6120··></pre></div><a· | |||
| 0003bef0:·636c·6173·733d·2262·746e·2062·746e·2d73··class="btn·btn-s | |||
| 0003bf00:·7563·6365·7373·2220·6461·7461·2d74·6f67··uccess"·data-tog | |||
| 0003bf10:·676c·653d·2263·6f6c·6c61·7073·6522·2064··gle="collapse"·d | |||
| 0003bf20:·6174·612d·7461·7267·6574·3d22·2369·646d··ata-target="#idm | |||
| 0003bf30:·3634·3337·2220·7461·6269·6e64·6578·3d22··6437"·tabindex=" | |||
| 0003bf40:·3022·2072·6f6c·653d·2262·7574·746f·6e22··0"·role="button" | |||
| 0003bf50:·2061·7269·612d·6578·7061·6e64·6564·3d22···aria-expanded=" | |||
| 0003bf60:·6661·6c73·6522·2074·6974·6c65·3d22·4163··false"·title="Ac | |||
| 0003bf70:·7469·7661·7465·2074·6f20·7265·7665·616c··tivate·to·reveal | |||
| 0003bf80:·2220·6872·6566·3d22·2321·223e·5265·6d65··"·href="#!">Reme | |||
| 0003bf90:·6469·6174·696f·6e20·416e·7369·626c·6520··diation·Ansible· | |||
| 0003bfa0:·736e·6970·7065·7420·e287·b23c·2f61·3e3c··snippet·...</a>< | |||
| 0003bfb0:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003bfc0:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003bfd0:·6c6c·6170·7365·2220·6964·3d22·6964·6d36··llapse"·id="idm6 | |||
| 0003bfe0:·3433·3722·3e3c·7461·626c·6520·636c·6173··437"><table·clas | |||
| 0003bff0:·733d·2274·6162·6c65·2074·6162·6c65·2d73··s="table·table-s | |||
| 0003c000:·7472·6970·6564·2074·6162·6c65·2d62·6f72··triped·table-bor | |||
| 0003c010:·6465·7265·6420·7461·626c·652d·636f·6e64··dered·table-cond | |||
| 0003c020:·656e·7365·6422·3e3c·7472·3e3c·7468·3e43··ensed"><tr><th>C | |||
| 0003c030:·6f6d·706c·6578·6974·793a·3c2f·7468·3e3c··omplexity:</th>< | |||
| 0003c040:·7464·3e68·6967·683c·2f74·643e·3c2f·7472··td>high</td></tr | |||
| 0003c050:·3e3c·7472·3e3c·7468·3e44·6973·7275·7074··><tr><th>Disrupt | |||
| 0003c060:·696f·6e3a·3c2f·7468·3e3c·7464·3e6d·6564··ion:</th><td>med | |||
| 0003c070:·6975·6d3c·2f74·643e·3c2f·7472·3e3c·7472··ium</td></tr><tr | |||
| 0003c080:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 0003c090:·7468·3e3c·7464·3e72·6573·7472·6963·743c··th><td>restrict< | |||
| 0003c0a0:·2f74·643e·3c2f·7472·3e3c·2f74·6162·6c65··/td></tr></table | |||
| 0003c0b0:·3e3c·7072·653e·3c63·6f64·653e·2d20·6e61··><pre><code>-·na | |||
| 0003be20:·6420·2864·6e66·2927·0a20·2073·6574·5f66··d·(dnf)'.··set_f | |||
| 0003be30:·6163·743a·0a20·2020·2070·6163·6b61·6765··act:.····package | |||
| 0003be40:·5f6d·616e·6167·6572·5f72·6569·6e73·7461··_manager_reinsta | |||
| 0003be50:·6c6c·5f63·6d64·3a20·646e·6620·7265·696e··ll_cmd:·dnf·rein | |||
| 0003be60:·7374·616c·6c20·2d79·0a20·2077·6865·6e3a··stall·-y.··when: | |||
| 0003be70:·2061·6e73·6962·6c65·5f64·6973·7472·6962···ansible_distrib | |||
| 0003be80:·7574·696f·6e20·3d3d·2022·4665·646f·7261··ution·==·"Fedora | |||
| 0003be90:·220a·2020·7461·6773·3a0a·2020·2d20·4343··".··tags:.··-·CC | |||
| 0003bea0:·452d·3835·3738·382d·380a·2020·2d20·434a··E-85788-8.··-·CJ | |||
| 0003beb0:·4953·2d35·2e31·302e·342e·310a·2020·2d20··IS-5.10.4.1.··-· | |||
| 0003bec0:·4e49·5354·2d38·3030·2d31·3731·2d33·2e33··NIST-800-171-3.3 | |||
| 0003bed0:·2e38·0a20·202d·204e·4953·542d·3830·302d··.8.··-·NIST-800- | |||
| 0003bee0:·3137·312d·332e·342e·310a·2020·2d20·4e49··171-3.4.1.··-·NI | |||
| 0003bef0:·5354·2d38·3030·2d35·332d·4155·2d39·2833··ST-800-53-AU-9(3 | |||
| 0003bf00:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003bf10:·332d·434d·2d36·2863·290a·2020·2d20·4e49··3-CM-6(c).··-·NI | |||
| 0003bf20:·5354·2d38·3030·2d35·332d·434d·2d36·2864··ST-800-53-CM-6(d | |||
| 0003bf30:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 0003bf40:·332d·5349·2d37·0a20·202d·204e·4953·542d··3-SI-7.··-·NIST- | |||
| 0003bf50:·3830·302d·3533·2d53·492d·3728·3129·0a20··800-53-SI-7(1).· | |||
| 0003bf60:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| Max diff block lines reached; 15488830/15534148 bytes (99.71%) of diff not shown. | |||
| Offset 45, 15 lines modified | Offset 45, 15 lines modified | ||
| 45 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) | 45 | Profile·Title·Health·Insurance·Portability·and·Accountability·Act·(HIPAA) |
| 46 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa | 46 | Profile·ID····xccdf_org.ssgproject.content_profile_hipaa |
| 47 | ***·CPE·Platforms·*** | 47 | ***·CPE·Platforms·*** |
| 48 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 48 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 49 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 49 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 50 | *****·Revision·History·***** | 50 | *****·Revision·History·***** |
| 51 | Current·version:·0.1.65 | 51 | Current·version:·0.1.65 |
| 52 | ····*·draft·(as·of·202 | 52 | ····*·draft·(as·of·2025-02-23) |
| 53 | *****·Table·of·Contents·***** | 53 | *****·Table·of·Contents·***** |
| 54 | ···1.·System_Settings | 54 | ···1.·System_Settings |
| 55 | ·········1.·Installing_and_Maintaining_Software | 55 | ·········1.·Installing_and_Maintaining_Software |
| 56 | ·········2.·Account_and_Access_Control | 56 | ·········2.·Account_and_Access_Control |
| 57 | ·········3.·System_Accounting_with_auditd | 57 | ·········3.·System_Accounting_with_auditd |
| 58 | ·········4.·GRUB2_bootloader_configuration | 58 | ·········4.·GRUB2_bootloader_configuration |
| 59 | ·········5.·Configure_Syslog | 59 | ·········5.·Configure_Syslog |
| Offset 120, 14 lines modified | Offset 120, 25 lines modified | ||
| 120 | ············Identifiers: ·CCE-85788-8 | 120 | ············Identifiers: ·CCE-85788-8 |
| 121 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, | 121 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, |
| 122 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 | 122 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 |
| 123 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, | 123 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, |
| 124 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 | 124 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 |
| 125 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- | 125 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- |
| 126 | ············00227 | 126 | ············00227 |
| 127 | Remediation_Shell_script_⇲ | ||
| 128 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 129 | names | ||
| 130 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 131 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 132 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 133 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 127 | Remediation_Ansible_snippet_⇲ | 134 | Remediation_Ansible_snippet_⇲ |
| 128 | Complexity:·high | 135 | Complexity:·high |
| 129 | Disruption:·medium | 136 | Disruption:·medium |
| 130 | Strategy:···restrict | 137 | Strategy:···restrict |
| 131 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 138 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 132 | ··set_fact: | 139 | ··set_fact: |
| 133 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 140 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 277, 25 lines modified | Offset 288, 14 lines modified | ||
| 277 | ··-·PCI-DSS-Req-11.5 | 288 | ··-·PCI-DSS-Req-11.5 |
| 278 | ··-·high_complexity | 289 | ··-·high_complexity |
| 279 | ··-·high_severity | 290 | ··-·high_severity |
| 280 | ··-·medium_disruption | 291 | ··-·medium_disruption |
| 281 | ··-·no_reboot_needed | 292 | ··-·no_reboot_needed |
| 282 | ··-·restrict_strategy | 293 | ··-·restrict_strategy |
| 283 | ··-·rpm_verify_hashes | 294 | ··-·rpm_verify_hashes |
| 284 | Remediation_Shell_script_⇲ | ||
| 285 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 286 | names | ||
| 287 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 288 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 289 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 290 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 291 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** | 295 | ***·Rule ·Verify·and·Correct·File·Permissions·with·RPM· [ref]·*** |
| 292 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many | 296 | The·RPM·package·management·system·can·check·file·access·permissions·of·installed·software·packages,·including·many |
| 293 | that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor | 297 | that·are·important·to·system·security.·Verify·that·the·file·permissions·of·system·files·and·commands·match·vendor |
| 294 | values.·Check·the·file·permissions·with·the·following·command: | 298 | values.·Check·the·file·permissions·with·the·following·command: |
| 295 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' | 299 | $·sudo·rpm·-Va·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}' |
| 296 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the | 300 | Output·indicates·files·that·do·not·match·vendor·defaults.·After·locating·a·file·with·incorrect·permissions,·run·the |
| 297 | following·command·to·determine·which·package·owns·it: | 301 | following·command·to·determine·which·package·owns·it: |
| Offset 318, 14 lines modified | Offset 318, 43 lines modified | ||
| 318 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 318 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 319 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, | 319 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, |
| 320 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, | 320 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, |
| 321 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- | 321 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- |
| 322 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- | 322 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- |
| 323 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, | 323 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, |
| 324 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 | 324 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 |
| 325 | Remediation_Shell_script_⇲ | ||
| 326 | Complexity:·high | ||
| 327 | Disruption:·medium | ||
| 328 | Strategy:···restrict | ||
| 329 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 330 | declare·-A·SETPERMS_RPM_DICT | ||
| 331 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 332 | #·is·expected·by·the·RPM·database | ||
| 333 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 334 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 335 | do | ||
| 336 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 337 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 338 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 339 | ········do | ||
| 340 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 341 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 342 | ········done | ||
| 343 | done | ||
| 344 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 345 | #·correct·values | ||
| 346 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 347 | do | ||
| 348 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 349 | done | ||
| 325 | Remediation_Ansible_snippet_⇲ | 350 | Remediation_Ansible_snippet_⇲ |
| 326 | Complexity:·high | 351 | Complexity:·high |
| 327 | Disruption:·medium | 352 | Disruption:·medium |
| 328 | Strategy:···restrict | 353 | Strategy:···restrict |
| 329 | -·name:·Read·list·of·files·with·incorrect·permissions | 354 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 330 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 355 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 331 | ····--nocaps·--nolinkto·--nouser·--nogroup | 356 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 402, 43 lines modified | Offset 431, 14 lines modified | ||
| 402 | ··-·PCI-DSS-Req-11.5 | 431 | ··-·PCI-DSS-Req-11.5 |
| 403 | ··-·high_complexity | 432 | ··-·high_complexity |
| 404 | ··-·high_severity | 433 | ··-·high_severity |
| 405 | ··-·medium_disruption | 434 | ··-·medium_disruption |
| 406 | ··-·no_reboot_needed | 435 | ··-·no_reboot_needed |
| 407 | ··-·restrict_strategy | 436 | ··-·restrict_strategy |
| 408 | ··-·rpm_verify_permissions | 437 | ··-·rpm_verify_permissions |
| 409 | Remediation_Shell_script_⇲ | ||
| 410 | Complexity:·high | ||
| 411 | Disruption:·medium | ||
| 412 | Strategy:···restrict | ||
| 413 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 414 | declare·-A·SETPERMS_RPM_DICT | ||
| Max diff block lines reached; 1060642/1067353 bytes (99.37%) of diff not shown. | |||
| Offset 14297, 15 lines modified | Offset 14297, 15 lines modified | ||
| 00037d80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | 00037d80:·2f68·323e·3c70·3e43·7572·7265·6e74·2076··/h2><p>Current·v | ||
| 00037d90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | 00037d90:·6572·7369·6f6e·3a20·3c73·7472·6f6e·673e··ersion:·<strong> | ||
| 00037da0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | 00037da0:·302e·312e·3635·3c2f·7374·726f·6e67·3e3c··0.1.65</strong>< | ||
| 00037db0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | 00037db0:·2f70·3e3c·756c·3e3c·6c69·3e3c·7374·726f··/p><ul><li><stro | ||
| 00037dc0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | 00037dc0:·6e67·3e64·7261·6674·3c2f·7374·726f·6e67··ng>draft</strong | ||
| 00037dd0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | 00037dd0:·3e0a·2020·2020·2020·2020·2020·2020·2020··>.·············· | ||
| 00037de0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | 00037de0:·2020·2020·2020·2861·7320·6f66·2032·3032········(as·of·202 | ||
| 00037df0:·3 | 00037df0:·352d·3032·2d32·3329·0a20·2020·2020·2020··5-02-23).······· | ||
| 00037e00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | 00037e00:·2020·2020·2020·2020·203c·2f6c·693e·3c2f···········</li></ | ||
| 00037e10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | 00037e10:·756c·3e3c·2f64·6976·3e3c·6832·3e54·6162··ul></div><h2>Tab | ||
| 00037e20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | 00037e20:·6c65·206f·6620·436f·6e74·656e·7473·3c2f··le·of·Contents</ | ||
| 00037e30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | 00037e30:·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120·6872··h2><ol><li><a·hr | ||
| 00037e40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | 00037e40:·6566·3d22·2378·6363·6466·5f6f·7267·2e73··ef="#xccdf_org.s | ||
| 00037e50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | 00037e50:·7367·7072·6f6a·6563·742e·636f·6e74·656e··sgproject.conten | ||
| 00037e60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | 00037e60:·745f·6772·6f75·705f·7379·7374·656d·223e··t_group_system"> | ||
| Offset 15321, 329 lines modified | Offset 15321, 329 lines modified | ||
| 0003bd80:·6172·6765·743d·2223·6964·6d36·3433·3622··arget="#idm6436" | 0003bd80:·6172·6765·743d·2223·6964·6d36·3433·3622··arget="#idm6436" | ||
| 0003bd90:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 0003bd90:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 0003bda0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 0003bda0:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 0003bdb0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 0003bdb0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 0003bdc0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 0003bdc0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 0003bdd0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 0003bdd0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 0003bde0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 0003bde0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 0003bdf0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 0003be00:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 0003be10:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 0003be20:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 0003be30:·6522·2069·643d·2269·646d·3634·3336·223e··e"·id="idm6436"> | |||
| 0003be40:·3c74·6162·6c65·2063·6c61·7373·3d22·7461··<table·class="ta | |||
| 0003be50:·626c·6520·7461·626c·652d·7374·7269·7065··ble·table-stripe | |||
| 0003b | 0003bdf0:·6f6e·2053·6865·6c6c·2073·6372·6970·7420··on·Shell·script· | ||
| 0003be00:·e287·b23c·2f61·3e3c·6272·3e3c·6469·7620··...</a><br><div· | |||
| 0003be10:·636c·6173·733d·2270·616e·656c·2d63·6f6c··class="panel-col | |||
| 0003be20:·6c61·7073·6520·636f·6c6c·6170·7365·2220··lapse·collapse"· | |||
| 0003be30:·6964·3d22·6964·6d36·3433·3622·3e3c·7072··id="idm6436"><pr | |||
| 0003be40:·653e·3c63·6f64·653e·0a23·2046·696e·6420··e><code>.#·Find· | |||
| 0003be50:·7768·6963·6820·6669·6c65·7320·6861·7665··which·files·have | |||
| 0003be60:·2069·6e63·6f72·7265·6374·2068·6173·6820···incorrect·hash· | |||
| 0003be70:·286e·6f74·2069·6e20·2f65·7463·2c20·6265··(not·in·/etc,·be | |||
| 0003be80:·6361·7573·6520·6f66·2074·6865·2073·7973··cause·of·the·sys | |||
| 0003be90:·7465·6d20·7265·6c61·7465·6420·636f·6e66··tem·related·conf | |||
| 0003bea0:·6967·2066·696c·6573·2920·616e·6420·7468··ig·files)·and·th | |||
| 0003beb0:·656e·2067·6574·2066·696c·6573·206e·616d··en·get·files·nam | |||
| 0003bec0:·6573·0a66·696c·6573·5f77·6974·685f·696e··es.files_with_in | |||
| 0003bed0:·636f·7272·6563·745f·6861·7368·3d22·2428··correct_hash="$( | |||
| 0003bee0:·7270·6d20·2d56·6120·2d2d·6e6f·636f·6e66··rpm·-Va·--noconf | |||
| 0003bef0:·6967·207c·2067·7265·7020·2d45·2027·5e2e··ig·|·grep·-E·'^. | |||
| 0003bf00:·2e35·2720·7c20·6177·6b20·277b·7072·696e··.5'·|·awk·'{prin | |||
| 0003bf10:·7420·244e·467d·2720·2922·0a0a·2320·4672··t·$NF}'·)"..#·Fr | |||
| 0003bf20:·6f6d·2066·696c·6573·206e·616d·6573·2067··om·files·names·g | |||
| 0003bf30:·6574·2070·6163·6b61·6765·206e·616d·6573··et·package·names | |||
| 0003bf40:·2061·6e64·2063·6861·6e67·6520·6e65·776c···and·change·newl | |||
| 0003bf50:·696e·6520·746f·2073·7061·6365·2c20·6265··ine·to·space,·be | |||
| 0003bf60:·6361·7573·6520·7270·6d20·7772·6974·6573··cause·rpm·writes | |||
| 0003bf70:·2065·6163·6820·7061·636b·6167·6520·746f···each·package·to | |||
| 0003bf80:·206e·6577·206c·696e·650a·7061·636b·6167···new·line.packag | |||
| 0003bf90:·6573·5f74·6f5f·7265·696e·7374·616c·6c3d··es_to_reinstall= | |||
| 0003bfa0:·2224·2872·706d·202d·7166·2024·6669·6c65··"$(rpm·-qf·$file | |||
| 0003bfb0:·735f·7769·7468·5f69·6e63·6f72·7265·6374··s_with_incorrect | |||
| 0003bfc0:·5f68·6173·6820·7c20·7472·2027·5c6e·2720··_hash·|·tr·'\n'· | |||
| 0003bfd0:·2720·2729·220a·0a0a·7a79·7070·6572·2069··'·')"...zypper·i | |||
| 0003bfe0:·6e73·7461·6c6c·202d·6620·2d79·2024·7061··nstall·-f·-y·$pa | |||
| 0003bff0:·636b·6167·6573·5f74·6f5f·7265·696e·7374··ckages_to_reinst | |||
| 0003c000:·616c·6c0a·3c2f·636f·6465·3e3c·2f70·7265··all.</code></pre | |||
| 0003c010:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 0003c020:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 0003c030:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 0003c040:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 0003c050:·7267·6574·3d22·2369·646d·3634·3337·2220··rget="#idm6437"· | |||
| 0003c060:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 0003c070:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 0003c080:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 0003c090:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 0003c0a0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 0003c0b0:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 0003c0c0:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003c0d0:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003c0e0:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003c0f0:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003c100:·2220·6964·3d22·6964·6d36·3433·3722·3e3c··"·id="idm6437">< | |||
| 0003c110:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003c120:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003 | 0003c130:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 0003c140:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003c150:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003c160:·6974·793a·3c2f·7468·3e3c·7464·3e68·6967··ity:</th><td>hig | |||
| 0003c170:·683c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··h</td></tr><tr>< | |||
| 0003c180:·7468·3e44·6973·7275·7074·696f·6e3a·3c2f··th>Disruption:</ | |||
| 0003c190:·7468·3e3c·7464·3e6d·6564·6975·6d3c·2f74··th><td>medium</t | |||
| 0003c1a0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e53··d></tr><tr><th>S | |||
| 0003c1b0:·7472·6174·6567·793a·3c2f·7468·3e3c·7464··trategy:</th><td | |||
| 0003c1c0:·3e72·6573·7472·6963·743c·2f74·643e·3c2f··>restrict</td></ | |||
| 0003c1d0:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | |||
| 0003c1e0:·3c63·6f64·653e·2d20·6e61·6d65·3a20·2753··<code>-·name:·'S | |||
| 0003be80:·223e·3c74·723e·3c74·683e·436f·6d70·6c65··"><tr><th>Comple | |||
| 0003be90:·7869·7479·3a3c·2f74·683e·3c74·643e·6869··xity:</th><td>hi | |||
| 0003bea0:·6768·3c2f·7464·3e3c·2f74·723e·3c74·723e··gh</td></tr><tr> | |||
| 0003beb0:·3c74·683e·4469·7372·7570·7469·6f6e·3a3c··<th>Disruption:< | |||
| 0003bec0:·2f74·683e·3c74·643e·6d65·6469·756d·3c2f··/th><td>medium</ | |||
| 0003bed0:·7464·3e3c·2f74·723e·3c74·723e·3c74·683e··td></tr><tr><th> | |||
| 0003bee0:·5374·7261·7465·6779·3a3c·2f74·683e·3c74··Strategy:</th><t | |||
| 0003bef0:·643e·7265·7374·7269·6374·3c2f·7464·3e3c··d>restrict</td>< | |||
| 0003bf00:·2f74·723e·3c2f·7461·626c·653e·3c70·7265··/tr></table><pre | |||
| 0003bf10:·3e3c·636f·6465·3e2d·206e·616d·653a·2027··><code>-·name:·' | |||
| 0003bf20:·5365·7420·6661·6374·3a20·5061·636b·6167··Set·fact:·Packag | |||
| 0003bf30:·6520·6d61·6e61·6765·7220·7265·696e·7374··e·manager·reinst | |||
| 0003bf40:·616c·6c20·636f·6d6d·616e·6420·2864·6e66··all·command·(dnf | |||
| 0003bf50:·2927·0a20·2073·6574·5f66·6163·743a·0a20··)'.··set_fact:.· | |||
| 0003bf60:·2020·2070·6163·6b61·6765·5f6d·616e·6167·····package_manag | |||
| 0003bf70:·6572·5f72·6569·6e73·7461·6c6c·5f63·6d64··er_reinstall_cmd | |||
| 0003bf80:·3a20·646e·6620·7265·696e·7374·616c·6c20··:·dnf·reinstall· | |||
| 0003bf90:·2d79·0a20·2077·6865·6e3a·2061·6e73·6962··-y.··when:·ansib | |||
| 0003bfa0:·6c65·5f64·6973·7472·6962·7574·696f·6e20··le_distribution· | |||
| 0003bfb0:·3d3d·2022·4665·646f·7261·220a·2020·7461··==·"Fedora".··ta | |||
| 0003bfc0:·6773·3a0a·2020·2d20·4343·452d·3835·3738··gs:.··-·CCE-8578 | |||
| 0003bfd0:·382d·380a·2020·2d20·434a·4953·2d35·2e31··8-8.··-·CJIS-5.1 | |||
| 0003bfe0:·302e·342e·310a·2020·2d20·4e49·5354·2d38··0.4.1.··-·NIST-8 | |||
| 0003bff0:·3030·2d31·3731·2d33·2e33·2e38·0a20·202d··00-171-3.3.8.··- | |||
| 0003c000:·204e·4953·542d·3830·302d·3137·312d·332e···NIST-800-171-3. | |||
| 0003c010:·342e·310a·2020·2d20·4e49·5354·2d38·3030··4.1.··-·NIST-800 | |||
| 0003c020:·2d35·332d·4155·2d39·2833·290a·2020·2d20··-53-AU-9(3).··-· | |||
| 0003c030:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003c040:·2863·290a·2020·2d20·4e49·5354·2d38·3030··(c).··-·NIST-800 | |||
| 0003c050:·2d35·332d·434d·2d36·2864·290a·2020·2d20··-53-CM-6(d).··-· | |||
| 0003c060:·4e49·5354·2d38·3030·2d35·332d·5349·2d37··NIST-800-53-SI-7 | |||
| 0003c070:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003c080:·2d53·492d·3728·3129·0a20·202d·204e·4953··-SI-7(1).··-·NIS | |||
| Max diff block lines reached; 18222786/18267966 bytes (99.75%) of diff not shown. | |||
| Offset 14297, 16 lines modified | Offset 14297, 16 lines modified | ||
| 00037d80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037d80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037d90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037d90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037da0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037da0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037db0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037db0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037dc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037dc0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037dd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037dd0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037de0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037df0:·2861·7320·6f66·2032·3032·3 | 00037df0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037e00:·3 | 00037e00:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037e10:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037e10:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037e20:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037e20:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037e30:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037e30:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037e40:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037e40:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037e50:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037e50:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037e60:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037e60:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037e70:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037e70:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15256, 330 lines modified | Offset 15256, 330 lines modified | ||
| 0003b970:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | 0003b970:·2220·6461·7461·2d74·6172·6765·743d·2223··"·data-target="# | ||
| 0003b980:·6964·6d36·3433·3622·2074·6162·696e·6465··idm6436"·tabinde | 0003b980:·6964·6d36·3433·3622·2074·6162·696e·6465··idm6436"·tabinde | ||
| 0003b990:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | 0003b990:·783d·2230·2220·726f·6c65·3d22·6275·7474··x="0"·role="butt | ||
| 0003b9a0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | 0003b9a0:·6f6e·2220·6172·6961·2d65·7870·616e·6465··on"·aria-expande | ||
| 0003b9b0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | 0003b9b0:·643d·2266·616c·7365·2220·7469·746c·653d··d="false"·title= | ||
| 0003b9c0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | 0003b9c0:·2241·6374·6976·6174·6520·746f·2072·6576··"Activate·to·rev | ||
| 0003b9d0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | 0003b9d0:·6561·6c22·2068·7265·663d·2223·2122·3e52··eal"·href="#!">R | ||
| 0003b9e0:·656d·6564·6961·7469·6f6e·20 | 0003b9e0:·656d·6564·6961·7469·6f6e·2053·6865·6c6c··emediation·Shell | ||
| 0003b9f0:·6c65·2073·6e69·7070·6574·20e2·87b2·3c2f··le·snippet·...</ | |||
| 0003ba00:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003ba10:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003ba20:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003ba30:·646d·3634·3336·223e·3c74·6162·6c65·2063··dm6436"><table·c | |||
| 0003ba40:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003ba50:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003ba60:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003ba70:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003ba80:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003ba90:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | |||
| 0003baa0:·2f74·723e·3c74·723e·3c74·683e·4469·7372··/tr><tr><th>Disr | |||
| 0003bab0:·7570·7469·6f6e·3a3c·2f74·683e·3c74·643e··uption:</th><td> | |||
| 0003bac0:·6d65·6469·756d·3c2f·7464·3e3c·2f74·723e··medium</td></tr> | |||
| 0003bad0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003bae0:·3a3c·2f74·683e·3c74·643e·7265·7374·7269··:</th><td>restri | |||
| 0003baf0:·6374·3c2f·7464·3e3c·2f74·723e·3c2f·7461··ct</td></tr></ta | |||
| 0003b | 0003b9f0:·2073·6372·6970·7420·e287·b23c·2f61·3e3c···script·...</a>< | ||
| 0003ba00:·6272·3e3c·6469·7620·636c·6173·733d·2270··br><div·class="p | |||
| 0003ba10:·616e·656c·2d63·6f6c·6c61·7073·6520·636f··anel-collapse·co | |||
| 0003ba20:·6c6c·6170·7365·2220·6964·3d22·6964·6d36··llapse"·id="idm6 | |||
| 0003ba30:·3433·3622·3e3c·7072·653e·3c63·6f64·653e··436"><pre><code> | |||
| 0003ba40:·0a23·2046·696e·6420·7768·6963·6820·6669··.#·Find·which·fi | |||
| 0003ba50:·6c65·7320·6861·7665·2069·6e63·6f72·7265··les·have·incorre | |||
| 0003ba60:·6374·2068·6173·6820·286e·6f74·2069·6e20··ct·hash·(not·in· | |||
| 0003ba70:·2f65·7463·2c20·6265·6361·7573·6520·6f66··/etc,·because·of | |||
| 0003ba80:·2074·6865·2073·7973·7465·6d20·7265·6c61···the·system·rela | |||
| 0003ba90:·7465·6420·636f·6e66·6967·2066·696c·6573··ted·config·files | |||
| 0003baa0:·2920·616e·6420·7468·656e·2067·6574·2066··)·and·then·get·f | |||
| 0003bab0:·696c·6573·206e·616d·6573·0a66·696c·6573··iles·names.files | |||
| 0003bac0:·5f77·6974·685f·696e·636f·7272·6563·745f··_with_incorrect_ | |||
| 0003bad0:·6861·7368·3d22·2428·7270·6d20·2d56·6120··hash="$(rpm·-Va· | |||
| 0003bae0:·2d2d·6e6f·636f·6e66·6967·207c·2067·7265··--noconfig·|·gre | |||
| 0003baf0:·7020·2d45·2027·5e2e·2e35·2720·7c20·6177··p·-E·'^..5'·|·aw | |||
| 0003bb00:·6b20·277b·7072·696e·7420·244e·467d·2720··k·'{print·$NF}'· | |||
| 0003bb10:·2922·0a0a·2320·4672·6f6d·2066·696c·6573··)"..#·From·files | |||
| 0003bb | 0003bb20:·206e·616d·6573·2067·6574·2070·6163·6b61···names·get·packa | ||
| 0003bb | 0003bb30:·6765·206e·616d·6573·2061·6e64·2063·6861··ge·names·and·cha | ||
| 0003bb40:·6e67·6520·6e65·776c·696e·6520·746f·2073··nge·newline·to·s | |||
| 0003bb50:·7061·6365·2c20·6265·6361·7573·6520·7270··pace,·because·rp | |||
| 0003bb60:·6d20·7772·6974·6573·2065·6163·6820·7061··m·writes·each·pa | |||
| 0003bb70:·636b·6167·6520·746f·206e·6577·206c·696e··ckage·to·new·lin | |||
| 0003bb80:·650a·7061·636b·6167·6573·5f74·6f5f·7265··e.packages_to_re | |||
| 0003bb90:·696e·7374·616c·6c3d·2224·2872·706d·202d··install="$(rpm·- | |||
| 0003bba0:·7166·2024·6669·6c65·735f·7769·7468·5f69··qf·$files_with_i | |||
| 0003bbb0:·6e63·6f72·7265·6374·5f68·6173·6820·7c20··ncorrect_hash·|· | |||
| 0003bbc0:·7472·2027·5c6e·2720·2720·2729·220a·0a0a··tr·'\n'·'·')"... | |||
| 0003bbd0:·7a79·7070·6572·2069·6e73·7461·6c6c·202d··zypper·install·- | |||
| 0003bbe0:·6620·2d79·2024·7061·636b·6167·6573·5f74··f·-y·$packages_t | |||
| 0003bb | 0003bbf0:·6f5f·7265·696e·7374·616c·6c0a·3c2f·636f··o_reinstall.</co | ||
| 0003bc00:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bc10:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bc20:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bc30:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | |||
| 0003bc40:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | |||
| 0003bc50:·646d·3634·3337·2220·7461·6269·6e64·6578··dm6437"·tabindex | |||
| 0003bc60:·3d22·3022·2072·6f6c·653d·2262·7574·746f··="0"·role="butto | |||
| 0003bc70:·6e22·2061·7269·612d·6578·7061·6e64·6564··n"·aria-expanded | |||
| 0003bc80:·3d22·6661·6c73·6522·2074·6974·6c65·3d22··="false"·title=" | |||
| 0003bc90:·4163·7469·7661·7465·2074·6f20·7265·7665··Activate·to·reve | |||
| 0003bca0:·616c·2220·6872·6566·3d22·2321·223e·5265··al"·href="#!">Re | |||
| 0003bcb0:·6d65·6469·6174·696f·6e20·416e·7369·626c··mediation·Ansibl | |||
| 0003bcc0:·6520·736e·6970·7065·7420·e287·b23c·2f61··e·snippet·...</a | |||
| 0003bcd0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003bce0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003bcf0:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003bd00:·6d36·3433·3722·3e3c·7461·626c·6520·636c··m6437"><table·cl | |||
| 0003bd10:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003bd20:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003bd30:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003bd40:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003bd50:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003bd60:·3e3c·7464·3e68·6967·683c·2f74·643e·3c2f··><td>high</td></ | |||
| 0003bd70:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003bd80:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6d··ption:</th><td>m | |||
| 0003bd90:·6564·6975·6d3c·2f74·643e·3c2f·7472·3e3c··edium</td></tr>< | |||
| 0003bda0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003bdb0:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003bdc0:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003bdd0:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003bb40:·616e·6420·2864·6e66·2927·0a20·2073·6574··and·(dnf)'.··set | |||
| 0003bb50:·5f66·6163·743a·0a20·2020·2070·6163·6b61··_fact:.····packa | |||
| 0003bb60:·6765·5f6d·616e·6167·6572·5f72·6569·6e73··ge_manager_reins | |||
| 0003bb70:·7461·6c6c·5f63·6d64·3a20·646e·6620·7265··tall_cmd:·dnf·re | |||
| 0003bb80:·696e·7374·616c·6c20·2d79·0a20·2077·6865··install·-y.··whe | |||
| 0003bb90:·6e3a·2061·6e73·6962·6c65·5f64·6973·7472··n:·ansible_distr | |||
| 0003bba0:·6962·7574·696f·6e20·3d3d·2022·4665·646f··ibution·==·"Fedo | |||
| 0003bbb0:·7261·220a·2020·7461·6773·3a0a·2020·2d20··ra".··tags:.··-· | |||
| 0003bbc0:·4343·452d·3835·3738·382d·380a·2020·2d20··CCE-85788-8.··-· | |||
| 0003bbd0:·434a·4953·2d35·2e31·302e·342e·310a·2020··CJIS-5.10.4.1.·· | |||
| 0003bbe0:·2d20·4e49·5354·2d38·3030·2d31·3731·2d33··-·NIST-800-171-3 | |||
| 0003bbf0:·2e33·2e38·0a20·202d·204e·4953·542d·3830··.3.8.··-·NIST-80 | |||
| 0003bc00:·302d·3137·312d·332e·342e·310a·2020·2d20··0-171-3.4.1.··-· | |||
| 0003bc10:·4e49·5354·2d38·3030·2d35·332d·4155·2d39··NIST-800-53-AU-9 | |||
| 0003bc20:·2833·290a·2020·2d20·4e49·5354·2d38·3030··(3).··-·NIST-800 | |||
| 0003bc30:·2d35·332d·434d·2d36·2863·290a·2020·2d20··-53-CM-6(c).··-· | |||
| 0003bc40:·4e49·5354·2d38·3030·2d35·332d·434d·2d36··NIST-800-53-CM-6 | |||
| 0003bc50:·2864·290a·2020·2d20·4e49·5354·2d38·3030··(d).··-·NIST-800 | |||
| 0003bc60:·2d35·332d·5349·2d37·0a20·202d·204e·4953··-53-SI-7.··-·NIS | |||
| 0003bc70:·542d·3830·302d·3533·2d53·492d·3728·3129··T-800-53-SI-7(1) | |||
| 0003bc80:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 0003bc90:·2d53·492d·3728·3629·0a20·202d·2050·4349··-SI-7(6).··-·PCI | |||
| Max diff block lines reached; 16289623/16335079 bytes (99.72%) of diff not shown. | |||
| Offset 38, 15 lines modified | Offset 38, 15 lines modified | ||
| 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·SUSE·Linux·enterprise·15 | 38 | Profile·Title·PCI-DSS·v3.2.1·Control·Baseline·for·SUSE·Linux·enterprise·15 |
| 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss | 39 | Profile·ID····xccdf_org.ssgproject.content_profile_pci-dss |
| 40 | ***·CPE·Platforms·*** | 40 | ***·CPE·Platforms·*** |
| 41 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 41 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 42 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 42 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 43 | *****·Revision·History·***** | 43 | *****·Revision·History·***** |
| 44 | Current·version:·0.1.65 | 44 | Current·version:·0.1.65 |
| 45 | ····*·draft·(as·of·202 | 45 | ····*·draft·(as·of·2025-02-23) |
| 46 | *****·Table·of·Contents·***** | 46 | *****·Table·of·Contents·***** |
| 47 | ···1.·System_Settings | 47 | ···1.·System_Settings |
| 48 | ·········1.·Installing_and_Maintaining_Software | 48 | ·········1.·Installing_and_Maintaining_Software |
| 49 | ·········2.·Account_and_Access_Control | 49 | ·········2.·Account_and_Access_Control |
| 50 | ·········3.·System_Accounting_with_auditd | 50 | ·········3.·System_Accounting_with_auditd |
| 51 | ·········4.·GRUB2_bootloader_configuration | 51 | ·········4.·GRUB2_bootloader_configuration |
| 52 | ·········5.·Configure_Syslog | 52 | ·········5.·Configure_Syslog |
| Offset 109, 14 lines modified | Offset 109, 25 lines modified | ||
| 109 | ············Identifiers: ·CCE-85788-8 | 109 | ············Identifiers: ·CCE-85788-8 |
| 110 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, | 110 | ············References: ·11,·2,·3,·9,·5.10.4.1,·APO01.06,·BAI03.05,·BAI06.01,·BAI10.01,·BAI10.02,·BAI10.03,·BAI10.05, |
| 111 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 | 111 | Identifiers·DSS06.02,·3.3.8,·3.4.1,·CCI-000366,·CCI-001749,·164.308(a)(1)(ii)(D),·164.312(b),·164.312(c)(1),·164.312 |
| 112 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, | 112 | and·········(c)(2),·164.312(e)(2)(i),·4.3.4.3.2,·4.3.4.3.3,·4.3.4.4.4,·SR_3.1,·SR_3.3,·SR_3.4,·SR_3.8,·SR_7.6, |
| 113 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 | 113 | References··A.11.2.4,·A.12.1.2,·A.12.2.1,·A.12.5.1,·A.12.6.2,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·CM-6 |
| 114 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- | 114 | ············(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·PR.DS-6,·PR.DS-8,·PR.IP-1,·Req-11.5,·SRG-OS-000480-GPOS- |
| 115 | ············00227 | 115 | ············00227 |
| 116 | Remediation_Shell_script_⇲ | ||
| 117 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 118 | names | ||
| 119 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 120 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 121 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 122 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 116 | Remediation_Ansible_snippet_⇲ | 123 | Remediation_Ansible_snippet_⇲ |
| 117 | Complexity:·high | 124 | Complexity:·high |
| 118 | Disruption:·medium | 125 | Disruption:·medium |
| 119 | Strategy:···restrict | 126 | Strategy:···restrict |
| 120 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' | 127 | -·name:·'Set·fact:·Package·manager·reinstall·command·(dnf)' |
| 121 | ··set_fact: | 128 | ··set_fact: |
| 122 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y | 129 | ····package_manager_reinstall_cmd:·dnf·reinstall·-y |
| Offset 266, 25 lines modified | Offset 277, 14 lines modified | ||
| 266 | ··-·PCI-DSS-Req-11.5 | 277 | ··-·PCI-DSS-Req-11.5 |
| 267 | ··-·high_complexity | 278 | ··-·high_complexity |
| 268 | ··-·high_severity | 279 | ··-·high_severity |
| 269 | ··-·medium_disruption | 280 | ··-·medium_disruption |
| 270 | ··-·no_reboot_needed | 281 | ··-·no_reboot_needed |
| 271 | ··-·restrict_strategy | 282 | ··-·restrict_strategy |
| 272 | ··-·rpm_verify_hashes | 283 | ··-·rpm_verify_hashes |
| 273 | Remediation_Shell_script_⇲ | ||
| 274 | #·Find·which·files·have·incorrect·hash·(not·in·/etc,·because·of·the·system·related·config·files)·and·then·get·files | ||
| 275 | names | ||
| 276 | files_with_incorrect_hash="$(rpm·-Va·--noconfig·|·grep·-E·'^..5'·|·awk·'{print·$NF}'·)" | ||
| 277 | #·From·files·names·get·package·names·and·change·newline·to·space,·because·rpm·writes·each·package·to·new·line | ||
| 278 | packages_to_reinstall="$(rpm·-qf·$files_with_incorrect_hash·|·tr·'\n'·'·')" | ||
| 279 | zypper·install·-f·-y·$packages_to_reinstall | ||
| 280 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** | 284 | ***·Rule ·Verify·and·Correct·Ownership·with·RPM· [ref]·*** |
| 281 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many | 285 | The·RPM·package·management·system·can·check·file·ownership·permissions·of·installed·software·packages,·including·many |
| 282 | that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with | 286 | that·are·important·to·system·security.·After·locating·a·file·with·incorrect·permissions,·which·can·be·found·with |
| 283 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' | 287 | rpm·-Va·|·awk·'{·if·(substr($0,6,1)=="U"·||·substr($0,7,1)=="G")·print·$NF·}' |
| 284 | run·the·following·command·to·determine·which·package·owns·it: | 288 | run·the·following·command·to·determine·which·package·owns·it: |
| 285 | $·rpm·-qf·FILENAME | 289 | $·rpm·-qf·FILENAME |
| 286 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: | 290 | Next,·run·the·following·command·to·reset·its·permissions·to·the·correct·values: |
| Offset 334, 14 lines modified | Offset 334, 43 lines modified | ||
| 334 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, | 334 | and·········2.1,·SR_2.10,·SR_2.11,·SR_2.12,·SR_2.8,·SR_2.9,·SR_5.2,·SR_7.6,·A.10.1.1,·A.11.1.4,·A.11.1.5,·A.11.2.1, |
| 335 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, | 335 | References··A.12.1.2,·A.12.4.1,·A.12.4.2,·A.12.4.3,·A.12.4.4,·A.12.5.1,·A.12.6.2,·A.12.7.1,·A.13.1.1,·A.13.1.3, |
| 336 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, | 336 | ············A.13.2.1,·A.13.2.3,·A.13.2.4,·A.14.1.2,·A.14.1.3,·A.14.2.2,·A.14.2.3,·A.14.2.4,·A.6.1.2,·A.7.1.1,·A.7.1.2, |
| 337 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- | 337 | ············A.7.3.1,·A.8.2.2,·A.8.2.3,·A.9.1.1,·A.9.1.2,·A.9.2.3,·A.9.4.1,·A.9.4.4,·A.9.4.5,·CIP-003-8_R4.2,·CIP-003- |
| 338 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- | 338 | ············8_R6,·CIP-007-3_R4,·CIP-007-3_R4.1,·CIP-007-3_R4.2,·CM-6(d),·CM-6(c),·SI-7,·SI-7(1),·SI-7(6),·AU-9(3),·CM- |
| 339 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, | 339 | ············6(a),·PR.AC-4,·PR.DS-5,·PR.IP-1,·PR.PT-1,·Req-11.5,·SRG-OS-000256-GPOS-00097,·SRG-OS-000257-GPOS-00098, |
| 340 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 | 340 | ············SRG-OS-000258-GPOS-00099,·SRG-OS-000278-GPOS-00108,·6.1.1 |
| 341 | Remediation_Shell_script_⇲ | ||
| 342 | Complexity:·high | ||
| 343 | Disruption:·medium | ||
| 344 | Strategy:···restrict | ||
| 345 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 346 | declare·-A·SETPERMS_RPM_DICT | ||
| 347 | #·Create·a·list·of·files·on·the·system·having·permissions·different·from·what | ||
| 348 | #·is·expected·by·the·RPM·database | ||
| 349 | readarray·-t·FILES_WITH_INCORRECT_PERMS·<·<(rpm·-Va·--nofiledigest·|·awk·'{·if·(substr($0,2,1)=="M")·print·$NF·}') | ||
| 350 | for·FILE_PATH·in·"${FILES_WITH_INCORRECT_PERMS[@]}" | ||
| 351 | do | ||
| 352 | ········#·NOTE:·some·files·maybe·controlled·by·more·then·one·package | ||
| 353 | ········readarray·-t·RPM_PACKAGES·<·<(rpm·-qf·"${FILE_PATH}") | ||
| 354 | ········for·RPM_PACKAGE·in·"${RPM_PACKAGES[@]}" | ||
| 355 | ········do | ||
| 356 | ················#·Use·an·associative·array·to·store·packages·as·it's·keys,·not·having·to·care·about·duplicates. | ||
| 357 | ················SETPERMS_RPM_DICT["$RPM_PACKAGE"]=1 | ||
| 358 | ········done | ||
| 359 | done | ||
| 360 | #·For·each·of·the·RPM·packages·left·in·the·list·--·reset·its·permissions·to·the | ||
| 361 | #·correct·values | ||
| 362 | for·RPM_PACKAGE·in·"${!SETPERMS_RPM_DICT[@]}" | ||
| 363 | do | ||
| 364 | » rpm·--restore·"${RPM_PACKAGE}" | ||
| 365 | done | ||
| 341 | Remediation_Ansible_snippet_⇲ | 366 | Remediation_Ansible_snippet_⇲ |
| 342 | Complexity:·high | 367 | Complexity:·high |
| 343 | Disruption:·medium | 368 | Disruption:·medium |
| 344 | Strategy:···restrict | 369 | Strategy:···restrict |
| 345 | -·name:·Read·list·of·files·with·incorrect·permissions | 370 | -·name:·Read·list·of·files·with·incorrect·permissions |
| 346 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev | 371 | ··command:·rpm·-Va·--nodeps·--nosignature·--nofiledigest·--nosize·--nomtime·--nordev |
| 347 | ····--nocaps·--nolinkto·--nouser·--nogroup | 372 | ····--nocaps·--nolinkto·--nouser·--nogroup |
| Offset 418, 43 lines modified | Offset 447, 14 lines modified | ||
| 418 | ··-·PCI-DSS-Req-11.5 | 447 | ··-·PCI-DSS-Req-11.5 |
| 419 | ··-·high_complexity | 448 | ··-·high_complexity |
| 420 | ··-·high_severity | 449 | ··-·high_severity |
| 421 | ··-·medium_disruption | 450 | ··-·medium_disruption |
| 422 | ··-·no_reboot_needed | 451 | ··-·no_reboot_needed |
| 423 | ··-·restrict_strategy | 452 | ··-·restrict_strategy |
| 424 | ··-·rpm_verify_permissions | 453 | ··-·rpm_verify_permissions |
| 425 | Remediation_Shell_script_⇲ | ||
| 426 | Complexity:·high | ||
| 427 | Disruption:·medium | ||
| 428 | Strategy:···restrict | ||
| 429 | #·Declare·array·to·hold·set·of·RPM·packages·we·need·to·correct·permissions·for | ||
| 430 | declare·-A·SETPERMS_RPM_DICT | ||
| Max diff block lines reached; 1127336/1133986 bytes (99.41%) of diff not shown. | |||
| Offset 14313, 16 lines modified | Offset 14313, 16 lines modified | ||
| 00037e80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | 00037e80:·6e20·4869·7374·6f72·793c·2f68·323e·3c70··n·History</h2><p | ||
| 00037e90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | 00037e90:·3e43·7572·7265·6e74·2076·6572·7369·6f6e··>Current·version | ||
| 00037ea0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | 00037ea0:·3a20·3c73·7472·6f6e·673e·302e·312e·3635··:·<strong>0.1.65 | ||
| 00037eb0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | 00037eb0:·3c2f·7374·726f·6e67·3e3c·2f70·3e3c·756c··</strong></p><ul | ||
| 00037ec0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | 00037ec0:·3e3c·6c69·3e3c·7374·726f·6e67·3e64·7261··><li><strong>dra | ||
| 00037ed0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | 00037ed0:·6674·3c2f·7374·726f·6e67·3e0a·2020·2020··ft</strong>.···· | ||
| 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037ee0:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037ef0:·2861·7320·6f66·2032·3032·3 | 00037ef0:·2861·7320·6f66·2032·3032·352d·3032·2d32··(as·of·2025-02-2 | ||
| 00037f00:·3 | 00037f00:·3329·0a20·2020·2020·2020·2020·2020·2020··3).············· | ||
| 00037f10:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | 00037f10:·2020·203c·2f6c·693e·3c2f·756c·3e3c·2f64·····</li></ul></d | ||
| 00037f20:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | 00037f20:·6976·3e3c·6832·3e54·6162·6c65·206f·6620··iv><h2>Table·of· | ||
| 00037f30:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | 00037f30:·436f·6e74·656e·7473·3c2f·6832·3e3c·6f6c··Contents</h2><ol | ||
| 00037f40:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | 00037f40:·3e3c·6c69·3e3c·6120·6872·6566·3d22·2378··><li><a·href="#x | ||
| 00037f50:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | 00037f50:·6363·6466·5f6f·7267·2e73·7367·7072·6f6a··ccdf_org.ssgproj | ||
| 00037f60:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | 00037f60:·6563·742e·636f·6e74·656e·745f·6772·6f75··ect.content_grou | ||
| 00037f70:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | 00037f70:·705f·7379·7374·656d·223e·5379·7374·656d··p_system">System | ||
| Offset 15286, 123 lines modified | Offset 15286, 123 lines modified | ||
| 0003bb50:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | 0003bb50:·7365·2220·6461·7461·2d74·6172·6765·743d··se"·data-target= | ||
| 0003bb60:·2223·6964·6d36·3737·3422·2074·6162·696e··"#idm6774"·tabin | 0003bb60:·2223·6964·6d36·3737·3422·2074·6162·696e··"#idm6774"·tabin | ||
| 0003bb70:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | 0003bb70:·6465·783d·2230·2220·726f·6c65·3d22·6275··dex="0"·role="bu | ||
| 0003bb80:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | 0003bb80:·7474·6f6e·2220·6172·6961·2d65·7870·616e··tton"·aria-expan | ||
| 0003bb90:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | 0003bb90:·6465·643d·2266·616c·7365·2220·7469·746c··ded="false"·titl | ||
| 0003bba0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | 0003bba0:·653d·2241·6374·6976·6174·6520·746f·2072··e="Activate·to·r | ||
| 0003bbb0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | 0003bbb0:·6576·6561·6c22·2068·7265·663d·2223·2122··eveal"·href="#!" | ||
| 0003bbc0:·3e52·656d·6564·6961·7469·6f6e·20 | 0003bbc0:·3e52·656d·6564·6961·7469·6f6e·2053·6865··>Remediation·She | ||
| 0003bbd0:·6c6c·2073·6372·6970·7420·e287·b23c·2f61··ll·script·...</a | |||
| 0003bbe0:·3e3c·6272·3e3c·6469·7620·636c·6173·733d··><br><div·class= | |||
| 0003bbf0:·2270·616e·656c·2d63·6f6c·6c61·7073·6520··"panel-collapse· | |||
| 0003bc00:·636f·6c6c·6170·7365·2220·6964·3d22·6964··collapse"·id="id | |||
| 0003bc10:·6d36·3737·3422·3e3c·7461·626c·6520·636c··m6774"><table·cl | |||
| 0003bc20:·6173·733d·2274·6162·6c65·2074·6162·6c65··ass="table·table | |||
| 0003bc30:·2d73·7472·6970·6564·2074·6162·6c65·2d62··-striped·table-b | |||
| 0003bc40:·6f72·6465·7265·6420·7461·626c·652d·636f··ordered·table-co | |||
| 0003bc50:·6e64·656e·7365·6422·3e3c·7472·3e3c·7468··ndensed"><tr><th | |||
| 0003bc60:·3e43·6f6d·706c·6578·6974·793a·3c2f·7468··>Complexity:</th | |||
| 0003bbd0:·6962·6c65·2073·6e69·7070·6574·20e2·87b2··ible·snippet·... | |||
| 0003bbe0:·3c2f·613e·3c62·723e·3c64·6976·2063·6c61··</a><br><div·cla | |||
| 0003bbf0:·7373·3d22·7061·6e65·6c2d·636f·6c6c·6170··ss="panel-collap | |||
| 0003bc00:·7365·2063·6f6c·6c61·7073·6522·2069·643d··se·collapse"·id= | |||
| 0003bc10:·2269·646d·3637·3734·223e·3c74·6162·6c65··"idm6774"><table | |||
| 0003bc20:·2063·6c61·7373·3d22·7461·626c·6520·7461···class="table·ta | |||
| 0003bc30:·626c·652d·7374·7269·7065·6420·7461·626c··ble-striped·tabl | |||
| 0003bc40:·652d·626f·7264·6572·6564·2074·6162·6c65··e-bordered·table | |||
| 0003bc50:·2d63·6f6e·6465·6e73·6564·223e·3c74·723e··-condensed"><tr> | |||
| 0003bc60:·3c74·683e·436f·6d70·6c65·7869·7479·3a3c··<th>Complexity:< | |||
| 0003bc70:·2f74·683e·3c74·643e·6c6f·773c·2f74·643e··/th><td>low</td> | |||
| 0003bc80:·3c2f·7472·3e3c·7472·3e3c·7468·3e44·6973··</tr><tr><th>Dis | |||
| 0003bc90:·7275·7074·696f·6e3a·3c2f·7468·3e3c·7464··ruption:</th><td | |||
| 0003bc | 0003bc70:·3e3c·7464·3e6c·6f77·3c2f·7464·3e3c·2f74··><td>low</td></t | ||
| 0003bc80:·723e·3c74·723e·3c74·683e·4469·7372·7570··r><tr><th>Disrup | |||
| 0003bc90:·7469·6f6e·3a3c·2f74·683e·3c74·643e·6c6f··tion:</th><td>lo | |||
| 0003bca0:·773c·2f74·643e·3c2f·7472·3e3c·7472·3e3c··w</td></tr><tr>< | |||
| 0003bcb0:·7468·3e53·7472·6174·6567·793a·3c2f·7468··th>Strategy:</th | |||
| 0003bcc0:·3e3c·7464·3e65·6e61·626c·653c·2f74·643e··><td>enable</td> | |||
| 0003bcd0:·3c2f·7472·3e3c·2f74·6162·6c65·3e3c·7072··</tr></table><pr | |||
| 0003bce0:·653e·3c63·6f64·653e·2320·5265·6d65·6469··e><code>#·Remedi | |||
| 0003bcf0:·6174·696f·6e20·6973·2061·7070·6c69·6361··ation·is·applica | |||
| 0003bd00:·626c·6520·6f6e·6c79·2069·6e20·6365·7274··ble·only·in·cert | |||
| 0003bd10:·6169·6e20·706c·6174·666f·726d·730a·6966··ain·platforms.if | |||
| 0003bd20:·205b·2021·202d·6620·2f2e·646f·636b·6572···[·!·-f·/.docker | |||
| 0003bd30:·656e·7620·5d20·2661·6d70·3b26·616d·703b··env·]·&& | |||
| 0003bd40:·205b·2021·202d·6620·2f72·756e·2f2e·636f···[·!·-f·/run/.co | |||
| 0003bd50:·6e74·6169·6e65·7265·6e76·205d·3b20·7468··ntainerenv·];·th | |||
| 0003bd60:·656e·0a0a·7a79·7070·6572·2069·6e73·7461··en..zypper·insta | |||
| 0003bd70:·6c6c·202d·7920·2261·6964·6522·0a0a·656c··ll·-y·"aide"..el | |||
| 0003bd80:·7365·0a20·2020·2026·6774·3b26·616d·703b··se.····>& | |||
| 0003bd90:·3220·6563·686f·2027·5265·6d65·6469·6174··2·echo·'Remediat | |||
| 0003bda0:·696f·6e20·6973·206e·6f74·2061·7070·6c69··ion·is·not·appli | |||
| 0003bdb0:·6361·626c·652c·206e·6f74·6869·6e67·2077··cable,·nothing·w | |||
| 0003bdc0:·6173·2064·6f6e·6527·0a66·690a·3c2f·636f··as·done'.fi.</co | |||
| 0003bdd0:·6465·3e3c·2f70·7265·3e3c·2f64·6976·3e3c··de></pre></div>< | |||
| 0003bde0:·6120·636c·6173·733d·2262·746e·2062·746e··a·class="btn·btn | |||
| 0003bdf0:·2d73·7563·6365·7373·2220·6461·7461·2d74··-success"·data-t | |||
| 0003bcb0:·723e·3c74·683e·5374·7261·7465·6779·3a3c··r><th>Strategy:< | |||
| 0003bcc0:·2f74·683e·3c74·643e·656e·6162·6c65·3c2f··/th><td>enable</ | |||
| 0003bcd0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003bce0:·3c70·7265·3e3c·636f·6465·3e2d·206e·616d··<pre><code>-·nam | |||
| 0003bcf0:·653a·2045·6e73·7572·6520·6169·6465·2069··e:·Ensure·aide·i | |||
| 0003bd00:·7320·696e·7374·616c·6c65·640a·2020·7061··s·installed.··pa | |||
| 0003bd10:·636b·6167·653a·0a20·2020·206e·616d·653a··ckage:.····name: | |||
| 0003bd20:·2061·6964·650a·2020·2020·7374·6174·653a···aide.····state: | |||
| 0003bd30:·2070·7265·7365·6e74·0a20·2077·6865·6e3a···present.··when: | |||
| 0003bd40:·2061·6e73·6962·6c65·5f76·6972·7475·616c···ansible_virtual | |||
| 0003bd50:·697a·6174·696f·6e5f·7479·7065·206e·6f74··ization_type·not | |||
| 0003bd60:·2069·6e20·5b22·646f·636b·6572·222c·2022···in·["docker",·" | |||
| 0003bd70:·6c78·6322·2c20·226f·7065·6e76·7a22·2c20··lxc",·"openvz",· | |||
| 0003bd80:·2270·6f64·6d61·6e22·2c20·2263·6f6e·7461··"podman",·"conta | |||
| 0003bd90:·696e·6572·225d·0a20·2074·6167·733a·0a20··iner"].··tags:.· | |||
| 0003bda0:·202d·2043·4345·2d38·3332·3839·2d39·0a20···-·CCE-83289-9.· | |||
| 0003bdb0:·202d·2043·4a49·532d·352e·3130·2e31·2e33···-·CJIS-5.10.1.3 | |||
| 0003bdc0:·0a20·202d·2044·4953·412d·5354·4947·2d53··.··-·DISA-STIG-S | |||
| 0003bdd0:·4c45·532d·3135·2d30·3130·3432·300a·2020··LES-15-010420.·· | |||
| 0003bde0:·2d20·4e49·5354·2d38·3030·2d35·332d·434d··-·NIST-800-53-CM | |||
| 0003bdf0:·2d36·2861·290a·2020·2d20·5043·492d·4453··-6(a).··-·PCI-DS | |||
| 0003be00:·532d·5265·712d·3131·2e35·0a20·202d·2065··S-Req-11.5.··-·e | |||
| 0003be10:·6e61·626c·655f·7374·7261·7465·6779·0a20··nable_strategy.· | |||
| 0003be20:·202d·206c·6f77·5f63·6f6d·706c·6578·6974···-·low_complexit | |||
| 0003be30:·790a·2020·2d20·6c6f·775f·6469·7372·7570··y.··-·low_disrup | |||
| 0003be40:·7469·6f6e·0a20·202d·206d·6564·6975·6d5f··tion.··-·medium_ | |||
| 0003be50:·7365·7665·7269·7479·0a20·202d·206e·6f5f··severity.··-·no_ | |||
| 0003be60:·7265·626f·6f74·5f6e·6565·6465·640a·2020··reboot_needed.·· | |||
| 0003be70:·2d20·7061·636b·6167·655f·6169·6465·5f69··-·package_aide_i | |||
| 0003be80:·6e73·7461·6c6c·6564·0a3c·2f63·6f64·653e··nstalled.</code> | |||
| 0003be90:·3c2f·7072·653e·3c2f·6469·763e·3c61·2063··</pre></div><a·c | |||
| 0003bea0:·6c61·7373·3d22·6274·6e20·6274·6e2d·7375··lass="btn·btn-su | |||
| 0003beb0:·6363·6573·7322·2064·6174·612d·746f·6767··ccess"·data-togg | |||
| 0003bec0:·6c65·3d22·636f·6c6c·6170·7365·2220·6461··le="collapse"·da | |||
| 0003bed0:·7461·2d74·6172·6765·743d·2223·6964·6d36··ta-target="#idm6 | |||
| 0003bee0:·3737·3522·2074·6162·696e·6465·783d·2230··775"·tabindex="0 | |||
| 0003bef0:·2220·726f·6c65·3d22·6275·7474·6f6e·2220··"·role="button"· | |||
| 0003bf00:·6172·6961·2d65·7870·616e·6465·643d·2266··aria-expanded="f | |||
| 0003bf10:·616c·7365·2220·7469·746c·653d·2241·6374··alse"·title="Act | |||
| 0003bf20:·6976·6174·6520·746f·2072·6576·6561·6c22··ivate·to·reveal" | |||
| 0003bf30:·2068·7265·663d·2223·2122·3e52·656d·6564···href="#!">Remed | |||
| 0003bf40:·6961·7469·6f6e·204f·5342·7569·6c64·2042··iation·OSBuild·B | |||
| 0003bf50:·6c75·6570·7269·6e74·2073·6e69·7070·6574··lueprint·snippet | |||
| 0003bf60:·20e2·87b2·3c2f·613e·3c62·723e·3c64·6976···...</a><br><div | |||
| 0003bf70:·2063·6c61·7373·3d22·7061·6e65·6c2d·636f···class="panel-co | |||
| 0003b | 0003be00:·6f67·676c·653d·2263·6f6c·6c61·7073·6522··oggle="collapse" | ||
| 0003bf90:·2069·643d·2269·646d·3637·3735·223e·3c70···id="idm6775"><p | |||
| 0003bfa0:·7265·3e3c·636f·6465·3e0a·5b5b·7061·636b··re><code>.[[pack | |||
| 0003bfb0:·6167·6573·5d5d·0a6e·616d·6520·3d20·2261··ages]].name·=·"a | |||
| 0003bfc0:·6964·6522·0a76·6572·7369·6f6e·203d·2022··ide".version·=·" | |||
| 0003bfd0:·2a22·0a3c·2f63·6f64·653e·3c2f·7072·653e··*".</code></pre> | |||
| 0003bfe0:·3c2f·6469·763e·3c61·2063·6c61·7373·3d22··</div><a·class=" | |||
| 0003bff0:·6274·6e20·6274·6e2d·7375·6363·6573·7322··btn·btn-success" | |||
| 0003 | 0003be10:·2064·6174·612d·7461·7267·6574·3d22·2369···data-target="#i | ||
| Max diff block lines reached; 20365602/20382492 bytes (99.92%) of diff not shown. | |||
| Offset 14300, 15 lines modified | Offset 14300, 15 lines modified | ||
| 00037db0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | 00037db0:·4869·7374·6f72·793c·2f68·323e·3c70·3e43··History</h2><p>C | ||
| 00037dc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | 00037dc0:·7572·7265·6e74·2076·6572·7369·6f6e·3a20··urrent·version:· | ||
| 00037dd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | 00037dd0:·3c73·7472·6f6e·673e·302e·312e·3635·3c2f··<strong>0.1.65</ | ||
| 00037de0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | 00037de0:·7374·726f·6e67·3e3c·2f70·3e3c·756c·3e3c··strong></p><ul>< | ||
| 00037df0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | 00037df0:·6c69·3e3c·7374·726f·6e67·3e64·7261·6674··li><strong>draft | ||
| 00037e00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | 00037e00:·3c2f·7374·726f·6e67·3e0a·2020·2020·2020··</strong>.······ | ||
| 00037e10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | 00037e10:·2020·2020·2020·2020·2020·2020·2020·2861················(a | ||
| 00037e20:·7320·6f66·2032·3032·3 | 00037e20:·7320·6f66·2032·3032·352d·3032·2d32·3329··s·of·2025-02-23) | ||
| 00037e30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | 00037e30:·0a20·2020·2020·2020·2020·2020·2020·2020··.··············· | ||
| 00037e40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | 00037e40:·203c·2f6c·693e·3c2f·756c·3e3c·2f64·6976···</li></ul></div | ||
| 00037e50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | 00037e50:·3e3c·6832·3e54·6162·6c65·206f·6620·436f··><h2>Table·of·Co | ||
| 00037e60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | 00037e60:·6e74·656e·7473·3c2f·6832·3e3c·6f6c·3e3c··ntents</h2><ol>< | ||
| 00037e70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | 00037e70:·6c69·3e3c·6120·6872·6566·3d22·2378·6363··li><a·href="#xcc | ||
| 00037e80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | 00037e80:·6466·5f6f·7267·2e73·7367·7072·6f6a·6563··df_org.ssgprojec | ||
| 00037e90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | 00037e90:·742e·636f·6e74·656e·745f·6772·6f75·705f··t.content_group_ | ||
| Offset 14983, 323 lines modified | Offset 14983, 323 lines modified | ||
| 0003a860:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | 0003a860:·7073·6522·2064·6174·612d·7461·7267·6574··pse"·data-target | ||
| 0003a870:·3d22·2369·646d·3638·3736·2220·7461·6269··="#idm6876"·tabi | 0003a870:·3d22·2369·646d·3638·3736·2220·7461·6269··="#idm6876"·tabi | ||
| 0003a880:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | 0003a880:·6e64·6578·3d22·3022·2072·6f6c·653d·2262··ndex="0"·role="b | ||
| 0003a890:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | 0003a890:·7574·746f·6e22·2061·7269·612d·6578·7061··utton"·aria-expa | ||
| 0003a8a0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | 0003a8a0:·6e64·6564·3d22·6661·6c73·6522·2074·6974··nded="false"·tit | ||
| 0003a8b0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | 0003a8b0:·6c65·3d22·4163·7469·7661·7465·2074·6f20··le="Activate·to· | ||
| 0003a8c0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | 0003a8c0:·7265·7665·616c·2220·6872·6566·3d22·2321··reveal"·href="#! | ||
| 0003a8d0:·223e·5265·6d65·6469·6174·696f·6e20· | 0003a8d0:·223e·5265·6d65·6469·6174·696f·6e20·5368··">Remediation·Sh | ||
| 0003a8e0:·656c·6c20·7363·7269·7074·20e2·87b2·3c2f··ell·script·...</ | |||
| 0003a8f0:·613e·3c62·723e·3c64·6976·2063·6c61·7373··a><br><div·class | |||
| 0003a900:·3d22·7061·6e65·6c2d·636f·6c6c·6170·7365··="panel-collapse | |||
| 0003a910:·2063·6f6c·6c61·7073·6522·2069·643d·2269···collapse"·id="i | |||
| 0003a920:·646d·3638·3736·223e·3c74·6162·6c65·2063··dm6876"><table·c | |||
| 0003a930:·6c61·7373·3d22·7461·626c·6520·7461·626c··lass="table·tabl | |||
| 0003a940:·652d·7374·7269·7065·6420·7461·626c·652d··e-striped·table- | |||
| 0003a950:·626f·7264·6572·6564·2074·6162·6c65·2d63··bordered·table-c | |||
| 0003a960:·6f6e·6465·6e73·6564·223e·3c74·723e·3c74··ondensed"><tr><t | |||
| 0003a970:·683e·436f·6d70·6c65·7869·7479·3a3c·2f74··h>Complexity:</t | |||
| 0003a8e0:·7369·626c·6520·736e·6970·7065·7420·e287··sible·snippet·.. | |||
| 0003a8f0:·b23c·2f61·3e3c·6272·3e3c·6469·7620·636c··.</a><br><div·cl | |||
| 0003a900:·6173·733d·2270·616e·656c·2d63·6f6c·6c61··ass="panel-colla | |||
| 0003a910:·7073·6520·636f·6c6c·6170·7365·2220·6964··pse·collapse"·id | |||
| 0003a920:·3d22·6964·6d36·3837·3622·3e3c·7461·626c··="idm6876"><tabl | |||
| 0003a930:·6520·636c·6173·733d·2274·6162·6c65·2074··e·class="table·t | |||
| 0003a940:·6162·6c65·2d73·7472·6970·6564·2074·6162··able-striped·tab | |||
| 0003a950:·6c65·2d62·6f72·6465·7265·6420·7461·626c··le-bordered·tabl | |||
| 0003a960:·652d·636f·6e64·656e·7365·6422·3e3c·7472··e-condensed"><tr | |||
| 0003a970:·3e3c·7468·3e43·6f6d·706c·6578·6974·793a··><th>Complexity: | |||
| 0003a980:·3c2f·7468·3e3c·7464·3e6c·6f77·3c2f·7464··</th><td>low</td | |||
| 0003a990:·3e3c·2f74·723e·3c74·723e·3c74·683e·4469··></tr><tr><th>Di | |||
| 0003a9a0:·7372·7570·7469·6f6e·3a3c·2f74·683e·3c74··sruption:</th><t | |||
| 0003a9 | 0003a980:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | ||
| 0003a990:·7472·3e3c·7472·3e3c·7468·3e44·6973·7275··tr><tr><th>Disru | |||
| 0003a9a0:·7074·696f·6e3a·3c2f·7468·3e3c·7464·3e6c··ption:</th><td>l | |||
| 0003a9b0:·6f77·3c2f·7464·3e3c·2f74·723e·3c74·723e··ow</td></tr><tr> | |||
| 0003a9c0:·3c74·683e·5374·7261·7465·6779·3a3c·2f74··<th>Strategy:</t | |||
| 0003a9d0:·683e·3c74·643e·7265·7374·7269·6374·3c2f··h><td>restrict</ | |||
| 0003a9e0:·7464·3e3c·2f74·723e·3c2f·7461·626c·653e··td></tr></table> | |||
| 0003a9f0:·3c70·7265·3e3c·636f·6465·3e23·2052·656d··<pre><code>#·Rem | |||
| 0003aa00:·6564·6961·7469·6f6e·2069·7320·6170·706c··ediation·is·appl | |||
| 0003aa10:·6963·6162·6c65·206f·6e6c·7920·696e·2063··icable·only·in·c | |||
| 0003aa20:·6572·7461·696e·2070·6c61·7466·6f72·6d73··ertain·platforms | |||
| 0003aa30:·0a69·6620·5b20·2120·2d66·202f·2e64·6f63··.if·[·!·-f·/.doc | |||
| 0003aa40:·6b65·7265·6e76·205d·2026·616d·703b·2661··kerenv·]·&&a | |||
| 0003aa50:·6d70·3b20·5b20·2120·2d66·202f·7275·6e2f··mp;·[·!·-f·/run/ | |||
| 0003aa60:·2e63·6f6e·7461·696e·6572·656e·7620·5d3b··.containerenv·]; | |||
| 0003aa70:·2074·6865·6e0a·0a7a·7970·7065·7220·696e···then..zypper·in | |||
| 0003aa80:·7374·616c·6c20·2d79·2022·6169·6465·220a··stall·-y·"aide". | |||
| 0003aa90:·0a0a·0a0a·0a0a·0a0a·0a0a·6966·2067·7265··..........if·gre | |||
| 0003aaa0:·7020·2d69·2027·5e2e·2a2f·7573·722f·7362··p·-i·'^.*/usr/sb | |||
| 0003aab0:·696e·2f61·7564·6974·6374·6c2e·2a24·2720··in/auditctl.*$'· | |||
| 0003aac0:·2f65·7463·2f61·6964·652e·636f·6e66·3b20··/etc/aide.conf;· | |||
| 0003aad0:·7468·656e·0a73·6564·202d·6920·2273·232e··then.sed·-i·"s#. | |||
| 0003a9c0:·7472·3e3c·7468·3e53·7472·6174·6567·793a··tr><th>Strategy: | |||
| 0003a9d0:·3c2f·7468·3e3c·7464·3e72·6573·7472·6963··</th><td>restric | |||
| 0003a9e0:·743c·2f74·643e·3c2f·7472·3e3c·2f74·6162··t</td></tr></tab | |||
| 0003a9f0:·6c65·3e3c·7072·653e·3c63·6f64·653e·2d20··le><pre><code>-· | |||
| 0003aa00:·6e61·6d65·3a20·456e·7375·7265·2061·6964··name:·Ensure·aid | |||
| 0003aa10:·6520·6973·2069·6e73·7461·6c6c·6564·0a20··e·is·installed.· | |||
| 0003aa20:·2070·6163·6b61·6765·3a0a·2020·2020·6e61···package:.····na | |||
| 0003aa30:·6d65·3a20·277b·7b20·6974·656d·207d·7d27··me:·'{{·item·}}' | |||
| 0003aa40:·0a20·2020·2073·7461·7465·3a20·7072·6573··.····state:·pres | |||
| 0003aa50:·656e·740a·2020·7769·7468·5f69·7465·6d73··ent.··with_items | |||
| 0003aa60:·3a0a·2020·2d20·6169·6465·0a20·2077·6865··:.··-·aide.··whe | |||
| 0003aa70:·6e3a·2061·6e73·6962·6c65·5f76·6972·7475··n:·ansible_virtu | |||
| 0003aa80:·616c·697a·6174·696f·6e5f·7479·7065·206e··alization_type·n | |||
| 0003aa90:·6f74·2069·6e20·5b22·646f·636b·6572·222c··ot·in·["docker", | |||
| 0003aaa0:·2022·6c78·6322·2c20·226f·7065·6e76·7a22···"lxc",·"openvz" | |||
| 0003aab0:·2c20·2270·6f64·6d61·6e22·2c20·2263·6f6e··,·"podman",·"con | |||
| 0003aac0:·7461·696e·6572·225d·0a20·2074·6167·733a··tainer"].··tags: | |||
| 0003aad0:·0a20·202d·2043·4345·2d38·3536·3130·2d34··.··-·CCE-85610-4 | |||
| 0003aae0:·0a20·202d·2044·4953·412d·5354·4947·2d53··.··-·DISA-STIG-S | |||
| 0003aaf0:·4c45·532d·3135·2d30·3330·3633·300a·2020··LES-15-030630.·· | |||
| 0003ab00:·2d20·4e49·5354·2d38·3030·2d35·332d·4155··-·NIST-800-53-AU | |||
| 0003ab10:·2d39·2833·290a·2020·2d20·4e49·5354·2d38··-9(3).··-·NIST-8 | |||
| 0003ab20:·3030·2d35·332d·4155·2d39·2833·292e·310a··00-53-AU-9(3).1. | |||
| 0003ab30:·2020·2d20·6169·6465·5f63·6865·636b·5f61····-·aide_check_a | |||
| 0003ab40:·7564·6974·5f74·6f6f·6c73·0a20·202d·206c··udit_tools.··-·l | |||
| 0003ab50:·6f77·5f63·6f6d·706c·6578·6974·790a·2020··ow_complexity.·· | |||
| 0003ab60:·2d20·6c6f·775f·6469·7372·7570·7469·6f6e··-·low_disruption | |||
| 0003ab70:·0a20·202d·206d·6564·6975·6d5f·7365·7665··.··-·medium_seve | |||
| 0003ab80:·7269·7479·0a20·202d·206e·6f5f·7265·626f··rity.··-·no_rebo | |||
| 0003ab90:·6f74·5f6e·6565·6465·640a·2020·2d20·7265··ot_needed.··-·re | |||
| 0003aba0:·7374·7269·6374·5f73·7472·6174·6567·790a··strict_strategy. | |||
| 0003abb0:·0a2d·206e·616d·653a·2053·6574·2061·7564··.-·name:·Set·aud | |||
| 0003abc0:·6974·5f74·6f6f·6c73·2066·6163·740a·2020··it_tools·fact.·· | |||
| 0003abd0:·7365·745f·6661·6374·3a0a·2020·2020·6175··set_fact:.····au | |||
| 0003abe0:·6469·745f·746f·6f6c·733a·0a20·2020·202d··dit_tools:.····- | |||
| 0003a | 0003aae0:·2a2f·7573·722f·7362·696e·2f61·7564·6974··*/usr/sbin/audit | ||
| 0003a | 0003aaf0:·6374·6c2e·2a23·2f75·7372·2f73·6269·6e2f··ctl.*#/usr/sbin/ | ||
| 0003ab00:·6175·6469·7463·746c·2070·2b69·2b6e·2b75··auditctl·p+i+n+u | |||
| 0003ab10:·2b67·2b73·2b62·2b61·636c·2b73·656c·696e··+g+s+b+acl+selin | |||
| 0003ab20:·7578·2b78·6174·7472·732b·7368·6135·3132··ux+xattrs+sha512 | |||
| 0003ab30:·2322·202f·6574·632f·6169·6465·2e63·6f6e··#"·/etc/aide.con | |||
| 0003ab40:·660a·656c·7365·0a65·6368·6f20·222f·7573··f.else.echo·"/us | |||
| 0003a | 0003ab50:·722f·7362·696e·2f61·7564·6974·6374·6c20··r/sbin/auditctl· | ||
| 0003ab60:·702b·692b·6e2b·752b·672b·732b·622b·6163··p+i+n+u+g+s+b+ac | |||
| 0003ab70:·6c2b·7365·6c69·6e75·782b·7861·7474·7273··l+selinux+xattrs | |||
| 0003ab80:·2b73·6861·3531·3222·2026·6774·3b26·6774··+sha512"·>> | |||
| 0003ab90:·3b20·2f65·7463·2f61·6964·652e·636f·6e66··;·/etc/aide.conf | |||
| 0003aba0:·0a66·690a·0a69·6620·6772·6570·202d·6920··.fi..if·grep·-i· | |||
| 0003abb0:·275e·2e2a·2f75·7372·2f73·6269·6e2f·6175··'^.*/usr/sbin/au | |||
| 0003abc0:·6469·7464·2e2a·2427·202f·6574·632f·6169··ditd.*$'·/etc/ai | |||
| 0003abd0:·6465·2e63·6f6e·663b·2074·6865·6e0a·7365··de.conf;·then.se | |||
| 0003abe0:·6420·2d69·2022·7323·2e2a·2f75·7372·2f73··d·-i·"s#.*/usr/s | |||
| 0003abf0:·6269·6e2f·6175·6469·7464·2e2a·232f·7573··bin/auditd.*#/us | |||
| 0003ac00:·722f·7362·696e·2f61·7564·6974·6420·702b··r/sbin/auditd·p+ | |||
| 0003ac10:·692b·6e2b·752b·672b·732b·622b·6163·6c2b··i+n+u+g+s+b+acl+ | |||
| 0003ac20:·7365·6c69·6e75·782b·7861·7474·7273·2b73··selinux+xattrs+s | |||
| 0003ac30:·6861·3531·3223·2220·2f65·7463·2f61·6964··ha512#"·/etc/aid | |||
| 0003ac40:·652e·636f·6e66·0a65·6c73·650a·6563·686f··e.conf.else.echo | |||
| Max diff block lines reached; 20362575/20406927 bytes (99.78%) of diff not shown. | |||
| Offset 14306, 16 lines modified | Offset 14306, 16 lines modified | ||
| 00037e10:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | 00037e10:·696f·6e20·4869·7374·6f72·793c·2f68·323e··ion·History</h2> | ||
| 00037e20:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | 00037e20:·3c70·3e43·7572·7265·6e74·2076·6572·7369··<p>Current·versi | ||
| 00037e30:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | 00037e30:·6f6e·3a20·3c73·7472·6f6e·673e·302e·312e··on:·<strong>0.1. | ||
| 00037e40:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | 00037e40:·3635·3c2f·7374·726f·6e67·3e3c·2f70·3e3c··65</strong></p>< | ||
| 00037e50:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | 00037e50:·756c·3e3c·6c69·3e3c·7374·726f·6e67·3e64··ul><li><strong>d | ||
| 00037e60:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | 00037e60:·7261·6674·3c2f·7374·726f·6e67·3e0a·2020··raft</strong>.·· | ||
| 00037e70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | 00037e70:·2020·2020·2020·2020·2020·2020·2020·2020·················· | ||
| 00037e80:·2020·2861·7320·6f66·2032·3032·3 | 00037e80:·2020·2861·7320·6f66·2032·3032·352d·3032····(as·of·2025-02 | ||
| 00037e90:·2d32·3 | 00037e90:·2d32·3329·0a20·2020·2020·2020·2020·2020··-23).··········· | ||
| 00037ea0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | 00037ea0:·2020·2020·203c·2f6c·693e·3c2f·756c·3e3c·······</li></ul>< | ||
| 00037eb0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | 00037eb0:·2f64·6976·3e3c·6832·3e54·6162·6c65·206f··/div><h2>Table·o | ||
| 00037ec0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | 00037ec0:·6620·436f·6e74·656e·7473·3c2f·6832·3e3c··f·Contents</h2>< | ||
| 00037ed0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | 00037ed0:·6f6c·3e3c·6c69·3e3c·6120·6872·6566·3d22··ol><li><a·href=" | ||
| 00037ee0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | 00037ee0:·2378·6363·6466·5f6f·7267·2e73·7367·7072··#xccdf_org.ssgpr | ||
| 00037ef0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | 00037ef0:·6f6a·6563·742e·636f·6e74·656e·745f·6772··oject.content_gr | ||
| 00037f00:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | 00037f00:·6f75·705f·7379·7374·656d·223e·5379·7374··oup_system">Syst | ||
| Offset 17402, 94 lines modified | Offset 17402, 94 lines modified | ||
| 00043f90:·2d74·6172·6765·743d·2223·6964·6d39·3738··-target="#idm978 | 00043f90:·2d74·6172·6765·743d·2223·6964·6d39·3738··-target="#idm978 | ||
| 00043fa0:·3022·2074·6162·696e·6465·783d·2230·2220··0"·tabindex="0"· | 00043fa0:·3022·2074·6162·696e·6465·783d·2230·2220··0"·tabindex="0"· | ||
| 00043fb0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | 00043fb0:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | ||
| 00043fc0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | 00043fc0:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | ||
| 00043fd0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | 00043fd0:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | ||
| 00043fe0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | 00043fe0:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | ||
| 00043ff0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | 00043ff0:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | ||
| 00044000:·7469·6f6e·2041·6e73·6962·6c65·2073·6e69··tion·Ansible·sni | |||
| 00044010:·7070·6574·20e2·87b2·3c2f·613e·3c62·723e··ppet·...</a><br> | |||
| 00044020:·3c64·6976·2063·6c61·7373·3d22·7061·6e65··<div·class="pane | |||
| 00044030:·6c2d·636f·6c6c·6170·7365·2063·6f6c·6c61··l-collapse·colla | |||
| 00044040:·7073·6522·2069·643d·2269·646d·3937·3830··pse"·id="idm9780 | |||
| 00044050:·223e·3c74·6162·6c65·2063·6c61·7373·3d22··"><table·class=" | |||
| 00044060:·7461·626c·6520·7461·626c·652d·7374·7269··table·table-stri | |||
| 00044070:·7065·6420·7461·626c·652d·626f·7264·6572··ped·table-border | |||
| 00044080:·6564·2074·6162·6c65·2d63·6f6e·6465·6e73··ed·table-condens | |||
| 00044090:·6564·223e·3c74·723e·3c74·683e·436f·6d70··ed"><tr><th>Comp | |||
| 000440a0:·6c65·7869·7479·3a3c·2f74·683e·3c74·643e··lexity:</th><td> | |||
| 000440b0:·6c6f·773c·2f74·643e·3c2f·7472·3e3c·7472··low</td></tr><tr | |||
| 000440c0:·3e3c·7468·3e44·6973·7275·7074·696f·6e3a··><th>Disruption: | |||
| 000440d0:·3c2f·7468·3e3c·7464·3e68·6967·683c·2f74··</th><td>high</t | |||
| 000440e0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e52··d></tr><tr><th>R | |||
| 000440f0:·6562·6f6f·743a·3c2f·7468·3e3c·7464·3e74··eboot:</th><td>t | |||
| 00044100:·7275·653c·2f74·643e·3c2f·7472·3e3c·7472··rue</td></tr><tr | |||
| 00044110:·3e3c·7468·3e53·7472·6174·6567·793a·3c2f··><th>Strategy:</ | |||
| 00044120:·7468·3e3c·7464·3e70·6174·6368·3c2f·7464··th><td>patch</td | |||
| 00044130:·3e3c·2f74·723e·3c2f·7461·626c·653e·3c70··></tr></table><p | |||
| 00044140:·7265·3e3c·636f·6465·3e2d·206e·616d·653a··re><code>-·name: | |||
| 00044150:·2053·6563·7572·6974·7920·7061·7463·6865···Security·patche | |||
| 00044160:·7320·6172·6520·7570·2074·6f20·6461·7465··s·are·up·to·date | |||
| 00044170:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 00044180:·6e61·6d65·3a20·272a·270a·2020·2020·7374··name:·'*'.····st | |||
| 00044190:·6174·653a·206c·6174·6573·740a·2020·7461··ate:·latest.··ta | |||
| 000441a0:·6773·3a0a·2020·2d20·4343·452d·3833·3236··gs:.··-·CCE-8326 | |||
| 000441b0:·312d·380a·2020·2d20·434a·4953·2d35·2e31··1-8.··-·CJIS-5.1 | |||
| 000441c0:·302e·342e·310a·2020·2d20·4449·5341·2d53··0.4.1.··-·DISA-S | |||
| 000441d0:·5449·472d·534c·4553·2d31·352d·3031·3030··TIG-SLES-15-0100 | |||
| 000441e0:·3130·0a20·202d·204e·4953·542d·3830·302d··10.··-·NIST-800- | |||
| 000441f0:·3533·2d43·4d2d·3628·6129·0a20·202d·204e··53-CM-6(a).··-·N | |||
| 00044200:·4953·542d·3830·302d·3533·2d53·492d·3228··IST-800-53-SI-2( | |||
| 00044210:·3529·0a20·202d·204e·4953·542d·3830·302d··5).··-·NIST-800- | |||
| 00044220:·3533·2d53·492d·3228·6329·0a20·202d·2050··53-SI-2(c).··-·P | |||
| 00044230:·4349·2d44·5353·2d52·6571·2d36·2e32·0a20··CI-DSS-Req-6.2.· | |||
| 00044240:·202d·2068·6967·685f·6469·7372·7570·7469···-·high_disrupti | |||
| 00044250:·6f6e·0a20·202d·206c·6f77·5f63·6f6d·706c··on.··-·low_compl | |||
| 00044260:·6578·6974·790a·2020·2d20·6d65·6469·756d··exity.··-·medium | |||
| 00044270:·5f73·6576·6572·6974·790a·2020·2d20·7061··_severity.··-·pa | |||
| 00044280:·7463·685f·7374·7261·7465·6779·0a20·202d··tch_strategy.··- | |||
| 00044290:·2072·6562·6f6f·745f·7265·7175·6972·6564···reboot_required | |||
| 000442a0:·0a20·202d·2073·6563·7572·6974·795f·7061··.··-·security_pa | |||
| 000442b0:·7463·6865·735f·7570·5f74·6f5f·6461·7465··tches_up_to_date | |||
| 000442c0:·0a20·202d·2073·6b69·705f·616e·7369·626c··.··-·skip_ansibl | |||
| 000442d0:·655f·6c69·6e74·0a3c·2f63·6f64·653e·3c2f··e_lint.</code></ | |||
| 000442e0:·7072·653e·3c2f·6469·763e·3c61·2063·6c61··pre></div><a·cla | |||
| 000442f0:·7373·3d22·6274·6e20·6274·6e2d·7375·6363··ss="btn·btn-succ | |||
| 00044300:·6573·7322·2064·6174·612d·746f·6767·6c65··ess"·data-toggle | |||
| 00044310:·3d22·636f·6c6c·6170·7365·2220·6461·7461··="collapse"·data | |||
| 00044320:·2d74·6172·6765·743d·2223·6964·6d39·3738··-target="#idm978 | |||
| 00044330:·3122·2074·6162·696e·6465·783d·2230·2220··1"·tabindex="0"· | |||
| 00044340:·726f·6c65·3d22·6275·7474·6f6e·2220·6172··role="button"·ar | |||
| 00044350:·6961·2d65·7870·616e·6465·643d·2266·616c··ia-expanded="fal | |||
| 00044360:·7365·2220·7469·746c·653d·2241·6374·6976··se"·title="Activ | |||
| 00044370:·6174·6520·746f·2072·6576·6561·6c22·2068··ate·to·reveal"·h | |||
| 00044380:·7265·663d·2223·2122·3e52·656d·6564·6961··ref="#!">Remedia | |||
| 00044 | 00044000:·7469·6f6e·2053·6865·6c6c·2073·6372·6970··tion·Shell·scrip | ||
| 00044 | 00044010:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | ||
| 00044 | 00044020:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | ||
| 00044 | 00044030:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | ||
| 00044 | 00044040:·2220·6964·3d22·6964·6d39·3738·3022·3e3c··"·id="idm9780">< | ||
| 00044 | 00044050:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | ||
| 00044 | 00044060:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | ||
| 00044 | 00044070:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | ||
| 00044 | 00044080:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | ||
| 00044 | 00044090:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | ||
| 00044 | 000440a0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | ||
| 00044 | 000440b0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 00044 | 000440c0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | ||
| 00044 | 000440d0:·683e·3c74·643e·6869·6768·3c2f·7464·3e3c··h><td>high</td>< | ||
| 00044 | 000440e0:·2f74·723e·3c74·723e·3c74·683e·5265·626f··/tr><tr><th>Rebo | ||
| 00044 | 000440f0:·6f74·3a3c·2f74·683e·3c74·643e·7472·7565··ot:</th><td>true | ||
| 00044 | 00044100:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | ||
| 00044 | 00044110:·683e·5374·7261·7465·6779·3a3c·2f74·683e··h>Strategy:</th> | ||
| 00044 | 00044120:·3c74·643e·7061·7463·683c·2f74·643e·3c2f··<td>patch</td></ | ||
| 00044 | 00044130:·7472·3e3c·2f74·6162·6c65·3e3c·7072·653e··tr></table><pre> | ||
| 00044 | 00044140:·3c63·6f64·653e·0a0a·7a79·7070·6572·2070··<code>..zypper·p | ||
| 00044 | 00044150:·6174·6368·202d·6720·7365·6375·7269·7479··atch·-g·security | ||
| 00044 | 00044160:·202d·790a·3c2f·636f·6465·3e3c·2f70·7265···-y.</code></pre | ||
| 00044170:·3e3c·2f64·6976·3e3c·6120·636c·6173·733d··></div><a·class= | |||
| 00044180:·2262·746e·2062·746e·2d73·7563·6365·7373··"btn·btn-success | |||
| 00044190:·2220·6461·7461·2d74·6f67·676c·653d·2263··"·data-toggle="c | |||
| 000441a0:·6f6c·6c61·7073·6522·2064·6174·612d·7461··ollapse"·data-ta | |||
| 000441b0:·7267·6574·3d22·2369·646d·3937·3831·2220··rget="#idm9781"· | |||
| 000441c0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | |||
| 000441d0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | |||
| 000441e0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | |||
| 000441f0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | |||
| 00044200:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | |||
| 00044210:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | |||
| 00044220:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 00044230:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 00044240:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 00044250:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 00044260:·2220·6964·3d22·6964·6d39·3738·3122·3e3c··"·id="idm9781">< | |||
| 00044270:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 00044280:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 00044290:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 000442a0:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 000442b0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 000442c0:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 000442d0:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| Max diff block lines reached; 9761734/9774620 bytes (99.87%) of diff not shown. | |||
| Offset 41, 15 lines modified | Offset 41, 15 lines modified | ||
| 41 | Profile·Title·Standard·System·Security·Profile·for·SUSE·Linux·Enterprise·15 | 41 | Profile·Title·Standard·System·Security·Profile·for·SUSE·Linux·Enterprise·15 |
| 42 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 42 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 43 | ***·CPE·Platforms·*** | 43 | ***·CPE·Platforms·*** |
| 44 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 | 44 | ····*·cpe:/o:suse:linux_enterprise_desktop:15 |
| 45 | ····*·cpe:/o:suse:linux_enterprise_server:15 | 45 | ····*·cpe:/o:suse:linux_enterprise_server:15 |
| 46 | *****·Revision·History·***** | 46 | *****·Revision·History·***** |
| 47 | Current·version:·0.1.65 | 47 | Current·version:·0.1.65 |
| 48 | ····*·draft·(as·of·202 | 48 | ····*·draft·(as·of·2025-02-23) |
| 49 | *****·Table·of·Contents·***** | 49 | *****·Table·of·Contents·***** |
| 50 | ···1.·System_Settings | 50 | ···1.·System_Settings |
| 51 | ·········1.·Installing_and_Maintaining_Software | 51 | ·········1.·Installing_and_Maintaining_Software |
| 52 | ·········2.·Account_and_Access_Control | 52 | ·········2.·Account_and_Access_Control |
| 53 | ·········3.·System_Accounting_with_auditd | 53 | ·········3.·System_Accounting_with_auditd |
| 54 | ·········4.·Configure_Syslog | 54 | ·········4.·Configure_Syslog |
| 55 | ·········5.·Network_Configuration_and_Firewalls | 55 | ·········5.·Network_Configuration_and_Firewalls |
| Offset 209, 14 lines modified | Offset 209, 22 lines modified | ||
| 209 | Rule·ID:····xccdf_org.ssgproject.content_rule_security_patches_up_to_date | 209 | Rule·ID:····xccdf_org.ssgproject.content_rule_security_patches_up_to_date |
| 210 | ············Identifiers: ·CCE-83261-8 | 210 | ············Identifiers: ·CCE-83261-8 |
| 211 | Identifiers·References: ·BP28(R08),·18,·20,·4,·5.10.4.1,·APO12.01,·APO12.02,·APO12.03,·APO12.04,·BAI03.10, | 211 | Identifiers·References: ·BP28(R08),·18,·20,·4,·5.10.4.1,·APO12.01,·APO12.02,·APO12.03,·APO12.04,·BAI03.10, |
| 212 | and·········DSS05.01,·DSS05.02,·CCI-000366,·CCI-001227,·4.2.3,·4.2.3.12,·4.2.3.7,·4.2.3.9,·A.12.6.1, | 212 | and·········DSS05.01,·DSS05.02,·CCI-000366,·CCI-001227,·4.2.3,·4.2.3.12,·4.2.3.7,·4.2.3.9,·A.12.6.1, |
| 213 | References··A.14.2.3,·A.16.1.3,·A.18.2.2,·A.18.2.3,·SI-2(5),·SI-2(c),·CM-6(a),·ID.RA-1,·PR.IP-12, | 213 | References··A.14.2.3,·A.16.1.3,·A.18.2.2,·A.18.2.3,·SI-2(5),·SI-2(c),·CM-6(a),·ID.RA-1,·PR.IP-12, |
| 214 | ············FMT_MOF_EXT.1,·Req-6.2,·SRG-OS-000480-GPOS-00227,·SRG-OS-000480-VMM-002000,·SLES-15-010010,·SV- | 214 | ············FMT_MOF_EXT.1,·Req-6.2,·SRG-OS-000480-GPOS-00227,·SRG-OS-000480-VMM-002000,·SLES-15-010010,·SV- |
| 215 | ············234802r622137_rule | 215 | ············234802r622137_rule |
| 216 | Remediation_Shell_script_⇲ | ||
| 217 | Complexity:·low | ||
| 218 | Disruption:·high | ||
| 219 | Reboot:·····true | ||
| 220 | Strategy:···patch | ||
| 221 | zypper·patch·-g·security·-y | ||
| 216 | Remediation_Ansible_snippet_⇲ | 222 | Remediation_Ansible_snippet_⇲ |
| 217 | Complexity:·low | 223 | Complexity:·low |
| 218 | Disruption:·high | 224 | Disruption:·high |
| 219 | Reboot:·····true | 225 | Reboot:·····true |
| 220 | Strategy:···patch | 226 | Strategy:···patch |
| 221 | -·name:·Security·patches·are·up·to·date | 227 | -·name:·Security·patches·are·up·to·date |
| 222 | ··package: | 228 | ··package: |
| Offset 233, 22 lines modified | Offset 241, 14 lines modified | ||
| 233 | ··-·high_disruption | 241 | ··-·high_disruption |
| 234 | ··-·low_complexity | 242 | ··-·low_complexity |
| 235 | ··-·medium_severity | 243 | ··-·medium_severity |
| 236 | ··-·patch_strategy | 244 | ··-·patch_strategy |
| 237 | ··-·reboot_required | 245 | ··-·reboot_required |
| 238 | ··-·security_patches_up_to_date | 246 | ··-·security_patches_up_to_date |
| 239 | ··-·skip_ansible_lint | 247 | ··-·skip_ansible_lint |
| 240 | Remediation_Shell_script_⇲ | ||
| 241 | Complexity:·low | ||
| 242 | Disruption:·high | ||
| 243 | Reboot:·····true | ||
| 244 | Strategy:···patch | ||
| 245 | zypper·patch·-g·security·-y | ||
| 246 | Group ·Account·and·Access·Control· Group·contains·7·groups·and·16·rules | 248 | Group ·Account·and·Access·Control· Group·contains·7·groups·and·16·rules |
| 247 | [ref] ·In·traditional·Unix·security,·if·an·attacker·gains·shell·access·to·a·certain·login·account, | 249 | [ref] ·In·traditional·Unix·security,·if·an·attacker·gains·shell·access·to·a·certain·login·account, |
| 248 | they·can·perform·any·action·or·access·any·file·to·which·that·account·has·access.·Therefore,·making·it | 250 | they·can·perform·any·action·or·access·any·file·to·which·that·account·has·access.·Therefore,·making·it |
| 249 | more·difficult·for·unauthorized·people·to·gain·shell·access·to·accounts,·particularly·to·privileged | 251 | more·difficult·for·unauthorized·people·to·gain·shell·access·to·accounts,·particularly·to·privileged |
| 250 | accounts,·is·a·necessary·part·of·securing·a·system.·This·section·introduces·mechanisms·for | 252 | accounts,·is·a·necessary·part·of·securing·a·system.·This·section·introduces·mechanisms·for |
| 251 | restricting·access·to·accounts·under·SUSE·Linux·Enterprise·15. | 253 | restricting·access·to·accounts·under·SUSE·Linux·Enterprise·15. |
| 252 | Group ·Protect·Accounts·by·Configuring·PAM· Group·contains·3·groups·and·11·rules | 254 | Group ·Protect·Accounts·by·Configuring·PAM· Group·contains·3·groups·and·11·rules |
| Offset 305, 14 lines modified | Offset 305, 129 lines modified | ||
| 305 | ············Identifiers: ·CCE-85842-3 | 305 | ············Identifiers: ·CCE-85842-3 |
| 306 | ············References: ·BP28(R18),·1,·12,·15,·16,·5.5.3,·DSS05.04,·DSS05.10,·DSS06.10,·3.1.8,·CCI-000044,·CCI- | 306 | ············References: ·BP28(R18),·1,·12,·15,·16,·5.5.3,·DSS05.04,·DSS05.10,·DSS06.10,·3.1.8,·CCI-000044,·CCI- |
| 307 | Identifiers·002236,·CCI-002237,·CCI-002238,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, | 307 | Identifiers·002236,·CCI-002237,·CCI-002238,·4.3.3.6.1,·4.3.3.6.2,·4.3.3.6.3,·4.3.3.6.4,·4.3.3.6.5,·4.3.3.6.6, |
| 308 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·0421, | 308 | and·········4.3.3.6.7,·4.3.3.6.8,·4.3.3.6.9,·SR_1.1,·SR_1.10,·SR_1.2,·SR_1.5,·SR_1.7,·SR_1.8,·SR_1.9,·0421, |
| 309 | References··0422,·0431,·0974,·1173,·1401,·1504,·1505,·1546,·1557,·1558,·1559,·1560,·1561,·A.18.1.4,·A.9.2.1, | 309 | References··0422,·0431,·0974,·1173,·1401,·1504,·1505,·1546,·1557,·1558,·1559,·1560,·1561,·A.18.1.4,·A.9.2.1, |
| 310 | ············A.9.2.4,·A.9.3.1,·A.9.4.2,·A.9.4.3,·CM-6(a),·AC-7(a),·PR.AC-7,·FIA_AFL.1,·Req-8.1.6,·SRG-OS-000329- | 310 | ············A.9.2.4,·A.9.3.1,·A.9.4.2,·A.9.4.3,·CM-6(a),·AC-7(a),·PR.AC-7,·FIA_AFL.1,·Req-8.1.6,·SRG-OS-000329- |
| 311 | ············GPOS-00128,·SRG-OS-000021-GPOS-00005,·SRG-OS-000021-VMM-000050 | 311 | ············GPOS-00128,·SRG-OS-000021-GPOS-00005,·SRG-OS-000021-VMM-000050 |
| 312 | Remediation_Shell_script_⇲ | ||
| 313 | #·Remediation·is·applicable·only·in·certain·platforms | ||
| 314 | if·rpm·--quiet·-q·pam;·then | ||
| 315 | var_accounts_passwords_pam_faillock_deny='3' | ||
| 316 | if·[·-f·/usr/bin/authselect·];·then | ||
| 317 | ····if·!·authselect·check;·then | ||
| 318 | echo·" | ||
| 319 | authselect·integrity·check·failed.·Remediation·aborted! | ||
| 320 | This·remediation·could·not·be·applied·because·an·authselect·profile·was·not·selected·or·the·selected·profile·is | ||
| 321 | not·intact. | ||
| 322 | It·is·not·recommended·to·manually·edit·the·PAM·files·when·authselect·tool·is·available. | ||
| 323 | In·cases·where·the·default·authselect·profile·does·not·cover·a·specific·demand,·a·custom·authselect·profile·is | ||
| 324 | recommended." | ||
| 325 | exit·1 | ||
| 326 | fi | ||
| 327 | authselect·enable-feature·with-faillock | ||
| 328 | authselect·apply-changes·-b | ||
| 329 | else | ||
| 330 | ····AUTH_FILES=("/etc/pam.d/system-auth"·"/etc/pam.d/password-auth") | ||
| 331 | for·pam_file·in·"${AUTH_FILES[@]}" | ||
| 332 | do | ||
| 333 | ····if·!·grep·-qE·'^\s*auth\s+required\s+pam_faillock\.so\s+(preauth·silent|authfail).*$'·"$pam_file"·;·then | ||
| 334 | ········sed·-i·--follow-symlinks·'/^auth.*sufficient.*pam_unix\.so.*/i·auth········required······pam_faillock.so | ||
| 335 | preauth·silent'·"$pam_file" | ||
| 336 | ········sed·-i·--follow-symlinks·'/^auth.*required.*pam_deny\.so.*/i·auth········required······pam_faillock.so | ||
| 337 | authfail'·"$pam_file" | ||
| 338 | ········sed·-i·--follow-symlinks·'/^account.*required.*pam_unix\.so.*/i·account·····required | ||
| 339 | pam_faillock.so'·"$pam_file" | ||
| 340 | ····fi | ||
| 341 | ····sed·-Ei·'s/(auth.*)(\[default=die\])(.*pam_faillock\.so)/\1required·····\3/g'·"$pam_file" | ||
| 342 | done | ||
| 343 | fi | ||
| 344 | AUTH_FILES=("/etc/pam.d/system-auth"·"/etc/pam.d/password-auth") | ||
| 345 | FAILLOCK_CONF="/etc/security/faillock.conf" | ||
| 346 | if·[·-f·$FAILLOCK_CONF·];·then | ||
| 347 | ····regex="^\s*deny\s*=" | ||
| 348 | ····line="deny·=·$var_accounts_passwords_pam_faillock_deny" | ||
| 349 | ····if·!·grep·-q·$regex·$FAILLOCK_CONF;·then | ||
| 350 | ········echo·$line·>>·$FAILLOCK_CONF | ||
| 351 | ····else | ||
| 352 | ········sed·-i·--follow-symlinks·'s|^\s*\(deny\s*=\s*\)\ | ||
| 353 | (\S\+\)|\1'"$var_accounts_passwords_pam_faillock_deny"'|g'·$FAILLOCK_CONF | ||
| 354 | ····fi | ||
| 355 | ····for·pam_file·in·"${AUTH_FILES[@]}" | ||
| 356 | ····do | ||
| 357 | ········if·[·-e·"$pam_file"·]·;·then | ||
| 358 | ············PAM_FILE_PATH="$pam_file" | ||
| 359 | ············if·[·-f·/usr/bin/authselect·];·then | ||
| 360 | ················if·!·authselect·check;·then | ||
| 361 | ····················echo·" | ||
| 362 | ····················authselect·integrity·check·failed.·Remediation·aborted! | ||
| 363 | ····················This·remediation·could·not·be·applied·because·an·authselect·profile·was·not·selected·or·the | ||
| 364 | selected·profile·is·not·intact. | ||
| 365 | ····················It·is·not·recommended·to·manually·edit·the·PAM·files·when·authselect·tool·is·available. | ||
| Max diff block lines reached; 794289/802651 bytes (98.96%) of diff not shown. | |||
| Offset 14297, 15 lines modified | Offset 14297, 15 lines modified | ||
| 00037d80:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | 00037d80:·3c2f·6832·3e3c·703e·4375·7272·656e·7420··</h2><p>Current· | ||
| 00037d90:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | 00037d90:·7665·7273·696f·6e3a·203c·7374·726f·6e67··version:·<strong | ||
| 00037da0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | 00037da0:·3e30·2e31·2e36·353c·2f73·7472·6f6e·673e··>0.1.65</strong> | ||
| 00037db0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | 00037db0:·3c2f·703e·3c75·6c3e·3c6c·693e·3c73·7472··</p><ul><li><str | ||
| 00037dc0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | 00037dc0:·6f6e·673e·6472·6166·743c·2f73·7472·6f6e··ong>draft</stron | ||
| 00037dd0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | 00037dd0:·673e·0a20·2020·2020·2020·2020·2020·2020··g>.············· | ||
| 00037de0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | 00037de0:·2020·2020·2020·2028·6173·206f·6620·3230·········(as·of·20 | ||
| 00037df0:·323 | 00037df0:·3235·2d30·322d·3233·290a·2020·2020·2020··25-02-23).······ | ||
| 00037e00:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | 00037e00:·2020·2020·2020·2020·2020·3c2f·6c69·3e3c············</li>< | ||
| 00037e10:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | 00037e10:·2f75·6c3e·3c2f·6469·763e·3c68·323e·5461··/ul></div><h2>Ta | ||
| 00037e20:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | 00037e20:·626c·6520·6f66·2043·6f6e·7465·6e74·733c··ble·of·Contents< | ||
| 00037e30:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | 00037e30:·2f68·323e·3c6f·6c3e·3c6c·693e·3c61·2068··/h2><ol><li><a·h | ||
| 00037e40:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | 00037e40:·7265·663d·2223·7863·6364·665f·6f72·672e··ref="#xccdf_org. | ||
| 00037e50:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | 00037e50:·7373·6770·726f·6a65·6374·2e63·6f6e·7465··ssgproject.conte | ||
| 00037e60:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | 00037e60:·6e74·5f67·726f·7570·5f73·7973·7465·6d22··nt_group_system" | ||
| Offset 15307, 123 lines modified | Offset 15307, 123 lines modified | ||
| 0003bca0:·7267·6574·3d22·2369·646d·3637·3734·2220··rget="#idm6774"· | 0003bca0:·7267·6574·3d22·2369·646d·3637·3734·2220··rget="#idm6774"· | ||
| 0003bcb0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | 0003bcb0:·7461·6269·6e64·6578·3d22·3022·2072·6f6c··tabindex="0"·rol | ||
| 0003bcc0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | 0003bcc0:·653d·2262·7574·746f·6e22·2061·7269·612d··e="button"·aria- | ||
| 0003bcd0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | 0003bcd0:·6578·7061·6e64·6564·3d22·6661·6c73·6522··expanded="false" | ||
| 0003bce0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | 0003bce0:·2074·6974·6c65·3d22·4163·7469·7661·7465···title="Activate | ||
| 0003bcf0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | 0003bcf0:·2074·6f20·7265·7665·616c·2220·6872·6566···to·reveal"·href | ||
| 0003bd00:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | 0003bd00:·3d22·2321·223e·5265·6d65·6469·6174·696f··="#!">Remediatio | ||
| 0003bd10:·6e20·416e·7369·626c·6520·736e·6970·7065··n·Ansible·snippe | |||
| 0003bd20:·7420·e287·b23c·2f61·3e3c·6272·3e3c·6469··t·...</a><br><di | |||
| 0003bd30:·7620·636c·6173·733d·2270·616e·656c·2d63··v·class="panel-c | |||
| 0003bd40:·6f6c·6c61·7073·6520·636f·6c6c·6170·7365··ollapse·collapse | |||
| 0003bd50:·2220·6964·3d22·6964·6d36·3737·3422·3e3c··"·id="idm6774">< | |||
| 0003bd60:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 0003bd70:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 0003bd80:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 0003bd90:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 0003bda0:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 0003bd | 0003bd10:·6e20·5368·656c·6c20·7363·7269·7074·20e2··n·Shell·script·. | ||
| 0003bd20:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bd30:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bd40:·6170·7365·2063·6f6c·6c61·7073·6522·2069··apse·collapse"·i | |||
| 0003bd50:·643d·2269·646d·3637·3734·223e·3c74·6162··d="idm6774"><tab | |||
| 0003bd60:·6c65·2063·6c61·7373·3d22·7461·626c·6520··le·class="table· | |||
| 0003bd70:·7461·626c·652d·7374·7269·7065·6420·7461··table-striped·ta | |||
| 0003bd80:·626c·652d·626f·7264·6572·6564·2074·6162··ble-bordered·tab | |||
| 0003bd90:·6c65·2d63·6f6e·6465·6e73·6564·223e·3c74··le-condensed"><t | |||
| 0003bda0:·723e·3c74·683e·436f·6d70·6c65·7869·7479··r><th>Complexity | |||
| 0003bdb0:·3a3c·2f74·683e·3c74·643e·6c6f·773c·2f74··:</th><td>low</t | |||
| 0003bdc0:·643e·3c2f·7472·3e3c·7472·3e3c·7468·3e44··d></tr><tr><th>D | |||
| 0003bdd0:·6973·7275·7074·696f·6e3a·3c2f·7468·3e3c··isruption:</th>< | |||
| 0003bde0:·7464·3e6c·6f77·3c2f·7464·3e3c·2f74·723e··td>low</td></tr> | |||
| 0003bdf0:·3c74·723e·3c74·683e·5374·7261·7465·6779··<tr><th>Strategy | |||
| 0003be00:·3a3c·2f74·683e·3c74·643e·656e·6162·6c65··:</th><td>enable | |||
| 0003b | 0003be10:·3c2f·7464·3e3c·2f74·723e·3c2f·7461·626c··</td></tr></tabl | ||
| 0003be20:·653e·3c70·7265·3e3c·636f·6465·3e23·2052··e><pre><code>#·R | |||
| 0003be30:·656d·6564·6961·7469·6f6e·2069·7320·6170··emediation·is·ap | |||
| 0003be40:·706c·6963·6162·6c65·206f·6e6c·7920·696e··plicable·only·in | |||
| 0003be50:·2063·6572·7461·696e·2070·6c61·7466·6f72···certain·platfor | |||
| 0003be60:·6d73·0a69·6620·5b20·2120·2d66·202f·2e64··ms.if·[·!·-f·/.d | |||
| 0003be70:·6f63·6b65·7265·6e76·205d·2026·616d·703b··ockerenv·]·& | |||
| 0003be80:·2661·6d70·3b20·5b20·2120·2d66·202f·7275··&·[·!·-f·/ru | |||
| 0003be90:·6e2f·2e63·6f6e·7461·696e·6572·656e·7620··n/.containerenv· | |||
| 0003bea0:·5d3b·2074·6865·6e0a·0a7a·7970·7065·7220··];·then..zypper· | |||
| 0003beb0:·696e·7374·616c·6c20·2d79·2022·6169·6465··install·-y·"aide | |||
| 0003bec0:·220a·0a65·6c73·650a·2020·2020·2667·743b··"..else.····> | |||
| 0003bed0:·2661·6d70·3b32·2065·6368·6f20·2752·656d··&2·echo·'Rem | |||
| 0003bee0:·6564·6961·7469·6f6e·2069·7320·6e6f·7420··ediation·is·not· | |||
| 0003bef0:·6170·706c·6963·6162·6c65·2c20·6e6f·7468··applicable,·noth | |||
| 0003bf00:·696e·6720·7761·7320·646f·6e65·270a·6669··ing·was·done'.fi | |||
| 0003bf10:·0a3c·2f63·6f64·653e·3c2f·7072·653e·3c2f··.</code></pre></ | |||
| 0003bf20:·6469·763e·3c61·2063·6c61·7373·3d22·6274··div><a·class="bt | |||
| 0003bf30:·6e20·6274·6e2d·7375·6363·6573·7322·2064··n·btn-success"·d | |||
| 0003bf40:·6174·612d·746f·6767·6c65·3d22·636f·6c6c··ata-toggle="coll | |||
| 0003bf50:·6170·7365·2220·6461·7461·2d74·6172·6765··apse"·data-targe | |||
| 0003bf60:·743d·2223·6964·6d36·3737·3522·2074·6162··t="#idm6775"·tab | |||
| 0003bf70:·696e·6465·783d·2230·2220·726f·6c65·3d22··index="0"·role=" | |||
| 0003bf80:·6275·7474·6f6e·2220·6172·6961·2d65·7870··button"·aria-exp | |||
| 0003bf90:·616e·6465·643d·2266·616c·7365·2220·7469··anded="false"·ti | |||
| 0003bfa0:·746c·653d·2241·6374·6976·6174·6520·746f··tle="Activate·to | |||
| 0003bfb0:·2072·6576·6561·6c22·2068·7265·663d·2223···reveal"·href="# | |||
| 0003bfc0:·2122·3e52·656d·6564·6961·7469·6f6e·2041··!">Remediation·A | |||
| 0003bfd0:·6e73·6962·6c65·2073·6e69·7070·6574·20e2··nsible·snippet·. | |||
| 0003bfe0:·87b2·3c2f·613e·3c62·723e·3c64·6976·2063··..</a><br><div·c | |||
| 0003bff0:·6c61·7373·3d22·7061·6e65·6c2d·636f·6c6c··lass="panel-coll | |||
| 0003bdd0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 0003bde0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 0003bdf0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 0003be00:·6567·793a·3c2f·7468·3e3c·7464·3e65·6e61··egy:</th><td>ena | |||
| 0003be10:·626c·653c·2f74·643e·3c2f·7472·3e3c·2f74··ble</td></tr></t | |||
| 0003be20:·6162·6c65·3e3c·7072·653e·3c63·6f64·653e··able><pre><code> | |||
| 0003be30:·2d20·6e61·6d65·3a20·456e·7375·7265·2061··-·name:·Ensure·a | |||
| 0003be40:·6964·6520·6973·2069·6e73·7461·6c6c·6564··ide·is·installed | |||
| 0003be50:·0a20·2070·6163·6b61·6765·3a0a·2020·2020··.··package:.···· | |||
| 0003be60:·6e61·6d65·3a20·6169·6465·0a20·2020·2073··name:·aide.····s | |||
| 0003be70:·7461·7465·3a20·7072·6573·656e·740a·2020··tate:·present.·· | |||
| 0003be80:·7768·656e·3a20·616e·7369·626c·655f·7669··when:·ansible_vi | |||
| 0003be90:·7274·7561·6c69·7a61·7469·6f6e·5f74·7970··rtualization_typ | |||
| 0003bea0:·6520·6e6f·7420·696e·205b·2264·6f63·6b65··e·not·in·["docke | |||
| 0003beb0:·7222·2c20·226c·7863·222c·2022·6f70·656e··r",·"lxc",·"open | |||
| 0003bec0:·767a·222c·2022·706f·646d·616e·222c·2022··vz",·"podman",·" | |||
| 0003bed0:·636f·6e74·6169·6e65·7222·5d0a·2020·7461··container"].··ta | |||
| 0003bee0:·6773·3a0a·2020·2d20·4343·452d·3833·3238··gs:.··-·CCE-8328 | |||
| 0003bef0:·392d·390a·2020·2d20·434a·4953·2d35·2e31··9-9.··-·CJIS-5.1 | |||
| 0003bf00:·302e·312e·330a·2020·2d20·4449·5341·2d53··0.1.3.··-·DISA-S | |||
| 0003bf10:·5449·472d·534c·4553·2d31·352d·3031·3034··TIG-SLES-15-0104 | |||
| 0003bf20:·3230·0a20·202d·204e·4953·542d·3830·302d··20.··-·NIST-800- | |||
| 0003bf30:·3533·2d43·4d2d·3628·6129·0a20·202d·2050··53-CM-6(a).··-·P | |||
| 0003bf40:·4349·2d44·5353·2d52·6571·2d31·312e·350a··CI-DSS-Req-11.5. | |||
| 0003bf50:·2020·2d20·656e·6162·6c65·5f73·7472·6174····-·enable_strat | |||
| 0003bf60:·6567·790a·2020·2d20·6c6f·775f·636f·6d70··egy.··-·low_comp | |||
| 0003bf70:·6c65·7869·7479·0a20·202d·206c·6f77·5f64··lexity.··-·low_d | |||
| 0003bf80:·6973·7275·7074·696f·6e0a·2020·2d20·6d65··isruption.··-·me | |||
| 0003bf90:·6469·756d·5f73·6576·6572·6974·790a·2020··dium_severity.·· | |||
| 0003bfa0:·2d20·6e6f·5f72·6562·6f6f·745f·6e65·6564··-·no_reboot_need | |||
| 0003bfb0:·6564·0a20·202d·2070·6163·6b61·6765·5f61··ed.··-·package_a | |||
| 0003bfc0:·6964·655f·696e·7374·616c·6c65·640a·3c2f··ide_installed.</ | |||
| 0003bfd0:·636f·6465·3e3c·2f70·7265·3e3c·2f64·6976··code></pre></div | |||
| 0003bfe0:·3e3c·6120·636c·6173·733d·2262·746e·2062··><a·class="btn·b | |||
| 0003bff0:·746e·2d73·7563·6365·7373·2220·6461·7461··tn-success"·data | |||
| 0003c000:·2d74·6f67·676c·653d·2263·6f6c·6c61·7073··-toggle="collaps | |||
| 0003c010:·6522·2064·6174·612d·7461·7267·6574·3d22··e"·data-target=" | |||
| 0003c020:·2369·646d·3637·3735·2220·7461·6269·6e64··#idm6775"·tabind | |||
| 0003c030:·6578·3d22·3022·2072·6f6c·653d·2262·7574··ex="0"·role="but | |||
| 0003c040:·746f·6e22·2061·7269·612d·6578·7061·6e64··ton"·aria-expand | |||
| 0003c050:·6564·3d22·6661·6c73·6522·2074·6974·6c65··ed="false"·title | |||
| 0003c060:·3d22·4163·7469·7661·7465·2074·6f20·7265··="Activate·to·re | |||
| 0003c070:·7665·616c·2220·6872·6566·3d22·2321·223e··veal"·href="#!"> | |||
| 0003c080:·5265·6d65·6469·6174·696f·6e20·4f53·4275··Remediation·OSBu | |||
| 0003c090:·696c·6420·426c·7565·7072·696e·7420·736e··ild·Blueprint·sn | |||
| 0003c0a0:·6970·7065·7420·e287·b23c·2f61·3e3c·6272··ippet·...</a><br | |||
| 0003c0b0:·3e3c·6469·7620·636c·6173·733d·2270·616e··><div·class="pan | |||
| Max diff block lines reached; 19870509/19887261 bytes (99.92%) of diff not shown. | |||
| Offset 14290, 15 lines modified | Offset 14290, 15 lines modified | ||
| 00037d10:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | 00037d10:·793c·2f68·323e·3c70·3e43·7572·7265·6e74··y</h2><p>Current | ||
| 00037d20:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | 00037d20:·2076·6572·7369·6f6e·3a20·3c73·7472·6f6e···version:·<stron | ||
| 00037d30:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | 00037d30:·673e·302e·312e·3635·3c2f·7374·726f·6e67··g>0.1.65</strong | ||
| 00037d40:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | 00037d40:·3e3c·2f70·3e3c·756c·3e3c·6c69·3e3c·7374··></p><ul><li><st | ||
| 00037d50:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | 00037d50:·726f·6e67·3e64·7261·6674·3c2f·7374·726f··rong>draft</stro | ||
| 00037d60:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | 00037d60:·6e67·3e0a·2020·2020·2020·2020·2020·2020··ng>.············ | ||
| 00037d70:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | 00037d70:·2020·2020·2020·2020·2861·7320·6f66·2032··········(as·of·2 | ||
| 00037d80:·3032·3 | 00037d80:·3032·352d·3032·2d32·3329·0a20·2020·2020··025-02-23).····· | ||
| 00037d90:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | 00037d90:·2020·2020·2020·2020·2020·203c·2f6c·693e·············</li> | ||
| 00037da0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | 00037da0:·3c2f·756c·3e3c·2f64·6976·3e3c·6832·3e54··</ul></div><h2>T | ||
| 00037db0:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | 00037db0:·6162·6c65·206f·6620·436f·6e74·656e·7473··able·of·Contents | ||
| 00037dc0:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | 00037dc0:·3c2f·6832·3e3c·6f6c·3e3c·6c69·3e3c·6120··</h2><ol><li><a· | ||
| 00037dd0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | 00037dd0:·6872·6566·3d22·2378·6363·6466·5f6f·7267··href="#xccdf_org | ||
| 00037de0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | 00037de0:·2e73·7367·7072·6f6a·6563·742e·636f·6e74··.ssgproject.cont | ||
| 00037df0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | 00037df0:·656e·745f·6772·6f75·705f·7379·7374·656d··ent_group_system | ||
| Offset 16664, 167 lines modified | Offset 16664, 167 lines modified | ||
| 00041170:·7461·7267·6574·3d22·2369·646d·3931·3322··target="#idm913" | 00041170:·7461·7267·6574·3d22·2369·646d·3931·3322··target="#idm913" | ||
| 00041180:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | 00041180:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | ||
| 00041190:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | 00041190:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | ||
| 000411a0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | 000411a0:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | ||
| 000411b0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | 000411b0:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | ||
| 000411c0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | 000411c0:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | ||
| 000411d0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | 000411d0:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | ||
| 000411e0:·6f6e·2041·6e73·6962·6c65·2073·6e69·7070··on·Ansible·snipp | |||
| 000411f0:·6574·20e2·87b2·3c2f·613e·3c62·723e·3c64··et·...</a><br><d | |||
| 00041200:·6976·2063·6c61·7373·3d22·7061·6e65·6c2d··iv·class="panel- | |||
| 00041210:·636f·6c6c·6170·7365·2063·6f6c·6c61·7073··collapse·collaps | |||
| 00041220:·6522·2069·643d·2269·646d·3931·3322·3e3c··e"·id="idm913">< | |||
| 00041230:·7461·626c·6520·636c·6173·733d·2274·6162··table·class="tab | |||
| 00041240:·6c65·2074·6162·6c65·2d73·7472·6970·6564··le·table-striped | |||
| 00041250:·2074·6162·6c65·2d62·6f72·6465·7265·6420···table-bordered· | |||
| 00041260:·7461·626c·652d·636f·6e64·656e·7365·6422··table-condensed" | |||
| 00041270:·3e3c·7472·3e3c·7468·3e43·6f6d·706c·6578··><tr><th>Complex | |||
| 00041280:·6974·793a·3c2f·7468·3e3c·7464·3e6c·6f77··ity:</th><td>low | |||
| 00041290:·3c2f·7464·3e3c·2f74·723e·3c74·723e·3c74··</td></tr><tr><t | |||
| 000412a0:·683e·4469·7372·7570·7469·6f6e·3a3c·2f74··h>Disruption:</t | |||
| 000412b0:·683e·3c74·643e·6c6f·773c·2f74·643e·3c2f··h><td>low</td></ | |||
| 000412c0:·7472·3e3c·7472·3e3c·7468·3e53·7472·6174··tr><tr><th>Strat | |||
| 000412d0:·6567·793a·3c2f·7468·3e3c·7464·3e72·6573··egy:</th><td>res | |||
| 000412e0:·7472·6963·743c·2f74·643e·3c2f·7472·3e3c··trict</td></tr>< | |||
| 000412f0:·2f74·6162·6c65·3e3c·7072·653e·3c63·6f64··/table><pre><cod | |||
| 00041300:·653e·2d20·6e61·6d65·3a20·5843·4344·4620··e>-·name:·XCCDF· | |||
| 00041310:·5661·6c75·6520·7661·725f·7379·7374·656d··Value·var_system | |||
| 00041320:·5f63·7279·7074·6f5f·706f·6c69·6379·2023··_crypto_policy·# | |||
| 00041330:·2070·726f·6d6f·7465·2074·6f20·7661·7269···promote·to·vari | |||
| 00041340:·6162·6c65·0a20·2073·6574·5f66·6163·743a··able.··set_fact: | |||
| 00041350:·0a20·2020·2076·6172·5f73·7973·7465·6d5f··.····var_system_ | |||
| 00041360:·6372·7970·746f·5f70·6f6c·6963·793a·2021··crypto_policy:·! | |||
| 00041370:·2173·7472·203c·6162·6272·2074·6974·6c65··!str·<abbr·title | |||
| 00041380:·3d22·6672·6f6d·2042·656e·6368·6d61·726b··="from·Benchmark | |||
| 00041390:·2f56·616c·7565·3a20·7863·6364·665f·6f72··/Value:·xccdf_or | |||
| 000413a0:·672e·7373·6770·726f·6a65·6374·2e63·6f6e··g.ssgproject.con | |||
| 000413b0:·7465·6e74·5f76·616c·7565·5f76·6172·5f73··tent_value_var_s | |||
| 000413c0:·7973·7465·6d5f·6372·7970·746f·5f70·6f6c··ystem_crypto_pol | |||
| 000413d0:·6963·7922·3e44·4546·4155·4c54·3c2f·6162··icy">DEFAULT</ab | |||
| 000413e0:·6272·3e0a·2020·7461·6773·3a0a·2020·2020··br>.··tags:.···· | |||
| 000413f0:·2d20·616c·7761·7973·0a0a·2d20·6e61·6d65··-·always..-·name | |||
| 00041400:·3a20·436f·6e66·6967·7572·6520·5379·7374··:·Configure·Syst | |||
| 00041410:·656d·2043·7279·7074·6f67·7261·7068·7920··em·Cryptography· | |||
| 00041420:·506f·6c69·6379·0a20·206c·696e·6569·6e66··Policy.··lineinf | |||
| 00041430:·696c·653a·0a20·2020·2070·6174·683a·202f··ile:.····path:·/ | |||
| 00041440:·6574·632f·6372·7970·746f·2d70·6f6c·6963··etc/crypto-polic | |||
| 00041450:·6965·732f·636f·6e66·6967·0a20·2020·2072··ies/config.····r | |||
| 00041460:·6567·6578·703a·205e·283f·2123·2928·5c53··egexp:·^(?!#)(\S | |||
| 00041470:·2b29·240a·2020·2020·6c69·6e65·3a20·277b··+)$.····line:·'{ | |||
| 00041480:·7b20·7661·725f·7379·7374·656d·5f63·7279··{·var_system_cry | |||
| 00041490:·7074·6f5f·706f·6c69·6379·207d·7d27·0a20··pto_policy·}}'.· | |||
| 000414a0:·2020·2063·7265·6174·653a·2074·7275·650a·····create:·true. | |||
| 000414b0:·2020·7461·6773·3a0a·2020·2d20·4e49·5354····tags:.··-·NIST | |||
| 000414c0:·2d38·3030·2d35·332d·4143·2d31·3728·3229··-800-53-AC-17(2) | |||
| 000414d0:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 000414e0:·2d41·432d·3137·2861·290a·2020·2d20·4e49··-AC-17(a).··-·NI | |||
| 000414f0:·5354·2d38·3030·2d35·332d·434d·2d36·2861··ST-800-53-CM-6(a | |||
| 00041500:·290a·2020·2d20·4e49·5354·2d38·3030·2d35··).··-·NIST-800-5 | |||
| 00041510:·332d·4d41·2d34·2836·290a·2020·2d20·4e49··3-MA-4(6).··-·NI | |||
| 00041520:·5354·2d38·3030·2d35·332d·5343·2d31·3228··ST-800-53-SC-12( | |||
| 00041530:·3229·0a20·202d·204e·4953·542d·3830·302d··2).··-·NIST-800- | |||
| 00041540:·3533·2d53·432d·3132·2833·290a·2020·2d20··53-SC-12(3).··-· | |||
| 00041550:·4e49·5354·2d38·3030·2d35·332d·5343·2d31··NIST-800-53-SC-1 | |||
| 00041560:·330a·2020·2d20·636f·6e66·6967·7572·655f··3.··-·configure_ | |||
| 00041570:·6372·7970·746f·5f70·6f6c·6963·790a·2020··crypto_policy.·· | |||
| 00041580:·2d20·6869·6768·5f73·6576·6572·6974·790a··-·high_severity. | |||
| 00041590:·2020·2d20·6c6f·775f·636f·6d70·6c65·7869····-·low_complexi | |||
| 000415a0:·7479·0a20·202d·206c·6f77·5f64·6973·7275··ty.··-·low_disru | |||
| 000415b0:·7074·696f·6e0a·2020·2d20·6e6f·5f72·6562··ption.··-·no_reb | |||
| 000415c0:·6f6f·745f·6e65·6564·6564·0a20·202d·2072··oot_needed.··-·r | |||
| 000415d0:·6573·7472·6963·745f·7374·7261·7465·6779··estrict_strategy | |||
| 000415e0:·0a0a·2d20·6e61·6d65·3a20·5665·7269·6679··..-·name:·Verify | |||
| 000415f0:·2074·6861·7420·4372·7970·746f·2050·6f6c···that·Crypto·Pol | |||
| 00041600:·6963·7920·6973·2053·6574·2028·7275·6e74··icy·is·Set·(runt | |||
| 00041610:·696d·6529·0a20·2063·6f6d·6d61·6e64·3a20··ime).··command:· | |||
| 00041620:·2f75·7372·2f62·696e·2f75·7064·6174·652d··/usr/bin/update- | |||
| 00041630:·6372·7970·746f·2d70·6f6c·6963·6965·7320··crypto-policies· | |||
| 00041640:·2d2d·7365·7420·7b7b·2076·6172·5f73·7973··--set·{{·var_sys | |||
| 00041650:·7465·6d5f·6372·7970·746f·5f70·6f6c·6963··tem_crypto_polic | |||
| 00041660:·7920·7d7d·0a20·2074·6167·733a·0a20·202d··y·}}.··tags:.··- | |||
| 00041670:·204e·4953·542d·3830·302d·3533·2d41·432d···NIST-800-53-AC- | |||
| 00041680:·3137·2832·290a·2020·2d20·4e49·5354·2d38··17(2).··-·NIST-8 | |||
| 00041690:·3030·2d35·332d·4143·2d31·3728·6129·0a20··00-53-AC-17(a).· | |||
| 000416a0:·202d·204e·4953·542d·3830·302d·3533·2d43···-·NIST-800-53-C | |||
| 000416b0:·4d2d·3628·6129·0a20·202d·204e·4953·542d··M-6(a).··-·NIST- | |||
| 000416c0:·3830·302d·3533·2d4d·412d·3428·3629·0a20··800-53-MA-4(6).· | |||
| 000416d0:·202d·204e·4953·542d·3830·302d·3533·2d53···-·NIST-800-53-S | |||
| 000416e0:·432d·3132·2832·290a·2020·2d20·4e49·5354··C-12(2).··-·NIST | |||
| 000416f0:·2d38·3030·2d35·332d·5343·2d31·3228·3329··-800-53-SC-12(3) | |||
| 00041700:·0a20·202d·204e·4953·542d·3830·302d·3533··.··-·NIST-800-53 | |||
| 00041710:·2d53·432d·3133·0a20·202d·2063·6f6e·6669··-SC-13.··-·confi | |||
| 00041720:·6775·7265·5f63·7279·7074·6f5f·706f·6c69··gure_crypto_poli | |||
| 00041730:·6379·0a20·202d·2068·6967·685f·7365·7665··cy.··-·high_seve | |||
| 00041740:·7269·7479·0a20·202d·206c·6f77·5f63·6f6d··rity.··-·low_com | |||
| 00041750:·706c·6578·6974·790a·2020·2d20·6c6f·775f··plexity.··-·low_ | |||
| 00041760:·6469·7372·7570·7469·6f6e·0a20·202d·206e··disruption.··-·n | |||
| 00041770:·6f5f·7265·626f·6f74·5f6e·6565·6465·640a··o_reboot_needed. | |||
| 00041780:·2020·2d20·7265·7374·7269·6374·5f73·7472····-·restrict_str | |||
| 00041790:·6174·6567·790a·3c2f·636f·6465·3e3c·2f70··ategy.</code></p | |||
| 000417a0:·7265·3e3c·2f64·6976·3e3c·6120·636c·6173··re></div><a·clas | |||
| 000417b0:·733d·2262·746e·2062·746e·2d73·7563·6365··s="btn·btn-succe | |||
| 000417c0:·7373·2220·6461·7461·2d74·6f67·676c·653d··ss"·data-toggle= | |||
| 000417d0:·2263·6f6c·6c61·7073·6522·2064·6174·612d··"collapse"·data- | |||
| 000417e0:·7461·7267·6574·3d22·2369·646d·3931·3522··target="#idm915" | |||
| 000417f0:·2074·6162·696e·6465·783d·2230·2220·726f···tabindex="0"·ro | |||
| 00041800:·6c65·3d22·6275·7474·6f6e·2220·6172·6961··le="button"·aria | |||
| 00041810:·2d65·7870·616e·6465·643d·2266·616c·7365··-expanded="false | |||
| 00041820:·2220·7469·746c·653d·2241·6374·6976·6174··"·title="Activat | |||
| 00041830:·6520·746f·2072·6576·6561·6c22·2068·7265··e·to·reveal"·hre | |||
| 00041840:·663d·2223·2122·3e52·656d·6564·6961·7469··f="#!">Remediati | |||
| 00041 | 000411e0:·6f6e·2053·6865·6c6c·2073·6372·6970·7420··on·Shell·script· | ||
| Max diff block lines reached; 68004/90828 bytes (74.87%) of diff not shown. | |||
| Offset 39, 15 lines modified | Offset 39, 15 lines modified | ||
| 39 | *****·Profile·Information·***** | 39 | *****·Profile·Information·***** |
| 40 | Profile·Title·Standard·System·Security·Profile·for·UnionTech·OS·Server·20 | 40 | Profile·Title·Standard·System·Security·Profile·for·UnionTech·OS·Server·20 |
| 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard | 41 | Profile·ID····xccdf_org.ssgproject.content_profile_standard |
| 42 | ***·CPE·Platforms·*** | 42 | ***·CPE·Platforms·*** |
| 43 | ····*·cpe:/o:uos:uniontech_os_server:20 | 43 | ····*·cpe:/o:uos:uniontech_os_server:20 |
| 44 | *****·Revision·History·***** | 44 | *****·Revision·History·***** |
| 45 | Current·version:·0.1.65 | 45 | Current·version:·0.1.65 |
| 46 | ····*·draft·(as·of·202 | 46 | ····*·draft·(as·of·2025-02-23) |
| 47 | *****·Table·of·Contents·***** | 47 | *****·Table·of·Contents·***** |
| 48 | ···1.·System_Settings | 48 | ···1.·System_Settings |
| 49 | ·········1.·Installing_and_Maintaining_Software | 49 | ·········1.·Installing_and_Maintaining_Software |
| 50 | ·········2.·System_Accounting_with_auditd | 50 | ·········2.·System_Accounting_with_auditd |
| 51 | ·········3.·File_Permissions_and_Masks | 51 | ·········3.·File_Permissions_and_Masks |
| 52 | ···2.·Services | 52 | ···2.·Services |
| 53 | ·········1.·Base_Services | 53 | ·········1.·Base_Services |
| Offset 222, 14 lines modified | Offset 222, 33 lines modified | ||
| 222 | Severity: ·high | 222 | Severity: ·high |
| 223 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy | 223 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| 224 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2) | 224 | ············References: ·164.308(a)(4)(i),·164.308(b)(1),·164.308(b)(3),·164.312(e)(1),·164.312(e)(2) |
| 225 | Identifiers·(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a), | 225 | Identifiers·(ii),·1446,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·CIP-007-3_R7.1,·AC-17(a),·AC-17(2),·CM-6(a), |
| 226 | and·········MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1 | 226 | and·········MA-4(6),·SC-13,·SC-12(2),·SC-12(3),·FCS_COP.1(1),·FCS_COP.1(2),·FCS_COP.1(3),·FCS_COP.1 |
| 227 | References··(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS- | 227 | References··(4),·FCS_CKM.1,·FCS_CKM.2,·FCS_TLSC_EXT.1,·SRG-OS-000396-GPOS-00176,·SRG-OS-000393-GPOS- |
| 228 | ············00173,·SRG-OS-000394-GPOS-00174 | 228 | ············00173,·SRG-OS-000394-GPOS-00174 |
| 229 | Remediation_Shell_script_⇲ | ||
| 230 | var_system_crypto_policy='DEFAULT' | ||
| 231 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 232 | rc=$? | ||
| 233 | if·test·"$rc"·=·127;·then | ||
| 234 | » echo·"$stderr_of_call"·>&2 | ||
| 235 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 236 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 237 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 238 | » false··#·end·with·an·error·code | ||
| 239 | elif·test·"$rc"·!=·0;·then | ||
| 240 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 241 | » false··#·end·with·an·error·code | ||
| 242 | fi | ||
| 229 | Remediation_Ansible_snippet_⇲ | 243 | Remediation_Ansible_snippet_⇲ |
| 230 | Complexity:·low | 244 | Complexity:·low |
| 231 | Disruption:·low | 245 | Disruption:·low |
| 232 | Strategy:···restrict | 246 | Strategy:···restrict |
| 233 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable | 247 | -·name:·XCCDF·Value·var_system_crypto_policy·#·promote·to·variable |
| 234 | ··set_fact: | 248 | ··set_fact: |
| 235 | ····var_system_crypto_policy:·!!str·DEFAULT | 249 | ····var_system_crypto_policy:·!!str·DEFAULT |
| Offset 269, 46 lines modified | Offset 288, 35 lines modified | ||
| 269 | ··-·NIST-800-53-SC-13 | 288 | ··-·NIST-800-53-SC-13 |
| 270 | ··-·configure_crypto_policy | 289 | ··-·configure_crypto_policy |
| 271 | ··-·high_severity | 290 | ··-·high_severity |
| 272 | ··-·low_complexity | 291 | ··-·low_complexity |
| 273 | ··-·low_disruption | 292 | ··-·low_disruption |
| 274 | ··-·no_reboot_needed | 293 | ··-·no_reboot_needed |
| 275 | ··-·restrict_strategy | 294 | ··-·restrict_strategy |
| 276 | Remediation_Shell_script_⇲ | ||
| 277 | var_system_crypto_policy='DEFAULT' | ||
| 278 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 279 | rc=$? | ||
| 280 | if·test·"$rc"·=·127;·then | ||
| 281 | » echo·"$stderr_of_call"·>&2 | ||
| 282 | » echo·"Make·sure·that·the·script·is·installed·on·the·remediated·system."·>&2 | ||
| 283 | » echo·"See·output·of·the·'dnf·provides·update-crypto-policies'·command"·>&2 | ||
| 284 | » echo·"to·see·what·package·to·(re)install"·>&2 | ||
| 285 | » false··#·end·with·an·error·code | ||
| 286 | elif·test·"$rc"·!=·0;·then | ||
| 287 | » echo·"Error·invoking·the·update-crypto-policies·script:·$stderr_of_call"·>&2 | ||
| 288 | » false··#·end·with·an·error·code | ||
| 289 | fi | ||
| 290 | ***·Rule ·Configure·Kerberos·to·use·System·Crypto·Policy· [ref]·*** | 295 | ***·Rule ·Configure·Kerberos·to·use·System·Crypto·Policy· [ref]·*** |
| 291 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Kerberos | 296 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Kerberos |
| 292 | is·supported·by·crypto·policy,·but·it's·configuration·may·be·set·up·to·ignore·it.·To·check·that·Crypto | 297 | is·supported·by·crypto·policy,·but·it's·configuration·may·be·set·up·to·ignore·it.·To·check·that·Crypto |
| 293 | Policies·settings·for·Kerberos·are·configured·correctly,·examine·that·there·is·a·symlink·at·/etc/ | 298 | Policies·settings·for·Kerberos·are·configured·correctly,·examine·that·there·is·a·symlink·at·/etc/ |
| 294 | krb5.conf.d/crypto-policies·targeting·/etc/cypto-policies/back-ends/krb5.config.·If·the·symlink | 299 | krb5.conf.d/crypto-policies·targeting·/etc/cypto-policies/back-ends/krb5.config.·If·the·symlink |
| 295 | exists,·Kerberos·is·configured·to·use·the·system-wide·crypto·policy·settings. | 300 | exists,·Kerberos·is·configured·to·use·the·system-wide·crypto·policy·settings. |
| 296 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·Kerberos·violate·expectations, | 301 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·Kerberos·violate·expectations, |
| 297 | ············and·makes·system·configuration·more·fragmented. | 302 | ············and·makes·system·configuration·more·fragmented. |
| 298 | Severity: ·high | 303 | Severity: ·high |
| 299 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy | 304 | Rule·ID:····xccdf_org.ssgproject.content_rule_configure_kerberos_crypto_policy |
| 300 | Identifiers·References: ·0418,·1055,·1402,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-13,·SC-12(2),·SC-12(3), | 305 | Identifiers·References: ·0418,·1055,·1402,·CIP-003-8_R4.2,·CIP-007-3_R5.1,·SC-13,·SC-12(2),·SC-12(3), |
| 301 | and·········SRG-OS-000120-GPOS-00061 | 306 | and·········SRG-OS-000120-GPOS-00061 |
| 302 | References | 307 | References |
| 308 | Remediation_Shell_script_⇲ | ||
| 309 | Complexity:·low | ||
| 310 | Disruption:·low | ||
| 311 | Reboot:·····true | ||
| 312 | Strategy:···configure | ||
| 313 | rm·-f·/etc/krb5.conf.d/crypto-policies | ||
| 314 | ln·-s·/etc/crypto-policies/back-ends/krb5.config·/etc/krb5.conf.d/crypto-policies | ||
| 303 | Remediation_Ansible_snippet_⇲ | 315 | Remediation_Ansible_snippet_⇲ |
| 304 | Complexity:·low | 316 | Complexity:·low |
| 305 | Disruption:·low | 317 | Disruption:·low |
| 306 | Reboot:·····true | 318 | Reboot:·····true |
| 307 | Strategy:···configure | 319 | Strategy:···configure |
| 308 | -·name:·Configure·Kerberos·to·use·System·Crypto·Policy | 320 | -·name:·Configure·Kerberos·to·use·System·Crypto·Policy |
| 309 | ··file: | 321 | ··file: |
| Offset 321, 35 lines modified | Offset 329, 40 lines modified | ||
| 321 | ··-·NIST-800-53-SC-13 | 329 | ··-·NIST-800-53-SC-13 |
| 322 | ··-·configure_kerberos_crypto_policy | 330 | ··-·configure_kerberos_crypto_policy |
| 323 | ··-·configure_strategy | 331 | ··-·configure_strategy |
| 324 | ··-·high_severity | 332 | ··-·high_severity |
| 325 | ··-·low_complexity | 333 | ··-·low_complexity |
| 326 | ··-·low_disruption | 334 | ··-·low_disruption |
| 327 | ··-·reboot_required | 335 | ··-·reboot_required |
| 328 | Remediation_Shell_script_⇲ | ||
| 329 | Complexity:·low | ||
| 330 | Disruption:·low | ||
| 331 | Reboot:·····true | ||
| 332 | Strategy:···configure | ||
| 333 | rm·-f·/etc/krb5.conf.d/crypto-policies | ||
| 334 | ln·-s·/etc/crypto-policies/back-ends/krb5.config·/etc/krb5.conf.d/crypto-policies | ||
| 335 | ***·Rule ·Configure·Libreswan·to·use·System·Crypto·Policy· [ref]·*** | 336 | ***·Rule ·Configure·Libreswan·to·use·System·Crypto·Policy· [ref]·*** |
| 336 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Libreswan | 337 | Crypto·Policies·provide·a·centralized·control·over·crypto·algorithms·usage·of·many·packages.·Libreswan |
| 337 | is·supported·by·system·crypto·policy,·but·the·Libreswan·configuration·may·be·set·up·to·ignore·it.·To | 338 | is·supported·by·system·crypto·policy,·but·the·Libreswan·configuration·may·be·set·up·to·ignore·it.·To |
| 338 | check·that·Crypto·Policies·settings·are·configured·correctly,·ensure·that·the·/etc/ipsec.conf·includes | 339 | check·that·Crypto·Policies·settings·are·configured·correctly,·ensure·that·the·/etc/ipsec.conf·includes |
| 339 | the·appropriate·configuration·file.·In·/etc/ipsec.conf,·make·sure·that·the·following·line·is·not | 340 | the·appropriate·configuration·file.·In·/etc/ipsec.conf,·make·sure·that·the·following·line·is·not |
| 340 | commented·out·or·superseded·by·later·includes:·include·/etc/crypto-policies/back-ends/libreswan.config | 341 | commented·out·or·superseded·by·later·includes:·include·/etc/crypto-policies/back-ends/libreswan.config |
| 341 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·the·Libreswan·service·violate | 342 | Rationale:··Overriding·the·system·crypto·policy·makes·the·behavior·of·the·Libreswan·service·violate |
| Max diff block lines reached; 7196/12515 bytes (57.50%) of diff not shown. | |||
| Offset 62, 570 lines modified | Offset 62, 570 lines modified | ||
| 000003d0:·7468·3e0a·2020·2020·3c74·683e·5275·6c65··th>.····<th>Rule | 000003d0:·7468·3e0a·2020·2020·3c74·683e·5275·6c65··th>.····<th>Rule | ||
| 000003e0:·2054·6974·6c65·3c2f·7468·3e0a·2020·2020···Title</th>.···· | 000003e0:·2054·6974·6c65·3c2f·7468·3e0a·2020·2020···Title</th>.···· | ||
| 000003f0:·3c74·683e·4465·7363·7269·7074·696f·6e3c··<th>Description< | 000003f0:·3c74·683e·4465·7363·7269·7074·696f·6e3c··<th>Description< | ||
| 00000400:·2f74·683e·0a20·2020·203c·7468·3e52·6174··/th>.····<th>Rat | 00000400:·2f74·683e·0a20·2020·203c·7468·3e52·6174··/th>.····<th>Rat | ||
| 00000410:·696f·6e61·6c65·3c2f·7468·3e0a·2020·3c2f··ionale</th>.··</ | 00000410:·696f·6e61·6c65·3c2f·7468·3e0a·2020·3c2f··ionale</th>.··</ | ||
| 00000420:·7468·6561·643e·0a20·203c·7462·6f64·793e··thead>.··<tbody> | 00000420:·7468·6561·643e·0a20·203c·7462·6f64·793e··thead>.··<tbody> | Diff chunk too large, falling back to line-by-line diff (556 lines added, 556 lines removed) | |
| 00000430:·0a20·203c·7472·3e0a·2020·2020·2020·3c74··.··<tr>.······<t | 00000430:·0a20·203c·7472·3e0a·2020·2020·2020·3c74··.··<tr>.······<t | ||
| 00000440:·643e·4250·3238·2852·3129·3c | 00000440:·643e·4250·3238·2852·3129·3c62·722f·3e4e··d>BP28(R1)<br/>N | ||
| 00000450:· | 00000450:·5430·3037·2852·3033·293c·2f74·643e·0a20··T007(R03)</td>.· | ||
| 00000460:· | 00000460:·2020·2020·203c·7464·3e55·6e69·6e73·7461·······<td>Uninsta | ||
| 00000470:·6 | 00000470:·6c6c·2074·6865·2074·656c·6e65·7420·7365··ll·the·telnet·se | ||
| 00000480:· | 00000480:·7276·6572·3c2f·7464·3e0a·2020·2020·2020··rver</td>.······ | ||
| 00000490:· | 00000490:·3c74·6420·786d·6c3a·6c61·6e67·3d22·656e··<td·xml:lang="en | ||
| 000004a0:· | 000004a0:·2d55·5322·3e0a·2020·2020·2020·2020·5468··-US">.········Th | ||
| 000004b0:·6 | 000004b0:·6520·7465·6c6e·6574·2064·6165·6d6f·6e20··e·telnet·daemon· | ||
| 000004c0:· | 000004c0:·7368·6f75·6c64·2062·6520·756e·696e·7374··should·be·uninst | ||
| 000004d0:· | 000004d0:·616c·6c65·642e·0a20·2020·2020·203c·2f74··alled..······</t | ||
| 000004e0:·6 | 000004e0:·643e·0a20·2020·2020·203c·7464·2078·6d6c··d>.······<td·xml | ||
| 000004f0:· | 000004f0:·3a6c·616e·673d·2265·6e2d·5553·223e·0a20··:lang="en-US">.· | ||
| 00000500:· | 00000500:·2020·2020·2020·203c·7474·3e74·656c·6e65·········<tt>telne | ||
| 00000510:· | 00000510:·743c·2f74·743e·2061·6c6c·6f77·7320·636c··t</tt>·allows·cl | ||
| 00000520:· | 00000520:·6561·7220·7465·7874·2063·6f6d·6d75·6e69··ear·text·communi | ||
| 00000530:· | 00000530:·6361·7469·6f6e·732c·2061·6e64·2064·6f65··cations,·and·doe | ||
| 00000540:· | 00000540:·7320·6e6f·7420·7072·6f74·6563·740a·616e··s·not·protect.an | ||
| 00000550:· | 00000550:·7920·6461·7461·2074·7261·6e73·6d69·7373··y·data·transmiss | ||
| 00000560:·6 | 00000560:·696f·6e20·6265·7477·6565·6e20·636c·6965··ion·between·clie | ||
| 00000570:·6e | 00000570:·6e74·2061·6e64·2073·6572·7665·722e·2041··nt·and·server.·A | ||
| 00000580:·6 | 00000580:·6e79·2063·6f6e·6669·6465·6e74·6961·6c20··ny·confidential· | ||
| 00000590:· | 00000590:·6461·7461·0a63·616e·2062·6520·6c69·7374··data.can·be·list | ||
| 000005a0:·6 | 000005a0:·656e·6564·2061·6e64·206e·6f20·696e·7465··ened·and·no·inte | ||
| 000005b0:·6 | 000005b0:·6772·6974·7920·6368·6563·6b69·6e67·2069··grity·checking·i | ||
| 000005c0:· | 000005c0:·7320·6d61·6465·2e27·0a20·2020·2020·203c··s·made.'.······< | ||
| 000005d0:· | 000005d0:·2f74·643e·0a20·2020·203c·2f74·723e·0a20··/td>.····</tr>.· | ||
| 000005e0:· | 000005e0:·2020·203c·7472·3e0a·2020·2020·2020·3c74·····<tr>.······<t | ||
| 000005f0:· | 000005f0:·643e·4250·3238·2852·3129·3c2f·7464·3e0a··d>BP28(R1)</td>. | ||
| 00000600:· | 00000600:·2020·2020·2020·3c74·643e·556e·696e·7374········<td>Uninst | ||
| 00000610:· | 00000610:·616c·6c20·5365·6e64·6d61·696c·2050·6163··all·Sendmail·Pac | ||
| 00000620:·6 | 00000620:·6b61·6765·3c2f·7464·3e0a·2020·2020·2020··kage</td>.······ | ||
| 00000630:· | 00000630:·3c74·6420·786d·6c3a·6c61·6e67·3d22·656e··<td·xml:lang="en | ||
| 00000640:· | 00000640:·2d55·5322·3e0a·2020·2020·2020·2020·5365··-US">.········Se | ||
| 00000650:· | 00000650:·6e64·6d61·696c·2069·7320·6e6f·7420·7468··ndmail·is·not·th | ||
| 00000660:· | 00000660:·6520·6465·6661·756c·7420·6d61·696c·2074··e·default·mail·t | ||
| 00000670:· | 00000670:·7261·6e73·6665·7220·6167·656e·7420·616e··ransfer·agent·an | ||
| 00000680:· | 00000680:·6420·6973·0a6e·6f74·2069·6e73·7461·6c6c··d·is.not·install | ||
| 00000690:· | 00000690:·6564·2062·7920·6465·6661·756c·742e·0a54··ed·by·default..T | ||
| 000006a0:· | 000006a0:·6865·203c·636f·6465·3e73·656e·646d·6169··he·<code>sendmai | ||
| 000006b0:·6c | 000006b0:·6c3c·2f63·6f64·653e·2070·6163·6b61·6765··l</code>·package | ||
| 000006c0:·20 | 000006c0:·2063·616e·2062·6520·7265·6d6f·7665·6420···can·be·removed· | ||
| 000006d0:· | 000006d0:·7769·7468·2074·6865·2066·6f6c·6c6f·7769··with·the·followi | ||
| 000006e0:· | 000006e0:·6e67·2063·6f6d·6d61·6e64·3a0a·3c70·7265··ng·command:.<pre | ||
| 000006f0:· | 000006f0:·3e0a·2420·7375·646f·2079·756d·2065·7261··>.$·sudo·yum·era | ||
| 00000700:· | 00000700:·7365·2073·656e·646d·6169·6c3c·2f70·7265··se·sendmail</pre | ||
| 00000710:· | 00000710:·3e0a·2020·2020·2020·3c2f·7464·3e0a·2020··>.······</td>.·· | ||
| 00000720:· | 00000720:·2020·2020·3c74·6420·786d·6c3a·6c61·6e67······<td·xml:lang | ||
| 00000730:· | 00000730:·3d22·656e·2d55·5322·3e0a·2020·2020·2020··="en-US">.······ | ||
| 00000740:·2020· | 00000740:·2020·5468·6520·7365·6e64·6d61·696c·2073····The·sendmail·s | ||
| 00000750:· | 00000750:·6f66·7477·6172·6520·7761·7320·6e6f·7420··oftware·was·not· | ||
| 00000760:· | 00000760:·6465·7665·6c6f·7065·6420·7769·7468·2073··developed·with·s | ||
| 00000770:·65 | 00000770:·6563·7572·6974·7920·696e·206d·696e·6420··ecurity·in·mind· | ||
| 00000780:· | 00000780:·616e·640a·6974·7320·6465·7369·676e·2070··and.its·design·p | ||
| 00000790:·7 | 00000790:·7265·7665·6e74·7320·6974·2066·726f·6d20··revents·it·from· | ||
| 000007a0:· | 000007a0:·6265·696e·6720·6566·6665·6374·6976·656c··being·effectivel | ||
| 000007b0:· | 000007b0:·7920·636f·6e74·6169·6e65·6420·6279·2053··y·contained·by·S | ||
| 000007c0:· | 000007c0:·454c·696e·7578·2e20·2050·6f73·7466·6978··ELinux.··Postfix | ||
| 000007d0:· | 000007d0:·0a73·686f·756c·6420·6265·2075·7365·6420··.should·be·used· | ||
| 000007e0:· | 000007e0:·696e·7374·6561·642e·0a20·2020·2020·203c··instead..······< | ||
| 000007f0:· | 000007f0:·2f74·643e·0a20·2020·203c·2f74·723e·0a20··/td>.····</tr>.· | ||
| 00000800:· | 00000800:·2020·203c·7472·3e0a·2020·2020·2020·3c74·····<tr>.······<t | ||
| 00000810:· | 00000810:·643e·4250·3238·2852·3129·3c2f·7464·3e0a··d>BP28(R1)</td>. | ||
| 00000820:· | 00000820:·2020·2020·2020·3c74·643e·556e·696e·7374········<td>Uninst | ||
| 00000830:·6 | 00000830:·616c·6c20·7869·6e65·7464·2050·6163·6b61··all·xinetd·Packa | ||
| 00000840:·6 | 00000840:·6765·3c2f·7464·3e0a·2020·2020·2020·3c74··ge</td>.······<t | ||
| 00000850:·207 | 00000850:·6420·786d·6c3a·6c61·6e67·3d22·656e·2d55··d·xml:lang="en-U | ||
| 00000860:· | 00000860:·5322·3e0a·2020·2020·2020·2020·5468·6520··S">.········The· | ||
| 00000870:·636 | 00000870:·3c63·6f64·653e·7869·6e65·7464·3c2f·636f··<code>xinetd</co | ||
| 00000880:· | 00000880:·6465·3e20·7061·636b·6167·6520·6361·6e20··de>·package·can· | ||
| 00000890:· | 00000890:·6265·2072·656d·6f76·6564·2077·6974·6820··be·removed·with· | ||
| 000008a0:· | 000008a0:·7468·6520·666f·6c6c·6f77·696e·6720·636f··the·following·co | ||
| 000008b0:· | 000008b0:·6d6d·616e·643a·0a3c·7072·653e·0a24·2073··mmand:.<pre>.$·s | ||
| 000008c0:· | 000008c0:·7564·6f20·7975·6d20·6572·6173·6520·7869··udo·yum·erase·xi | ||
| 000008d0:·6 | 000008d0:·6e65·7464·3c2f·7072·653e·0a20·2020·2020··netd</pre>.····· | ||
| 000008e0:·20 | 000008e0:·203c·2f74·643e·0a20·2020·2020·203c·7464···</td>.······<td | ||
| 000008f0:· | 000008f0:·2078·6d6c·3a6c·616e·673d·2265·6e2d·5553···xml:lang="en-US | ||
| 00000900:· | 00000900:·223e·0a20·2020·2020·2020·2052·656d·6f76··">.········Remov | ||
| 00000910:· | 00000910:·696e·6720·7468·6520·3c74·743e·7869·6e65··ing·the·<tt>xine | ||
| 00000920:· | 00000920:·7464·3c2f·7474·3e20·7061·636b·6167·6520··td</tt>·package· | ||
| 00000930:·6 | 00000930:·6465·6372·6561·7365·7320·7468·6520·7269··decreases·the·ri | ||
| 00000940:· | 00000940:·736b·206f·6620·7468·650a·7869·6e65·7464··sk·of·the.xinetd | ||
| 00000950:· | 00000950:·2073·6572·7669·6365·2773·2061·6363·6964···service's·accid | ||
| 00000960:·65 | 00000960:·656e·7461·6c20·286f·7220·696e·7465·6e74··ental·(or·intent | ||
| 00000970:· | 00000970:·696f·6e61·6c29·2061·6374·6976·6174·696f··ional)·activatio | ||
| 00000980:· | 00000980:·6e2e·0a20·2020·2020·203c·2f74·643e·0a20··n..······</td>.· | ||
| 00000990:· | 00000990:·2020·203c·2f74·723e·0a20·2020·203c·7472·····</tr>.····<tr | ||
| 000009a0:· | 000009a0:·3e0a·2020·2020·2020·3c74·643e·4250·3238··>.······<td>BP28 | ||
| 000009b0:· | 000009b0:·2852·3129·3c2f·7464·3e0a·2020·2020·2020··(R1)</td>.······ | ||
| 000009c0:· | 000009c0:·3c74·643e·5265·6d6f·7665·204e·4953·2043··<td>Remove·NIS·C | ||
| 000009d0:·6 | 000009d0:·6c69·656e·743c·2f74·643e·0a20·2020·2020··lient</td>.····· | ||
| 000009e0:· | 000009e0:·203c·7464·2078·6d6c·3a6c·616e·673d·2265···<td·xml:lang="e | ||
| 000009f0:·6 | 000009f0:·6e2d·5553·223e·0a20·2020·2020·2020·2054··n-US">.········T | ||
| 00000a00:· | 00000a00:·6865·204e·6574·776f·726b·2049·6e66·6f72··he·Network·Infor | ||
| 00000a10:·6 | 00000a10:·6d61·7469·6f6e·2053·6572·7669·6365·2028··mation·Service·( | ||
| 00000a20:· | 00000a20:·4e49·5329·2c20·666f·726d·6572·6c79·206b··NIS),·formerly·k | ||
| 00000a30:· | 00000a30:·6e6f·776e·2061·7320·5965·6c6c·6f77·2050··nown·as·Yellow·P | ||
| 00000a40:· | 00000a40:·6167·6573·2c0a·6973·2061·2063·6c69·656e··ages,.is·a·clien | ||
| 00000a50:· | 00000a50:·742d·7365·7276·6572·2064·6972·6563·746f··t-server·directo | ||
| 00000a60:· | 00000a60:·7279·2073·6572·7669·6365·2070·726f·746f··ry·service·proto | ||
| 00000a70:· | 00000a70:·636f·6c20·7573·6564·2074·6f20·6469·7374··col·used·to·dist | ||
| 00000a80:· | 00000a80:·7269·6275·7465·2073·7973·7465·6d20·636f··ribute·system·co | ||
| 00000a90:· | 00000a90:·6e66·6967·7572·6174·696f·6e0a·6669·6c65··nfiguration.file | ||
| 00000aa0:·7 | 00000aa0:·732e·2054·6865·204e·4953·2063·6c69·656e··s.·The·NIS·clien | ||
| 00000ab0:· | 00000ab0:·7420·283c·7474·3e79·7062·696e·643c·2f74··t·(<tt>ypbind</t | ||
| 00000ac0:· | 00000ac0:·743e·2920·7761·7320·7573·6564·2074·6f20··t>)·was·used·to· | ||
| 00000ad0:· | 00000ad0:·6269·6e64·2061·2073·7973·7465·6d20·746f··bind·a·system·to | ||
| 00000ae0:· | 00000ae0:·2061·6e20·4e49·5320·7365·7276·6572·0a61···an·NIS·server.a | ||
| 00000af0:·6 | 00000af0:·6e64·2072·6563·6569·7665·2074·6865·2064··nd·receive·the·d | ||
| 00000b00:· | 00000b00:·6973·7472·6962·7574·6564·2063·6f6e·6669··istributed·confi | ||
| 00000b10:· | 00000b10:·6775·7261·7469·6f6e·2066·696c·6573·2e0a··guration·files.. | ||
| 00000b20:· | 00000b20:·2020·2020·2020·3c2f·7464·3e0a·2020·2020········</td>.···· | ||
| 00000b30:· | 00000b30:·2020·3c74·6420·786d·6c3a·6c61·6e67·3d22····<td·xml:lang=" | ||
| 00000b40:·6 | 00000b40:·656e·2d55·5322·3e0a·2020·2020·2020·2020··en-US">.········ | ||
| 00000b50:· | 00000b50:·5468·6520·4e49·5320·7365·7276·6963·6520··The·NIS·service· | ||
| 00000b60:·6 | 00000b60:·6973·2069·6e68·6572·656e·746c·7920·616e··is·inherently·an | ||
| 00000b70:·6 | 00000b70:·2069·6e73·6563·7572·6520·7379·7374·656d···insecure·system | ||
| 00000b80:· | 00000b80:·2074·6861·7420·6861·7320·6265·656e·2076···that·has·been·v | ||
| 00000b90:· | 00000b90:·756c·6e65·7261·626c·650a·746f·2044·4f53··ulnerable.to·DOS | ||
| 00000ba0:· | 00000ba0:·2061·7474·6163·6b73·2c20·6275·6666·6572···attacks,·buffer | ||
| Max diff block lines reached; 1032010/1109312 bytes (93.03%) of diff not shown. | |||
| Offset 1, 125 lines modified | Offset 1, 125 lines modified | ||
| 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle·Linux | 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle·Linux |
| 2 | 7 | 2 | 7 |
| 3 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does | ||
| 4 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 5 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 6 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 7 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted | ||
| 8 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 9 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 10 | ·············································································in | 3 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data |
| 4 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 5 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 6 | (R03) | ||
| 7 | ································Sendmail·is·not·the·default·mail·transfer | ||
| 8 | BP28··Uninstall·Sendmail········agent·and·is·not·installed·by·default.·The···The·sendmail·software·was·not·developed·with·security·in·mind·and·its·design | ||
| 9 | (R1)··Package···················sendmail·package·can·be·removed·with·the·····prevents·it·from·being·effectively·contained·by·SELinux.·Postfix·should·be | ||
| 10 | ································following·command:···························used·instead. | ||
| 11 | ································$·sudo·yum·erase·sendmail | ||
| 11 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's | 12 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's |
| 12 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. | 13 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. |
| 13 | ································$·sudo·yum·erase·xinetd | 14 | ································$·sudo·yum·erase·xinetd |
| 14 | ································The·talk·package·contains·the·client·program | ||
| 15 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 16 | ································the·user·to·chat·with·other·users·on | ||
| 17 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 18 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 19 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 20 | ································ | 15 | ································The·Network·Information·Service·(NIS), |
| 16 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 17 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 18 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 19 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 20 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 21 | ································distributed·configuration·files. | ||
| 22 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 23 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 24 | (R1)··Package···················The·dhcp·package·can·be·removed·with·the·····reactivated·and·disrupt·network·operation. | ||
| 21 | ································command: | 25 | ································following·command: |
| 22 | ································$·sudo·yum·erase· | 26 | ································$·sudo·yum·erase·dhcp |
| 27 | ·············································································Removing·the·tftp-server·package·decreases·the·risk·of·the·accidental·(or | ||
| 28 | ·············································································intentional)·activation·of·tftp·services. | ||
| 29 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 30 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 31 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| 32 | ·············································································Securty·Manager·(ISSM),·restricted·to·only·authorized·personnel,·and·have | ||
| 33 | ·············································································access·control·rules·established. | ||
| 23 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, | 34 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, |
| 24 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These | 35 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These |
| 25 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain | 36 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain |
| 26 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional | 37 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional |
| 27 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. | 38 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. |
| 28 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does | 39 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does |
| 29 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 40 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 30 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the | 41 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the |
| 31 | ·············································································privileged·user·password·could·be·compromised. | 42 | ·············································································privileged·user·password·could·be·compromised. |
| 32 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet | 43 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet |
| 33 | ·············································································service's·accidental·(or·intentional)·activation. | 44 | ·············································································service's·accidental·(or·intentional)·activation. |
| 34 | ································The·Network·Information·Service·(NIS), | ||
| 35 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 36 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 37 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 38 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 39 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 40 | ································dis | 45 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does |
| 46 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 47 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 48 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 49 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 50 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 51 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 52 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 53 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 54 | ·············································································rsh,rcp,·and·rlogin. | ||
| 55 | ································The·talk·package·contains·the·client·program | ||
| 56 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 57 | ································the·user·to·chat·with·other·users·on | ||
| 58 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 59 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 60 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 61 | ································package·can·be·removed·with·the·following | ||
| 62 | ································command: | ||
| 63 | ································$·sudo·yum·erase·talk | ||
| 41 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does | 64 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does |
| 42 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 65 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 43 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were | 66 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were |
| 44 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be | 67 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be |
| 45 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure | 68 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure |
| 46 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' | 69 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' |
| 47 | ·············································································accidental·(or·intentional)·activation. | 70 | ·············································································accidental·(or·intentional)·activation. |
| 48 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data | ||
| 49 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 50 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 51 | (R03) | ||
| 52 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a | 71 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a |
| 53 | ································simple·file·transfer·protocol,·typically | 72 | ································simple·file·transfer·protocol,·typically |
| 54 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for | 73 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for |
| 55 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when | 74 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when |
| 56 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. | 75 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. |
| 57 | ································hacked.·The·package·tftp·is·a·client·program | 76 | ································hacked.·The·package·tftp·is·a·client·program |
| 58 | ································that·allows·for·connections·to·a·tftp | 77 | ································that·allows·for·connections·to·a·tftp |
| 59 | ································server. | 78 | ································server. |
| 60 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 61 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 62 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 63 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 64 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 65 | ·············································································rsh,rcp,·and·rlogin. | ||
| 66 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 67 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 68 | (R1)··Package···················The·dhcp·package·can·be·removed·with·the·····reactivated·and·disrupt·network·operation. | ||
| 69 | ································following·command: | ||
| 70 | ································$·sudo·yum·erase·dhcp | ||
| 71 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | 79 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols |
| 72 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of | 80 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of |
| 73 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. | 81 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. |
| 74 | ································ | 82 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted |
| 83 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 84 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 75 | ·············································································in | 85 | ·············································································included·in·Oracle·Linux·7. |
| 76 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 77 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 78 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| 79 | ·············································································Securty·Manager·(ISSM),·restricted·to·only·authorized·personnel,·and·have | ||
| Max diff block lines reached; 204865/221193 bytes (92.62%) of diff not shown. | |||
| Offset 40, 71 lines modified | Offset 40, 32 lines modified | ||
| 40 | ····<th>Mapping</th> | 40 | ····<th>Mapping</th> |
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>3.1.1<br/>3.1.6</td> | ||
| 48 | ······<td>Direct·root·Logins·Not·Allowed</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·further·limit·access·to·the·<tt>root</tt>·account,·administrators | ||
| 51 | can·disable·root·logins·at·the·console·by·editing·the·<tt>/etc/securetty</tt>·file. | ||
| 52 | This·file·lists·all·devices·the·root·user·is·allowed·to·login·to.·If·the·file·does | ||
| 53 | not·exist·at·all,·the·root·user·can·login·through·any·communication·device·on·the | ||
| 54 | system,·whether·via·the·console·or·via·a·raw·network·interface.·This·is·dangerous | ||
| 55 | as·user·can·login·to·the·system·as·root·via·Telnet,·which·sends·the·password·in | ||
| 56 | plain·text·over·the·network.·By·default,·Oracle·Linux·7's | ||
| 57 | <tt>/etc/securetty</tt>·file·only·allows·the·root·user·to·login·at·the·console | ||
| 58 | physically·attached·to·the·system.·To·prevent·root·from·logging·in,·remove·the | ||
| 59 | contents·of·this·file.·To·prevent·direct·root·logins,·remove·the·contents·of·this | ||
| 60 | file·by·typing·the·following·command: | ||
| 61 | <pre> | ||
| 62 | $·sudo·echo·>·/etc/securetty | ||
| 63 | </pre> | ||
| 64 | ······</td> | ||
| 65 | ······<td·xml:lang="en-US"> | ||
| 66 | ········Disabling·direct·root·logins·ensures·proper·accountability·and·multifactor | ||
| 67 | authentication·to·privileged·accounts.·Users·will·first·login,·then·escalate | ||
| 68 | to·privileged·(root)·access·via·su·/·sudo.·This·is·required·for·FISMA·Low | ||
| 69 | and·FISMA·Moderate·systems. | ||
| 70 | ······</td> | ||
| 71 | ····</tr> | ||
| 72 | ····<tr> | ||
| 73 | ······<td>3.1.1</td> | ||
| 74 | ······<td>Disable·GDM·Guest·Login</td> | ||
| 75 | ······<td·xml:lang="en-US"> | ||
| 76 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·login·without·credentials | ||
| 77 | which·can·be·useful·for·public·kiosk·scenarios.·Allowing·users·to·login·without·credentials | ||
| 78 | or·"guest"·account·access·has·inherent·security·risks·and·should·be·disabled.·To·do·disable | ||
| 79 | timed·logins·or·guest·account·access,·set·the·<tt>TimedLoginEnable</tt>·to·<tt>false</tt>·in | ||
| 80 | the·<tt>[daemon]</tt>·section·in·<tt>/etc/gdm/custom.conf</tt>.·For·example: | ||
| 81 | <pre>[daemon] | ||
| 82 | TimedLoginEnable=false</pre> | ||
| 83 | ······</td> | ||
| 84 | ······<td·xml:lang="en-US"> | ||
| 85 | ········Failure·to·restrict·system·access·to·authenticated·users·negatively·impacts·operating | ||
| 86 | system·security. | ||
| 87 | ······</td> | ||
| 88 | ····</tr> | ||
| 89 | ····<tr> | ||
| 90 | ······<td>3.1.1<br/>3.1.5</td> | 47 | ······<td>3.1.1<br/>3.1.5</td> |
| 91 | ······<td> | 48 | ······<td>Verify·Only·Root·Has·UID·0</td> |
| 92 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 93 | ········To·restrict·root·logins·through·the·(deprecated)·virtual·console·devices, | ||
| 94 | ensure·lines·of·this·form·do·not·appear·in·<tt>/etc/securetty</tt>: | ||
| 95 | <pre>vc/1 | ||
| 96 | vc/2 | ||
| 97 | vc/3 | ||
| 98 | 50 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | |
| 51 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 52 | their·UID·changed. | ||
| 53 | <br·/> | ||
| 54 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 55 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 56 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 57 | assigned. | ||
| 99 | ······</td> | 58 | ······</td> |
| 100 | ······<td·xml:lang="en-US"> | 59 | ······<td·xml:lang="en-US"> |
| 101 | ········Preventing·direct·root·login·to·virtual·console·devices | ||
| 102 | helps·ensure·accountability·for·actions·taken·on·the·system | ||
| 103 | usi | 60 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts |
| 61 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 62 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 63 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 64 | access·to·root·privileges·in·an·accountable·manner. | ||
| 104 | ······</td> | 65 | ······</td> |
| 105 | ····</tr> | 66 | ····</tr> |
| 106 | ····<tr> | 67 | ····<tr> |
| 107 | ······<td>3.1.1<br/>3.1.5</td> | 68 | ······<td>3.1.1<br/>3.1.5</td> |
| 108 | ······<td>Disable·SSH·Root·Login</td> | 69 | ······<td>Disable·SSH·Root·Login</td> |
| 109 | ······<td·xml:lang="en-US"> | 70 | ······<td·xml:lang="en-US"> |
| 110 | ········The·root·user·should·never·be·allowed·to·login·to·a | 71 | ········The·root·user·should·never·be·allowed·to·login·to·a |
| Offset 121, 32 lines modified | Offset 82, 28 lines modified | ||
| 121 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | 82 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. |
| 122 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | 83 | In·addition,·logging·in·with·a·user-specific·account·provides·individual |
| 123 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | 84 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize |
| 124 | direct·attack·attempts·on·root's·password. | 85 | direct·attack·attempts·on·root's·password. |
| 125 | ······</td> | 86 | ······</td> |
| 126 | ····</tr> | 87 | ····</tr> |
| 127 | ····<tr> | 88 | ····<tr> |
| 128 | ······<td>3.1.1<br/>3. | 89 | ······<td>3.1.1<br/>3.4.5</td> |
| 129 | ······<td> | 90 | ······<td>Require·Authentication·for·Emergency·Systemd·Target</td> |
| 130 | ······<td·xml:lang="en-US"> | 91 | ······<td·xml:lang="en-US"> |
| 92 | ········Emergency·mode·is·intended·as·a·system·recovery | ||
| 93 | method,·providing·a·single·user·root·access·to·the·system | ||
| 94 | during·a·failed·boot·sequence. | ||
| 95 | <br·/><br·/> | ||
| 96 | By·default,·Emergency·mode·is·protected·by·requiring·a·password·and·is·set | ||
| 97 | in·<tt>/usr/lib/systemd/system/emergency.service</tt>. | ||
| 131 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | ||
| 132 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 133 | their·UID·changed. | ||
| 134 | <br·/> | ||
| 135 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 136 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 137 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 138 | assigned. | ||
| 139 | ······</td> | 98 | ······</td> |
| 140 | ······<td·xml:lang="en-US"> | 99 | ······<td·xml:lang="en-US"> |
| 100 | ········This·prevents·attackers·with·physical·access·from·trivially·bypassing·security | ||
| 101 | on·the·machine·and·gaining·root·access.·Such·accesses·are·further·prevented | ||
| 102 | by·configuring·the·bootloader·password. | ||
| 141 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts | ||
| 142 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 143 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 144 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 145 | access·to·root·privileges·in·an·accountable·manner. | ||
| 146 | ······</td> | 103 | ······</td> |
| 147 | ····</tr> | 104 | ····</tr> |
| 148 | ····<tr> | 105 | ····<tr> |
| 149 | ······<td>3.1.1</td> | 106 | ······<td>3.1.1</td> |
| 150 | ······<td>Disable·GDM·Automatic·Login</td> | 107 | ······<td>Disable·GDM·Automatic·Login</td> |
| 151 | ······<td·xml:lang="en-US"> | 108 | ······<td·xml:lang="en-US"> |
| 152 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without | 109 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without |
| Offset 159, 43 lines modified | Offset 116, 28 lines modified | ||
| 159 | ······</td> | 116 | ······</td> |
| 160 | ······<td·xml:lang="en-US"> | 117 | ······<td·xml:lang="en-US"> |
| Max diff block lines reached; 407886/413801 bytes (98.57%) of diff not shown. | |||
| Offset 1, 48 lines modified | Offset 1, 31 lines modified | ||
| 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of | 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of |
| 2 | Oracle·Linux·7 | 2 | Oracle·Linux·7 |
| 3 | ·····································To·further·limit·access·to·the·root·account, | ||
| 4 | ·····································administrators·can·disable·root·logins·at·the·console··Disabling·direct | ||
| 5 | ·····································by·editing·the·/etc/securetty·file.·This·file·lists····root·logins·ensures | ||
| 6 | ·····································all·devices·the·root·user·is·allowed·to·login·to.·If···proper | ||
| 7 | ·····································the·file·does·not·exist·at·all,·the·root·user·can······accountability·and | ||
| 8 | ·····································login·through·any·communication·device·on·the·system,··multifactor | ||
| 9 | ·····································whether·via·the·console·or·via·a·raw·network···········authentication·to | ||
| 10 | 3.1.1···Direct·root·Logins·Not·······interface.·This·is·dangerous·as·user·can·login·to·the··privileged·accounts. | ||
| 11 | 3.1.6···Allowed······················system·as·root·via·Telnet,·which·sends·the·password·in·Users·will·first | ||
| 12 | ·····································plain·text·over·the·network.·By·default,·Oracle·Linux··login,·then·escalate | ||
| 13 | ·····································7's·/etc/securetty·file·only·allows·the·root·user·to···to·privileged·(root) | ||
| 14 | ·····································login·at·the·console·physically·attached·to·the········access·via·su·/ | ||
| 15 | ·····································system.·To·prevent·root·from·logging·in,·remove·the····sudo.·This·is | ||
| 16 | ·····································contents·of·this·file.·To·prevent·direct·root·logins,··required·for·FISMA | ||
| 17 | ·····································remove·the·contents·of·this·file·by·typing·the·········Low·and·FISMA | ||
| 18 | ·····································following·command:·····································Moderate·systems. | ||
| 19 | ·····································$·sudo·echo·>·/etc/securetty | ||
| 20 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 21 | ·····································login·without·credentials·which·can·be·useful·for | ||
| 22 | ·····································public·kiosk·scenarios.·Allowing·users·to·login········Failure·to·restrict | ||
| 23 | ·····································without·credentials·or·"guest"·account·access·has······system·access·to | ||
| 24 | 3.1.1···Disable·GDM·Guest·Login······inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users | ||
| 25 | ·····································disable·timed·logins·or·guest·account·access,·set·the··negatively·impacts | ||
| 26 | ·····································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/·operating·system | ||
| 27 | ·····································etc/gdm/custom.conf.·For·example:······················security. | ||
| 28 | ·····································[daemon] | ||
| 29 | ·····································TimedLoginEnable=false | ||
| 30 | ·····································To·restrict·root·logins·through·the·(deprecated)·······Preventing·direct | ||
| 31 | ·····································virtual·console·devices,·ensure·lines·of·this·form·do··root·login·to | ||
| 32 | ·····································not·appear·in·/etc/securetty:··························virtual·console | ||
| 33 | 3.1.1···Restrict·Virtual·Console·····vc/1···················································devices·helps·ensure | ||
| 34 | 3.1.5···Root·Logins··················vc/2···················································accountability·for | ||
| 35 | ·····································vc/3···················································actions·taken·on·the | ||
| 36 | ·····································vc/4···················································system·using·the | ||
| 37 | ···························································································· | 3 | ····························································································An·account·has·root |
| 4 | ····························································································authority·if·it·has | ||
| 5 | ····························································································a·UID·of·0.·Multiple | ||
| 6 | ····························································································accounts·with·a·UID | ||
| 7 | ·····································If·any·account·other·than·root·has·a·UID·of·0,·this····of·0·afford·more | ||
| 8 | ·····································misconfiguration·should·be·investigated·and·the········opportunity·for | ||
| 9 | ·····································accounts·other·than·root·should·be·removed·or·have·····potential·intruders | ||
| 10 | ·····································their·UID·changed.·····································to·guess·a·password | ||
| 11 | 3.1.1···Verify·Only·Root·Has·UID·0···If·the·account·is·associated·with·system·commands·or···for·a·privileged | ||
| 12 | 3.1.5································applications·the·UID·should·be·changed·to·one·greater··account.·Proper | ||
| 13 | ·····································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··configuration·of | ||
| 14 | ·····································greater·than·"1000"·that·has·not·already·been··········sudo·is·recommended | ||
| 15 | ·····································assigned.··············································to·afford·multiple | ||
| 16 | ····························································································system | ||
| 17 | ····························································································administrators | ||
| 18 | ····························································································access·to·root | ||
| 19 | ····························································································privileges·in·an | ||
| 20 | ····························································································accountable·manner. | ||
| 38 | ····························································································Even·though·the | 21 | ····························································································Even·though·the |
| 39 | ····························································································communications | 22 | ····························································································communications |
| 40 | ····························································································channel·may·be | 23 | ····························································································channel·may·be |
| 41 | ····························································································encrypted,·an | 24 | ····························································································encrypted,·an |
| 42 | ····························································································additional·layer·of | 25 | ····························································································additional·layer·of |
| 43 | ····························································································security·is·gained | 26 | ····························································································security·is·gained |
| 44 | ····························································································by·extending·the | 27 | ····························································································by·extending·the |
| Offset 56, 61 lines modified | Offset 39, 45 lines modified | ||
| 56 | ····························································································accountability·of | 39 | ····························································································accountability·of |
| 57 | ····························································································actions·performed·on | 40 | ····························································································actions·performed·on |
| 58 | ····························································································the·system·and·also | 41 | ····························································································the·system·and·also |
| 59 | ····························································································helps·to·minimize | 42 | ····························································································helps·to·minimize |
| 60 | ····························································································direct·attack | 43 | ····························································································direct·attack |
| 61 | ····························································································attempts·on·root's | 44 | ····························································································attempts·on·root's |
| 62 | ····························································································password. | 45 | ····························································································password. |
| 63 | ····························································································An·account·has·root | ||
| 64 | ····························································································authority·if·it·has | ||
| 65 | ····························································································a·UID·of·0.·Multiple | ||
| 66 | ····························································································accounts·with·a·UID | ||
| 67 | ·····································If·any·account·other·than·root·has·a·UID·of·0,·this····of·0·afford·more | ||
| 68 | ·····································misconfiguration·should·be·investigated·and·the········opportunity·for | ||
| 69 | ·····································accounts·other·than·root·should·be·removed·or·have·····potential·intruders | ||
| 70 | ·····································their·UID·changed.·····································to·guess·a·password | ||
| 71 | 3.1.1···Verify·Only·Root·Has·UID·0···If·the·account·is·associated·with·system·commands·or···for·a·privileged | ||
| 72 | 3.1.5································applications·the·UID·should·be·changed·to·one·greater··account.·Proper | ||
| 73 | ·····································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··configuration·of | ||
| 74 | ·····································greater·than·"1000"·that·has·not·already·been··········sudo·is·recommended | ||
| 75 | ·····································assigned.··············································to·afford·multiple | ||
| 76 | ····························································································s | 46 | ····························································································This·prevents |
| 77 | ····························································································administrators | ||
| 78 | ····························································································a | 47 | ····························································································attackers·with |
| 48 | ·····································Emergency·mode·is·intended·as·a·system·recovery········physical·access·from | ||
| 49 | ·····································method,·providing·a·single·user·root·access·to·the·····trivially·bypassing | ||
| 50 | 3.1.1···Require·Authentication·for···system·during·a·failed·boot·sequence.··················security·on·the | ||
| 51 | 3.4.5···Emergency·Systemd·Target····························································machine·and·gaining | ||
| 52 | ·····································By·default,·Emergency·mode·is·protected·by·requiring·a·root·access.·Such | ||
| 53 | ·····································password·and·is·set·in·/usr/lib/systemd/system/········accesses·are·further | ||
| 79 | ····································· | 54 | ·····································emergency.service.·····································prevented·by |
| 80 | ···························································································· | 55 | ····························································································configuring·the |
| 56 | ····························································································bootloader·password. | ||
| 81 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | 57 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to |
| 82 | ·····································automatically·login·without·user·interaction·or | 58 | ·····································automatically·login·without·user·interaction·or |
| 83 | ·····································credentials.·User·should·always·be·required·to·········Failure·to·restrict | 59 | ·····································credentials.·User·should·always·be·required·to·········Failure·to·restrict |
| 84 | ·····································authenticate·themselves·to·the·system·that·they·are····system·access·to | 60 | ·····································authenticate·themselves·to·the·system·that·they·are····system·access·to |
| 85 | 3.1.1···Disable·GDM·Automatic·Login··authorized·to·use.·To·disable·user·ability·to··········authenticated·users | 61 | 3.1.1···Disable·GDM·Automatic·Login··authorized·to·use.·To·disable·user·ability·to··········authenticated·users |
| 86 | ·····································automatically·login·to·the·system,·set·the·············negatively·impacts | 62 | ·····································automatically·login·to·the·system,·set·the·············negatively·impacts |
| 87 | ·····································AutomaticLoginEnable·to·false·in·the·[daemon]·section··operating·system | 63 | ·····································AutomaticLoginEnable·to·false·in·the·[daemon]·section··operating·system |
| 88 | ·····································in·/etc/gdm/custom.conf.·For·example:··················security. | 64 | ·····································in·/etc/gdm/custom.conf.·For·example:··················security. |
| 89 | ·····································[daemon] | 65 | ·····································[daemon] |
| 90 | ·····································AutomaticLoginEnable=false | 66 | ·····································AutomaticLoginEnable=false |
| 67 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 68 | ·····································login·without·credentials·which·can·be·useful·for | ||
| 69 | ·····································public·kiosk·scenarios.·Allowing·users·to·login········Failure·to·restrict | ||
| 70 | ·····································without·credentials·or·"guest"·account·access·has······system·access·to | ||
| 71 | 3.1.1···Disable·GDM·Guest·Login······inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users | ||
| 72 | ·····································disable·timed·logins·or·guest·account·access,·set·the··negatively·impacts | ||
| 73 | ·····································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/·operating·system | ||
| 74 | ·····································etc/gdm/custom.conf.·For·example:······················security. | ||
| 75 | ·····································[daemon] | ||
| 76 | ·····································TimedLoginEnable=false | ||
| 91 | ····························································································Preventing·direct | ||
| 92 | ····························································································root·login·to·serial | ||
| 93 | ·····································To·restrict·root·logins·on·serial·ports,·ensure·lines··port·interfaces | ||
| 94 | 3.1.1···Restrict·Serial·Port·Root····of·this·form·do·not·appear·in·/etc/securetty:··········helps·ensure | ||
| 95 | 3.1.5···Logins·······················ttyS0··················································accountability·for | ||
| 96 | ·····································ttyS1··················································actions·taken·on·the | ||
| 97 | ····························································································systems·using·the | ||
| 98 | ····························································································root·account. | ||
| 99 | ····························································································This·prevents | ||
| Max diff block lines reached; 714959/729573 bytes (98.00%) of diff not shown. | |||
| Offset 7647, 18 lines modified | Offset 7647, 18 lines modified | ||
| 0001dde0:·7061·7373·776f·7264·7320·6865·6c70·7320··passwords·helps· | 0001dde0:·7061·7373·776f·7264·7320·6865·6c70·7320··passwords·helps· | ||
| 0001ddf0:·656e·7375·7265·2074·6861·7420·6120·636f··ensure·that·a·co | 0001ddf0:·656e·7375·7265·2074·6861·7420·6120·636f··ensure·that·a·co | ||
| 0001de00:·6d70·726f·6d69·7365·6420·7061·7373·776f··mpromised·passwo | 0001de00:·6d70·726f·6d69·7365·6420·7061·7373·776f··mpromised·passwo | ||
| 0001de10:·7264·2069·7320·6e6f·7420·7265·2d75·7365··rd·is·not·re-use | 0001de10:·7264·2069·7320·6e6f·7420·7265·2d75·7365··rd·is·not·re-use | ||
| 0001de20:·6420·6279·2061·2075·7365·722e·0a20·203c··d·by·a·user..··< | 0001de20:·6420·6279·2061·2075·7365·722e·0a20·203c··d·by·a·user..··< | ||
| 0001de30:·2f74·643e·0a20·203c·7464·3e76·6172·5f70··/td>.··<td>var_p | 0001de30:·2f74·643e·0a20·203c·7464·3e76·6172·5f70··/td>.··<td>var_p | ||
| 0001de40:·6173·7377·6f72·645f·7061·6d5f·7265·6d65··assword_pam_reme | 0001de40:·6173·7377·6f72·645f·7061·6d5f·7265·6d65··assword_pam_reme | ||
| 0001de50:·6d62·6572·3d35·3c62·722f·3e76·6172·5f70··mber=5<br/>var_p | |||
| 0001de60:·6173·7377·6f72·645f·7061·6d5f·7265·6d65··assword_pam_reme | |||
| 0001de | 0001de70:·6d62·6572·5f63·6f6e·7472·6f6c·5f66·6c61··mber_control_fla | ||
| 0001de | 0001de80:·673d·7265·7175·6972·6564·3c2f·7464·3e0a··g=required</td>. | ||
| 0001de70:·6172·5f70·6173·7377·6f72·645f·7061·6d5f··ar_password_pam_ | |||
| 0001de80:·7265·6d65·6d62·6572·3d35·3c2f·7464·3e0a··remember=5</td>. | |||
| 0001de90:·3c2f·7472·3e0a·3c74·723e·0a20·203c·7464··</tr>.<tr>.··<td | 0001de90:·3c2f·7472·3e0a·3c74·723e·0a20·203c·7464··</tr>.<tr>.··<td | ||
| 0001dea0:·3e49·412d·3528·6629·3c62·722f·3e49·412d··>IA-5(f)<br/>IA- | 0001dea0:·3e49·412d·3528·6629·3c62·722f·3e49·412d··>IA-5(f)<br/>IA- | ||
| 0001deb0:·3528·3129·2865·293c·2f74·643e·0a20·203c··5(1)(e)</td>.··< | 0001deb0:·3528·3129·2865·293c·2f74·643e·0a20·203c··5(1)(e)</td>.··< | ||
| 0001dec0:·7464·3e4e·2f41·3c2f·7464·3e0a·2020·3c74··td>N/A</td>.··<t | 0001dec0:·7464·3e4e·2f41·3c2f·7464·3e0a·2020·3c74··td>N/A</td>.··<t | ||
| 0001ded0:·643e·4c69·6d69·7420·5061·7373·776f·7264··d>Limit·Password | 0001ded0:·643e·4c69·6d69·7420·5061·7373·776f·7264··d>Limit·Password | ||
| 0001dee0:·2052·6575·7365·3a20·7379·7374·656d·2d61···Reuse:·system-a | 0001dee0:·2052·6575·7365·3a20·7379·7374·656d·2d61···Reuse:·system-a | ||
| 0001def0:·7574·683c·2f74·643e·0a20·203c·7464·2078··uth</td>.··<td·x | 0001def0:·7574·683c·2f74·643e·0a20·203c·7464·2078··uth</td>.··<td·x | ||
| Offset 7703, 19 lines modified | Offset 7703, 19 lines modified | ||
| 0001e160:·7265·7669·6f75·7320·7061·7373·776f·7264··revious·password | 0001e160:·7265·7669·6f75·7320·7061·7373·776f·7264··revious·password | ||
| 0001e170:·7320·6865·6c70·7320·656e·7375·7265·2074··s·helps·ensure·t | 0001e170:·7320·6865·6c70·7320·656e·7375·7265·2074··s·helps·ensure·t | ||
| 0001e180:·6861·7420·6120·636f·6d70·726f·6d69·7365··hat·a·compromise | 0001e180:·6861·7420·6120·636f·6d70·726f·6d69·7365··hat·a·compromise | ||
| 0001e190:·6420·7061·7373·776f·7264·2069·7320·6e6f··d·password·is·no | 0001e190:·6420·7061·7373·776f·7264·2069·7320·6e6f··d·password·is·no | ||
| 0001e1a0:·7420·7265·2d75·7365·6420·6279·2061·2075··t·re-used·by·a·u | 0001e1a0:·7420·7265·2d75·7365·6420·6279·2061·2075··t·re-used·by·a·u | ||
| 0001e1b0:·7365·722e·0a20·203c·2f74·643e·0a20·203c··ser..··</td>.··< | 0001e1b0:·7365·722e·0a20·203c·2f74·643e·0a20·203c··ser..··</td>.··< | ||
| 0001e1c0:·7464·3e76·6172·5f70·6173·7377·6f72·645f··td>var_password_ | 0001e1c0:·7464·3e76·6172·5f70·6173·7377·6f72·645f··td>var_password_ | ||
| 0001e1d0:·7061·6d5f·7265·6d65·6d62·6572·3d35·3c62··pam_remember=5<b | |||
| 0001e1e0:·722f·3e76·6172·5f70·6173·7377·6f72·645f··r/>var_password_ | |||
| 0001e1 | 0001e1f0:·7061·6d5f·7265·6d65·6d62·6572·5f63·6f6e··pam_remember_con | ||
| 0001e | 0001e200:·7472·6f6c·5f66·6c61·673d·7265·7175·6972··trol_flag=requir | ||
| 0001e1f0:·6564·3c62·722f·3e76·6172·5f70·6173·7377··ed<br/>var_passw | |||
| 0001e200:·6f72·645f·7061·6d5f·7265·6d65·6d62·6572··ord_pam_remember | |||
| 0001e210:· | 0001e210:·6564·3c2f·7464·3e0a·3c2f·7472·3e0a·3c74··ed</td>.</tr>.<t | ||
| 0001e220:·723e·0a20·203c·7464·3e49·412d·3528·6329··r>.··<td>IA-5(c) | 0001e220:·723e·0a20·203c·7464·3e49·412d·3528·6329··r>.··<td>IA-5(c) | ||
| 0001e230:·3c62·722f·3e49·412d·3528·3129·2861·293c··<br/>IA-5(1)(a)< | 0001e230:·3c62·722f·3e49·412d·3528·3129·2861·293c··<br/>IA-5(1)(a)< | ||
| 0001e240:·6272·2f3e·434d·2d36·2861·293c·6272·2f3e··br/>CM-6(a)<br/> | 0001e240:·6272·2f3e·434d·2d36·2861·293c·6272·2f3e··br/>CM-6(a)<br/> | ||
| 0001e250:·4941·2d35·2834·293c·2f74·643e·0a20·203c··IA-5(4)</td>.··< | 0001e250:·4941·2d35·2834·293c·2f74·643e·0a20·203c··IA-5(4)</td>.··< | ||
| 0001e260:·7464·3e4e·2f41·3c2f·7464·3e0a·2020·3c74··td>N/A</td>.··<t | 0001e260:·7464·3e4e·2f41·3c2f·7464·3e0a·2020·3c74··td>N/A</td>.··<t | ||
| 0001e270:·643e·456e·7375·7265·2050·414d·2045·6e66··d>Ensure·PAM·Enf | 0001e270:·643e·456e·7375·7265·2050·414d·2045·6e66··d>Ensure·PAM·Enf | ||
| 0001e280:·6f72·6365·7320·5061·7373·776f·7264·2052··orces·Password·R | 0001e280:·6f72·6365·7320·5061·7373·776f·7264·2052··orces·Password·R |
| Offset 1666, 30 lines modified | Offset 1666, 30 lines modified | ||
| 1666 | ··············································································search·space. | 1666 | ··············································································search·space. |
| 1667 | ··································Do·not·allow·users·to·reuse·recent | 1667 | ··································Do·not·allow·users·to·reuse·recent |
| 1668 | ··································passwords.·This·can·be·accomplished·by | 1668 | ··································passwords.·This·can·be·accomplished·by |
| 1669 | ··································using·the·remember·option·for·the | 1669 | ··································using·the·remember·option·for·the |
| 1670 | ··································pam_pwhistory·PAM·module. | 1670 | ··································pam_pwhistory·PAM·module. |
| 1671 | IA-5(f)···························In·the·file·/etc/pam.d/password-auth,·make | 1671 | IA-5(f)···························In·the·file·/etc/pam.d/password-auth,·make |
| 1672 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember | 1672 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember=5 |
| 1673 | (e)·····A··password-auth··········it·has·a·value·equal·to·or·greater·than·5.··compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember= | 1673 | (e)·····A··password-auth··········it·has·a·value·equal·to·or·greater·than·5.··compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember_control_flag=required |
| 1674 | ··································For·example: | 1674 | ··································For·example: |
| 1675 | ··································password·control_flag·pam_pwhistory.so | 1675 | ··································password·control_flag·pam_pwhistory.so |
| 1676 | ··································...existing_options...·remember=5 | 1676 | ··································...existing_options...·remember=5 |
| 1677 | ··································use_authtok | 1677 | ··································use_authtok |
| 1678 | ··································control_flag·should·be·one·of·the·next | 1678 | ··································control_flag·should·be·one·of·the·next |
| 1679 | ··································values:·required | 1679 | ··································values:·required |
| 1680 | ··································Do·not·allow·users·to·reuse·recent | 1680 | ··································Do·not·allow·users·to·reuse·recent |
| 1681 | ··································passwords.·This·can·be·accomplished·by | 1681 | ··································passwords.·This·can·be·accomplished·by |
| 1682 | ··································using·the·remember·option·for·the | 1682 | ··································using·the·remember·option·for·the |
| 1683 | ··································pam_pwhistory·PAM·module. | 1683 | ··································pam_pwhistory·PAM·module. |
| 1684 | IA-5(f)···························In·the·file·/etc/pam.d/system-auth,·make | 1684 | IA-5(f)···························In·the·file·/etc/pam.d/system-auth,·make |
| 1685 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember | 1685 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember=5 |
| 1686 | (e)·····A··system-auth············it·has·a·value·equal·to·or·greater·than·5···compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember= | 1686 | (e)·····A··system-auth············it·has·a·value·equal·to·or·greater·than·5···compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember_control_flag=required |
| 1687 | ··································For·example: | 1687 | ··································For·example: |
| 1688 | ··································password·control_flag·pam_pwhistory.so | 1688 | ··································password·control_flag·pam_pwhistory.so |
| 1689 | ··································...existing_options...·remember=5 | 1689 | ··································...existing_options...·remember=5 |
| 1690 | ··································use_authtok | 1690 | ··································use_authtok |
| 1691 | ··································control_flag·should·be·one·of·the·next | 1691 | ··································control_flag·should·be·one·of·the·next |
| 1692 | ··································values:·required | 1692 | ··································values:·required |
| 1693 | ··································The·pam_pwquality·module's·ucredit=·········Use·of·a·complex·password·helps·to·increase·the·time·and | 1693 | ··································The·pam_pwquality·module's·ucredit=·········Use·of·a·complex·password·helps·to·increase·the·time·and |
| Offset 7648, 18 lines modified | Offset 7648, 18 lines modified | ||
| 0001ddf0:·7320·7061·7373·776f·7264·7320·6865·6c70··s·passwords·help | 0001ddf0:·7320·7061·7373·776f·7264·7320·6865·6c70··s·passwords·help | ||
| 0001de00:·7320·656e·7375·7265·2074·6861·7420·6120··s·ensure·that·a· | 0001de00:·7320·656e·7375·7265·2074·6861·7420·6120··s·ensure·that·a· | ||
| 0001de10:·636f·6d70·726f·6d69·7365·6420·7061·7373··compromised·pass | 0001de10:·636f·6d70·726f·6d69·7365·6420·7061·7373··compromised·pass | ||
| 0001de20:·776f·7264·2069·7320·6e6f·7420·7265·2d75··word·is·not·re-u | 0001de20:·776f·7264·2069·7320·6e6f·7420·7265·2d75··word·is·not·re-u | ||
| 0001de30:·7365·6420·6279·2061·2075·7365·722e·0a20··sed·by·a·user..· | 0001de30:·7365·6420·6279·2061·2075·7365·722e·0a20··sed·by·a·user..· | ||
| 0001de40:·203c·2f74·643e·0a20·203c·7464·3e76·6172···</td>.··<td>var | 0001de40:·203c·2f74·643e·0a20·203c·7464·3e76·6172···</td>.··<td>var | ||
| 0001de50:·5f70·6173·7377·6f72·645f·7061·6d5f·7265··_password_pam_re | 0001de50:·5f70·6173·7377·6f72·645f·7061·6d5f·7265··_password_pam_re | ||
| 0001de60:·6d65·6d62·6572·3d35·3c62·722f·3e76·6172··member=5<br/>var | |||
| 0001de70:·5f70·6173·7377·6f72·645f·7061·6d5f·7265··_password_pam_re | |||
| 0001de | 0001de80:·6d65·6d62·6572·5f63·6f6e·7472·6f6c·5f66··member_control_f | ||
| 0001de | 0001de90:·6c61·673d·7265·7175·6972·6564·3c2f·7464··lag=required</td | ||
| 0001de80:·3e76·6172·5f70·6173·7377·6f72·645f·7061··>var_password_pa | |||
| 0001de90:·6d5f·7265·6d65·6d62·6572·3d35·3c2f·7464··m_remember=5</td | |||
| 0001dea0:·3e0a·3c2f·7472·3e0a·3c74·723e·0a20·203c··>.</tr>.<tr>.··< | 0001dea0:·3e0a·3c2f·7472·3e0a·3c74·723e·0a20·203c··>.</tr>.<tr>.··< | ||
| 0001deb0:·7464·3e49·412d·3528·6629·3c62·722f·3e49··td>IA-5(f)<br/>I | 0001deb0:·7464·3e49·412d·3528·6629·3c62·722f·3e49··td>IA-5(f)<br/>I | ||
| 0001dec0:·412d·3528·3129·2865·293c·2f74·643e·0a20··A-5(1)(e)</td>.· | 0001dec0:·412d·3528·3129·2865·293c·2f74·643e·0a20··A-5(1)(e)</td>.· | ||
| 0001ded0:·203c·7464·3e4e·2f41·3c2f·7464·3e0a·2020···<td>N/A</td>.·· | 0001ded0:·203c·7464·3e4e·2f41·3c2f·7464·3e0a·2020···<td>N/A</td>.·· | ||
| 0001dee0:·3c74·643e·4c69·6d69·7420·5061·7373·776f··<td>Limit·Passwo | 0001dee0:·3c74·643e·4c69·6d69·7420·5061·7373·776f··<td>Limit·Passwo | ||
| 0001def0:·7264·2052·6575·7365·3a20·7379·7374·656d··rd·Reuse:·system | 0001def0:·7264·2052·6575·7365·3a20·7379·7374·656d··rd·Reuse:·system | ||
| 0001df00:·2d61·7574·683c·2f74·643e·0a20·203c·7464··-auth</td>.··<td | 0001df00:·2d61·7574·683c·2f74·643e·0a20·203c·7464··-auth</td>.··<td | ||
| Offset 7704, 19 lines modified | Offset 7704, 19 lines modified | ||
| 0001e170:·2070·7265·7669·6f75·7320·7061·7373·776f···previous·passwo | 0001e170:·2070·7265·7669·6f75·7320·7061·7373·776f···previous·passwo | ||
| 0001e180:·7264·7320·6865·6c70·7320·656e·7375·7265··rds·helps·ensure | 0001e180:·7264·7320·6865·6c70·7320·656e·7375·7265··rds·helps·ensure | ||
| 0001e190:·2074·6861·7420·6120·636f·6d70·726f·6d69···that·a·compromi | 0001e190:·2074·6861·7420·6120·636f·6d70·726f·6d69···that·a·compromi | ||
| 0001e1a0:·7365·6420·7061·7373·776f·7264·2069·7320··sed·password·is· | 0001e1a0:·7365·6420·7061·7373·776f·7264·2069·7320··sed·password·is· | ||
| 0001e1b0:·6e6f·7420·7265·2d75·7365·6420·6279·2061··not·re-used·by·a | 0001e1b0:·6e6f·7420·7265·2d75·7365·6420·6279·2061··not·re-used·by·a | ||
| 0001e1c0:·2075·7365·722e·0a20·203c·2f74·643e·0a20···user..··</td>.· | 0001e1c0:·2075·7365·722e·0a20·203c·2f74·643e·0a20···user..··</td>.· | ||
| 0001e1d0:·203c·7464·3e76·6172·5f70·6173·7377·6f72···<td>var_passwor | 0001e1d0:·203c·7464·3e76·6172·5f70·6173·7377·6f72···<td>var_passwor | ||
| 0001e1e0:·645f·7061·6d5f·7265·6d65·6d62·6572·3d35··d_pam_remember=5 | |||
| 0001e1f0:·3c62·722f·3e76·6172·5f70·6173·7377·6f72··<br/>var_passwor | |||
| 0001e | 0001e200:·645f·7061·6d5f·7265·6d65·6d62·6572·5f63··d_pam_remember_c | ||
| 0001e | 0001e210:·6f6e·7472·6f6c·5f66·6c61·673d·7265·7175··ontrol_flag=requ | ||
| 0001e200:·6972·6564·3c62·722f·3e76·6172·5f70·6173··ired<br/>var_pas | |||
| 0001e210:·7377·6f72·645f·7061·6d5f·7265·6d65·6d62··sword_pam_rememb | |||
| 0001e220:·6 | 0001e220:·6972·6564·3c2f·7464·3e0a·3c2f·7472·3e0a··ired</td>.</tr>. | ||
| 0001e230:·3c74·723e·0a20·203c·7464·3e49·412d·3528··<tr>.··<td>IA-5( | 0001e230:·3c74·723e·0a20·203c·7464·3e49·412d·3528··<tr>.··<td>IA-5( | ||
| 0001e240:·6329·3c62·722f·3e49·412d·3528·3129·2861··c)<br/>IA-5(1)(a | 0001e240:·6329·3c62·722f·3e49·412d·3528·3129·2861··c)<br/>IA-5(1)(a | ||
| 0001e250:·293c·6272·2f3e·434d·2d36·2861·293c·6272··)<br/>CM-6(a)<br | 0001e250:·293c·6272·2f3e·434d·2d36·2861·293c·6272··)<br/>CM-6(a)<br | ||
| 0001e260:·2f3e·4941·2d35·2834·293c·2f74·643e·0a20··/>IA-5(4)</td>.· | 0001e260:·2f3e·4941·2d35·2834·293c·2f74·643e·0a20··/>IA-5(4)</td>.· | ||
| 0001e270:·203c·7464·3e4e·2f41·3c2f·7464·3e0a·2020···<td>N/A</td>.·· | 0001e270:·203c·7464·3e4e·2f41·3c2f·7464·3e0a·2020···<td>N/A</td>.·· | ||
| 0001e280:·3c74·643e·456e·7375·7265·2050·414d·2045··<td>Ensure·PAM·E | 0001e280:·3c74·643e·456e·7375·7265·2050·414d·2045··<td>Ensure·PAM·E | ||
| 0001e290:·6e66·6f72·6365·7320·5061·7373·776f·7264··nforces·Password | 0001e290:·6e66·6f72·6365·7320·5061·7373·776f·7264··nforces·Password | ||
| Offset 8529, 18 lines modified | Offset 8529, 18 lines modified | ||
| 00021500:·6e64·2075·7365·2074·6865·2069·6e66·6f72··nd·use·the·infor | 00021500:·6e64·2075·7365·2074·6865·2069·6e66·6f72··nd·use·the·infor | ||
| 00021510:·6d61·7469·6f6e·2074·6f20·706f·7465·6e74··mation·to·potent | 00021510:·6d61·7469·6f6e·2074·6f20·706f·7465·6e74··mation·to·potent | ||
| 00021520:·6961·6c6c·7920·636f·6d70·726f·6d69·7365··ially·compromise | 00021520:·6961·6c6c·7920·636f·6d70·726f·6d69·7365··ially·compromise | ||
| 00021530:·2074·6865·2069·6e74·6567·7269·7479·206f···the·integrity·o | 00021530:·2074·6865·2069·6e74·6567·7269·7479·206f···the·integrity·o | ||
| 00021540:·6620·7468·6520·7379·7374·656d·2061·6e64··f·the·system·and | 00021540:·6620·7468·6520·7379·7374·656d·2061·6e64··f·the·system·and | ||
| 00021550:·0a6e·6574·776f·726b·2873·292e·0a20·203c··.network(s)..··< | 00021550:·0a6e·6574·776f·726b·2873·292e·0a20·203c··.network(s)..··< | ||
| 00021560:·2f74·643e·0a20·203c·7464·3e76·6172·5f73··/td>.··<td>var_s | 00021560:·2f74·643e·0a20·203c·7464·3e76·6172·5f73··/td>.··<td>var_s | ||
| 00021570:·6e6d·7064·5f72· | 00021570:·6e6d·7064·5f72·775f·7374·7269·6e67·3d63··nmpd_rw_string=c | ||
| 00021580:·6861·6e67·656d·6572· | 00021580:·6861·6e67·656d·6572·773c·6272·2f3e·7661··hangemerw<br/>va | ||
| 00021590:·725f·736e·6d70·645f·72 | 00021590:·725f·736e·6d70·645f·726f·5f73·7472·696e··r_snmpd_ro_strin | ||
| 000215a0:·673d·6368·616e·6765·6d65·72 | 000215a0:·673d·6368·616e·6765·6d65·726f·3c2f·7464··g=changemero</td | ||
| 000215b0:·3e0a·3c2f·7472·3e0a·3c74·723e·0a20·203c··>.</tr>.<tr>.··< | 000215b0:·3e0a·3c2f·7472·3e0a·3c74·723e·0a20·203c··>.</tr>.<tr>.··< | ||
| 000215c0:·7464·3e43·4d2d·3528·3129·3c62·722f·3e41··td>CM-5(1)<br/>A | 000215c0:·7464·3e43·4d2d·3528·3129·3c62·722f·3e41··td>CM-5(1)<br/>A | ||
| 000215d0:·552d·3728·6129·3c62·722f·3e41·552d·3728··U-7(a)<br/>AU-7( | 000215d0:·552d·3728·6129·3c62·722f·3e41·552d·3728··U-7(a)<br/>AU-7( | ||
| 000215e0:·6229·3c62·722f·3e41·552d·3828·6229·3c62··b)<br/>AU-8(b)<b | 000215e0:·6229·3c62·722f·3e41·552d·3828·6229·3c62··b)<br/>AU-8(b)<b | ||
| 000215f0:·722f·3e41·552d·3132·2833·293c·6272·2f3e··r/>AU-12(3)<br/> | 000215f0:·722f·3e41·552d·3132·2833·293c·6272·2f3e··r/>AU-12(3)<br/> | ||
| 00021600:·4143·2d36·2839·293c·2f74·643e·0a20·203c··AC-6(9)</td>.··< | 00021600:·4143·2d36·2839·293c·2f74·643e·0a20·203c··AC-6(9)</td>.··< | ||
| 00021610:·7464·3e4e·2f41·3c2f·7464·3e0a·2020·3c74··td>N/A</td>.··<t | 00021610:·7464·3e4e·2f41·3c2f·7464·3e0a·2020·3c74··td>N/A</td>.··<t |
| Offset 1666, 30 lines modified | Offset 1666, 30 lines modified | ||
| 1666 | ··············································································search·space. | 1666 | ··············································································search·space. |
| 1667 | ··································Do·not·allow·users·to·reuse·recent | 1667 | ··································Do·not·allow·users·to·reuse·recent |
| 1668 | ··································passwords.·This·can·be·accomplished·by | 1668 | ··································passwords.·This·can·be·accomplished·by |
| 1669 | ··································using·the·remember·option·for·the | 1669 | ··································using·the·remember·option·for·the |
| 1670 | ··································pam_pwhistory·PAM·module. | 1670 | ··································pam_pwhistory·PAM·module. |
| 1671 | IA-5(f)···························In·the·file·/etc/pam.d/password-auth,·make | 1671 | IA-5(f)···························In·the·file·/etc/pam.d/password-auth,·make |
| 1672 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember | 1672 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember=5 |
| 1673 | (e)·····A··password-auth··········it·has·a·value·equal·to·or·greater·than·5.··compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember= | 1673 | (e)·····A··password-auth··········it·has·a·value·equal·to·or·greater·than·5.··compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember_control_flag=required |
| 1674 | ··································For·example: | 1674 | ··································For·example: |
| 1675 | ··································password·control_flag·pam_pwhistory.so | 1675 | ··································password·control_flag·pam_pwhistory.so |
| 1676 | ··································...existing_options...·remember=5 | 1676 | ··································...existing_options...·remember=5 |
| 1677 | ··································use_authtok | 1677 | ··································use_authtok |
| 1678 | ··································control_flag·should·be·one·of·the·next | 1678 | ··································control_flag·should·be·one·of·the·next |
| 1679 | ··································values:·required | 1679 | ··································values:·required |
| 1680 | ··································Do·not·allow·users·to·reuse·recent | 1680 | ··································Do·not·allow·users·to·reuse·recent |
| 1681 | ··································passwords.·This·can·be·accomplished·by | 1681 | ··································passwords.·This·can·be·accomplished·by |
| 1682 | ··································using·the·remember·option·for·the | 1682 | ··································using·the·remember·option·for·the |
| 1683 | ··································pam_pwhistory·PAM·module. | 1683 | ··································pam_pwhistory·PAM·module. |
| 1684 | IA-5(f)···························In·the·file·/etc/pam.d/system-auth,·make | 1684 | IA-5(f)···························In·the·file·/etc/pam.d/system-auth,·make |
| 1685 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember | 1685 | IA-5(1)·N/·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember=5 |
| 1686 | (e)·····A··system-auth············it·has·a·value·equal·to·or·greater·than·5···compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember= | 1686 | (e)·····A··system-auth············it·has·a·value·equal·to·or·greater·than·5···compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember_control_flag=required |
| 1687 | ··································For·example: | 1687 | ··································For·example: |
| 1688 | ··································password·control_flag·pam_pwhistory.so | 1688 | ··································password·control_flag·pam_pwhistory.so |
| 1689 | ··································...existing_options...·remember=5 | 1689 | ··································...existing_options...·remember=5 |
| 1690 | ··································use_authtok | 1690 | ··································use_authtok |
| 1691 | ··································control_flag·should·be·one·of·the·next | 1691 | ··································control_flag·should·be·one·of·the·next |
| 1692 | ··································values:·required | 1692 | ··································values:·required |
| 1693 | ··································The·pam_pwquality·module's·ucredit=·········Use·of·a·complex·password·helps·to·increase·the·time·and | 1693 | ··································The·pam_pwquality·module's·ucredit=·········Use·of·a·complex·password·helps·to·increase·the·time·and |
| Offset 1837, 16 lines modified | Offset 1837, 16 lines modified | ||
| 1837 | ··································This·will·help·ensure·when·local·users······configuration·option·ensures·the·use·of·a·strong·hashing | 1837 | ··································This·will·help·ensure·when·local·users······configuration·option·ensures·the·use·of·a·strong·hashing |
| 1838 | ··································change·their·passwords,·hashes·for·the·new··algorithm·that·makes·password·cracking·attacks·more·difficult. | 1838 | ··································change·their·passwords,·hashes·for·the·new··algorithm·that·makes·password·cracking·attacks·more·difficult. |
| 1839 | ··································passwords·will·be·generated·using·the·SHA- | 1839 | ··································passwords·will·be·generated·using·the·SHA- |
| 1840 | ··································512·algorithm.·This·is·the·default. | 1840 | ··································512·algorithm.·This·is·the·default. |
| 1841 | ··································Edit·/etc/snmp/snmpd.conf,·remove·or·change | 1841 | ··································Edit·/etc/snmp/snmpd.conf,·remove·or·change |
| 1842 | ··································the·default·community·strings·of·public·and·Whether·active·or·not,·default·simple·network·management | 1842 | ··································the·default·community·strings·of·public·and·Whether·active·or·not,·default·simple·network·management |
| 1843 | ··································private.·This·profile·configures·new·read-··protocol·(SNMP)·community·strings·must·be·changed·to·maintain | 1843 | ··································private.·This·profile·configures·new·read-··protocol·(SNMP)·community·strings·must·be·changed·to·maintain |
| 1844 | IA-5(e)·N/·Ensure·Default·SNMP····only·community·string·to·changemero·and·····security.·If·the·service·is·running·with·the·default···········var_snmpd_r | 1844 | IA-5(e)·N/·Ensure·Default·SNMP····only·community·string·to·changemero·and·····security.·If·the·service·is·running·with·the·default···········var_snmpd_rw_string=changemerw |
| 1845 | ········A··Password·Is·Not·Used···read-write·community·string·to·changemerw.··authenticators,·then·anyone·can·gather·data·about·the·system···var_snmpd_r | 1845 | ········A··Password·Is·Not·Used···read-write·community·string·to·changemerw.··authenticators,·then·anyone·can·gather·data·about·the·system···var_snmpd_ro_string=changemero |
| 1846 | ··································Once·the·default·community·strings·have·····and·the·network·and·use·the·information·to·potentially | 1846 | ··································Once·the·default·community·strings·have·····and·the·network·and·use·the·information·to·potentially |
| 1847 | ··································been·changed,·restart·the·SNMP·service:·····compromise·the·integrity·of·the·system·and·network(s). | 1847 | ··································been·changed,·restart·the·SNMP·service:·····compromise·the·integrity·of·the·system·and·network(s). |
| 1848 | ··································$·sudo·service·snmpd·restart | 1848 | ··································$·sudo·service·snmpd·restart |
| 1849 | ··································Verify·the·system·generates·an·audit·record | 1849 | ··································Verify·the·system·generates·an·audit·record |
| 1850 | ··································when·privileged·functions·are·executed.·If | 1850 | ··································when·privileged·functions·are·executed.·If |
| 1851 | ··································audit·is·using·the·"auditctl"·tool·to·load | 1851 | ··································audit·is·using·the·"auditctl"·tool·to·load |
| 1852 | ··································the·rules,·run·the·following·command: | 1852 | ··································the·rules,·run·the·following·command: |
| Offset 69, 9291 lines modified | Offset 69, 9291 lines modified | ||
| 00000440:·7472·3e0a·2020·2020·2020·3c74·643e·4155··tr>.······<td>AU | 00000440:·7472·3e0a·2020·2020·2020·3c74·643e·4155··tr>.······<td>AU | ||
| 00000450:·2d32·2864·293c·6272·2f3e·4155·2d31·3228··-2(d)<br/>AU-12( | 00000450:·2d32·2864·293c·6272·2f3e·4155·2d31·3228··-2(d)<br/>AU-12( | ||
| 00000460:·6329·3c62·722f·3e43·4d2d·3628·6129·3c2f··c)<br/>CM-6(a)</ | 00000460:·6329·3c62·722f·3e43·4d2d·3628·6129·3c2f··c)<br/>CM-6(a)</ | ||
| 00000470:·7464·3e0a·2020·2020·2020·3c74·643e·5265··td>.······<td>Re | 00000470:·7464·3e0a·2020·2020·2020·3c74·643e·5265··td>.······<td>Re | ||
| 00000480:·636f·7264·2055·6e73·7563·6365·7373·6675··cord·Unsuccessfu | 00000480:·636f·7264·2055·6e73·7563·6365·7373·6675··cord·Unsuccessfu | ||
| 00000490:·6c20·5065·726d·6973·7369·6f6e·2043·6861··l·Permission·Cha | 00000490:·6c20·5065·726d·6973·7369·6f6e·2043·6861··l·Permission·Cha | Diff chunk too large, falling back to line-by-line diff (1621 lines added, 1621 lines removed) | |
| 000004a0:·6e67·6573·2074·6f20·4669·6c65·7320·2d20··nges·to·Files·-· | 000004a0:·6e67·6573·2074·6f20·4669·6c65·7320·2d20··nges·to·Files·-· | ||
| 000004b0:· | 000004b0:·7365·7478·6174·7472·3c2f·7464·3e0a·2020··setxattr</td>.·· | ||
| 000004c0:·2020·2020· | 000004c0:·2020·2020·3c74·6420·786d·6c3a·6c61·6e67······<td·xml:lang | ||
| 000004d0:· | 000004d0:·3d22·656e·2d55·5322·3e0a·2020·2020·2020··="en-US">.······ | ||
| 000004e0:·2020· | 000004e0:·2020·5468·6520·6175·6469·7420·7379·7374····The·audit·syst | ||
| 000004f0:· | 000004f0:·656d·2073·686f·756c·6420·636f·6c6c·6563··em·should·collec | ||
| 00000500:· | 00000500:·7420·756e·7375·6363·6573·7366·756c·2066··t·unsuccessful·f | ||
| 00000510:·6 | 00000510:·696c·6520·7065·726d·6973·7369·6f6e·2063··ile·permission·c | ||
| 00000520:·6 | 00000520:·6861·6e67·650a·6174·7465·6d70·7473·2066··hange.attempts·f | ||
| 00000530:·6 | 00000530:·6f72·2061·6c6c·2075·7365·7273·2061·6e64··or·all·users·and | ||
| 00000540:· | 00000540:·2072·6f6f·742e·0a49·6620·7468·6520·3c74···root..If·the·<t | ||
| 00000550:·74 | 00000550:·743e·6175·6469·7464·3c2f·7474·3e20·6461··t>auditd</tt>·da | ||
| 00000560:·6 | 00000560:·656d·6f6e·2069·7320·636f·6e66·6967·7572··emon·is·configur | ||
| 00000570:· | 00000570:·6564·0a74·6f20·7573·6520·7468·6520·3c74··ed.to·use·the·<t | ||
| 00000580:·74 | 00000580:·743e·6175·6765·6e72·756c·6573·3c2f·7474··t>augenrules</tt | ||
| 00000590:· | 00000590:·3e20·7072·6f67·7261·6d20·746f·2072·6561··>·program·to·rea | ||
| 000005a0:·6 | 000005a0:·6420·6175·6469·7420·7275·6c65·7320·6475··d·audit·rules·du | ||
| 000005b0:·7 | 000005b0:·7269·6e67·2064·6165·6d6f·6e0a·7374·6172··ring·daemon.star | ||
| 000005c0:·7 | 000005c0:·7475·7020·2874·6865·2064·6566·6175·6c74··tup·(the·default | ||
| 000005d0:· | 000005d0:·292c·2061·6464·2074·6865·2066·6f6c·6c6f··),·add·the·follo | ||
| 000005e0:· | 000005e0:·7769·6e67·206c·696e·6573·2074·6f20·6120··wing·lines·to·a· | ||
| 000005f0:· | 000005f0:·6669·6c65·2077·6974·6820·7375·6666·6978··file·with·suffix | ||
| 00000600:· | 00000600:·0a3c·7474·3e2e·7275·6c65·733c·2f74·743e··.<tt>.rules</tt> | ||
| 00000610:· | 00000610:·2069·6e20·7468·6520·6469·7265·6374·6f72···in·the·director | ||
| 00000620:·7 | 00000620:·7920·3c74·743e·2f65·7463·2f61·7564·6974··y·<tt>/etc/audit | ||
| 00000630:· | 00000630:·2f72·756c·6573·2e64·3c2f·7474·3e2e·0a49··/rules.d</tt>..I | ||
| 00000640:· | 00000640:·6620·7468·6520·3c74·743e·6175·6469·7464··f·the·<tt>auditd | ||
| 00000650:· | 00000650:·3c2f·7474·3e20·6461·656d·6f6e·2069·7320··</tt>·daemon·is· | ||
| 00000660:· | 00000660:·636f·6e66·6967·7572·6564·2074·6f20·7573··configured·to·us | ||
| 00000670:· | 00000670:·6520·7468·6520·3c74·743e·6175·6469·7463··e·the·<tt>auditc | ||
| 00000680:· | 00000680:·746c·3c2f·7474·3e0a·7574·696c·6974·7920··tl</tt>.utility· | ||
| 00000690:· | 00000690:·746f·2072·6561·6420·6175·6469·7420·7275··to·read·audit·ru | ||
| 000006a0:· | 000006a0:·6c65·7320·6475·7269·6e67·2064·6165·6d6f··les·during·daemo | ||
| 000006b0:·6 | 000006b0:·6e20·7374·6172·7475·702c·2061·6464·2074··n·startup,·add·t | ||
| 000006c0:· | 000006c0:·6865·2066·6f6c·6c6f·7769·6e67·206c·696e··he·following·lin | ||
| 000006d0:·6 | 000006d0:·6573·2074·6f0a·3c74·743e·2f65·7463·2f61··es·to.<tt>/etc/a | ||
| 000006e0:· | 000006e0:·7564·6974·2f61·7564·6974·2e72·756c·6573··udit/audit.rules | ||
| 000006f0:· | 000006f0:·3c2f·7474·3e20·6669·6c65·2e0a·3c70·7265··</tt>·file..<pre | ||
| 00000700:· | 00000700:·3e2d·6120·616c·7761·7973·2c65·7869·7420··>-a·always,exit· | ||
| 00000710:·2 | 00000710:·2d46·2061·7263·683d·6233·3220·2d53·2073··-F·arch=b32·-S·s | ||
| 00000720:·6 | 00000720:·6574·7861·7474·7220·2d46·2065·7869·743d··etxattr·-F·exit= | ||
| 00000730:· | 00000730:·2d45·4143·4345·5320·2d46·2061·7569·643e··-EACCES·-F·auid> | ||
| 00000740:· | 00000740:·3d31·3030·3020·2d46·2061·7569·6421·3d75··=1000·-F·auid!=u | ||
| 00000750:· | 00000750:·6e73·6574·202d·4620·6b65·793d·756e·7375··nset·-F·key=unsu | ||
| 00000760:· | 00000760:·6363·6573·6675·6c2d·7065·726d·2d63·6861··ccesful-perm-cha | ||
| 00000770:·6 | 00000770:·6e67·650a·2d61·2061·6c77·6179·732c·6578··nge.-a·always,ex | ||
| 00000780:·6 | 00000780:·6974·202d·4620·6172·6368·3d62·3332·202d··it·-F·arch=b32·- | ||
| 00000790:· | 00000790:·5320·7365·7478·6174·7472·202d·4620·6578··S·setxattr·-F·ex | ||
| 000007a0:· | 000007a0:·6974·3d2d·4550·4552·4d20·2d46·2061·7569··it=-EPERM·-F·aui | ||
| 000007b0:·6 | 000007b0:·643e·3d31·3030·3020·2d46·2061·7569·6421··d>=1000·-F·auid! | ||
| 000007c0:· | 000007c0:·3d75·6e73·6574·202d·4620·6b65·793d·756e··=unset·-F·key=un | ||
| 000007d0:· | 000007d0:·7375·6363·6573·6675·6c2d·7065·726d·2d63··succesful-perm-c | ||
| 000007e0:·6 | 000007e0:·6861·6e67·653c·2f70·7265·3e0a·4966·2074··hange</pre>.If·t | ||
| 000007f0:·6 | 000007f0:·6865·2073·7973·7465·6d20·6973·2036·3420··he·system·is·64· | ||
| 00000800:· | 00000800:·6269·7420·7468·656e·2061·6c73·6f20·6164··bit·then·also·ad | ||
| 00000810:· | 00000810:·6420·7468·6520·666f·6c6c·6f77·696e·6720··d·the·following· | ||
| 00000820:·6 | 00000820:·6c69·6e65·733a·0a3c·7072·653e·2d61·2061··lines:.<pre>-a·a | ||
| 00000830:·6 | 00000830:·6c77·6179·732c·6578·6974·202d·4620·6172··lways,exit·-F·ar | ||
| 00000840:· | 00000840:·6368·3d62·3634·202d·5320·7365·7478·6174··ch=b64·-S·setxat | ||
| 00000850:·747 | 00000850:·7472·202d·4620·6578·6974·3d2d·4541·4343··tr·-F·exit=-EACC | ||
| 00000860:·45 | 00000860:·4553·202d·4620·6175·6964·3e3d·3130·3030··ES·-F·auid>=1000 | ||
| 00000870:· | 00000870:·202d·4620·6175·6964·213d·756e·7365·7420···-F·auid!=unset· | ||
| 00000880:· | 00000880:·2d46·206b·6579·3d75·6e73·7563·6365·7366··-F·key=unsuccesf | ||
| 00000890:· | 00000890:·756c·2d70·6572·6d2d·6368·616e·6765·0a2d··ul-perm-change.- | ||
| 000008a0:·6 | 000008a0:·6120·616c·7761·7973·2c65·7869·7420·2d46··a·always,exit·-F | ||
| 000008b0:· | 000008b0:·2061·7263·683d·6236·3420·2d53·2073·6574···arch=b64·-S·set | ||
| 000008c0:· | 000008c0:·7861·7474·7220·2d46·2065·7869·743d·2d45··xattr·-F·exit=-E | ||
| 000008d0:· | 000008d0:·5045·524d·202d·4620·6175·6964·3e3d·3130··PERM·-F·auid>=10 | ||
| 000008e0:· | 000008e0:·3030·202d·4620·6175·6964·213d·756e·7365··00·-F·auid!=unse | ||
| 000008f0:· | 000008f0:·7420·2d46·206b·6579·3d75·6e73·7563·6365··t·-F·key=unsucce | ||
| 00000900:·73 | 00000900:·7366·756c·2d70·6572·6d2d·6368·616e·6765··sful-perm-change | ||
| 00000910:· | 00000910:·3c2f·7072·653e·0a20·2020·2020·203c·2f74··</pre>.······</t | ||
| 00000920:· | 00000920:·643e·0a20·2020·2020·203c·7464·2078·6d6c··d>.······<td·xml | ||
| 00000930:· | 00000930:·3a6c·616e·673d·2265·6e2d·5553·223e·0a20··:lang="en-US">.· | ||
| 00000940:· | 00000940:·2020·2020·2020·2055·6e73·7563·6365·7373·········Unsuccess | ||
| 00000950:·6 | 00000950:·6675·6c20·6174·7465·6d70·7473·2074·6f20··ful·attempts·to· | ||
| 00000960:· | 00000960:·6368·616e·6765·2070·6572·6d69·7373·696f··change·permissio | ||
| 00000970:·6 | 00000970:·6e73·206f·6620·6669·6c65·7320·636f·756c··ns·of·files·coul | ||
| 00000980:· | 00000980:·6420·6265·2061·6e20·696e·6469·6361·746f··d·be·an·indicato | ||
| 00000990:· | 00000990:·7220·6f66·206d·616c·6963·696f·7573·2061··r·of·malicious·a | ||
| 000009a0:·6 | 000009a0:·6374·6976·6974·7920·6f6e·2061·2073·7973··ctivity·on·a·sys | ||
| 000009b0:· | 000009b0:·7465·6d2e·2041·7564·6974·696e·670a·7468··tem.·Auditing.th | ||
| 000009c0:·6 | 000009c0:·6573·6520·6576·656e·7473·2063·6f75·6c64··ese·events·could | ||
| 000009d0:· | 000009d0:·2073·6572·7665·2061·7320·6576·6964·656e···serve·as·eviden | ||
| 000009e0:· | 000009e0:·6365·206f·6620·706f·7465·6e74·6961·6c20··ce·of·potential· | ||
| 000009f0:·7 | 000009f0:·7379·7374·656d·2063·6f6d·7072·6f6d·6973··system·compromis | ||
| 00000a00:· | 00000a00:·652e·0a20·2020·2020·203c·2f74·643e·0a20··e..······</td>.· | ||
| 00000a10:· | 00000a10:·2020·203c·2f74·723e·0a20·2020·203c·7472·····</tr>.····<tr | ||
| 00000a20:· | 00000a20:·3e0a·2020·2020·2020·3c74·643e·4155·2d32··>.······<td>AU-2 | ||
| 00000a30:· | 00000a30:·2864·293c·6272·2f3e·4155·2d31·3228·6329··(d)<br/>AU-12(c) | ||
| 00000a40:·3 | 00000a40:·3c62·722f·3e43·4d2d·3628·6129·3c2f·7464··<br/>CM-6(a)</td | ||
| 00000a50:· | 00000a50:·3e0a·2020·2020·2020·3c74·643e·456e·7375··>.······<td>Ensu | ||
| 00000a60:· | 00000a60:·7265·2061·7564·6974·6420·436f·6c6c·6563··re·auditd·Collec | ||
| 00000a70:·7 | 00000a70:·7473·2055·6e61·7574·686f·7269·7a65·6420··ts·Unauthorized· | ||
| 00000a80:·4 | 00000a80:·4163·6365·7373·2041·7474·656d·7074·7320··Access·Attempts· | ||
| 00000a90:· | 00000a90:·746f·2046·696c·6573·2028·756e·7375·6363··to·Files·(unsucc | ||
| 00000aa0:· | 00000aa0:·6573·7366·756c·293c·2f74·643e·0a20·2020··essful)</td>.··· | ||
| 00000ab0:· | 00000ab0:·2020·203c·7464·2078·6d6c·3a6c·616e·673d·····<td·xml:lang= | ||
| 00000ac0:·2 | 00000ac0:·2265·6e2d·5553·223e·0a20·2020·2020·2020··"en-US">.······· | ||
| 00000ad0:· | 00000ad0:·2041·7420·6120·6d69·6e69·6d75·6d20·7468···At·a·minimum·th | ||
| 00000ae0:·6 | 00000ae0:·6520·6175·6469·7420·7379·7374·656d·2073··e·audit·system·s | ||
| 00000af0:·6 | 00000af0:·686f·756c·6420·636f·6c6c·6563·7420·756e··hould·collect·un | ||
| 00000b00:·6 | 00000b00:·6175·7468·6f72·697a·6564·2066·696c·650a··authorized·file. | ||
| 00000b10:·6 | 00000b10:·6163·6365·7373·6573·2066·6f72·2061·6c6c··accesses·for·all | ||
| 00000b20:· | 00000b20:·2075·7365·7273·2061·6e64·2072·6f6f·742e···users·and·root. | ||
| 00000b30:· | 00000b30:·2049·6620·7468·6520·3c74·743e·6175·6469···If·the·<tt>audi | ||
| 00000b40:· | 00000b40:·7464·3c2f·7474·3e20·6461·656d·6f6e·2069··td</tt>·daemon·i | ||
| 00000b50:·726 | 00000b50:·7320·636f·6e66·6967·7572·6564·0a74·6f20··s·configured.to· | ||
| 00000b60:·7 | 00000b60:·7573·6520·7468·6520·3c74·743e·6175·6765··use·the·<tt>auge | ||
| 00000b70:· | 00000b70:·6e72·756c·6573·3c2f·7474·3e20·7072·6f67··nrules</tt>·prog | ||
| 00000b80:· | 00000b80:·7261·6d20·746f·2072·6561·6420·6175·6469··ram·to·read·audi | ||
| 00000b90:·7 | 00000b90:·7420·7275·6c65·7320·6475·7269·6e67·2064··t·rules·during·d | ||
| 00000ba0:· | 00000ba0:·6165·6d6f·6e0a·7374·6172·7475·7020·2874··aemon.startup·(t | ||
| 00000bb0:· | 00000bb0:·6865·2064·6566·6175·6c74·292c·2061·6464··he·default),·add | ||
| 00000bc0:· | 00000bc0:·2074·6865·2066·6f6c·6c6f·7769·6e67·206c···the·following·l | ||
| 00000bd0:· | 00000bd0:·696e·6573·2074·6f20·6120·6669·6c65·2077··ines·to·a·file·w | ||
| 00000be0:· | 00000be0:·6974·6820·7375·6666·6978·0a3c·7474·3e2e··ith·suffix.<tt>. | ||
| 00000bf0:· | 00000bf0:·7275·6c65·733c·2f74·743e·2069·6e20·7468··rules</tt>·in·th | ||
| 00000c00:· | 00000c00:·6520·6469·7265·6374·6f72·7920·3c74·743e··e·directory·<tt> | ||
| 00000c10:· | 00000c10:·2f65·7463·2f61·7564·6974·2f72·756c·6573··/etc/audit/rules | ||
| Max diff block lines reached; 4693830/4918104 bytes (95.44%) of diff not shown. | |||
| Offset 9, 216 lines modified | Offset 9, 112 lines modified | ||
| 9 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules | 9 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules |
| 10 | ·······························program·to·read·audit·rules·during·daemon·startup·(the | 10 | ·······························program·to·read·audit·rules·during·daemon·startup·(the |
| 11 | ·······························default),·add·the·following·lines·to·a·file·with | 11 | ·······························default),·add·the·following·lines·to·a·file·with |
| 12 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d.·If | 12 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d.·If |
| 13 | ·······························the·auditd·daemon·is·configured·to·use·the·auditctl | 13 | ·······························the·auditd·daemon·is·configured·to·use·the·auditctl |
| 14 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 14 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 15 | ·······························the·following·lines·to·/etc/audit/audit.rules·file. | 15 | ·······························the·following·lines·to·/etc/audit/audit.rules·file. |
| 16 | AU-2(d)························-a·always,exit·-F·arch=b32·-S· | 16 | AU-2(d)························-a·always,exit·-F·arch=b32·-S·setxattr·-F·exit=-EACCES |
| 17 | AU-12···Record·Unsuccessful···· | 17 | AU-12···Record·Unsuccessful····-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm-··Unsuccessful·attempts·to·change·permissions·of·files·could·be·an·indicator |
| 18 | (c)·····Permission·Changes·to·· | 18 | (c)·····Permission·Changes·to··change·················································of·malicious·activity·on·a·system.·Auditing·these·events·could·serve·as |
| 19 | CM-6(a)·Files·-· | 19 | CM-6(a)·Files·-·setxattr·······-a·always,exit·-F·arch=b32·-S·setxattr·-F·exit=-EPERM··evidence·of·potential·system·compromise. |
| 20 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | 20 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- |
| 21 | ·······························change | 21 | ·······························change |
| 22 | ·······························If·the·system·is·64·bit·then·also·add·the·following | 22 | ·······························If·the·system·is·64·bit·then·also·add·the·following |
| 23 | ·······························lines: | 23 | ·······························lines: |
| 24 | ·······························-a·always,exit·-F·arch=b64·-S· | 24 | ·······························-a·always,exit·-F·arch=b64·-S·setxattr·-F·exit=-EACCES |
| 25 | ·······························EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 26 | ·······························F·key=unsuccesful-perm-change | ||
| 27 | ·······························-a·always,exit·-F·arch=b64·-S·fsetxattr·-F·exit=-EPERM | ||
| 28 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | 25 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- |
| 29 | ·······························change | 26 | ·······························change |
| 27 | ·······························-a·always,exit·-F·arch=b64·-S·setxattr·-F·exit=-EPERM | ||
| 28 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 29 | ·······························change | ||
| 30 | ······························· | 30 | ·······························At·a·minimum·the·audit·system·should·collect |
| 31 | ······························· | 31 | ·······························unauthorized·file·accesses·for·all·users·and·root.·If |
| 32 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules | 32 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules |
| 33 | ·······························program·to·read·audit·rules·during·daemon·startup·(the | 33 | ·······························program·to·read·audit·rules·during·daemon·startup·(the |
| 34 | ·······························default),·add·the·following·lines·to·a·file·with | 34 | ·······························default),·add·the·following·lines·to·a·file·with |
| 35 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d | 35 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d: |
| 36 | ·······························-a·always,exit·-F·arch=b32·- | ||
| 36 | ·······························the·auditd·daemon·is·configured·to·use·the·auditctl | ||
| 37 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | ||
| 38 | ·······························the·following·lines·to·/etc/audit/audit.rules·file. | ||
| 39 | AU-2(d)························-a·always,exit·-F·arch=b32·-S·fchmod·-F·exit=-EACCES·- | ||
| 40 | AU-12···Record·Unsuccessful····F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm-···Unsuccessful·attempts·to·change·permissions·of·files·could·be·an·indicator | ||
| 41 | (c)·····Permission·Changes·to··change·················································of·malicious·activity·on·a·system.·Auditing·these·events·could·serve·as | ||
| 42 | CM-6(a)·Files·-·fchmod·········-a·always,exit·-F·arch=b32·-S·fchmod·-F·exit=-EPERM·-··evidence·of·potential·system·compromise. | ||
| 43 | ·······························F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 44 | ······························· | 37 | ·······························S |
| 38 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 39 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 40 | ·······························F·key=access | ||
| 41 | ·······························-a·always,exit·-F·arch=b32·- | ||
| 42 | ·······························S | ||
| 43 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 44 | ·······························-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·- | ||
| 45 | ·······························F·key=access | ||
| 45 | ·······························If·the·system·is·64·bit·then·also·add·the·following | 46 | ·······························If·the·system·is·64·bit·then·also·add·the·following |
| 46 | ·······························lines: | 47 | ·······························lines: |
| 47 | ·······························-a·always,exit·-F·arch=b64·- | 48 | ·······························-a·always,exit·-F·arch=b64·- |
| 48 | ·······························F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 49 | ······························· | 49 | ·······························S |
| 50 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 51 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 52 | ·······························F·key=access | ||
| 50 | ·······························-a·always,exit·-F·arch=b64·- | 53 | ·······························-a·always,exit·-F·arch=b64·- |
| 54 | AU-2(d)·Ensure·auditd·Collects·S | ||
| 55 | AU-12···Unauthorized·Access····creat,open,openat,open_by_handle_at,truncate,ftruncate·Unsuccessful·attempts·to·access·files·could·be·an·indicator·of·malicious | ||
| 56 | (c)·····Attempts·to·Files······-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·-··········activity·on·a·system.·Auditing·these·events·could·serve·as·evidence·of | ||
| 57 | CM-6(a)·(unsuccessful)·········F·key=access···········································potential·system·compromise. | ||
| 51 | ·······························F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 52 | ·······························change | ||
| 53 | ·······························At·a·minimum,·the·audit·system·should·collect·file | ||
| 54 | ·······························permission·changes·for·all·users·and·root.·If·the | ||
| 55 | ·······························auditd·daemon·is·configured·to·use·the·augenrules | ||
| 56 | ·······························program·to·read·audit·rules·during·daemon·startup·(the | ||
| 57 | ·······························default),·add·the·following·line·to·a·file·with·suffix | ||
| 58 | ·······························.rules·in·the·directory·/etc/audit/rules.d: | ||
| 59 | ·······························-a·always,exit·-F·arch=b32·-S·fchmod·-F·auid>=1000·- | ||
| 60 | ·······························F·auid!=unset·-F·key=perm_mod | ||
| 61 | AU-2(d)·Record·Events·that·····If·the·system·is·64·bit·then·also·add·the·following····The·changing·of·file·permissions·could·indicate·that·a·user·is·attempting·to | ||
| 62 | AU-12···Modify·the·System's····line:··················································gain·access·to·information·that·would·otherwise·be·disallowed.·Auditing·DAC | ||
| 63 | (c)·····Discretionary·Access···-a·always,exit·-F·arch=b64·-S·fchmod·-F·auid>=1000·-···modifications·can·facilitate·the·identification·of·patterns·of·abuse·among | ||
| 64 | CM-6(a)·Controls·-·fchmod······F·auid!=unset·-F·key=perm_mod··························both·authorized·and·unauthorized·users. | ||
| 65 | ·······························If·the·auditd·daemon·is·configured·to·use·the·auditctl | 58 | ·······························If·the·auditd·daemon·is·configured·to·use·the·auditctl |
| 66 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 59 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 67 | ·······························the·following·line·to·/etc/audit/audit.rules·file: | 60 | ·······························the·following·lines·to·/etc/audit/audit.rules·file: |
| 68 | ·······························-a·always,exit·-F·arch=b32·- | 61 | ·······························-a·always,exit·-F·arch=b32·- |
| 69 | ······························· | 62 | ·······························S |
| 63 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 64 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 65 | ·······························F·key=access | ||
| 66 | ·······························-a·always,exit·-F·arch=b32·- | ||
| 67 | ·······························S | ||
| 68 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 69 | ·······························-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·- | ||
| 70 | ·······························F·key=access | ||
| 70 | ·······························If·the·system·is·64·bit·then·also·add·the·following | 71 | ·······························If·the·system·is·64·bit·then·also·add·the·following |
| 71 | ·······························line: | 72 | ·······························lines: |
| 72 | ·······························-a·always,exit·-F·arch=b64·- | 73 | ·······························-a·always,exit·-F·arch=b64·- |
| 73 | ······························· | 74 | ·······························S |
| 75 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 76 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 77 | ·······························F·key=access | ||
| 78 | ·······························-a·always,exit·-F·arch=b64·- | ||
| 79 | ·······························S | ||
| 80 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 81 | ·······························-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·- | ||
| 82 | ·······························F·key=access | ||
| 74 | ·······························The·audit·system·already·collects·login·information | 83 | ·······························The·audit·system·already·collects·login·information |
| 75 | ·······························for·all·users·and·root.·If·the·auditd·daemon·is | 84 | ·······························for·all·users·and·root.·If·the·auditd·daemon·is |
| 76 | ·······························configured·to·use·the·augenrules·program·to·read·audit | 85 | ·······························configured·to·use·the·augenrules·program·to·read·audit |
| 77 | ·······························rules·during·daemon·startup·(the·default),·add·the | 86 | ·······························rules·during·daemon·startup·(the·default),·add·the |
| 78 | ·······························following·lines·to·a·file·with·suffix·.rules·in·the | 87 | ·······························following·lines·to·a·file·with·suffix·.rules·in·the |
| 79 | AU-2(d)························directory·/etc/audit/rules.d·in·order·to·watch·for | 88 | AU-2(d)························directory·/etc/audit/rules.d·in·order·to·watch·for |
| 80 | AU-12···Record·Attempts·to·····attempted·manual·edits·of·files·involved·in·storing····Manual·editing·of·these·files·may·indicate·nefarious·activity,·such·as·an | 89 | AU-12···Record·Attempts·to·····attempted·manual·edits·of·files·involved·in·storing····Manual·editing·of·these·files·may·indicate·nefarious·activity,·such·as·an |
| 81 | (c)·····Alter·Logon·and·Logout·logon·events:··········································attacker·attempting·to·remove·evidence·of·an·intrusion. | 90 | (c)·····Alter·Logon·and·Logout·logon·events:··········································attacker·attempting·to·remove·evidence·of·an·intrusion. |
| 82 | AC-6(9)·Events·-· | 91 | AC-6(9)·Events·-·lastlog·······-w·/var/log/lastlog·-p·wa·-k·logins |
| 83 | CM-6(a)························If·the·auditd·daemon·is·configured·to·use·the·auditctl | 92 | CM-6(a)························If·the·auditd·daemon·is·configured·to·use·the·auditctl |
| 84 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 93 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 85 | ·······························the·following·lines·to·/etc/audit/audit.rules·file·in | 94 | ·······························the·following·lines·to·/etc/audit/audit.rules·file·in |
| 86 | ·······························order·to·watch·for·unattempted·manual·edits·of·files | 95 | ·······························order·to·watch·for·unattempted·manual·edits·of·files |
| 87 | ·······························involved·in·storing·logon·events: | 96 | ·······························involved·in·storing·logon·events: |
| 88 | ·······························-w·/var/log/ | 97 | ·······························-w·/var/log/lastlog·-p·wa·-k·logins |
| 89 | ······························· | 98 | ·······························At·a·minimum,·the·audit·system·should·collect·file |
| 90 | ······························· | 99 | ·······························deletion·events·for·all·users·and·root.·If·the·auditd |
| 91 | ······························· | 100 | ·······························daemon·is·configured·to·use·the·augenrules·program·to |
| 92 | ······························· | 101 | ·······························read·audit·rules·during·daemon·startup·(the·default), |
| 93 | ······························· | 102 | ·······························add·the·following·line·to·a·file·with·suffix·.rules·in |
| 94 | ······························· | 103 | ·······························the·directory·/etc/audit/rules.d,·setting·ARCH·to |
| 95 | ··········· | 104 | AU-2(d)·Ensure·auditd·Collects·either·b32·or·b64·as·appropriate·for·your·system:······Auditing·file·deletions·will·create·an·audit·trail·for·files·that·are |
| 105 | AU-12···File·Deletion·Events···-a·always,exit·-F·arch=ARCH·-S·renameat·-F·auid>=1000··removed·from·the·system.·The·audit·trail·could·aid·in·system | ||
| 106 | (c)·····by·User·-·renameat·····-F·auid!=unset·-F·key=delete···························troubleshooting,·as·well·as,·detecting·malicious·processes·that·attempt·to | ||
| 107 | CM-6(a)························If·the·auditd·daemon·is·configured·to·use·the·auditctl·delete·log·files·to·conceal·their·presence. | ||
| 96 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 108 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 97 | ·······························the·following·line | 109 | ·······························the·following·line·to·/etc/audit/audit.rules·file, |
| Max diff block lines reached; 1047406/1073703 bytes (97.55%) of diff not shown. | |||
| Offset 75, 33 lines modified | Offset 75, 31 lines modified | ||
| 75 | ········<tt>openscap-scanner</tt>·contains·the·<tt>oscap</tt>·command·line·tool.·This·tool·is·a | 75 | ········<tt>openscap-scanner</tt>·contains·the·<tt>oscap</tt>·command·line·tool.·This·tool·is·a |
| 76 | configuration·and·vulnerability·scanner,·capable·of·performing·compliance·checking·using | 76 | configuration·and·vulnerability·scanner,·capable·of·performing·compliance·checking·using |
| 77 | SCAP·content. | 77 | SCAP·content. |
| 78 | ······</td> | 78 | ······</td> |
| 79 | ····</tr> | 79 | ····</tr> |
| 80 | ····<tr> | 80 | ····<tr> |
| 81 | ······<td>FAU_GEN.1</td> | 81 | ······<td>FAU_GEN.1</td> |
| 82 | ······<td>Disable·SSH·Root·Login</td> | ||
| 82 | ······<td>Include·Local·Events·in·Audit·Logs</td> | ||
| 83 | ······<td·xml:lang="en-US"> | ||
| 84 | ········To·configure·Audit·daemon·to·include·local·events·in·Audit·logs,·set | ||
| 85 | <tt>local_events</tt>·to·<tt>yes</tt>·in·<tt>/etc/audit/auditd.conf</tt>. | ||
| 86 | This·is·the·default·setting. | ||
| 87 | ······</td> | ||
| 88 | ······<td·xml:lang="en-US"> | ||
| 89 | ········If·option·<tt>local_events</tt>·isn't·set·to·<tt>yes</tt>·only·events·from | ||
| 90 | network·will·be·aggregated. | ||
| 91 | ······</td> | ||
| 92 | ····</tr> | ||
| 93 | ····<tr> | ||
| 94 | ······<td>FAU_GEN.1</td> | ||
| 95 | ······<td>Ensure·the·audit·Subsystem·is·Installed</td> | ||
| 96 | ······<td·xml:lang="en-US"> | 83 | ······<td·xml:lang="en-US"> |
| 97 | ········The· | 84 | ········The·root·user·should·never·be·allowed·to·login·to·a |
| 85 | system·directly·over·a·network. | ||
| 86 | To·disable·root·login·via·SSH,·add·or·correct·the·following·line·in | ||
| 87 | <tt>/etc/ssh/sshd_config</tt>: | ||
| 88 | <pre>PermitRootLogin·no</pre> | ||
| 98 | ······</td> | 89 | ······</td> |
| 99 | ······<td·xml:lang="en-US"> | 90 | ······<td·xml:lang="en-US"> |
| 100 | ········ | 91 | ········Even·though·the·communications·channel·may·be·encrypted,·an·additional·layer·of |
| 92 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | ||
| 93 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | ||
| 94 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | ||
| 95 | direct·attack·attempts·on·root's·password. | ||
| 101 | ······</td> | 96 | ······</td> |
| 102 | ····</tr> | 97 | ····</tr> |
| 103 | ····<tr> | 98 | ····<tr> |
| 104 | ······<td>FAU_GEN.1</td> | 99 | ······<td>FAU_GEN.1</td> |
| 105 | ······<td>Enable·Auditing·for·Processes·Which·Start·Prior·to·the·Audit·Daemon</td> | 100 | ······<td>Enable·Auditing·for·Processes·Which·Start·Prior·to·the·Audit·Daemon</td> |
| 106 | ······<td·xml:lang="en-US"> | 101 | ······<td·xml:lang="en-US"> |
| 107 | ········To·ensure·all·processes·can·be·audited,·even·those·which·start | 102 | ········To·ensure·all·processes·can·be·audited,·even·those·which·start |
| Offset 119, 45 lines modified | Offset 117, 33 lines modified | ||
| 119 | its·activities·can·be·audited.·Although·<tt>auditd</tt>·takes·care·of·enabling | 117 | its·activities·can·be·audited.·Although·<tt>auditd</tt>·takes·care·of·enabling |
| 120 | this·for·all·processes·which·launch·after·it·does,·adding·the·kernel·argument | 118 | this·for·all·processes·which·launch·after·it·does,·adding·the·kernel·argument |
| 121 | ensures·it·is·set·for·every·process·during·boot. | 119 | ensures·it·is·set·for·every·process·during·boot. |
| 122 | ······</td> | 120 | ······</td> |
| 123 | ····</tr> | 121 | ····</tr> |
| 124 | ····<tr> | 122 | ····<tr> |
| 125 | ······<td>FAU_GEN.1</td> | 123 | ······<td>FAU_GEN.1</td> |
| 126 | ······<td> | 124 | ······<td>Ensure·the·audit·Subsystem·is·Installed</td> |
| 127 | ······<td·xml:lang="en-US"> | 125 | ······<td·xml:lang="en-US"> |
| 126 | ········The·audit·package·should·be·installed. | ||
| 128 | ········To·configure·Audit·daemon·to·issue·an·explicit·flush·to·disk·command | ||
| 129 | after·writing·<abbr·title="$var_auditd_freq"><tt>50</tt></abbr>·records,·set·<tt>freq</tt>·to·<tt><abbr·title="$var_auditd_freq"><tt>50</tt></abbr></tt> | ||
| 130 | in·<tt>/etc/audit/auditd.conf</tt>. | ||
| 131 | ······</td> | 127 | ······</td> |
| 132 | ······<td·xml:lang="en-US"> | 128 | ······<td·xml:lang="en-US"> |
| 129 | ········The·auditd·service·is·an·access·monitoring·and·accounting·daemon,·watching·system·calls·to·audit·any·access,·in·comparison·with·potential·local·access·control·policy·such·as·SELinux·policy. | ||
| 133 | ········If·option·<tt>freq</tt>·isn't·set·to·<tt><sub·idref="var_auditd_freq"·/></tt>,·the·flush·to·disk | ||
| 134 | may·happen·after·higher·number·of·records,·increasing·the·danger | ||
| 135 | of·audit·loss. | ||
| 136 | ······</td> | 130 | ······</td> |
| 137 | ····</tr> | 131 | ····</tr> |
| 138 | ····<tr> | 132 | ····<tr> |
| 139 | ······<td>FAU_GEN.1</td> | 133 | ······<td>FAU_GEN.1</td> |
| 140 | ······<td> | 134 | ······<td>Include·Local·Events·in·Audit·Logs</td> |
| 141 | ······<td·xml:lang="en-US"> | 135 | ······<td·xml:lang="en-US"> |
| 136 | ········To·configure·Audit·daemon·to·include·local·events·in·Audit·logs,·set | ||
| 137 | <tt>local_events</tt>·to·<tt>yes</tt>·in·<tt>/etc/audit/auditd.conf</tt>. | ||
| 138 | This·is·the·default·setting. | ||
| 142 | ········The·root·user·should·never·be·allowed·to·login·to·a | ||
| 143 | system·directly·over·a·network. | ||
| 144 | To·disable·root·login·via·SSH,·add·or·correct·the·following·line·in | ||
| 145 | <tt>/etc/ssh/sshd_config</tt>: | ||
| 146 | <pre>PermitRootLogin·no</pre> | ||
| 147 | ······</td> | 139 | ······</td> |
| 148 | ······<td·xml:lang="en-US"> | 140 | ······<td·xml:lang="en-US"> |
| 141 | ········If·option·<tt>local_events</tt>·isn't·set·to·<tt>yes</tt>·only·events·from | ||
| 142 | network·will·be·aggregated. | ||
| 149 | ········Even·though·the·communications·channel·may·be·encrypted,·an·additional·layer·of | ||
| 150 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | ||
| 151 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | ||
| 152 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | ||
| 153 | direct·attack·attempts·on·root's·password. | ||
| 154 | ······</td> | 143 | ······</td> |
| 155 | ····</tr> | 144 | ····</tr> |
| 156 | ····<tr> | 145 | ····<tr> |
| 157 | ······<td>FAU_GEN.1</td> | 146 | ······<td>FAU_GEN.1</td> |
| 158 | ······<td>Enable·auditd·Service</td> | 147 | ······<td>Enable·auditd·Service</td> |
| 159 | ······<td·xml:lang="en-US"> | 148 | ······<td·xml:lang="en-US"> |
| 160 | ········The·<tt>auditd</tt>·service·is·an·essential·userspace·component·of | 149 | ········The·<tt>auditd</tt>·service·is·an·essential·userspace·component·of |
| Offset 175, 236 lines modified | Offset 161, 85 lines modified | ||
| 175 | <br·/><br·/> | 161 | <br·/><br·/> |
| 176 | Additionally,·a·properly·configured·audit·subsystem·ensures·that·actions·of | 162 | Additionally,·a·properly·configured·audit·subsystem·ensures·that·actions·of |
| 177 | individual·system·users·can·be·uniquely·traced·to·those·users·so·they | 163 | individual·system·users·can·be·uniquely·traced·to·those·users·so·they |
| 178 | can·be·held·accountable·for·their·actions. | 164 | can·be·held·accountable·for·their·actions. |
| 179 | ······</td> | 165 | ······</td> |
| 180 | ····</tr> | 166 | ····</tr> |
| 181 | ····<tr> | 167 | ····<tr> |
| 182 | ······<td>FAU_GEN.1 | 168 | ······<td>FAU_GEN.1</td> |
| 169 | ······<td>Set·number·of·records·to·cause·an·explicit·flush·to·audit·logs</td> | ||
| 183 | ······<td>Ensure·auditd·Collects·Information·on·the·Use·of·Privileged·Commands·-·newgidmap</td> | ||
| 184 | ······<td·xml:lang="en-US"> | ||
| 185 | ········At·a·minimum,·the·audit·system·should·collect·the·execution·of | ||
| 186 | privileged·commands·for·all·users·and·root.·If·the·<tt>auditd</tt>·daemon·is | ||
| 187 | configured·to·use·the·<tt>augenrules</tt>·program·to·read·audit·rules·during | ||
| 188 | daemon·startup·(the·default),·add·a·line·of·the·following·form·to·a·file·with | ||
| 189 | suffix·<tt>.rules</tt>·in·the·directory·<tt>/etc/audit/rules.d</tt>: | ||
| 190 | <pre>-a·always,exit·-F·path=/usr/bin/newgidmap·-F·auid>=1000·-F·auid!=unset·-F·key=privileged</pre> | ||
| 191 | If·the·<tt>auditd</tt>·daemon·is·configured·to·use·the·<tt>auditctl</tt> | ||
| 192 | utility·to·read·audit·rules·during·daemon·startup,·add·a·line·of·the·following | ||
| 193 | form·to·<tt>/etc/audit/audit.rules</tt>: | ||
| 194 | <pre>-a·always,exit·-F·path=/usr/bin/newgidmap·-F·auid>=1000·-F·auid!=unset·-F·key=privileged</pre> | ||
| 195 | ······</td> | ||
| 196 | ······<td·xml:lang="en-US"> | ||
| 197 | ········Misuse·of·privileged·functions,·either·intentionally·or·unintentionally·by | ||
| 198 | authorized·users,·or·by·unauthorized·external·entities·that·have·compromised·system·accounts, | ||
| 199 | is·a·serious·and·ongoing·concern·and·can·have·significant·adverse·impacts·on·organizations. | ||
| 200 | Auditing·the·use·of·privileged·functions·is·one·way·to·detect·such·misuse·and·identify | ||
| 201 | the·risk·from·insider·and·advanced·persistent·threats. | ||
| Max diff block lines reached; 307698/315997 bytes (97.37%) of diff not shown. | |||
| Offset 43, 28 lines modified | Offset 43, 31 lines modified | ||
| 43 | ········································································command·line·tool.·This | 43 | ········································································command·line·tool.·This |
| 44 | AGD_PRE.1·······Install·openscap-·The·openscap-scanner·package·can·be···tool·is·a·configuration | 44 | AGD_PRE.1·······Install·openscap-·The·openscap-scanner·package·can·be···tool·is·a·configuration |
| 45 | AGD_OPE.1·······scanner·Package···installed·with·the·following·command:·and·vulnerability | 45 | AGD_OPE.1·······scanner·Package···installed·with·the·following·command:·and·vulnerability |
| 46 | ··································$·sudo·yum·install·openscap-scanner···scanner,·capable·of | 46 | ··································$·sudo·yum·install·openscap-scanner···scanner,·capable·of |
| 47 | ········································································performing·compliance | 47 | ········································································performing·compliance |
| 48 | ········································································checking·using·SCAP | 48 | ········································································checking·using·SCAP |
| 49 | ········································································content. | 49 | ········································································content. |
| 50 | ········································································Even·though·the | ||
| 51 | ········································································communications·channel | ||
| 52 | ········································································may·be·encrypted,·an | ||
| 50 | ··································To·configure·Audit·daemon·to·include··If·option·local_events | ||
| 51 | ················Include·Local·····local·events·in·Audit·logs,·set·······isn't·set·to·yes·only | ||
| 52 | FAU_GEN.1·······Events·in·Audit···local_events·to·yes·in·/etc/audit/····events·from·network | ||
| 53 | ················Logs··············auditd.conf.·This·is·the·default······will·be·aggregated. | ||
| 54 | ··································setting. | ||
| 55 | ········································································ | 53 | ········································································additional·layer·of |
| 56 | ········································································ | 54 | ········································································security·is·gained·by |
| 55 | ··································The·root·user·should·never·be·allowed·extending·the·policy·of | ||
| 56 | ··································to·login·to·a·system·directly·over·a··not·logging·directly·on | ||
| 57 | ················Disable·SSH·Root··network.·To·disable·root·login·via····as·root.·In·addition, | ||
| 58 | FAU_GEN.1·······Login·············SSH,·add·or·correct·the·following·····logging·in·with·a·user- | ||
| 59 | ··································line·in·/etc/ssh/sshd_config:·········specific·account | ||
| 60 | ··································PermitRootLogin·no····················provides·individual | ||
| 57 | ········································································a | 61 | ········································································accountability·of |
| 58 | ················Ensure·the·audit··The·audit·package·should·be···········watching·system·calls | ||
| 59 | FAU_GEN.1·······Subsystem·is······installed.····························to·audit·any·access,·in | ||
| 60 | ················Installed···············································comparison·with | ||
| 61 | ········································································potential·local·access | ||
| 62 | ········································································ | 62 | ········································································actions·performed·on |
| 63 | ········································································the·system·and·also | ||
| 64 | ········································································helps·to·minimize | ||
| 65 | ········································································direct·attack·attempts | ||
| 63 | ········································································ | 66 | ········································································on·root's·password. |
| 64 | ··································To·ensure·all·processes·can·be | 67 | ··································To·ensure·all·processes·can·be |
| 65 | ··································audited,·even·those·which·start·prior | 68 | ··································audited,·even·those·which·start·prior |
| 66 | ··································to·the·audit·daemon,·add·the·argument·Each·process·on·the | 69 | ··································to·the·audit·daemon,·add·the·argument·Each·process·on·the |
| 67 | ··································audit=1·to·the·default·GRUB·2·command·system·carries·an | 70 | ··································audit=1·to·the·default·GRUB·2·command·system·carries·an |
| 68 | ··································line·for·the·Linux·operating·system.··"auditable"·flag·which | 71 | ··································line·for·the·Linux·operating·system.··"auditable"·flag·which |
| 69 | ··································To·ensure·that·audit=1·is·added·as·a··indicates·whether·its | 72 | ··································To·ensure·that·audit=1·is·added·as·a··indicates·whether·its |
| 70 | ················Enable·Auditing···kernel·command·line·argument·to·newly·activities·can·be | 73 | ················Enable·Auditing···kernel·command·line·argument·to·newly·activities·can·be |
| Offset 75, 37 lines modified | Offset 78, 28 lines modified | ||
| 75 | ··································below:································after·it·does,·adding | 78 | ··································below:································after·it·does,·adding |
| 76 | ··································GRUB_CMDLINE_LINUX="...·audit=1·..."··the·kernel·argument | 79 | ··································GRUB_CMDLINE_LINUX="...·audit=1·..."··the·kernel·argument |
| 77 | ··································Run·the·following·command·to·update···ensures·it·is·set·for | 80 | ··································Run·the·following·command·to·update···ensures·it·is·set·for |
| 78 | ··································command·line·for·already·installed····every·process·during | 81 | ··································command·line·for·already·installed····every·process·during |
| 79 | ··································kernels:······························boot. | 82 | ··································kernels:······························boot. |
| 80 | ··································#·grubby·--update-kernel=ALL·-- | 83 | ··································#·grubby·--update-kernel=ALL·-- |
| 81 | ··································args="audit=1" | 84 | ··································args="audit=1" |
| 82 | ········································································If·option·freq·isn't | ||
| 83 | ················Set·number·of·····To·configure·Audit·daemon·to·issue·an·set·to·,·the·flush·to | ||
| 84 | FAU_GEN.1·······records·to·cause··explicit·flush·to·disk·command·after··disk·may·happen·after | ||
| 85 | ················an·explicit·flush·writing·50·records,·set·freq·to·50·in·higher·number·of | ||
| 86 | ················to·audit·logs·····/etc/audit/auditd.conf.···············records,·increasing·the | ||
| 87 | ········································································ | 85 | ········································································The·auditd·service·is |
| 88 | ········································································ | 86 | ········································································an·access·monitoring |
| 89 | ········································································communications·channel | ||
| 90 | ········································································may·be·encrypted,·an | ||
| 91 | ········································································additional·layer·of | ||
| 92 | ········································································security·is·gained·by | ||
| 93 | ··································The·root·user·should·never·be·allowed·extending·the·policy·of | ||
| 94 | ··································to·login·to·a·system·directly·over·a··not·logging·directly·on | ||
| 95 | ················Disable·SSH·Root··network.·To·disable·root·login·via····as·root.·In·addition, | ||
| 96 | FAU_GEN.1·······Login·············SSH,·add·or·correct·the·following·····logging·in·with·a·user- | ||
| 97 | ··································line·in·/etc/ssh/sshd_config:·········specific·account | ||
| 98 | ··································PermitRootLogin·no····················provides·individual | ||
| 99 | ········································································account | 87 | ········································································and·accounting·daemon, |
| 88 | ················Ensure·the·audit··The·audit·package·should·be···········watching·system·calls | ||
| 89 | FAU_GEN.1·······Subsystem·is······installed.····························to·audit·any·access,·in | ||
| 90 | ················Installed···············································comparison·with | ||
| 91 | ········································································potential·local·access | ||
| 100 | ········································································ | 92 | ········································································control·policy·such·as |
| 101 | ········································································the·system·and·also | ||
| 102 | ········································································helps·to·minimize | ||
| 103 | ········································································direct·attack·attempts | ||
| 104 | ········································································ | 93 | ········································································SELinux·policy. |
| 94 | ··································To·configure·Audit·daemon·to·include··If·option·local_events | ||
| 95 | ················Include·Local·····local·events·in·Audit·logs,·set·······isn't·set·to·yes·only | ||
| 96 | FAU_GEN.1·······Events·in·Audit···local_events·to·yes·in·/etc/audit/····events·from·network | ||
| 97 | ················Logs··············auditd.conf.·This·is·the·default······will·be·aggregated. | ||
| 98 | ··································setting. | ||
| 105 | ········································································Without·establishing | 99 | ········································································Without·establishing |
| 106 | ········································································what·type·of·events | 100 | ········································································what·type·of·events |
| 107 | ········································································occurred,·it·would·be | 101 | ········································································occurred,·it·would·be |
| 108 | ········································································difficult·to·establish, | 102 | ········································································difficult·to·establish, |
| 109 | ········································································correlate,·and | 103 | ········································································correlate,·and |
| 110 | ········································································investigate·the·events | 104 | ········································································investigate·the·events |
| 111 | ········································································leading·up·to·an·outage | 105 | ········································································leading·up·to·an·outage |
| Offset 122, 221 lines modified | Offset 116, 69 lines modified | ||
| 122 | ········································································audit·subsystem·ensures | 116 | ········································································audit·subsystem·ensures |
| 123 | ········································································that·actions·of | 117 | ········································································that·actions·of |
| 124 | ········································································individual·system·users | 118 | ········································································individual·system·users |
| 125 | ········································································can·be·uniquely·traced | 119 | ········································································can·be·uniquely·traced |
| 126 | ········································································to·those·users·so·they | 120 | ········································································to·those·users·so·they |
| 127 | ········································································can·be·held·accountable | 121 | ········································································can·be·held·accountable |
| 128 | ········································································for·their·actions. | 122 | ········································································for·their·actions. |
| 129 | ········································································Misuse·of·privileged | ||
| 130 | ········································································functions,·either | ||
| 131 | ········································································intentionally·or | ||
| 132 | ········································································unintentionally·by | ||
| 133 | ········································································authorized·users,·or·by | ||
| 134 | ··································At·a·minimum,·the·audit·system·should·unauthorized·external | ||
| 135 | ··································collect·the·execution·of·privileged···entities·that·have | ||
| 136 | ··································commands·for·all·users·and·root.·If···compromised·system | ||
| 137 | ··································the·auditd·daemon·is·configured·to····accounts,·is·a·serious | ||
| 138 | ··································use·the·augenrules·program·to·read····and·ongoing·concern·and | ||
| 139 | ··································audit·rules·during·daemon·startup·····can·have·significant | ||
| 140 | ··································(the·default),·add·a·line·of·the······adverse·impacts·on | ||
| 141 | ················Ensure·auditd·····following·form·to·a·file·with·suffix··organizations.·Auditing | ||
| 142 | ················Collects··········.rules·in·the·directory·/etc/audit/···the·use·of·privileged | ||
| 143 | ················Information·on····rules.d:······························functions·is·one·way·to | ||
| 144 | FAU_GEN.1.1.c···the·Use·of········-a·always,exit·-F·path=/usr/bin/······detect·such·misuse·and | ||
| 145 | ················Privileged········newgidmap·-F·auid>=1000·-·············identify·the·risk·from | ||
| 146 | ················Commands·-········F·auid!=unset·-F·key=privileged·······insider·and·advanced | ||
| 147 | ················newgidmap·········If·the·auditd·daemon·is·configured·to·persistent·threats. | ||
| 148 | ··································use·the·auditctl·utility·to·read | ||
| 149 | ··································audit·rules·during·daemon·startup,····Privileged·programs·are | ||
| 150 | ··································add·a·line·of·the·following·form·to·/·subject·to·escalation- | ||
| 151 | ··································etc/audit/audit.rules:················of-privilege·attacks, | ||
| 152 | ··································-a·always,exit·-F·path=/usr/bin/······which·attempt·to | ||
| 153 | ··································newgidmap·-F·auid>=1000·-·············subvert·their·normal | ||
| 154 | ··································F·auid!=unset·-F·key=privileged·······role·of·providing·some | ||
| 155 | ········································································necessary·but·limited | ||
| 156 | ········································································capability.·As·such, | ||
| 157 | ········································································ | 123 | ········································································If·option·freq·isn't |
| 124 | ················Set·number·of·····To·configure·Audit·daemon·to·issue·an·set·to·,·the·flush·to | ||
| 125 | FAU_GEN.1·······records·to·cause··explicit·flush·to·disk·command·after··disk·may·happen·after | ||
| 126 | ················an·explicit·flush·writing·50·records,·set·freq·to·50·in·higher·number·of | ||
| Max diff block lines reached; 482227/500494 bytes (96.35%) of diff not shown. | |||
| Offset 41, 28 lines modified | Offset 41, 14 lines modified | ||
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> |
| 48 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 51 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 52 | ······</td> | ||
| 53 | ······<td·xml:lang="en-US"> | ||
| 54 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 55 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 56 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 57 | the·network. | ||
| 58 | ······</td> | ||
| 59 | ····</tr> | ||
| 60 | ····<tr> | ||
| 61 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 62 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> | 48 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> |
| 63 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 64 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, | 50 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, |
| 65 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default | 51 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default |
| 66 | GRUB2·command·line·for·the·Linux·operating·system. | 52 | GRUB2·command·line·for·the·Linux·operating·system. |
| 67 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line | 53 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line |
| 68 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the | 54 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the |
| Offset 73, 14 lines modified | Offset 59, 28 lines modified | ||
| 73 | ······</td> | 59 | ······</td> |
| 74 | ······<td·xml:lang="en-US"> | 60 | ······<td·xml:lang="en-US"> |
| 75 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce | 61 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce |
| 76 | the·vulnerability·to·exploitation. | 62 | the·vulnerability·to·exploitation. |
| 77 | ······</td> | 63 | ······</td> |
| 78 | ····</tr> | 64 | ····</tr> |
| 79 | ····<tr> | 65 | ····<tr> |
| 66 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 67 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 68 | ······<td·xml:lang="en-US"> | ||
| 69 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 70 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 71 | ······</td> | ||
| 72 | ······<td·xml:lang="en-US"> | ||
| 73 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 74 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 75 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 76 | the·network. | ||
| 77 | ······</td> | ||
| 78 | ····</tr> | ||
| 79 | ····<tr> | ||
| 80 | ······<td>Req-1.3.3</td> | 80 | ······<td>Req-1.3.3</td> |
| 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> | 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> |
| 82 | ······<td·xml:lang="en-US"> | 82 | ······<td·xml:lang="en-US"> |
| 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless | 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless |
| 84 | capability. | 84 | capability. |
| 85 | <br·/><br·/> | 85 | <br·/><br·/> |
| Offset 111, 30 lines modified | Offset 111, 14 lines modified | ||
| 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, | 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, |
| 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an | 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 113 | anti-spoofing·measure. | 113 | anti-spoofing·measure. |
| 114 | ······</td> | 114 | ······</td> |
| 115 | ····</tr> | 115 | ····</tr> |
| 116 | ····<tr> | 116 | ····<tr> |
| 117 | ······<td>Req-1.4.1</td> | 117 | ······<td>Req-1.4.1</td> |
| 118 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 119 | ······<td·xml:lang="en-US"> | ||
| 120 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 121 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 122 | ······</td> | ||
| 123 | ······<td·xml:lang="en-US"> | ||
| 124 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 125 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 126 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 127 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 128 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 129 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 130 | ······</td> | ||
| 131 | ····</tr> | ||
| 132 | ····<tr> | ||
| 133 | ······<td>Req-1.4.1</td> | ||
| 134 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> | 118 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> |
| 135 | ······<td·xml:lang="en-US"> | 119 | ······<td·xml:lang="en-US"> |
| 136 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for | 120 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for |
| 137 | the·built-in·INPUT·chain·which·processes·incoming·packets, | 121 | the·built-in·INPUT·chain·which·processes·incoming·packets, |
| 138 | add·or·correct·the·following·line·in | 122 | add·or·correct·the·following·line·in |
| 139 | <tt>/etc/sysconfig/ip6tables</tt>: | 123 | <tt>/etc/sysconfig/ip6tables</tt>: |
| 140 | <pre>:INPUT·DROP·[0:0]</pre> | 124 | <pre>:INPUT·DROP·[0:0]</pre> |
| Offset 176, 14 lines modified | Offset 160, 30 lines modified | ||
| 176 | typically·critical·to·operation·of·the·system.·The·loopback·interface· | 160 | typically·critical·to·operation·of·the·system.·The·loopback·interface· |
| 177 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· | 161 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· |
| 178 | other·interfaces·should·ignore·traffic·on·this·network·as·an | 162 | other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 179 | anti-spoofing·measure. | 163 | anti-spoofing·measure. |
| 180 | ······</td> | 164 | ······</td> |
| 181 | ····</tr> | 165 | ····</tr> |
| 182 | ····<tr> | 166 | ····<tr> |
| 167 | ······<td>Req-1.4.1</td> | ||
| 168 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 169 | ······<td·xml:lang="en-US"> | ||
| 170 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 171 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 172 | ······</td> | ||
| 173 | ······<td·xml:lang="en-US"> | ||
| 174 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 175 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 176 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 177 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 178 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 179 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 180 | ······</td> | ||
| 181 | ····</tr> | ||
| 182 | ····<tr> | ||
| 183 | ······<td>Req-1.4.2</td> | 183 | ······<td>Req-1.4.2</td> |
| 184 | ······<td>Disable·SCTP·Support</td> | 184 | ······<td>Disable·SCTP·Support</td> |
| 185 | ······<td·xml:lang="en-US"> | 185 | ······<td·xml:lang="en-US"> |
| 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a | 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a |
| 187 | transport·layer·protocol,·designed·to·support·the·idea·of | 187 | transport·layer·protocol,·designed·to·support·the·idea·of |
| 188 | message-oriented·communication,·with·several·streams·of·messages | 188 | message-oriented·communication,·with·several·streams·of·messages |
| 189 | within·one·connection. | 189 | within·one·connection. |
| Offset 248, 14 lines modified | Offset 248, 41 lines modified | ||
| 248 | <br·/> | 248 | <br·/> |
| 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast | 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast |
| 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. | 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. |
| 251 | ······</td> | 251 | ······</td> |
| 252 | ····</tr> | 252 | ····</tr> |
| 253 | ····<tr> | 253 | ····<tr> |
| 254 | ······<td>Req-1.4.3</td> | 254 | ······<td>Req-1.4.3</td> |
| Max diff block lines reached; 245719/253458 bytes (96.95%) of diff not shown. | |||
| Offset 1, 13 lines modified | Offset 1, 25 lines modified | ||
| 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle | 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle |
| 2 | Linux·7 | 2 | Linux·7 |
| 3 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 4 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 5 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 6 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 7 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 8 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 9 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 10 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 11 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 12 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 13 | ·····························already·installed·kernels: | ||
| 14 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 3 | ····················································································Routing·protocol | 15 | ····················································································Routing·protocol |
| 4 | ····················································································daemons·are | 16 | ····················································································daemons·are |
| 5 | ····················································································typically·used·on | 17 | ····················································································typically·used·on |
| 6 | ····················································································routers·to·exchange | 18 | ····················································································routers·to·exchange |
| 7 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology | 19 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology |
| 8 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with | 20 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with |
| 9 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If | 21 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If |
| Offset 15, 26 lines modified | Offset 27, 14 lines modified | ||
| 15 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not | 27 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not |
| 16 | ·····························sysctl.d:··············································required,·system | 28 | ·····························sysctl.d:··············································required,·system |
| 17 | ·····························net.ipv4.ip_forward·=·0································network·information | 29 | ·····························net.ipv4.ip_forward·=·0································network·information |
| 18 | ····················································································may·be | 30 | ····················································································may·be |
| 19 | ····················································································unnecessarily | 31 | ····················································································unnecessarily |
| 20 | ····················································································transmitted·across | 32 | ····················································································transmitted·across |
| 21 | ····················································································the·network. | 33 | ····················································································the·network. |
| 22 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 23 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 24 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 25 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 26 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 27 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 28 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 29 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 30 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 31 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 32 | ·····························already·installed·kernels: | ||
| 33 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 34 | ····················································································The·use·of·wireless | 34 | ····················································································The·use·of·wireless |
| 35 | ····················································································networking·can | 35 | ····················································································networking·can |
| 36 | ····················································································introduce·many | 36 | ····················································································introduce·many |
| 37 | ····················································································different·attack | 37 | ····················································································different·attack |
| 38 | ····················································································vectors·into·the | 38 | ····················································································vectors·into·the |
| 39 | ····················································································organization's | 39 | ····················································································organization's |
| 40 | ····················································································network.·Common | 40 | ····················································································network.·Common |
| Offset 73, 40 lines modified | Offset 73, 14 lines modified | ||
| 73 | ····················································································network·traffic | 73 | ····················································································network·traffic |
| 74 | ····················································································should·be·seen,·all | 74 | ····················································································should·be·seen,·all |
| 75 | ····················································································other·interfaces | 75 | ····················································································other·interfaces |
| 76 | ····················································································should·ignore | 76 | ····················································································should·ignore |
| 77 | ····················································································traffic·on·this | 77 | ····················································································traffic·on·this |
| 78 | ····················································································network·as·an·anti- | 78 | ····················································································network·as·an·anti- |
| 79 | ····················································································spoofing·measure. | 79 | ····················································································spoofing·measure. |
| 80 | ····················································································A·TCP·SYN·flood | ||
| 81 | ····················································································attack·can·cause·a | ||
| 82 | ····················································································denial·of·service | ||
| 83 | ····················································································by·filling·a | ||
| 84 | ····················································································system's·TCP | ||
| 85 | ····················································································connection·table | ||
| 86 | ····················································································with·connections·in | ||
| 87 | ····················································································the·SYN_RCVD·state. | ||
| 88 | ····················································································Syncookies·can·be | ||
| 89 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 90 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 91 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 92 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 93 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 94 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 95 | ·····························sysctl.d:··············································connection·and·is | ||
| 96 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 97 | ····················································································This·feature·is | ||
| 98 | ····················································································activated·when·a | ||
| 99 | ····················································································flood·condition·is | ||
| 100 | ····················································································detected,·and | ||
| 101 | ····················································································enables·the·system | ||
| 102 | ····················································································to·continue | ||
| 103 | ····················································································servicing·valid | ||
| 104 | ····················································································connection | ||
| 105 | ····················································································requests. | ||
| 106 | ····················································································In·ip6tables,·the | 80 | ····················································································In·ip6tables,·the |
| 107 | ····················································································default·policy·is | 81 | ····················································································default·policy·is |
| 108 | ····················································································applied·only·after | 82 | ····················································································applied·only·after |
| 109 | ····················································································all·the·applicable | 83 | ····················································································all·the·applicable |
| 110 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table | 84 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table |
| 111 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a | 85 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a |
| 112 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the | 86 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the |
| Offset 140, 14 lines modified | Offset 114, 40 lines modified | ||
| 140 | ····················································································network·traffic | 114 | ····················································································network·traffic |
| 141 | ····················································································should·be·seen,·all | 115 | ····················································································should·be·seen,·all |
| 142 | ····················································································other·interfaces | 116 | ····················································································other·interfaces |
| 143 | ····················································································should·ignore | 117 | ····················································································should·ignore |
| 144 | ····················································································traffic·on·this | 118 | ····················································································traffic·on·this |
| 145 | ····················································································network·as·an·anti- | 119 | ····················································································network·as·an·anti- |
| 146 | ····················································································spoofing·measure. | 120 | ····················································································spoofing·measure. |
| 121 | ····················································································A·TCP·SYN·flood | ||
| 122 | ····················································································attack·can·cause·a | ||
| 123 | ····················································································denial·of·service | ||
| 124 | ····················································································by·filling·a | ||
| 125 | ····················································································system's·TCP | ||
| 126 | ····················································································connection·table | ||
| 127 | ····················································································with·connections·in | ||
| 128 | ····················································································the·SYN_RCVD·state. | ||
| 129 | ····················································································Syncookies·can·be | ||
| 130 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 131 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 132 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 133 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 134 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 135 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 136 | ·····························sysctl.d:··············································connection·and·is | ||
| 137 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 138 | ····················································································This·feature·is | ||
| 139 | ····················································································activated·when·a | ||
| 140 | ····················································································flood·condition·is | ||
| 141 | ····················································································detected,·and | ||
| 142 | ····················································································enables·the·system | ||
| 143 | ····················································································to·continue | ||
| 144 | ····················································································servicing·valid | ||
| 145 | ····················································································connection | ||
| 146 | ····················································································requests. | ||
| Max diff block lines reached; 397486/409506 bytes (97.06%) of diff not shown. | |||
| Offset 62, 571 lines modified | Offset 62, 571 lines modified | ||
| 000003d0:·7468·3e0a·2020·2020·3c74·683e·5275·6c65··th>.····<th>Rule | 000003d0:·7468·3e0a·2020·2020·3c74·683e·5275·6c65··th>.····<th>Rule | ||
| 000003e0:·2054·6974·6c65·3c2f·7468·3e0a·2020·2020···Title</th>.···· | 000003e0:·2054·6974·6c65·3c2f·7468·3e0a·2020·2020···Title</th>.···· | ||
| 000003f0:·3c74·683e·4465·7363·7269·7074·696f·6e3c··<th>Description< | 000003f0:·3c74·683e·4465·7363·7269·7074·696f·6e3c··<th>Description< | ||
| 00000400:·2f74·683e·0a20·2020·203c·7468·3e52·6174··/th>.····<th>Rat | 00000400:·2f74·683e·0a20·2020·203c·7468·3e52·6174··/th>.····<th>Rat | ||
| 00000410:·696f·6e61·6c65·3c2f·7468·3e0a·2020·3c2f··ionale</th>.··</ | 00000410:·696f·6e61·6c65·3c2f·7468·3e0a·2020·3c2f··ionale</th>.··</ | ||
| 00000420:·7468·6561·643e·0a20·203c·7462·6f64·793e··thead>.··<tbody> | 00000420:·7468·6561·643e·0a20·203c·7462·6f64·793e··thead>.··<tbody> | Diff chunk too large, falling back to line-by-line diff (557 lines added, 557 lines removed) | |
| 00000430:·0a20·203c·7472·3e0a·2020·2020·2020·3c74··.··<tr>.······<t | 00000430:·0a20·203c·7472·3e0a·2020·2020·2020·3c74··.··<tr>.······<t | ||
| 00000440:·643e·4250·3238·2852·3129·3c | 00000440:·643e·4250·3238·2852·3129·3c62·722f·3e4e··d>BP28(R1)<br/>N | ||
| 00000450:· | 00000450:·5430·3037·2852·3033·293c·2f74·643e·0a20··T007(R03)</td>.· | ||
| 00000460:· | 00000460:·2020·2020·203c·7464·3e55·6e69·6e73·7461·······<td>Uninsta | ||
| 00000470:·6 | 00000470:·6c6c·2074·6865·2074·656c·6e65·7420·7365··ll·the·telnet·se | ||
| 00000480:· | 00000480:·7276·6572·3c2f·7464·3e0a·2020·2020·2020··rver</td>.······ | ||
| 00000490:· | 00000490:·3c74·6420·786d·6c3a·6c61·6e67·3d22·656e··<td·xml:lang="en | ||
| 000004a0:· | 000004a0:·2d55·5322·3e0a·2020·2020·2020·2020·5468··-US">.········Th | ||
| 000004b0:·6 | 000004b0:·6520·7465·6c6e·6574·2064·6165·6d6f·6e20··e·telnet·daemon· | ||
| 000004c0:· | 000004c0:·7368·6f75·6c64·2062·6520·756e·696e·7374··should·be·uninst | ||
| 000004d0:· | 000004d0:·616c·6c65·642e·0a20·2020·2020·203c·2f74··alled..······</t | ||
| 000004e0:·6 | 000004e0:·643e·0a20·2020·2020·203c·7464·2078·6d6c··d>.······<td·xml | ||
| 000004f0:· | 000004f0:·3a6c·616e·673d·2265·6e2d·5553·223e·0a20··:lang="en-US">.· | ||
| 00000500:· | 00000500:·2020·2020·2020·203c·7474·3e74·656c·6e65·········<tt>telne | ||
| 00000510:· | 00000510:·743c·2f74·743e·2061·6c6c·6f77·7320·636c··t</tt>·allows·cl | ||
| 00000520:· | 00000520:·6561·7220·7465·7874·2063·6f6d·6d75·6e69··ear·text·communi | ||
| 00000530:· | 00000530:·6361·7469·6f6e·732c·2061·6e64·2064·6f65··cations,·and·doe | ||
| 00000540:· | 00000540:·7320·6e6f·7420·7072·6f74·6563·740a·616e··s·not·protect.an | ||
| 00000550:· | 00000550:·7920·6461·7461·2074·7261·6e73·6d69·7373··y·data·transmiss | ||
| 00000560:·6 | 00000560:·696f·6e20·6265·7477·6565·6e20·636c·6965··ion·between·clie | ||
| 00000570:·6e | 00000570:·6e74·2061·6e64·2073·6572·7665·722e·2041··nt·and·server.·A | ||
| 00000580:·6 | 00000580:·6e79·2063·6f6e·6669·6465·6e74·6961·6c20··ny·confidential· | ||
| 00000590:· | 00000590:·6461·7461·0a63·616e·2062·6520·6c69·7374··data.can·be·list | ||
| 000005a0:·6 | 000005a0:·656e·6564·2061·6e64·206e·6f20·696e·7465··ened·and·no·inte | ||
| 000005b0:·6 | 000005b0:·6772·6974·7920·6368·6563·6b69·6e67·2069··grity·checking·i | ||
| 000005c0:· | 000005c0:·7320·6d61·6465·2e27·0a20·2020·2020·203c··s·made.'.······< | ||
| 000005d0:· | 000005d0:·2f74·643e·0a20·2020·203c·2f74·723e·0a20··/td>.····</tr>.· | ||
| 000005e0:· | 000005e0:·2020·203c·7472·3e0a·2020·2020·2020·3c74·····<tr>.······<t | ||
| 000005f0:· | 000005f0:·643e·4250·3238·2852·3129·3c2f·7464·3e0a··d>BP28(R1)</td>. | ||
| 00000600:· | 00000600:·2020·2020·2020·3c74·643e·556e·696e·7374········<td>Uninst | ||
| 00000610:· | 00000610:·616c·6c20·5365·6e64·6d61·696c·2050·6163··all·Sendmail·Pac | ||
| 00000620:·6 | 00000620:·6b61·6765·3c2f·7464·3e0a·2020·2020·2020··kage</td>.······ | ||
| 00000630:· | 00000630:·3c74·6420·786d·6c3a·6c61·6e67·3d22·656e··<td·xml:lang="en | ||
| 00000640:· | 00000640:·2d55·5322·3e0a·2020·2020·2020·2020·5365··-US">.········Se | ||
| 00000650:· | 00000650:·6e64·6d61·696c·2069·7320·6e6f·7420·7468··ndmail·is·not·th | ||
| 00000660:· | 00000660:·6520·6465·6661·756c·7420·6d61·696c·2074··e·default·mail·t | ||
| 00000670:· | 00000670:·7261·6e73·6665·7220·6167·656e·7420·616e··ransfer·agent·an | ||
| 00000680:· | 00000680:·6420·6973·0a6e·6f74·2069·6e73·7461·6c6c··d·is.not·install | ||
| 00000690:· | 00000690:·6564·2062·7920·6465·6661·756c·742e·0a54··ed·by·default..T | ||
| 000006a0:· | 000006a0:·6865·203c·636f·6465·3e73·656e·646d·6169··he·<code>sendmai | ||
| 000006b0:·6c | 000006b0:·6c3c·2f63·6f64·653e·2070·6163·6b61·6765··l</code>·package | ||
| 000006c0:·20 | 000006c0:·2063·616e·2062·6520·7265·6d6f·7665·6420···can·be·removed· | ||
| 000006d0:· | 000006d0:·7769·7468·2074·6865·2066·6f6c·6c6f·7769··with·the·followi | ||
| 000006e0:· | 000006e0:·6e67·2063·6f6d·6d61·6e64·3a0a·3c70·7265··ng·command:.<pre | ||
| 000006f0:· | 000006f0:·3e0a·2420·7375·646f·2079·756d·2065·7261··>.$·sudo·yum·era | ||
| 00000700:· | 00000700:·7365·2073·656e·646d·6169·6c3c·2f70·7265··se·sendmail</pre | ||
| 00000710:· | 00000710:·3e0a·2020·2020·2020·3c2f·7464·3e0a·2020··>.······</td>.·· | ||
| 00000720:· | 00000720:·2020·2020·3c74·6420·786d·6c3a·6c61·6e67······<td·xml:lang | ||
| 00000730:· | 00000730:·3d22·656e·2d55·5322·3e0a·2020·2020·2020··="en-US">.······ | ||
| 00000740:·2020· | 00000740:·2020·5468·6520·7365·6e64·6d61·696c·2073····The·sendmail·s | ||
| 00000750:· | 00000750:·6f66·7477·6172·6520·7761·7320·6e6f·7420··oftware·was·not· | ||
| 00000760:· | 00000760:·6465·7665·6c6f·7065·6420·7769·7468·2073··developed·with·s | ||
| 00000770:·65 | 00000770:·6563·7572·6974·7920·696e·206d·696e·6420··ecurity·in·mind· | ||
| 00000780:· | 00000780:·616e·640a·6974·7320·6465·7369·676e·2070··and.its·design·p | ||
| 00000790:·7 | 00000790:·7265·7665·6e74·7320·6974·2066·726f·6d20··revents·it·from· | ||
| 000007a0:· | 000007a0:·6265·696e·6720·6566·6665·6374·6976·656c··being·effectivel | ||
| 000007b0:· | 000007b0:·7920·636f·6e74·6169·6e65·6420·6279·2053··y·contained·by·S | ||
| 000007c0:· | 000007c0:·454c·696e·7578·2e20·2050·6f73·7466·6978··ELinux.··Postfix | ||
| 000007d0:· | 000007d0:·0a73·686f·756c·6420·6265·2075·7365·6420··.should·be·used· | ||
| 000007e0:· | 000007e0:·696e·7374·6561·642e·0a20·2020·2020·203c··instead..······< | ||
| 000007f0:· | 000007f0:·2f74·643e·0a20·2020·203c·2f74·723e·0a20··/td>.····</tr>.· | ||
| 00000800:· | 00000800:·2020·203c·7472·3e0a·2020·2020·2020·3c74·····<tr>.······<t | ||
| 00000810:· | 00000810:·643e·4250·3238·2852·3129·3c2f·7464·3e0a··d>BP28(R1)</td>. | ||
| 00000820:· | 00000820:·2020·2020·2020·3c74·643e·556e·696e·7374········<td>Uninst | ||
| 00000830:·6 | 00000830:·616c·6c20·7869·6e65·7464·2050·6163·6b61··all·xinetd·Packa | ||
| 00000840:·6 | 00000840:·6765·3c2f·7464·3e0a·2020·2020·2020·3c74··ge</td>.······<t | ||
| 00000850:·207 | 00000850:·6420·786d·6c3a·6c61·6e67·3d22·656e·2d55··d·xml:lang="en-U | ||
| 00000860:· | 00000860:·5322·3e0a·2020·2020·2020·2020·5468·6520··S">.········The· | ||
| 00000870:·636 | 00000870:·3c63·6f64·653e·7869·6e65·7464·3c2f·636f··<code>xinetd</co | ||
| 00000880:· | 00000880:·6465·3e20·7061·636b·6167·6520·6361·6e20··de>·package·can· | ||
| 00000890:· | 00000890:·6265·2072·656d·6f76·6564·2077·6974·6820··be·removed·with· | ||
| 000008a0:· | 000008a0:·7468·6520·666f·6c6c·6f77·696e·6720·636f··the·following·co | ||
| 000008b0:· | 000008b0:·6d6d·616e·643a·0a3c·7072·653e·0a24·2073··mmand:.<pre>.$·s | ||
| 000008c0:· | 000008c0:·7564·6f20·7975·6d20·6572·6173·6520·7869··udo·yum·erase·xi | ||
| 000008d0:·6 | 000008d0:·6e65·7464·3c2f·7072·653e·0a20·2020·2020··netd</pre>.····· | ||
| 000008e0:·20 | 000008e0:·203c·2f74·643e·0a20·2020·2020·203c·7464···</td>.······<td | ||
| 000008f0:· | 000008f0:·2078·6d6c·3a6c·616e·673d·2265·6e2d·5553···xml:lang="en-US | ||
| 00000900:· | 00000900:·223e·0a20·2020·2020·2020·2052·656d·6f76··">.········Remov | ||
| 00000910:· | 00000910:·696e·6720·7468·6520·3c74·743e·7869·6e65··ing·the·<tt>xine | ||
| 00000920:· | 00000920:·7464·3c2f·7474·3e20·7061·636b·6167·6520··td</tt>·package· | ||
| 00000930:·6 | 00000930:·6465·6372·6561·7365·7320·7468·6520·7269··decreases·the·ri | ||
| 00000940:· | 00000940:·736b·206f·6620·7468·650a·7869·6e65·7464··sk·of·the.xinetd | ||
| 00000950:· | 00000950:·2073·6572·7669·6365·2773·2061·6363·6964···service's·accid | ||
| 00000960:·65 | 00000960:·656e·7461·6c20·286f·7220·696e·7465·6e74··ental·(or·intent | ||
| 00000970:· | 00000970:·696f·6e61·6c29·2061·6374·6976·6174·696f··ional)·activatio | ||
| 00000980:· | 00000980:·6e2e·0a20·2020·2020·203c·2f74·643e·0a20··n..······</td>.· | ||
| 00000990:· | 00000990:·2020·203c·2f74·723e·0a20·2020·203c·7472·····</tr>.····<tr | ||
| 000009a0:· | 000009a0:·3e0a·2020·2020·2020·3c74·643e·4250·3238··>.······<td>BP28 | ||
| 000009b0:· | 000009b0:·2852·3129·3c2f·7464·3e0a·2020·2020·2020··(R1)</td>.······ | ||
| 000009c0:· | 000009c0:·3c74·643e·5265·6d6f·7665·204e·4953·2043··<td>Remove·NIS·C | ||
| 000009d0:·6 | 000009d0:·6c69·656e·743c·2f74·643e·0a20·2020·2020··lient</td>.····· | ||
| 000009e0:· | 000009e0:·203c·7464·2078·6d6c·3a6c·616e·673d·2265···<td·xml:lang="e | ||
| 000009f0:·6 | 000009f0:·6e2d·5553·223e·0a20·2020·2020·2020·2054··n-US">.········T | ||
| 00000a00:· | 00000a00:·6865·204e·6574·776f·726b·2049·6e66·6f72··he·Network·Infor | ||
| 00000a10:·6 | 00000a10:·6d61·7469·6f6e·2053·6572·7669·6365·2028··mation·Service·( | ||
| 00000a20:· | 00000a20:·4e49·5329·2c20·666f·726d·6572·6c79·206b··NIS),·formerly·k | ||
| 00000a30:· | 00000a30:·6e6f·776e·2061·7320·5965·6c6c·6f77·2050··nown·as·Yellow·P | ||
| 00000a40:· | 00000a40:·6167·6573·2c0a·6973·2061·2063·6c69·656e··ages,.is·a·clien | ||
| 00000a50:· | 00000a50:·742d·7365·7276·6572·2064·6972·6563·746f··t-server·directo | ||
| 00000a60:· | 00000a60:·7279·2073·6572·7669·6365·2070·726f·746f··ry·service·proto | ||
| 00000a70:· | 00000a70:·636f·6c20·7573·6564·2074·6f20·6469·7374··col·used·to·dist | ||
| 00000a80:· | 00000a80:·7269·6275·7465·2073·7973·7465·6d20·636f··ribute·system·co | ||
| 00000a90:· | 00000a90:·6e66·6967·7572·6174·696f·6e0a·6669·6c65··nfiguration.file | ||
| 00000aa0:·7 | 00000aa0:·732e·2054·6865·204e·4953·2063·6c69·656e··s.·The·NIS·clien | ||
| 00000ab0:· | 00000ab0:·7420·283c·7474·3e79·7062·696e·643c·2f74··t·(<tt>ypbind</t | ||
| 00000ac0:· | 00000ac0:·743e·2920·7761·7320·7573·6564·2074·6f20··t>)·was·used·to· | ||
| 00000ad0:· | 00000ad0:·6269·6e64·2061·2073·7973·7465·6d20·746f··bind·a·system·to | ||
| 00000ae0:· | 00000ae0:·2061·6e20·4e49·5320·7365·7276·6572·0a61···an·NIS·server.a | ||
| 00000af0:·6 | 00000af0:·6e64·2072·6563·6569·7665·2074·6865·2064··nd·receive·the·d | ||
| 00000b00:· | 00000b00:·6973·7472·6962·7574·6564·2063·6f6e·6669··istributed·confi | ||
| 00000b10:· | 00000b10:·6775·7261·7469·6f6e·2066·696c·6573·2e0a··guration·files.. | ||
| 00000b20:· | 00000b20:·2020·2020·2020·3c2f·7464·3e0a·2020·2020········</td>.···· | ||
| 00000b30:· | 00000b30:·2020·3c74·6420·786d·6c3a·6c61·6e67·3d22····<td·xml:lang=" | ||
| 00000b40:·6 | 00000b40:·656e·2d55·5322·3e0a·2020·2020·2020·2020··en-US">.········ | ||
| 00000b50:· | 00000b50:·5468·6520·4e49·5320·7365·7276·6963·6520··The·NIS·service· | ||
| 00000b60:·6 | 00000b60:·6973·2069·6e68·6572·656e·746c·7920·616e··is·inherently·an | ||
| 00000b70:·6 | 00000b70:·2069·6e73·6563·7572·6520·7379·7374·656d···insecure·system | ||
| 00000b80:· | 00000b80:·2074·6861·7420·6861·7320·6265·656e·2076···that·has·been·v | ||
| 00000b90:· | 00000b90:·756c·6e65·7261·626c·650a·746f·2044·4f53··ulnerable.to·DOS | ||
| 00000ba0:· | 00000ba0:·2061·7474·6163·6b73·2c20·6275·6666·6572···attacks,·buffer | ||
| Max diff block lines reached; 1101967/1179407 bytes (93.43%) of diff not shown. | |||
| Offset 1, 130 lines modified | Offset 1, 130 lines modified | ||
| 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle·Linux | 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle·Linux |
| 2 | 8 | 2 | 8 |
| 3 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does | ||
| 4 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 5 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 6 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 7 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted | ||
| 8 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 9 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 10 | ·············································································in | 3 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data |
| 4 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 5 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 6 | (R03) | ||
| 7 | ································Sendmail·is·not·the·default·mail·transfer | ||
| 8 | BP28··Uninstall·Sendmail········agent·and·is·not·installed·by·default.·The···The·sendmail·software·was·not·developed·with·security·in·mind·and·its·design | ||
| 9 | (R1)··Package···················sendmail·package·can·be·removed·with·the·····prevents·it·from·being·effectively·contained·by·SELinux.·Postfix·should·be | ||
| 10 | ································following·command:···························used·instead. | ||
| 11 | ································$·sudo·yum·erase·sendmail | ||
| 11 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's | 12 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's |
| 12 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. | 13 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. |
| 13 | ································$·sudo·yum·erase·xinetd | 14 | ································$·sudo·yum·erase·xinetd |
| 14 | ································The·talk·package·contains·the·client·program | ||
| 15 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 16 | ································the·user·to·chat·with·other·users·on | ||
| 17 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 18 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 19 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 20 | ································ | 15 | ································The·Network·Information·Service·(NIS), |
| 16 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 17 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 18 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 19 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 20 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 21 | ································distributed·configuration·files. | ||
| 22 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 23 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 24 | (R1)··Package···················The·dhcp-server·package·can·be·removed·with··reactivated·and·disrupt·network·operation. | ||
| 21 | ································command: | 25 | ································the·following·command: |
| 22 | ································$·sudo·yum·erase· | 26 | ································$·sudo·yum·erase·dhcp-server |
| 27 | ·············································································Removing·the·tftp-server·package·decreases·the·risk·of·the·accidental·(or | ||
| 28 | ·············································································intentional)·activation·of·tftp·services. | ||
| 29 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 30 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 31 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| 32 | ·············································································Securty·Manager·(ISSM),·restricted·to·only·authorized·personnel,·and·have | ||
| 33 | ·············································································access·control·rules·established. | ||
| 23 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, | 34 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, |
| 24 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These | 35 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These |
| 25 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain | 36 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain |
| 26 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional | 37 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional |
| 27 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. | 38 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. |
| 28 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does | 39 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does |
| 29 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 40 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 30 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the | 41 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the |
| 31 | ·············································································privileged·user·password·could·be·compromised. | 42 | ·············································································privileged·user·password·could·be·compromised. |
| 32 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet | 43 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet |
| 33 | ·············································································service's·accidental·(or·intentional)·activation. | 44 | ·············································································service's·accidental·(or·intentional)·activation. |
| 34 | ································The·Network·Information·Service·(NIS), | ||
| 35 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 36 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 37 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 38 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 39 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 40 | ································dis | 45 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does |
| 46 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 47 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 48 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 49 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 50 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 51 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 52 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 53 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 54 | ·············································································rsh,rcp,·and·rlogin. | ||
| 55 | ································The·talk·package·contains·the·client·program | ||
| 56 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 57 | ································the·user·to·chat·with·other·users·on | ||
| 58 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 59 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 60 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 61 | ································package·can·be·removed·with·the·following | ||
| 62 | ································command: | ||
| 63 | ································$·sudo·yum·erase·talk | ||
| 41 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does | 64 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does |
| 42 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 65 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 43 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were | 66 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were |
| 44 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be | 67 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be |
| 45 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure | 68 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure |
| 46 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' | 69 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' |
| 47 | ·············································································accidental·(or·intentional)·activation. | 70 | ·············································································accidental·(or·intentional)·activation. |
| 48 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data | ||
| 49 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 50 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 51 | (R03) | ||
| 52 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a | 71 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a |
| 53 | ································simple·file·transfer·protocol,·typically | 72 | ································simple·file·transfer·protocol,·typically |
| 54 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for | 73 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for |
| 55 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when | 74 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when |
| 56 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. | 75 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. |
| 57 | ································hacked.·The·package·tftp·is·a·client·program | 76 | ································hacked.·The·package·tftp·is·a·client·program |
| 58 | ································that·allows·for·connections·to·a·tftp | 77 | ································that·allows·for·connections·to·a·tftp |
| 59 | ································server. | 78 | ································server. |
| 60 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 61 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 62 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 63 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 64 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 65 | ·············································································rsh,rcp,·and·rlogin. | ||
| 66 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 67 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 68 | (R1)··Package···················The·dhcp-server·package·can·be·removed·with··reactivated·and·disrupt·network·operation. | ||
| 69 | ································the·following·command: | ||
| 70 | ································$·sudo·yum·erase·dhcp-server | ||
| 71 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | 79 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols |
| 72 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of | 80 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of |
| 73 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. | 81 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. |
| 74 | ································ | 82 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted |
| 83 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 84 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 75 | ·············································································in | 85 | ·············································································included·in·Oracle·Linux·8. |
| 76 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 77 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 78 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| 79 | ·············································································Securty·Manager·(ISSM),·restricted·to·only·authorized·personnel,·and·have | ||
| Max diff block lines reached; 217438/233788 bytes (93.01%) of diff not shown. | |||
| Offset 40, 71 lines modified | Offset 40, 32 lines modified | ||
| 40 | ····<th>Mapping</th> | 40 | ····<th>Mapping</th> |
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>3.1.1<br/>3.1.6</td> | ||
| 48 | ······<td>Direct·root·Logins·Not·Allowed</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·further·limit·access·to·the·<tt>root</tt>·account,·administrators | ||
| 51 | can·disable·root·logins·at·the·console·by·editing·the·<tt>/etc/securetty</tt>·file. | ||
| 52 | This·file·lists·all·devices·the·root·user·is·allowed·to·login·to.·If·the·file·does | ||
| 53 | not·exist·at·all,·the·root·user·can·login·through·any·communication·device·on·the | ||
| 54 | system,·whether·via·the·console·or·via·a·raw·network·interface.·This·is·dangerous | ||
| 55 | as·user·can·login·to·the·system·as·root·via·Telnet,·which·sends·the·password·in | ||
| 56 | plain·text·over·the·network.·By·default,·Oracle·Linux·8's | ||
| 57 | <tt>/etc/securetty</tt>·file·only·allows·the·root·user·to·login·at·the·console | ||
| 58 | physically·attached·to·the·system.·To·prevent·root·from·logging·in,·remove·the | ||
| 59 | contents·of·this·file.·To·prevent·direct·root·logins,·remove·the·contents·of·this | ||
| 60 | file·by·typing·the·following·command: | ||
| 61 | <pre> | ||
| 62 | $·sudo·echo·>·/etc/securetty | ||
| 63 | </pre> | ||
| 64 | ······</td> | ||
| 65 | ······<td·xml:lang="en-US"> | ||
| 66 | ········Disabling·direct·root·logins·ensures·proper·accountability·and·multifactor | ||
| 67 | authentication·to·privileged·accounts.·Users·will·first·login,·then·escalate | ||
| 68 | to·privileged·(root)·access·via·su·/·sudo.·This·is·required·for·FISMA·Low | ||
| 69 | and·FISMA·Moderate·systems. | ||
| 70 | ······</td> | ||
| 71 | ····</tr> | ||
| 72 | ····<tr> | ||
| 73 | ······<td>3.1.1</td> | ||
| 74 | ······<td>Disable·GDM·Guest·Login</td> | ||
| 75 | ······<td·xml:lang="en-US"> | ||
| 76 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·login·without·credentials | ||
| 77 | which·can·be·useful·for·public·kiosk·scenarios.·Allowing·users·to·login·without·credentials | ||
| 78 | or·"guest"·account·access·has·inherent·security·risks·and·should·be·disabled.·To·do·disable | ||
| 79 | timed·logins·or·guest·account·access,·set·the·<tt>TimedLoginEnable</tt>·to·<tt>false</tt>·in | ||
| 80 | the·<tt>[daemon]</tt>·section·in·<tt>/etc/gdm/custom.conf</tt>.·For·example: | ||
| 81 | <pre>[daemon] | ||
| 82 | TimedLoginEnable=false</pre> | ||
| 83 | ······</td> | ||
| 84 | ······<td·xml:lang="en-US"> | ||
| 85 | ········Failure·to·restrict·system·access·to·authenticated·users·negatively·impacts·operating | ||
| 86 | system·security. | ||
| 87 | ······</td> | ||
| 88 | ····</tr> | ||
| 89 | ····<tr> | ||
| 90 | ······<td>3.1.1<br/>3.1.5</td> | 47 | ······<td>3.1.1<br/>3.1.5</td> |
| 91 | ······<td> | 48 | ······<td>Verify·Only·Root·Has·UID·0</td> |
| 92 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 93 | ········To·restrict·root·logins·through·the·(deprecated)·virtual·console·devices, | ||
| 94 | ensure·lines·of·this·form·do·not·appear·in·<tt>/etc/securetty</tt>: | ||
| 95 | <pre>vc/1 | ||
| 96 | vc/2 | ||
| 97 | vc/3 | ||
| 98 | 50 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | |
| 51 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 52 | their·UID·changed. | ||
| 53 | <br·/> | ||
| 54 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 55 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 56 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 57 | assigned. | ||
| 99 | ······</td> | 58 | ······</td> |
| 100 | ······<td·xml:lang="en-US"> | 59 | ······<td·xml:lang="en-US"> |
| 101 | ········Preventing·direct·root·login·to·virtual·console·devices | ||
| 102 | helps·ensure·accountability·for·actions·taken·on·the·system | ||
| 103 | usi | 60 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts |
| 61 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 62 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 63 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 64 | access·to·root·privileges·in·an·accountable·manner. | ||
| 104 | ······</td> | 65 | ······</td> |
| 105 | ····</tr> | 66 | ····</tr> |
| 106 | ····<tr> | 67 | ····<tr> |
| 107 | ······<td>3.1.1<br/>3.1.5</td> | 68 | ······<td>3.1.1<br/>3.1.5</td> |
| 108 | ······<td>Disable·SSH·Root·Login</td> | 69 | ······<td>Disable·SSH·Root·Login</td> |
| 109 | ······<td·xml:lang="en-US"> | 70 | ······<td·xml:lang="en-US"> |
| 110 | ········The·root·user·should·never·be·allowed·to·login·to·a | 71 | ········The·root·user·should·never·be·allowed·to·login·to·a |
| Offset 121, 32 lines modified | Offset 82, 28 lines modified | ||
| 121 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | 82 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. |
| 122 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | 83 | In·addition,·logging·in·with·a·user-specific·account·provides·individual |
| 123 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | 84 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize |
| 124 | direct·attack·attempts·on·root's·password. | 85 | direct·attack·attempts·on·root's·password. |
| 125 | ······</td> | 86 | ······</td> |
| 126 | ····</tr> | 87 | ····</tr> |
| 127 | ····<tr> | 88 | ····<tr> |
| 128 | ······<td>3.1.1<br/>3. | 89 | ······<td>3.1.1<br/>3.4.5</td> |
| 129 | ······<td> | 90 | ······<td>Require·Authentication·for·Emergency·Systemd·Target</td> |
| 130 | ······<td·xml:lang="en-US"> | 91 | ······<td·xml:lang="en-US"> |
| 92 | ········Emergency·mode·is·intended·as·a·system·recovery | ||
| 93 | method,·providing·a·single·user·root·access·to·the·system | ||
| 94 | during·a·failed·boot·sequence. | ||
| 95 | <br·/><br·/> | ||
| 96 | By·default,·Emergency·mode·is·protected·by·requiring·a·password·and·is·set | ||
| 97 | in·<tt>/usr/lib/systemd/system/emergency.service</tt>. | ||
| 131 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | ||
| 132 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 133 | their·UID·changed. | ||
| 134 | <br·/> | ||
| 135 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 136 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 137 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 138 | assigned. | ||
| 139 | ······</td> | 98 | ······</td> |
| 140 | ······<td·xml:lang="en-US"> | 99 | ······<td·xml:lang="en-US"> |
| 100 | ········This·prevents·attackers·with·physical·access·from·trivially·bypassing·security | ||
| 101 | on·the·machine·and·gaining·root·access.·Such·accesses·are·further·prevented | ||
| 102 | by·configuring·the·bootloader·password. | ||
| 141 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts | ||
| 142 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 143 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 144 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 145 | access·to·root·privileges·in·an·accountable·manner. | ||
| 146 | ······</td> | 103 | ······</td> |
| 147 | ····</tr> | 104 | ····</tr> |
| 148 | ····<tr> | 105 | ····<tr> |
| 149 | ······<td>3.1.1</td> | 106 | ······<td>3.1.1</td> |
| 150 | ······<td>Disable·GDM·Automatic·Login</td> | 107 | ······<td>Disable·GDM·Automatic·Login</td> |
| 151 | ······<td·xml:lang="en-US"> | 108 | ······<td·xml:lang="en-US"> |
| 152 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without | 109 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without |
| Offset 159, 43 lines modified | Offset 116, 28 lines modified | ||
| 159 | ······</td> | 116 | ······</td> |
| 160 | ······<td·xml:lang="en-US"> | 117 | ······<td·xml:lang="en-US"> |
| Max diff block lines reached; 415405/421320 bytes (98.60%) of diff not shown. | |||
| Offset 1, 48 lines modified | Offset 1, 31 lines modified | ||
| 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of | 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of |
| 2 | Oracle·Linux·8 | 2 | Oracle·Linux·8 |
| 3 | ·····································To·further·limit·access·to·the·root·account, | ||
| 4 | ·····································administrators·can·disable·root·logins·at·the·console··Disabling·direct | ||
| 5 | ·····································by·editing·the·/etc/securetty·file.·This·file·lists····root·logins·ensures | ||
| 6 | ·····································all·devices·the·root·user·is·allowed·to·login·to.·If···proper | ||
| 7 | ·····································the·file·does·not·exist·at·all,·the·root·user·can······accountability·and | ||
| 8 | ·····································login·through·any·communication·device·on·the·system,··multifactor | ||
| 9 | ·····································whether·via·the·console·or·via·a·raw·network···········authentication·to | ||
| 10 | 3.1.1···Direct·root·Logins·Not·······interface.·This·is·dangerous·as·user·can·login·to·the··privileged·accounts. | ||
| 11 | 3.1.6···Allowed······················system·as·root·via·Telnet,·which·sends·the·password·in·Users·will·first | ||
| 12 | ·····································plain·text·over·the·network.·By·default,·Oracle·Linux··login,·then·escalate | ||
| 13 | ·····································8's·/etc/securetty·file·only·allows·the·root·user·to···to·privileged·(root) | ||
| 14 | ·····································login·at·the·console·physically·attached·to·the········access·via·su·/ | ||
| 15 | ·····································system.·To·prevent·root·from·logging·in,·remove·the····sudo.·This·is | ||
| 16 | ·····································contents·of·this·file.·To·prevent·direct·root·logins,··required·for·FISMA | ||
| 17 | ·····································remove·the·contents·of·this·file·by·typing·the·········Low·and·FISMA | ||
| 18 | ·····································following·command:·····································Moderate·systems. | ||
| 19 | ·····································$·sudo·echo·>·/etc/securetty | ||
| 20 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 21 | ·····································login·without·credentials·which·can·be·useful·for | ||
| 22 | ·····································public·kiosk·scenarios.·Allowing·users·to·login········Failure·to·restrict | ||
| 23 | ·····································without·credentials·or·"guest"·account·access·has······system·access·to | ||
| 24 | 3.1.1···Disable·GDM·Guest·Login······inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users | ||
| 25 | ·····································disable·timed·logins·or·guest·account·access,·set·the··negatively·impacts | ||
| 26 | ·····································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/·operating·system | ||
| 27 | ·····································etc/gdm/custom.conf.·For·example:······················security. | ||
| 28 | ·····································[daemon] | ||
| 29 | ·····································TimedLoginEnable=false | ||
| 30 | ·····································To·restrict·root·logins·through·the·(deprecated)·······Preventing·direct | ||
| 31 | ·····································virtual·console·devices,·ensure·lines·of·this·form·do··root·login·to | ||
| 32 | ·····································not·appear·in·/etc/securetty:··························virtual·console | ||
| 33 | 3.1.1···Restrict·Virtual·Console·····vc/1···················································devices·helps·ensure | ||
| 34 | 3.1.5···Root·Logins··················vc/2···················································accountability·for | ||
| 35 | ·····································vc/3···················································actions·taken·on·the | ||
| 36 | ·····································vc/4···················································system·using·the | ||
| 37 | ···························································································· | 3 | ····························································································An·account·has·root |
| 4 | ····························································································authority·if·it·has | ||
| 5 | ····························································································a·UID·of·0.·Multiple | ||
| 6 | ····························································································accounts·with·a·UID | ||
| 7 | ·····································If·any·account·other·than·root·has·a·UID·of·0,·this····of·0·afford·more | ||
| 8 | ·····································misconfiguration·should·be·investigated·and·the········opportunity·for | ||
| 9 | ·····································accounts·other·than·root·should·be·removed·or·have·····potential·intruders | ||
| 10 | ·····································their·UID·changed.·····································to·guess·a·password | ||
| 11 | 3.1.1···Verify·Only·Root·Has·UID·0···If·the·account·is·associated·with·system·commands·or···for·a·privileged | ||
| 12 | 3.1.5································applications·the·UID·should·be·changed·to·one·greater··account.·Proper | ||
| 13 | ·····································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··configuration·of | ||
| 14 | ·····································greater·than·"1000"·that·has·not·already·been··········sudo·is·recommended | ||
| 15 | ·····································assigned.··············································to·afford·multiple | ||
| 16 | ····························································································system | ||
| 17 | ····························································································administrators | ||
| 18 | ····························································································access·to·root | ||
| 19 | ····························································································privileges·in·an | ||
| 20 | ····························································································accountable·manner. | ||
| 38 | ····························································································Even·though·the | 21 | ····························································································Even·though·the |
| 39 | ····························································································communications | 22 | ····························································································communications |
| 40 | ····························································································channel·may·be | 23 | ····························································································channel·may·be |
| 41 | ····························································································encrypted,·an | 24 | ····························································································encrypted,·an |
| 42 | ····························································································additional·layer·of | 25 | ····························································································additional·layer·of |
| 43 | ····························································································security·is·gained | 26 | ····························································································security·is·gained |
| 44 | ····························································································by·extending·the | 27 | ····························································································by·extending·the |
| Offset 56, 61 lines modified | Offset 39, 45 lines modified | ||
| 56 | ····························································································accountability·of | 39 | ····························································································accountability·of |
| 57 | ····························································································actions·performed·on | 40 | ····························································································actions·performed·on |
| 58 | ····························································································the·system·and·also | 41 | ····························································································the·system·and·also |
| 59 | ····························································································helps·to·minimize | 42 | ····························································································helps·to·minimize |
| 60 | ····························································································direct·attack | 43 | ····························································································direct·attack |
| 61 | ····························································································attempts·on·root's | 44 | ····························································································attempts·on·root's |
| 62 | ····························································································password. | 45 | ····························································································password. |
| 63 | ····························································································An·account·has·root | ||
| 64 | ····························································································authority·if·it·has | ||
| 65 | ····························································································a·UID·of·0.·Multiple | ||
| 66 | ····························································································accounts·with·a·UID | ||
| 67 | ·····································If·any·account·other·than·root·has·a·UID·of·0,·this····of·0·afford·more | ||
| 68 | ·····································misconfiguration·should·be·investigated·and·the········opportunity·for | ||
| 69 | ·····································accounts·other·than·root·should·be·removed·or·have·····potential·intruders | ||
| 70 | ·····································their·UID·changed.·····································to·guess·a·password | ||
| 71 | 3.1.1···Verify·Only·Root·Has·UID·0···If·the·account·is·associated·with·system·commands·or···for·a·privileged | ||
| 72 | 3.1.5································applications·the·UID·should·be·changed·to·one·greater··account.·Proper | ||
| 73 | ·····································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··configuration·of | ||
| 74 | ·····································greater·than·"1000"·that·has·not·already·been··········sudo·is·recommended | ||
| 75 | ·····································assigned.··············································to·afford·multiple | ||
| 76 | ····························································································s | 46 | ····························································································This·prevents |
| 77 | ····························································································administrators | ||
| 78 | ····························································································a | 47 | ····························································································attackers·with |
| 48 | ·····································Emergency·mode·is·intended·as·a·system·recovery········physical·access·from | ||
| 49 | ·····································method,·providing·a·single·user·root·access·to·the·····trivially·bypassing | ||
| 50 | 3.1.1···Require·Authentication·for···system·during·a·failed·boot·sequence.··················security·on·the | ||
| 51 | 3.4.5···Emergency·Systemd·Target····························································machine·and·gaining | ||
| 52 | ·····································By·default,·Emergency·mode·is·protected·by·requiring·a·root·access.·Such | ||
| 53 | ·····································password·and·is·set·in·/usr/lib/systemd/system/········accesses·are·further | ||
| 79 | ····································· | 54 | ·····································emergency.service.·····································prevented·by |
| 80 | ···························································································· | 55 | ····························································································configuring·the |
| 56 | ····························································································bootloader·password. | ||
| 81 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | 57 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to |
| 82 | ·····································automatically·login·without·user·interaction·or | 58 | ·····································automatically·login·without·user·interaction·or |
| 83 | ·····································credentials.·User·should·always·be·required·to·········Failure·to·restrict | 59 | ·····································credentials.·User·should·always·be·required·to·········Failure·to·restrict |
| 84 | ·····································authenticate·themselves·to·the·system·that·they·are····system·access·to | 60 | ·····································authenticate·themselves·to·the·system·that·they·are····system·access·to |
| 85 | 3.1.1···Disable·GDM·Automatic·Login··authorized·to·use.·To·disable·user·ability·to··········authenticated·users | 61 | 3.1.1···Disable·GDM·Automatic·Login··authorized·to·use.·To·disable·user·ability·to··········authenticated·users |
| 86 | ·····································automatically·login·to·the·system,·set·the·············negatively·impacts | 62 | ·····································automatically·login·to·the·system,·set·the·············negatively·impacts |
| 87 | ·····································AutomaticLoginEnable·to·false·in·the·[daemon]·section··operating·system | 63 | ·····································AutomaticLoginEnable·to·false·in·the·[daemon]·section··operating·system |
| 88 | ·····································in·/etc/gdm/custom.conf.·For·example:··················security. | 64 | ·····································in·/etc/gdm/custom.conf.·For·example:··················security. |
| 89 | ·····································[daemon] | 65 | ·····································[daemon] |
| 90 | ·····································AutomaticLoginEnable=false | 66 | ·····································AutomaticLoginEnable=false |
| 67 | ·····································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 68 | ·····································login·without·credentials·which·can·be·useful·for | ||
| 69 | ·····································public·kiosk·scenarios.·Allowing·users·to·login········Failure·to·restrict | ||
| 70 | ·····································without·credentials·or·"guest"·account·access·has······system·access·to | ||
| 71 | 3.1.1···Disable·GDM·Guest·Login······inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users | ||
| 72 | ·····································disable·timed·logins·or·guest·account·access,·set·the··negatively·impacts | ||
| 73 | ·····································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/·operating·system | ||
| 74 | ·····································etc/gdm/custom.conf.·For·example:······················security. | ||
| 75 | ·····································[daemon] | ||
| 76 | ·····································TimedLoginEnable=false | ||
| 91 | ····························································································Preventing·direct | ||
| 92 | ····························································································root·login·to·serial | ||
| 93 | ·····································To·restrict·root·logins·on·serial·ports,·ensure·lines··port·interfaces | ||
| 94 | 3.1.1···Restrict·Serial·Port·Root····of·this·form·do·not·appear·in·/etc/securetty:··········helps·ensure | ||
| 95 | 3.1.5···Logins·······················ttyS0··················································accountability·for | ||
| 96 | ·····································ttyS1··················································actions·taken·on·the | ||
| 97 | ····························································································systems·using·the | ||
| 98 | ····························································································root·account. | ||
| 99 | ····························································································This·prevents | ||
| Max diff block lines reached; 728803/743417 bytes (98.03%) of diff not shown. | |||
| Offset 4058, 15 lines modified | Offset 4058, 15 lines modified | ||
| 4058 | <tt>RekeyLimit</tt>. | 4058 | <tt>RekeyLimit</tt>. |
| 4059 | ··</td> | 4059 | ··</td> |
| 4060 | ··<td·xml:lang="en-US"> | 4060 | ··<td·xml:lang="en-US"> |
| 4061 | By·decreasing·the·limit·based·on·the·amount·of·data·and·enabling | 4061 | By·decreasing·the·limit·based·on·the·amount·of·data·and·enabling |
| 4062 | time-based·limit,·effects·of·potential·attacks·against | 4062 | time-based·limit,·effects·of·potential·attacks·against |
| 4063 | encryption·keys·are·limited. | 4063 | encryption·keys·are·limited. |
| 4064 | ··</td> | 4064 | ··</td> |
| 4065 | ··<td>var_ssh_client_rekey_limit_ | 4065 | ··<td>var_ssh_client_rekey_limit_time=1hour<br/>var_ssh_client_rekey_limit_size=1G</td> |
| 4066 | </tr> | 4066 | </tr> |
| 4067 | <tr> | 4067 | <tr> |
| 4068 | ··<td></td> | 4068 | ··<td></td> |
| 4069 | ··<td>N/A</td> | 4069 | ··<td>N/A</td> |
| 4070 | ··<td>SSH·client·uses·strong·entropy·to·seed·(for·CSH·like·shells)</td> | 4070 | ··<td>SSH·client·uses·strong·entropy·to·seed·(for·CSH·like·shells)</td> |
| 4071 | ··<td·xml:lang="en-US"> | 4071 | ··<td·xml:lang="en-US"> |
| 4072 | To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure | 4072 | To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure |
| Offset 1878, 16 lines modified | Offset 1878, 16 lines modified | ||
| 1878 | ·····N/·certificate·for··/etc/rsyslog.conf,·for·example·with·the·following·command:·······························start·with | 1878 | ·····N/·certificate·for··/etc/rsyslog.conf,·for·example·with·the·following·command:·······························start·with |
| 1879 | ·····A··rsyslog·remote···echo·'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")'·>>·/etc/rsyslog.conf·error:·ca·certificate·is·not·set,·cannot·continue | 1879 | ·····A··rsyslog·remote···echo·'global(DefaultNetstreamDriverCAFile="/etc/pki/tls/cert.pem")'·>>·/etc/rsyslog.conf·error:·ca·certificate·is·not·set,·cannot·continue |
| 1880 | ········logging··········Replace·the·/etc/pki/tls/cert.pem·in·the·above·command·with·the·path·to·the·file·with·CA | 1880 | ········logging··········Replace·the·/etc/pki/tls/cert.pem·in·the·above·command·with·the·path·to·the·file·with·CA |
| 1881 | ·························certificate·generated·for·the·purpose·of·remote·logging. | 1881 | ·························certificate·generated·for·the·purpose·of·remote·logging. |
| 1882 | ·························The·RekeyLimit·parameter·specifies·how·often·the·session·key·is·renegotiated,·both·in | 1882 | ·························The·RekeyLimit·parameter·specifies·how·often·the·session·key·is·renegotiated,·both·in |
| 1883 | ·························terms·of·amount·of·data·that·may·be·transmitted·and·the·time·elapsed.·To·decrease·the | 1883 | ·························terms·of·amount·of·data·that·may·be·transmitted·and·the·time·elapsed.·To·decrease·the |
| 1884 | ········Configure········default·limits,·put·line·RekeyLimit·1G·1hour·to·file·/etc/ssh/ssh_config.d/02-rekey-·····By·decreasing·the·limit·based·on·the·amount·of·data·and | 1884 | ········Configure········default·limits,·put·line·RekeyLimit·1G·1hour·to·file·/etc/ssh/ssh_config.d/02-rekey-·····By·decreasing·the·limit·based·on·the·amount·of·data·and |
| 1885 | ·····N/·session··········limit.conf.·Make·sure·that·there·is·no·other·RekeyLimit·configuration·preceding·the······enabling·time-based·limit,·effects·of·potential·attacks········var_ssh_client_rekey_limit_ | 1885 | ·····N/·session··········limit.conf.·Make·sure·that·there·is·no·other·RekeyLimit·configuration·preceding·the······enabling·time-based·limit,·effects·of·potential·attacks········var_ssh_client_rekey_limit_time=1hour |
| 1886 | ·····A··renegotiation····include·directive·in·the·main·config·file·/etc/ssh/ssh_config.·Check·also·other·files·in·against·encryption·keys·are·limited.···························var_ssh_client_rekey_limit_ | 1886 | ·····A··renegotiation····include·directive·in·the·main·config·file·/etc/ssh/ssh_config.·Check·also·other·files·in·against·encryption·keys·are·limited.···························var_ssh_client_rekey_limit_size=1G |
| 1887 | ········for·SSH·client···/etc/ssh/ssh_config.d·directory.·Files·are·processed·according·to·lexicographical·order | 1887 | ········for·SSH·client···/etc/ssh/ssh_config.d·directory.·Files·are·processed·according·to·lexicographical·order |
| 1888 | ·························of·file·names.·Make·sure·that·there·is·no·file·processed·before·02-rekey-limit.conf | 1888 | ·························of·file·names.·Make·sure·that·there·is·no·file·processed·before·02-rekey-limit.conf |
| 1889 | ·························containing·definition·of·RekeyLimit. | 1889 | ·························containing·definition·of·RekeyLimit. |
| 1890 | ·························To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure·that·the·······Some·SSH·implementations·use·the·openssl·library·for·entropy, | 1890 | ·························To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure·that·the·······Some·SSH·implementations·use·the·openssl·library·for·entropy, |
| 1891 | ········SSH·client·uses··appropriate·shell·environment·variable·is·configured.·The·SSH_USE_STRONG_RNG·environment·which·by·default,·doesn't·use·high-entropy·sources.·Randomness | 1891 | ········SSH·client·uses··appropriate·shell·environment·variable·is·configured.·The·SSH_USE_STRONG_RNG·environment·which·by·default,·doesn't·use·high-entropy·sources.·Randomness |
| 1892 | ·····N/·strong·entropy···variable·determines·how·many·bytes·of·entropy·to·use.·Make·sure·that·the·file·/etc/······is·needed·to·generate·considerably·more·secure·data-encryption | 1892 | ·····N/·strong·entropy···variable·determines·how·many·bytes·of·entropy·to·use.·Make·sure·that·the·file·/etc/······is·needed·to·generate·considerably·more·secure·data-encryption |
| 1893 | ·····A··to·seed·(for·CSH·profile.d/cc-ssh-strong-rng.csh·contains·line············································keys.·Plaintext·padding,·initialization·vectors·in·encryption | 1893 | ·····A··to·seed·(for·CSH·profile.d/cc-ssh-strong-rng.csh·contains·line············································keys.·Plaintext·padding,·initialization·vectors·in·encryption |
| Offset 63, 11576 lines modified | Offset 63, 11576 lines modified | ||
| 000003e0:·2020·2020·3c74·683e·5275·6c65·2054·6974······<th>Rule·Tit | 000003e0:·2020·2020·3c74·683e·5275·6c65·2054·6974······<th>Rule·Tit | ||
| 000003f0:·6c65·3c2f·7468·3e0a·2020·2020·3c74·683e··le</th>.····<th> | 000003f0:·6c65·3c2f·7468·3e0a·2020·2020·3c74·683e··le</th>.····<th> | ||
| 00000400:·4465·7363·7269·7074·696f·6e3c·2f74·683e··Description</th> | 00000400:·4465·7363·7269·7074·696f·6e3c·2f74·683e··Description</th> | ||
| 00000410:·0a20·2020·203c·7468·3e52·6174·696f·6e61··.····<th>Rationa | 00000410:·0a20·2020·203c·7468·3e52·6174·696f·6e61··.····<th>Rationa | ||
| 00000420:·6c65·3c2f·7468·3e0a·2020·3c2f·7468·6561··le</th>.··</thea | 00000420:·6c65·3c2f·7468·3e0a·2020·3c2f·7468·6561··le</th>.··</thea | ||
| 00000430:·643e·0a20·203c·7462·6f64·793e·0a20·203c··d>.··<tbody>.··< | 00000430:·643e·0a20·203c·7462·6f64·793e·0a20·203c··d>.··<tbody>.··< | Diff chunk too large, falling back to line-by-line diff (4999 lines added, 4999 lines removed) | |
| 00000440:·7472·3e0a·2020·2020·2020·3c74·643e·4155··tr>.······<td>AU | 00000440:·7472·3e0a·2020·2020·2020·3c74·643e·4155··tr>.······<td>AU | ||
| 00000450:·2d32·286 | 00000450:·2d32·2861·293c·2f74·643e·0a20·2020·2020··-2(a)</td>.····· | ||
| 00000460:· | 00000460:·203c·7464·3e43·6f6e·6669·6775·7265·2061···<td>Configure·a | ||
| 00000470:·7 | 00000470:·7564·6974·696e·6720·6f66·2075·6e73·7563··uditing·of·unsuc | ||
| 00000480:·636 | 00000480:·6365·7373·6675·6c20·6669·6c65·2061·6363··cessful·file·acc | ||
| 00000490:·6 | 00000490:·6573·7365·733c·2f74·643e·0a20·2020·2020··esses</td>.····· | ||
| 000004a0:· | 000004a0:·203c·7464·2078·6d6c·3a6c·616e·673d·2265···<td·xml:lang="e | ||
| 000004b0:·6 | 000004b0:·6e2d·5553·223e·0a20·2020·2020·2020·2045··n-US">.········E | ||
| 000004c0:· | 000004c0:·6e73·7572·6520·7468·6174·2075·6e73·7563··nsure·that·unsuc | ||
| 000004d0:·6 | 000004d0:·6365·7373·6675·6c20·6174·7465·6d70·7473··cessful·attempts | ||
| 000004e0:·20 | 000004e0:·2074·6f20·6163·6365·7373·2061·2066·696c···to·access·a·fil | ||
| 000004f0:· | 000004f0:·6520·6172·6520·6175·6469·7465·642e·0a0a··e·are·audited... | ||
| 00000500:· | 00000500:·5468·6520·666f·6c6c·6f77·696e·6720·7275··The·following·ru | ||
| 00000510:·6 | 00000510:·6c65·7320·636f·6e66·6967·7572·6520·6175··les·configure·au | ||
| 00000520:·6 | 00000520:·6469·7420·6173·2064·6573·6372·6962·6564··dit·as·described | ||
| 00000530:·666f·7 | 00000530:·2061·626f·7665·3a0a·3c70·7265·3e23·2320···above:.<pre>##· | ||
| 00000540:· | 00000540:·556e·7375·6363·6573·7366·756c·2066·696c··Unsuccessful·fil | ||
| 00000550:· | 00000550:·6520·6163·6365·7373·2028·616e·7920·6f74··e·access·(any·ot | ||
| 00000560:·6 | 00000560:·6865·7220·6f70·656e·7329·2054·6869·7320··her·opens)·This· | ||
| 00000570:· | 00000570:·6861·7320·746f·2067·6f20·6c61·7374·2e0a··has·to·go·last.. | ||
| 00000580:· | 00000580:·2d61·2061·6c77·6179·732c·6578·6974·202d··-a·always,exit·- | ||
| 00000590:· | 00000590:·4620·6172·6368·3d62·3332·202d·5320·6f70··F·arch=b32·-S·op | ||
| 000005a0:·6 | 000005a0:·656e·2c6f·7065·6e61·742c·6f70·656e·6174··en,openat,openat | ||
| 000005b0:· | 000005b0:·322c·6f70·656e·5f62·795f·6861·6e64·6c65··2,open_by_handle | ||
| 000005c0:· | 000005c0:·5f61·7420·2d46·2065·7869·743d·2d45·4143··_at·-F·exit=-EAC | ||
| 000005d0:· | 000005d0:·4345·5320·2d46·2061·7569·643e·3d31·3030··CES·-F·auid>=100 | ||
| 000005e0:· | 000005e0:·3020·2d46·2061·7569·6421·3d75·6e73·6574··0·-F·auid!=unset | ||
| 000005f0:·20 | 000005f0:·202d·4620·6b65·793d·756e·7375·6363·6573···-F·key=unsucces | ||
| 00000600:·7 | 00000600:·7366·756c·2d61·6363·6573·730a·2d61·2061··sful-access.-a·a | ||
| 00000610:· | 00000610:·6c77·6179·732c·6578·6974·202d·4620·6172··lways,exit·-F·ar | ||
| 00000620:· | 00000620:·6368·3d62·3634·202d·5320·6f70·656e·2c6f··ch=b64·-S·open,o | ||
| 00000630:·7 | 00000630:·7065·6e61·742c·6f70·656e·6174·322c·6f70··penat,openat2,op | ||
| 00000640:· | 00000640:·656e·5f62·795f·6861·6e64·6c65·5f61·7420··en_by_handle_at· | ||
| 00000650:· | 00000650:·2d46·2065·7869·743d·2d45·4143·4345·5320··-F·exit=-EACCES· | ||
| 00000660:·2 | 00000660:·2d46·2061·7569·643e·3d31·3030·3020·2d46··-F·auid>=1000·-F | ||
| 00000670:· | 00000670:·2061·7569·6421·3d75·6e73·6574·202d·4620···auid!=unset·-F· | ||
| 00000680:·6 | 00000680:·6b65·793d·756e·7375·6363·6573·7366·756c··key=unsuccessful | ||
| 00000690:·2 | 00000690:·2d61·6363·6573·730a·2d61·2061·6c77·6179··-access.-a·alway | ||
| 000006a0:·7 | 000006a0:·732c·6578·6974·202d·4620·6172·6368·3d62··s,exit·-F·arch=b | ||
| 000006b0:· | 000006b0:·3332·202d·5320·6f70·656e·2c6f·7065·6e61··32·-S·open,opena | ||
| 000006c0:·74 | 000006c0:·742c·6f70·656e·6174·322c·6f70·656e·5f62··t,openat2,open_b | ||
| 000006d0:· | 000006d0:·795f·6861·6e64·6c65·5f61·7420·2d46·2065··y_handle_at·-F·e | ||
| 000006e0:· | 000006e0:·7869·743d·2d45·5045·524d·202d·4620·6175··xit=-EPERM·-F·au | ||
| 000006f0:· | 000006f0:·6964·3e3d·3130·3030·202d·4620·6175·6964··id>=1000·-F·auid | ||
| 00000700:· | 00000700:·213d·756e·7365·7420·2d46·206b·6579·3d75··!=unset·-F·key=u | ||
| 00000710:· | 00000710:·6e73·7563·6365·7373·6675·6c2d·6163·6365··nsuccessful-acce | ||
| 00000720:· | 00000720:·7373·0a2d·6120·616c·7761·7973·2c65·7869··ss.-a·always,exi | ||
| 00000730:·74 | 00000730:·7420·2d46·2061·7263·683d·6236·3420·2d53··t·-F·arch=b64·-S | ||
| 00000740:· | 00000740:·206f·7065·6e2c·6f70·656e·6174·2c6f·7065···open,openat,ope | ||
| 00000750:· | 00000750:·6e61·7432·2c6f·7065·6e5f·6279·5f68·616e··nat2,open_by_han | ||
| 00000760:· | 00000760:·646c·655f·6174·202d·4620·6578·6974·3d2d··dle_at·-F·exit=- | ||
| 00000770:· | 00000770:·4550·4552·4d20·2d46·2061·7569·643e·3d31··EPERM·-F·auid>=1 | ||
| 00000780:· | 00000780:·3030·3020·2d46·2061·7569·6421·3d75·6e73··000·-F·auid!=uns | ||
| 00000790:·202d· | 00000790:·6574·202d·4620·6b65·793d·756e·7375·6363··et·-F·key=unsucc | ||
| 000007a0:· | 000007a0:·6573·7366·756c·2d61·6363·6573·7320·2020··essful-access··· | ||
| 000007b0:· | 000007b0:·203c·2f70·7265·3e0a·0a4c·6f61·6420·6e65···</pre>..Load·ne | ||
| 000007c0:· | 000007c0:·7720·4175·6469·7420·7275·6c65·7320·696e··w·Audit·rules·in | ||
| 000007d0:· | 000007d0:·746f·206b·6572·6e65·6c20·6279·2072·756e··to·kernel·by·run | ||
| 000007e0:·6 | 000007e0:·6e69·6e67·3a0a·3c70·7265·3e61·7567·656e··ning:.<pre>augen | ||
| 000007f0:· | 000007f0:·7275·6c65·7320·2d2d·6c6f·6164·3c2f·7072··rules·--load</pr | ||
| 00000800:· | 00000800:·653e·0a0a·4e6f·7465·3a20·5468·6973·2072··e>..Note:·This·r | ||
| 00000810:· | 00000810:·756c·6520·7573·6573·2061·2073·7065·6369··ule·uses·a·speci | ||
| 00000820:·6 | 00000820:·616c·2073·6574·206f·6620·4175·6469·7420··al·set·of·Audit· | ||
| 00000830:· | 00000830:·7275·6c65·7320·746f·2063·6f6d·706c·7920··rules·to·comply· | ||
| 00000840:· | 00000840:·7769·7468·204f·5350·5020·342e·322e·312e··with·OSPP·4.2.1. | ||
| 00000850:· | 00000850:·2059·6f75·206d·6179·2072·6575·7365·2074···You·may·reuse·t | ||
| 00000860:· | 00000860:·6869·7320·7275·6c65·2069·6e20·6469·6666··his·rule·in·diff | ||
| 00000870:· | 00000870:·6572·656e·7420·7072·6f66·696c·6573·2e20··erent·profiles.· | ||
| 00000880:· | 00000880:·4966·2079·6f75·2064·6563·6964·6520·746f··If·you·decide·to | ||
| 00000890:· | 00000890:·2064·6f20·736f·2c20·6974·2069·7320·7265···do·so,·it·is·re | ||
| 000008a0:·6 | 000008a0:·636f·6d6d·656e·6465·6420·7468·6174·2079··commended·that·y | ||
| 000008b0:· | 000008b0:·6f75·2069·6e73·7065·6374·2063·6f6e·7465··ou·inspect·conte | ||
| 000008c0:· | 000008c0:·6e74·7320·6f66·2074·6865·2066·696c·6520··nts·of·the·file· | ||
| 000008d0:·6 | 000008d0:·636c·6f73·656c·7920·616e·6420·6d61·6b65··closely·and·make | ||
| 000008e0:· | 000008e0:·2073·7572·6520·7468·6174·2074·6865·7920···sure·that·they· | ||
| 000008f0:· | 000008f0:·6172·6520·616c·6c69·676e·6564·2077·6974··are·alligned·wit | ||
| 00000900:· | 00000900:·6820·796f·7572·206e·6565·6473·2e0a·2020··h·your·needs..·· | ||
| 00000910:· | 00000910:·2020·2020·3c2f·7464·3e0a·2020·2020·2020······</td>.······ | ||
| 00000920:· | 00000920:·3c74·6420·786d·6c3a·6c61·6e67·3d22·656e··<td·xml:lang="en | ||
| 00000930:· | 00000930:·2d55·5322·3e0a·2020·2020·2020·2020·556e··-US">.········Un | ||
| 00000940:· | 00000940:·7375·6363·6573·7366·756c·2061·7474·656d··successful·attem | ||
| 00000950:· | 00000950:·7074·7320·746f·2061·6363·6573·7320·6120··pts·to·access·a· | ||
| 00000960:· | 00000960:·6669·6c65·206d·6967·6874·2062·6520·7369··file·might·be·si | ||
| 00000970:·6 | 00000970:·676e·7320·6f66·206d·616c·6963·696f·7573··gns·of·malicious | ||
| 00000980:·206 | 00000980:·2061·6374·6976·6974·7920·6861·7070·656e···activity·happen | ||
| 00000990:·696 | 00000990:·696e·6720·7769·7468·696e·2074·6865·2073··ing·within·the·s | ||
| 000009a0:· | 000009a0:·7973·7465·6d2e·2041·7564·6974·696e·6720··ystem.·Auditing· | ||
| 000009b0:·6 | 000009b0:·6f66·2073·7563·6820·6163·7469·7669·7469··of·such·activiti | ||
| 000009c0:·6 | 000009c0:·6573·2068·656c·7073·2069·6e20·7468·6569··es·helps·in·thei | ||
| 000009d0:· | 000009d0:·7220·6d6f·6e69·746f·7269·6e67·2061·6e64··r·monitoring·and | ||
| 000009e0:· | 000009e0:·2069·6e76·6573·7469·6761·7469·6f6e·2e0a···investigation.. | ||
| 000009f0:· | 000009f0:·2020·2020·2020·3c2f·7464·3e0a·2020·2020········</td>.···· | ||
| 00000a00:· | 00000a00:·3c2f·7472·3e0a·2020·2020·3c74·723e·0a20··</tr>.····<tr>.· | ||
| 00000a10:· | 00000a10:·2020·2020·203c·7464·3e41·552d·3228·6429·······<td>AU-2(d) | ||
| 00000a20:· | 00000a20:·3c62·722f·3e41·552d·3132·2863·293c·6272··<br/>AU-12(c)<br | ||
| 00000a30:·3e4 | 00000a30:·2f3e·434d·2d36·2861·293c·2f74·643e·0a20··/>CM-6(a)</td>.· | ||
| 00000a40:· | 00000a40:·2020·2020·203c·7464·3e52·6563·6f72·6420·······<td>Record· | ||
| 00000a50:· | 00000a50:·556e·7375·6363·6573·7366·756c·2050·6572··Unsuccessful·Per | ||
| 00000a60:· | 00000a60:·6d69·7373·696f·6e20·4368·616e·6765·7320··mission·Changes· | ||
| 00000a70:·7 | 00000a70:·746f·2046·696c·6573·202d·2073·6574·7861··to·Files·-·setxa | ||
| 00000a80:· | 00000a80:·7474·723c·2f74·643e·0a20·2020·2020·203c··ttr</td>.······< | ||
| 00000a90:· | 00000a90:·7464·2078·6d6c·3a6c·616e·673d·2265·6e2d··td·xml:lang="en- | ||
| 00000aa0:·2020·2020·20 | 00000aa0:·5553·223e·0a20·2020·2020·2020·2054·6865··US">.········The | ||
| 00000ab0:· | 00000ab0:·2061·7564·6974·2073·7973·7465·6d20·7368···audit·system·sh | ||
| 00000ac0:· | 00000ac0:·6f75·6c64·2063·6f6c·6c65·6374·2075·6e73··ould·collect·uns | ||
| 00000ad0:·7 | 00000ad0:·7563·6365·7373·6675·6c20·6669·6c65·2070··uccessful·file·p | ||
| 00000ae0:·6 | 00000ae0:·6572·6d69·7373·696f·6e20·6368·616e·6765··ermission·change | ||
| 00000af0:· | 00000af0:·0a61·7474·656d·7074·7320·666f·7220·616c··.attempts·for·al | ||
| 00000b00:·6 | 00000b00:·6c20·7573·6572·7320·616e·6420·726f·6f74··l·users·and·root | ||
| 00000b10:· | 00000b10:·2e0a·4966·2074·6865·203c·7474·3e61·7564··..If·the·<tt>aud | ||
| 00000b20:·6 | 00000b20:·6974·643c·2f74·743e·2064·6165·6d6f·6e20··itd</tt>·daemon· | ||
| 00000b30:· | 00000b30:·6973·2063·6f6e·6669·6775·7265·640a·746f··is·configured.to | ||
| 00000b40:· | 00000b40:·2075·7365·2074·6865·203c·7474·3e61·7567···use·the·<tt>aug | ||
| 00000b50:· | 00000b50:·656e·7275·6c65·733c·2f74·743e·2070·726f··enrules</tt>·pro | ||
| 00000b60:· | 00000b60:·6772·616d·2074·6f20·7265·6164·2061·7564··gram·to·read·aud | ||
| 00000b70:· | 00000b70:·6974·2072·756c·6573·2064·7572·696e·6720··it·rules·during· | ||
| 00000b80:·6 | 00000b80:·6461·656d·6f6e·0a73·7461·7274·7570·2028··daemon.startup·( | ||
| 00000b90:·7 | 00000b90:·7468·6520·6465·6661·756c·7429·2c20·6164··the·default),·ad | ||
| 00000ba0:· | 00000ba0:·6420·7468·6520·666f·6c6c·6f77·696e·6720··d·the·following· | ||
| 00000bb0:· | 00000bb0:·6c69·6e65·7320·746f·2061·2066·696c·6520··lines·to·a·file· | ||
| Max diff block lines reached; 4968348/5658788 bytes (87.80%) of diff not shown. | |||
| Offset 41, 28 lines modified | Offset 41, 14 lines modified | ||
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> |
| 48 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 51 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 52 | ······</td> | ||
| 53 | ······<td·xml:lang="en-US"> | ||
| 54 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 55 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 56 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 57 | the·network. | ||
| 58 | ······</td> | ||
| 59 | ····</tr> | ||
| 60 | ····<tr> | ||
| 61 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 62 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> | 48 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> |
| 63 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 64 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, | 50 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, |
| 65 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default | 51 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default |
| 66 | GRUB2·command·line·for·the·Linux·operating·system. | 52 | GRUB2·command·line·for·the·Linux·operating·system. |
| 67 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line | 53 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line |
| 68 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the | 54 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the |
| Offset 73, 14 lines modified | Offset 59, 28 lines modified | ||
| 73 | ······</td> | 59 | ······</td> |
| 74 | ······<td·xml:lang="en-US"> | 60 | ······<td·xml:lang="en-US"> |
| 75 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce | 61 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce |
| 76 | the·vulnerability·to·exploitation. | 62 | the·vulnerability·to·exploitation. |
| 77 | ······</td> | 63 | ······</td> |
| 78 | ····</tr> | 64 | ····</tr> |
| 79 | ····<tr> | 65 | ····<tr> |
| 66 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 67 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 68 | ······<td·xml:lang="en-US"> | ||
| 69 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 70 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 71 | ······</td> | ||
| 72 | ······<td·xml:lang="en-US"> | ||
| 73 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 74 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 75 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 76 | the·network. | ||
| 77 | ······</td> | ||
| 78 | ····</tr> | ||
| 79 | ····<tr> | ||
| 80 | ······<td>Req-1.3.3</td> | 80 | ······<td>Req-1.3.3</td> |
| 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> | 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> |
| 82 | ······<td·xml:lang="en-US"> | 82 | ······<td·xml:lang="en-US"> |
| 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless | 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless |
| 84 | capability. | 84 | capability. |
| 85 | <br·/><br·/> | 85 | <br·/><br·/> |
| Offset 111, 30 lines modified | Offset 111, 14 lines modified | ||
| 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, | 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, |
| 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an | 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 113 | anti-spoofing·measure. | 113 | anti-spoofing·measure. |
| 114 | ······</td> | 114 | ······</td> |
| 115 | ····</tr> | 115 | ····</tr> |
| 116 | ····<tr> | 116 | ····<tr> |
| 117 | ······<td>Req-1.4.1</td> | 117 | ······<td>Req-1.4.1</td> |
| 118 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 119 | ······<td·xml:lang="en-US"> | ||
| 120 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 121 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 122 | ······</td> | ||
| 123 | ······<td·xml:lang="en-US"> | ||
| 124 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 125 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 126 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 127 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 128 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 129 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 130 | ······</td> | ||
| 131 | ····</tr> | ||
| 132 | ····<tr> | ||
| 133 | ······<td>Req-1.4.1</td> | ||
| 134 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> | 118 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> |
| 135 | ······<td·xml:lang="en-US"> | 119 | ······<td·xml:lang="en-US"> |
| 136 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for | 120 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for |
| 137 | the·built-in·INPUT·chain·which·processes·incoming·packets, | 121 | the·built-in·INPUT·chain·which·processes·incoming·packets, |
| 138 | add·or·correct·the·following·line·in | 122 | add·or·correct·the·following·line·in |
| 139 | <tt>/etc/sysconfig/ip6tables</tt>: | 123 | <tt>/etc/sysconfig/ip6tables</tt>: |
| 140 | <pre>:INPUT·DROP·[0:0]</pre> | 124 | <pre>:INPUT·DROP·[0:0]</pre> |
| Offset 176, 14 lines modified | Offset 160, 30 lines modified | ||
| 176 | typically·critical·to·operation·of·the·system.·The·loopback·interface· | 160 | typically·critical·to·operation·of·the·system.·The·loopback·interface· |
| 177 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· | 161 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· |
| 178 | other·interfaces·should·ignore·traffic·on·this·network·as·an | 162 | other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 179 | anti-spoofing·measure. | 163 | anti-spoofing·measure. |
| 180 | ······</td> | 164 | ······</td> |
| 181 | ····</tr> | 165 | ····</tr> |
| 182 | ····<tr> | 166 | ····<tr> |
| 167 | ······<td>Req-1.4.1</td> | ||
| 168 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 169 | ······<td·xml:lang="en-US"> | ||
| 170 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 171 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 172 | ······</td> | ||
| 173 | ······<td·xml:lang="en-US"> | ||
| 174 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 175 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 176 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 177 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 178 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 179 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 180 | ······</td> | ||
| 181 | ····</tr> | ||
| 182 | ····<tr> | ||
| 183 | ······<td>Req-1.4.2</td> | 183 | ······<td>Req-1.4.2</td> |
| 184 | ······<td>Disable·SCTP·Support</td> | 184 | ······<td>Disable·SCTP·Support</td> |
| 185 | ······<td·xml:lang="en-US"> | 185 | ······<td·xml:lang="en-US"> |
| 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a | 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a |
| 187 | transport·layer·protocol,·designed·to·support·the·idea·of | 187 | transport·layer·protocol,·designed·to·support·the·idea·of |
| 188 | message-oriented·communication,·with·several·streams·of·messages | 188 | message-oriented·communication,·with·several·streams·of·messages |
| 189 | within·one·connection. | 189 | within·one·connection. |
| Offset 248, 14 lines modified | Offset 248, 41 lines modified | ||
| 248 | <br·/> | 248 | <br·/> |
| 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast | 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast |
| 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. | 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. |
| 251 | ······</td> | 251 | ······</td> |
| 252 | ····</tr> | 252 | ····</tr> |
| 253 | ····<tr> | 253 | ····<tr> |
| 254 | ······<td>Req-1.4.3</td> | 254 | ······<td>Req-1.4.3</td> |
| Max diff block lines reached; 254883/262622 bytes (97.05%) of diff not shown. | |||
| Offset 1, 13 lines modified | Offset 1, 25 lines modified | ||
| 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle | 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Oracle |
| 2 | Linux·8 | 2 | Linux·8 |
| 3 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 4 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 5 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 6 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 7 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 8 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 9 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 10 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 11 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 12 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 13 | ·····························already·installed·kernels: | ||
| 14 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 3 | ····················································································Routing·protocol | 15 | ····················································································Routing·protocol |
| 4 | ····················································································daemons·are | 16 | ····················································································daemons·are |
| 5 | ····················································································typically·used·on | 17 | ····················································································typically·used·on |
| 6 | ····················································································routers·to·exchange | 18 | ····················································································routers·to·exchange |
| 7 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology | 19 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology |
| 8 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with | 20 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with |
| 9 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If | 21 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If |
| Offset 15, 26 lines modified | Offset 27, 14 lines modified | ||
| 15 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not | 27 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not |
| 16 | ·····························sysctl.d:··············································required,·system | 28 | ·····························sysctl.d:··············································required,·system |
| 17 | ·····························net.ipv4.ip_forward·=·0································network·information | 29 | ·····························net.ipv4.ip_forward·=·0································network·information |
| 18 | ····················································································may·be | 30 | ····················································································may·be |
| 19 | ····················································································unnecessarily | 31 | ····················································································unnecessarily |
| 20 | ····················································································transmitted·across | 32 | ····················································································transmitted·across |
| 21 | ····················································································the·network. | 33 | ····················································································the·network. |
| 22 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 23 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 24 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 25 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 26 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 27 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 28 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 29 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 30 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 31 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 32 | ·····························already·installed·kernels: | ||
| 33 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 34 | ····················································································The·use·of·wireless | 34 | ····················································································The·use·of·wireless |
| 35 | ····················································································networking·can | 35 | ····················································································networking·can |
| 36 | ····················································································introduce·many | 36 | ····················································································introduce·many |
| 37 | ····················································································different·attack | 37 | ····················································································different·attack |
| 38 | ····················································································vectors·into·the | 38 | ····················································································vectors·into·the |
| 39 | ····················································································organization's | 39 | ····················································································organization's |
| 40 | ····················································································network.·Common | 40 | ····················································································network.·Common |
| Offset 73, 40 lines modified | Offset 73, 14 lines modified | ||
| 73 | ····················································································network·traffic | 73 | ····················································································network·traffic |
| 74 | ····················································································should·be·seen,·all | 74 | ····················································································should·be·seen,·all |
| 75 | ····················································································other·interfaces | 75 | ····················································································other·interfaces |
| 76 | ····················································································should·ignore | 76 | ····················································································should·ignore |
| 77 | ····················································································traffic·on·this | 77 | ····················································································traffic·on·this |
| 78 | ····················································································network·as·an·anti- | 78 | ····················································································network·as·an·anti- |
| 79 | ····················································································spoofing·measure. | 79 | ····················································································spoofing·measure. |
| 80 | ····················································································A·TCP·SYN·flood | ||
| 81 | ····················································································attack·can·cause·a | ||
| 82 | ····················································································denial·of·service | ||
| 83 | ····················································································by·filling·a | ||
| 84 | ····················································································system's·TCP | ||
| 85 | ····················································································connection·table | ||
| 86 | ····················································································with·connections·in | ||
| 87 | ····················································································the·SYN_RCVD·state. | ||
| 88 | ····················································································Syncookies·can·be | ||
| 89 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 90 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 91 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 92 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 93 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 94 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 95 | ·····························sysctl.d:··············································connection·and·is | ||
| 96 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 97 | ····················································································This·feature·is | ||
| 98 | ····················································································activated·when·a | ||
| 99 | ····················································································flood·condition·is | ||
| 100 | ····················································································detected,·and | ||
| 101 | ····················································································enables·the·system | ||
| 102 | ····················································································to·continue | ||
| 103 | ····················································································servicing·valid | ||
| 104 | ····················································································connection | ||
| 105 | ····················································································requests. | ||
| 106 | ····················································································In·ip6tables,·the | 80 | ····················································································In·ip6tables,·the |
| 107 | ····················································································default·policy·is | 81 | ····················································································default·policy·is |
| 108 | ····················································································applied·only·after | 82 | ····················································································applied·only·after |
| 109 | ····················································································all·the·applicable | 83 | ····················································································all·the·applicable |
| 110 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table | 84 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table |
| 111 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a | 85 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a |
| 112 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the | 86 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the |
| Offset 140, 14 lines modified | Offset 114, 40 lines modified | ||
| 140 | ····················································································network·traffic | 114 | ····················································································network·traffic |
| 141 | ····················································································should·be·seen,·all | 115 | ····················································································should·be·seen,·all |
| 142 | ····················································································other·interfaces | 116 | ····················································································other·interfaces |
| 143 | ····················································································should·ignore | 117 | ····················································································should·ignore |
| 144 | ····················································································traffic·on·this | 118 | ····················································································traffic·on·this |
| 145 | ····················································································network·as·an·anti- | 119 | ····················································································network·as·an·anti- |
| 146 | ····················································································spoofing·measure. | 120 | ····················································································spoofing·measure. |
| 121 | ····················································································A·TCP·SYN·flood | ||
| 122 | ····················································································attack·can·cause·a | ||
| 123 | ····················································································denial·of·service | ||
| 124 | ····················································································by·filling·a | ||
| 125 | ····················································································system's·TCP | ||
| 126 | ····················································································connection·table | ||
| 127 | ····················································································with·connections·in | ||
| 128 | ····················································································the·SYN_RCVD·state. | ||
| 129 | ····················································································Syncookies·can·be | ||
| 130 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 131 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 132 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 133 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 134 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 135 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 136 | ·····························sysctl.d:··············································connection·and·is | ||
| 137 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 138 | ····················································································This·feature·is | ||
| 139 | ····················································································activated·when·a | ||
| 140 | ····················································································flood·condition·is | ||
| 141 | ····················································································detected,·and | ||
| 142 | ····················································································enables·the·system | ||
| 143 | ····················································································to·continue | ||
| 144 | ····················································································servicing·valid | ||
| 145 | ····················································································connection | ||
| 146 | ····················································································requests. | ||
| Max diff block lines reached; 414743/426763 bytes (97.18%) of diff not shown. | |||
| Offset 65, 11111 lines modified | Offset 65, 11111 lines modified | ||
| 00000400:·3c2f·7468·3e0a·2020·2020·3c74·683e·5275··</th>.····<th>Ru | 00000400:·3c2f·7468·3e0a·2020·2020·3c74·683e·5275··</th>.····<th>Ru | ||
| 00000410:·6c65·2054·6974·6c65·3c2f·7468·3e0a·2020··le·Title</th>.·· | 00000410:·6c65·2054·6974·6c65·3c2f·7468·3e0a·2020··le·Title</th>.·· | ||
| 00000420:·2020·3c74·683e·4465·7363·7269·7074·696f····<th>Descriptio | 00000420:·2020·3c74·683e·4465·7363·7269·7074·696f····<th>Descriptio | ||
| 00000430:·6e3c·2f74·683e·0a20·2020·203c·7468·3e52··n</th>.····<th>R | 00000430:·6e3c·2f74·683e·0a20·2020·203c·7468·3e52··n</th>.····<th>R | ||
| 00000440:·6174·696f·6e61·6c65·3c2f·7468·3e0a·2020··ationale</th>.·· | 00000440:·6174·696f·6e61·6c65·3c2f·7468·3e0a·2020··ationale</th>.·· | ||
| 00000450:·3c2f·7468·6561·643e·0a20·203c·7462·6f64··</thead>.··<tbod | 00000450:·3c2f·7468·6561·643e·0a20·203c·7462·6f64··</thead>.··<tbod | Diff chunk too large, falling back to line-by-line diff (1257 lines added, 1257 lines removed) | |
| 00000460:·793e·0a20·203c·7472·3e0a·2020·2020·2020··y>.··<tr>.······ | 00000460:·793e·0a20·203c·7472·3e0a·2020·2020·2020··y>.··<tr>.······ | ||
| 00000470:·3c74·643e·4155·2d32·286 | 00000470:·3c74·643e·4155·2d32·2861·293c·2f74·643e··<td>AU-2(a)</td> | ||
| 00000480:· | 00000480:·0a20·2020·2020·203c·7464·3e43·6f6e·6669··.······<td>Confi | ||
| 00000490:· | 00000490:·6775·7265·2061·7564·6974·696e·6720·6f66··gure·auditing·of | ||
| 000004a0:· | 000004a0:·2075·6e73·7563·6365·7373·6675·6c20·6669···unsuccessful·fi | ||
| 000004b0:·6 | 000004b0:·6c65·2061·6363·6573·7365·733c·2f74·643e··le·accesses</td> | ||
| 000004c0:· | 000004c0:·0a20·2020·2020·203c·7464·2078·6d6c·3a6c··.······<td·xml:l | ||
| 000004d0:·6 | 000004d0:·616e·673d·2265·6e2d·5553·223e·0a20·2020··ang="en-US">.··· | ||
| 000004e0:·2 | 000004e0:·2020·2020·2045·6e73·7572·6520·7468·6174·······Ensure·that | ||
| 000004f0:· | 000004f0:·2075·6e73·7563·6365·7373·6675·6c20·6174···unsuccessful·at | ||
| 00000500:· | 00000500:·7465·6d70·7473·2074·6f20·6163·6365·7373··tempts·to·access | ||
| 00000510:· | 00000510:·2061·2066·696c·6520·6172·6520·6175·6469···a·file·are·audi | ||
| 00000520:· | 00000520:·7465·642e·0a0a·5468·6520·666f·6c6c·6f77··ted...The·follow | ||
| 00000530:· | 00000530:·696e·6720·7275·6c65·7320·636f·6e66·6967··ing·rules·config | ||
| 00000540:·7 | 00000540:·7572·6520·6175·6469·7420·6173·2064·6573··ure·audit·as·des | ||
| 00000550:·6 | 00000550:·6372·6962·6564·2061·626f·7665·3a0a·3c70··cribed·above:.<p | ||
| 00000560:·65 | 00000560:·7265·3e23·2320·556e·7375·6363·6573·7366··re>##·Unsuccessf | ||
| 00000570:· | 00000570:·756c·2066·696c·6520·6163·6365·7373·2028··ul·file·access·( | ||
| 00000580:· | 00000580:·616e·7920·6f74·6865·7220·6f70·656e·7329··any·other·opens) | ||
| 00000590:· | 00000590:·2054·6869·7320·6861·7320·746f·2067·6f20···This·has·to·go· | ||
| 000005a0:· | 000005a0:·6c61·7374·2e0a·2d61·2061·6c77·6179·732c··last..-a·always, | ||
| 000005b0:·6 | 000005b0:·6578·6974·202d·4620·6172·6368·3d62·3332··exit·-F·arch=b32 | ||
| 000005c0:·20 | 000005c0:·202d·5320·6f70·656e·2c6f·7065·6e61·742c···-S·open,openat, | ||
| 000005d0:· | 000005d0:·6f70·656e·6174·322c·6f70·656e·5f62·795f··openat2,open_by_ | ||
| 000005e0:·6 | 000005e0:·6861·6e64·6c65·5f61·7420·2d46·2065·7869··handle_at·-F·exi | ||
| 000005f0:· | 000005f0:·743d·2d45·4143·4345·5320·2d46·2061·7569··t=-EACCES·-F·aui | ||
| 00000600:·6 | 00000600:·643e·3d31·3030·3020·2d46·2061·7569·6421··d>=1000·-F·auid! | ||
| 00000610:· | 00000610:·3d75·6e73·6574·202d·4620·6b65·793d·756e··=unset·-F·key=un | ||
| 00000620:· | 00000620:·7375·6363·6573·7366·756c·2d61·6363·6573··successful-acces | ||
| 00000630:· | 00000630:·730a·2d61·2061·6c77·6179·732c·6578·6974··s.-a·always,exit | ||
| 00000640:· | 00000640:·202d·4620·6172·6368·3d62·3634·202d·5320···-F·arch=b64·-S· | ||
| 00000650:·6 | 00000650:·6f70·656e·2c6f·7065·6e61·742c·6f70·656e··open,openat,open | ||
| 00000660:· | 00000660:·6174·322c·6f70·656e·5f62·795f·6861·6e64··at2,open_by_hand | ||
| 00000670:· | 00000670:·6c65·5f61·7420·2d46·2065·7869·743d·2d45··le_at·-F·exit=-E | ||
| 00000680:· | 00000680:·4143·4345·5320·2d46·2061·7569·643e·3d31··ACCES·-F·auid>=1 | ||
| 00000690:· | 00000690:·3030·3020·2d46·2061·7569·6421·3d75·6e73··000·-F·auid!=uns | ||
| 000006a0:· | 000006a0:·6574·202d·4620·6b65·793d·756e·7375·6363··et·-F·key=unsucc | ||
| 000006b0:· | 000006b0:·6573·7366·756c·2d61·6363·6573·730a·2d61··essful-access.-a | ||
| 000006c0:· | 000006c0:·2061·6c77·6179·732c·6578·6974·202d·4620···always,exit·-F· | ||
| 000006d0:·672 | 000006d0:·6172·6368·3d62·3332·202d·5320·6f70·656e··arch=b32·-S·open | ||
| 000006e0:·2c | 000006e0:·2c6f·7065·6e61·742c·6f70·656e·6174·322c··,openat,openat2, | ||
| 000006f0:·6 | 000006f0:·6f70·656e·5f62·795f·6861·6e64·6c65·5f61··open_by_handle_a | ||
| 00000700:· | 00000700:·7420·2d46·2065·7869·743d·2d45·5045·524d··t·-F·exit=-EPERM | ||
| 00000710:· | 00000710:·202d·4620·6175·6964·3e3d·3130·3030·202d···-F·auid>=1000·- | ||
| 00000720:· | 00000720:·4620·6175·6964·213d·756e·7365·7420·2d46··F·auid!=unset·-F | ||
| 00000730:· | 00000730:·206b·6579·3d75·6e73·7563·6365·7373·6675···key=unsuccessfu | ||
| 00000740:· | 00000740:·6c2d·6163·6365·7373·0a2d·6120·616c·7761··l-access.-a·alwa | ||
| 00000750:· | 00000750:·7973·2c65·7869·7420·2d46·2061·7263·683d··ys,exit·-F·arch= | ||
| 00000760:· | 00000760:·6236·3420·2d53·206f·7065·6e2c·6f70·656e··b64·-S·open,open | ||
| 00000770:· | 00000770:·6174·2c6f·7065·6e61·7432·2c6f·7065·6e5f··at,openat2,open_ | ||
| 00000780:·6 | 00000780:·6279·5f68·616e·646c·655f·6174·202d·4620··by_handle_at·-F· | ||
| 00000790:· | 00000790:·6578·6974·3d2d·4550·4552·4d20·2d46·2061··exit=-EPERM·-F·a | ||
| 000007a0:· | 000007a0:·7569·643e·3d31·3030·3020·2d46·2061·7569··uid>=1000·-F·aui | ||
| 000007b0:·6 | 000007b0:·6421·3d75·6e73·6574·202d·4620·6b65·793d··d!=unset·-F·key= | ||
| 000007c0:·7 | 000007c0:·756e·7375·6363·6573·7366·756c·2d61·6363··unsuccessful-acc | ||
| 000007d0:· | 000007d0:·6573·7320·2020·203c·2f70·7265·3e0a·0a4c··ess····</pre>..L | ||
| 000007e0:· | 000007e0:·6f61·6420·6e65·7720·4175·6469·7420·7275··oad·new·Audit·ru | ||
| 000007f0:· | 000007f0:·6c65·7320·696e·746f·206b·6572·6e65·6c20··les·into·kernel· | ||
| 00000800:· | 00000800:·6279·2072·756e·6e69·6e67·3a0a·3c70·7265··by·running:.<pre | ||
| 00000810:· | 00000810:·3e61·7567·656e·7275·6c65·7320·2d2d·6c6f··>augenrules·--lo | ||
| 00000820:·6 | 00000820:·6164·3c2f·7072·653e·0a0a·4e6f·7465·3a20··ad</pre>..Note:· | ||
| 00000830:· | 00000830:·5468·6973·2072·756c·6520·7573·6573·2061··This·rule·uses·a | ||
| 00000840:· | 00000840:·2073·7065·6369·616c·2073·6574·206f·6620···special·set·of· | ||
| 00000850:· | 00000850:·4175·6469·7420·7275·6c65·7320·746f·2063··Audit·rules·to·c | ||
| 00000860:· | 00000860:·6f6d·706c·7920·7769·7468·204f·5350·5020··omply·with·OSPP· | ||
| 00000870:·2 | 00000870:·342e·322e·312e·2059·6f75·206d·6179·2072··4.2.1.·You·may·r | ||
| 00000880:·657 | 00000880:·6575·7365·2074·6869·7320·7275·6c65·2069··euse·this·rule·i | ||
| 00000890:·6 | 00000890:·6e20·6469·6666·6572·656e·7420·7072·6f66··n·different·prof | ||
| 000008a0:·696 | 000008a0:·696c·6573·2e20·4966·2079·6f75·2064·6563··iles.·If·you·dec | ||
| 000008b0:· | 000008b0:·6964·6520·746f·2064·6f20·736f·2c20·6974··ide·to·do·so,·it | ||
| 000008c0:· | 000008c0:·2069·7320·7265·636f·6d6d·656e·6465·6420···is·recommended· | ||
| 000008d0:·7 | 000008d0:·7468·6174·2079·6f75·2069·6e73·7065·6374··that·you·inspect | ||
| 000008e0:· | 000008e0:·2063·6f6e·7465·6e74·7320·6f66·2074·6865···contents·of·the | ||
| 000008f0:·20 | 000008f0:·2066·696c·6520·636c·6f73·656c·7920·616e···file·closely·an | ||
| 00000900:· | 00000900:·6420·6d61·6b65·2073·7572·6520·7468·6174··d·make·sure·that | ||
| 00000910:·20 | 00000910:·2074·6865·7920·6172·6520·616c·6c69·676e···they·are·allign | ||
| 00000920:·6 | 00000920:·6564·2077·6974·6820·796f·7572·206e·6565··ed·with·your·nee | ||
| 00000930:· | 00000930:·6473·2e0a·2020·2020·2020·3c2f·7464·3e0a··ds..······</td>. | ||
| 00000940:· | 00000940:·2020·2020·2020·3c74·6420·786d·6c3a·6c61········<td·xml:la | ||
| 00000950:· | 00000950:·6e67·3d22·656e·2d55·5322·3e0a·2020·2020··ng="en-US">.···· | ||
| 00000960:· | 00000960:·2020·2020·556e·7375·6363·6573·7366·756c······Unsuccessful | ||
| 00000970:·20 | 00000970:·2061·7474·656d·7074·7320·746f·2061·6363···attempts·to·acc | ||
| 00000980:· | 00000980:·6573·7320·6120·6669·6c65·206d·6967·6874··ess·a·file·might | ||
| 00000990:· | 00000990:·2062·6520·7369·676e·7320·6f66·206d·616c···be·signs·of·mal | ||
| 000009a0:· | 000009a0:·6963·696f·7573·2061·6374·6976·6974·7920··icious·activity· | ||
| 000009b0:·6 | 000009b0:·6861·7070·656e·696e·6720·7769·7468·696e··happening·within | ||
| 000009c0:· | 000009c0:·2074·6865·2073·7973·7465·6d2e·2041·7564···the·system.·Aud | ||
| 000009d0:· | 000009d0:·6974·696e·6720·6f66·2073·7563·6820·6163··iting·of·such·ac | ||
| 000009e0:· | 000009e0:·7469·7669·7469·6573·2068·656c·7073·2069··tivities·helps·i | ||
| 000009f0:·7 | 000009f0:·6e20·7468·6569·7220·6d6f·6e69·746f·7269··n·their·monitori | ||
| 00000a00:·6 | 00000a00:·6e67·2061·6e64·2069·6e76·6573·7469·6761··ng·and·investiga | ||
| 00000a10:· | 00000a10:·7469·6f6e·2e0a·2020·2020·2020·3c2f·7464··tion..······</td | ||
| 00000a20:· | 00000a20:·3e0a·2020·2020·3c2f·7472·3e0a·2020·2020··>.····</tr>.···· | ||
| 00000a30:· | 00000a30:·3c74·723e·0a20·2020·2020·203c·7464·3e41··<tr>.······<td>A | ||
| 00000a40:· | 00000a40:·552d·3228·6429·3c62·722f·3e41·552d·3132··U-2(d)<br/>AU-12 | ||
| 00000a50:·2 | 00000a50:·2863·293c·6272·2f3e·434d·2d36·2861·293c··(c)<br/>CM-6(a)< | ||
| 00000a60:· | 00000a60:·2f74·643e·0a20·2020·2020·203c·7464·3e52··/td>.······<td>R | ||
| 00000a70:· | 00000a70:·6563·6f72·6420·556e·7375·6363·6573·7366··ecord·Unsuccessf | ||
| 00000a80:· | 00000a80:·756c·2050·6572·6d69·7373·696f·6e20·4368··ul·Permission·Ch | ||
| 00000a90:· | 00000a90:·616e·6765·7320·746f·2046·696c·6573·202d··anges·to·Files·- | ||
| 00000aa0:· | 00000aa0:·2073·6574·7861·7474·723c·2f74·643e·0a20···setxattr</td>.· | ||
| 00000ab0:·20 | 00000ab0:·2020·2020·203c·7464·2078·6d6c·3a6c·616e·······<td·xml:lan | ||
| 00000ac0:·2 | 00000ac0:·673d·2265·6e2d·5553·223e·0a20·2020·2020··g="en-US">.····· | ||
| 00000ad0:· | 00000ad0:·2020·2054·6865·2061·7564·6974·2073·7973·····The·audit·sys | ||
| 00000ae0:· | 00000ae0:·7465·6d20·7368·6f75·6c64·2063·6f6c·6c65··tem·should·colle | ||
| 00000af0:·6 | 00000af0:·6374·2075·6e73·7563·6365·7373·6675·6c20··ct·unsuccessful· | ||
| 00000b00:· | 00000b00:·6669·6c65·2070·6572·6d69·7373·696f·6e20··file·permission· | ||
| 00000b10:· | 00000b10:·6368·616e·6765·0a61·7474·656d·7074·7320··change.attempts· | ||
| 00000b20:· | 00000b20:·666f·7220·616c·6c20·7573·6572·7320·616e··for·all·users·an | ||
| 00000b30:·6 | 00000b30:·6420·726f·6f74·2e0a·4966·2074·6865·203c··d·root..If·the·< | ||
| 00000b40:· | 00000b40:·7474·3e61·7564·6974·643c·2f74·743e·2064··tt>auditd</tt>·d | ||
| 00000b50:· | 00000b50:·6165·6d6f·6e20·6973·2063·6f6e·6669·6775··aemon·is·configu | ||
| 00000b60:· | 00000b60:·7265·640a·746f·2075·7365·2074·6865·203c··red.to·use·the·< | ||
| 00000b70:· | 00000b70:·7474·3e61·7567·656e·7275·6c65·733c·2f74··tt>augenrules</t | ||
| 00000b80:· | 00000b80:·743e·2070·726f·6772·616d·2074·6f20·7265··t>·program·to·re | ||
| 00000b90:·6 | 00000b90:·6164·2061·7564·6974·2072·756c·6573·2064··ad·audit·rules·d | ||
| 00000ba0:· | 00000ba0:·7572·696e·6720·6461·656d·6f6e·0a73·7461··uring·daemon.sta | ||
| 00000bb0:·7 | 00000bb0:·7274·7570·2028·7468·6520·6465·6661·756c··rtup·(the·defaul | ||
| 00000bc0:· | 00000bc0:·7429·2c20·6164·6420·7468·6520·666f·6c6c··t),·add·the·foll | ||
| 00000bd0:·6 | 00000bd0:·6f77·696e·6720·6c69·6e65·7320·746f·2061··owing·lines·to·a | ||
| Max diff block lines reached; 4041443/4215487 bytes (95.87%) of diff not shown. | |||
| Offset 64, 570 lines modified | Offset 64, 570 lines modified | ||
| 000003f0:·3c74·683e·5275·6c65·2054·6974·6c65·3c2f··<th>Rule·Title</ | 000003f0:·3c74·683e·5275·6c65·2054·6974·6c65·3c2f··<th>Rule·Title</ | ||
| 00000400:·7468·3e0a·2020·2020·3c74·683e·4465·7363··th>.····<th>Desc | 00000400:·7468·3e0a·2020·2020·3c74·683e·4465·7363··th>.····<th>Desc | ||
| 00000410:·7269·7074·696f·6e3c·2f74·683e·0a20·2020··ription</th>.··· | 00000410:·7269·7074·696f·6e3c·2f74·683e·0a20·2020··ription</th>.··· | ||
| 00000420:·203c·7468·3e52·6174·696f·6e61·6c65·3c2f···<th>Rationale</ | 00000420:·203c·7468·3e52·6174·696f·6e61·6c65·3c2f···<th>Rationale</ | ||
| 00000430:·7468·3e0a·2020·3c2f·7468·6561·643e·0a20··th>.··</thead>.· | 00000430:·7468·3e0a·2020·3c2f·7468·6561·643e·0a20··th>.··</thead>.· | ||
| 00000440:·203c·7462·6f64·793e·0a20·203c·7472·3e0a···<tbody>.··<tr>. | 00000440:·203c·7462·6f64·793e·0a20·203c·7472·3e0a···<tbody>.··<tr>. | Diff chunk too large, falling back to line-by-line diff (556 lines added, 556 lines removed) | |
| 00000450:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | 00000450:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | ||
| 00000460:·3129·3c | 00000460:·3129·3c62·722f·3e4e·5430·3037·2852·3033··1)<br/>NT007(R03 | ||
| 00000470:· | 00000470:·293c·2f74·643e·0a20·2020·2020·203c·7464··)</td>.······<td | ||
| 00000480:· | 00000480:·3e55·6e69·6e73·7461·6c6c·2074·6865·2074··>Uninstall·the·t | ||
| 00000490:· | 00000490:·656c·6e65·7420·7365·7276·6572·3c2f·7464··elnet·server</td | ||
| 000004a0:· | 000004a0:·3e0a·2020·2020·2020·3c74·6420·786d·6c3a··>.······<td·xml: | ||
| 000004b0:· | 000004b0:·6c61·6e67·3d22·656e·2d55·5322·3e0a·2020··lang="en-US">.·· | ||
| 000004c0:· | 000004c0:·2020·2020·2020·5468·6520·7465·6c6e·6574········The·telnet | ||
| 000004d0:· | 000004d0:·2064·6165·6d6f·6e20·7368·6f75·6c64·2062···daemon·should·b | ||
| 000004e0:·65 | 000004e0:·6520·756e·696e·7374·616c·6c65·642e·0a20··e·uninstalled..· | ||
| 000004f0:· | 000004f0:·2020·2020·203c·2f74·643e·0a20·2020·2020·······</td>.····· | ||
| 00000500:· | 00000500:·203c·7464·2078·6d6c·3a6c·616e·673d·2265···<td·xml:lang="e | ||
| 00000510:·6 | 00000510:·6e2d·5553·223e·0a20·2020·2020·2020·203c··n-US">.········< | ||
| 00000520:· | 00000520:·7474·3e74·656c·6e65·743c·2f74·743e·2061··tt>telnet</tt>·a | ||
| 00000530:· | 00000530:·6c6c·6f77·7320·636c·6561·7220·7465·7874··llows·clear·text | ||
| 00000540:· | 00000540:·2063·6f6d·6d75·6e69·6361·7469·6f6e·732c···communications, | ||
| 00000550:·20 | 00000550:·2061·6e64·2064·6f65·7320·6e6f·7420·7072···and·does·not·pr | ||
| 00000560:·6 | 00000560:·6f74·6563·740a·616e·7920·6461·7461·2074··otect.any·data·t | ||
| 00000570:· | 00000570:·7261·6e73·6d69·7373·696f·6e20·6265·7477··ransmission·betw | ||
| 00000580:·6 | 00000580:·6565·6e20·636c·6965·6e74·2061·6e64·2073··een·client·and·s | ||
| 00000590:·65 | 00000590:·6572·7665·722e·2041·6e79·2063·6f6e·6669··erver.·Any·confi | ||
| 000005a0:· | 000005a0:·6465·6e74·6961·6c20·6461·7461·0a63·616e··dential·data.can | ||
| 000005b0:·206 | 000005b0:·2062·6520·6c69·7374·656e·6564·2061·6e64···be·listened·and | ||
| 000005c0:·206 | 000005c0:·206e·6f20·696e·7465·6772·6974·7920·6368···no·integrity·ch | ||
| 000005d0:·6 | 000005d0:·6563·6b69·6e67·2069·7320·6d61·6465·2e27··ecking·is·made.' | ||
| 000005e0:· | 000005e0:·0a20·2020·2020·203c·2f74·643e·0a20·2020··.······</td>.··· | ||
| 000005f0:· | 000005f0:·203c·2f74·723e·0a20·2020·203c·7472·3e0a···</tr>.····<tr>. | ||
| 00000600:· | 00000600:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | ||
| 00000610:·3c2f·74 | 00000610:·3129·3c2f·7464·3e0a·2020·2020·2020·3c74··1)</td>.······<t | ||
| 00000620:·6 | 00000620:·643e·556e·696e·7374·616c·6c20·5365·6e64··d>Uninstall·Send | ||
| 00000630:· | 00000630:·6d61·696c·2050·6163·6b61·6765·3c2f·7464··mail·Package</td | ||
| 00000640:· | 00000640:·3e0a·2020·2020·2020·3c74·6420·786d·6c3a··>.······<td·xml: | ||
| 00000650:·6 | 00000650:·6c61·6e67·3d22·656e·2d55·5322·3e0a·2020··lang="en-US">.·· | ||
| 00000660:· | 00000660:·2020·2020·2020·5365·6e64·6d61·696c·2069········Sendmail·i | ||
| 00000670:·7 | 00000670:·7320·6e6f·7420·7468·6520·6465·6661·756c··s·not·the·defaul | ||
| 00000680:·74 | 00000680:·7420·6d61·696c·2074·7261·6e73·6665·7220··t·mail·transfer· | ||
| 00000690:· | 00000690:·6167·656e·7420·616e·6420·6973·0a6e·6f74··agent·and·is.not | ||
| 000006a0:· | 000006a0:·2069·6e73·7461·6c6c·6564·2062·7920·6465···installed·by·de | ||
| 000006b0:· | 000006b0:·6661·756c·742e·0a54·6865·203c·636f·6465··fault..The·<code | ||
| 000006c0:· | 000006c0:·3e73·656e·646d·6169·6c3c·2f63·6f64·653e··>sendmail</code> | ||
| 000006d0:· | 000006d0:·2070·6163·6b61·6765·2063·616e·2062·6520···package·can·be· | ||
| 000006e0:· | 000006e0:·7265·6d6f·7665·6420·7769·7468·2074·6865··removed·with·the | ||
| 000006f0:·20 | 000006f0:·2066·6f6c·6c6f·7769·6e67·2063·6f6d·6d61···following·comma | ||
| 00000700:·6 | 00000700:·6e64·3a0a·3c70·7265·3e0a·2420·7375·646f··nd:.<pre>.$·sudo | ||
| 00000710:·207 | 00000710:·2079·756d·2065·7261·7365·2073·656e·646d···yum·erase·sendm | ||
| 00000720:·6 | 00000720:·6169·6c3c·2f70·7265·3e0a·2020·2020·2020··ail</pre>.······ | ||
| 00000730:· | 00000730:·3c2f·7464·3e0a·2020·2020·2020·3c74·6420··</td>.······<td· | ||
| 00000740:· | 00000740:·786d·6c3a·6c61·6e67·3d22·656e·2d55·5322··xml:lang="en-US" | ||
| 00000750:· | 00000750:·3e0a·2020·2020·2020·2020·5468·6520·7365··>.········The·se | ||
| 00000760:· | 00000760:·6e64·6d61·696c·2073·6f66·7477·6172·6520··ndmail·software· | ||
| 00000770:· | 00000770:·7761·7320·6e6f·7420·6465·7665·6c6f·7065··was·not·develope | ||
| 00000780:· | 00000780:·6420·7769·7468·2073·6563·7572·6974·7920··d·with·security· | ||
| 00000790:·6 | 00000790:·696e·206d·696e·6420·616e·640a·6974·7320··in·mind·and.its· | ||
| 000007a0:·6 | 000007a0:·6465·7369·676e·2070·7265·7665·6e74·7320··design·prevents· | ||
| 000007b0:·6 | 000007b0:·6974·2066·726f·6d20·6265·696e·6720·6566··it·from·being·ef | ||
| 000007c0:· | 000007c0:·6665·6374·6976·656c·7920·636f·6e74·6169··fectively·contai | ||
| 000007d0:·6 | 000007d0:·6e65·6420·6279·2053·454c·696e·7578·2e20··ned·by·SELinux.· | ||
| 000007e0:·6 | 000007e0:·2050·6f73·7466·6978·0a73·686f·756c·6420···Postfix.should· | ||
| 000007f0:· | 000007f0:·6265·2075·7365·6420·696e·7374·6561·642e··be·used·instead. | ||
| 00000800:· | 00000800:·0a20·2020·2020·203c·2f74·643e·0a20·2020··.······</td>.··· | ||
| 00000810:· | 00000810:·203c·2f74·723e·0a20·2020·203c·7472·3e0a···</tr>.····<tr>. | ||
| 00000820:· | 00000820:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | ||
| 00000830:·3c2f·74 | 00000830:·3129·3c2f·7464·3e0a·2020·2020·2020·3c74··1)</td>.······<t | ||
| 00000840:·6 | 00000840:·643e·556e·696e·7374·616c·6c20·7869·6e65··d>Uninstall·xine | ||
| 00000850:·746 | 00000850:·7464·2050·6163·6b61·6765·3c2f·7464·3e0a··td·Package</td>. | ||
| 00000860:· | 00000860:·2020·2020·2020·3c74·6420·786d·6c3a·6c61········<td·xml:la | ||
| 00000870:· | 00000870:·6e67·3d22·656e·2d55·5322·3e0a·2020·2020··ng="en-US">.···· | ||
| 00000880:· | 00000880:·2020·2020·5468·6520·3c63·6f64·653e·7869······The·<code>xi | ||
| 00000890:·6 | 00000890:·6e65·7464·3c2f·636f·6465·3e20·7061·636b··netd</code>·pack | ||
| 000008a0:· | 000008a0:·6167·6520·6361·6e20·6265·2072·656d·6f76··age·can·be·remov | ||
| 000008b0:· | 000008b0:·6564·2077·6974·6820·7468·6520·666f·6c6c··ed·with·the·foll | ||
| 000008c0:· | 000008c0:·6f77·696e·6720·636f·6d6d·616e·643a·0a3c··owing·command:.< | ||
| 000008d0:· | 000008d0:·7072·653e·0a24·2073·7564·6f20·7975·6d20··pre>.$·sudo·yum· | ||
| 000008e0:·6 | 000008e0:·6572·6173·6520·7869·6e65·7464·3c2f·7072··erase·xinetd</pr | ||
| 000008f0:· | 000008f0:·653e·0a20·2020·2020·203c·2f74·643e·0a20··e>.······</td>.· | ||
| 00000900:·2020·2020·20 | 00000900:·2020·2020·203c·7464·2078·6d6c·3a6c·616e·······<td·xml:lan | ||
| 00000910:·6 | 00000910:·673d·2265·6e2d·5553·223e·0a20·2020·2020··g="en-US">.····· | ||
| 00000920:·2020·20 | 00000920:·2020·2052·656d·6f76·696e·6720·7468·6520·····Removing·the· | ||
| 00000930:· | 00000930:·3c74·743e·7869·6e65·7464·3c2f·7474·3e20··<tt>xinetd</tt>· | ||
| 00000940:· | 00000940:·7061·636b·6167·6520·6465·6372·6561·7365··package·decrease | ||
| 00000950:· | 00000950:·7320·7468·6520·7269·736b·206f·6620·7468··s·the·risk·of·th | ||
| 00000960:·6 | 00000960:·650a·7869·6e65·7464·2073·6572·7669·6365··e.xinetd·service | ||
| 00000970:· | 00000970:·2773·2061·6363·6964·656e·7461·6c20·286f··'s·accidental·(o | ||
| 00000980:· | 00000980:·7220·696e·7465·6e74·696f·6e61·6c29·2061··r·intentional)·a | ||
| 00000990:·6 | 00000990:·6374·6976·6174·696f·6e2e·0a20·2020·2020··ctivation..····· | ||
| 000009a0:·20 | 000009a0:·203c·2f74·643e·0a20·2020·203c·2f74·723e···</td>.····</tr> | ||
| 000009b0:· | 000009b0:·0a20·2020·203c·7472·3e0a·2020·2020·2020··.····<tr>.······ | ||
| 000009c0:· | 000009c0:·3c74·643e·4250·3238·2852·3129·3c2f·7464··<td>BP28(R1)</td | ||
| 000009d0:·3 | 000009d0:·3e0a·2020·2020·2020·3c74·643e·5265·6d6f··>.······<td>Remo | ||
| 000009e0:·7 | 000009e0:·7665·204e·4953·2043·6c69·656e·743c·2f74··ve·NIS·Client</t | ||
| 000009f0:· | 000009f0:·643e·0a20·2020·2020·203c·7464·2078·6d6c··d>.······<td·xml | ||
| 00000a00:· | 00000a00:·3a6c·616e·673d·2265·6e2d·5553·223e·0a20··:lang="en-US">.· | ||
| 00000a10:·2 | 00000a10:·2020·2020·2020·2054·6865·204e·6574·776f·········The·Netwo | ||
| 00000a20:·72 | 00000a20:·726b·2049·6e66·6f72·6d61·7469·6f6e·2053··rk·Information·S | ||
| 00000a30:·6 | 00000a30:·6572·7669·6365·2028·4e49·5329·2c20·666f··ervice·(NIS),·fo | ||
| 00000a40:· | 00000a40:·726d·6572·6c79·206b·6e6f·776e·2061·7320··rmerly·known·as· | ||
| 00000a50:· | 00000a50:·5965·6c6c·6f77·2050·6167·6573·2c0a·6973··Yellow·Pages,.is | ||
| 00000a60:· | 00000a60:·2061·2063·6c69·656e·742d·7365·7276·6572···a·client-server | ||
| 00000a70:· | 00000a70:·2064·6972·6563·746f·7279·2073·6572·7669···directory·servi | ||
| 00000a80:· | 00000a80:·6365·2070·726f·746f·636f·6c20·7573·6564··ce·protocol·used | ||
| 00000a90:· | 00000a90:·2074·6f20·6469·7374·7269·6275·7465·2073···to·distribute·s | ||
| 00000aa0:· | 00000aa0:·7973·7465·6d20·636f·6e66·6967·7572·6174··ystem·configurat | ||
| 00000ab0:· | 00000ab0:·696f·6e0a·6669·6c65·732e·2054·6865·204e··ion.files.·The·N | ||
| 00000ac0:· | 00000ac0:·4953·2063·6c69·656e·7420·283c·7474·3e79··IS·client·(<tt>y | ||
| 00000ad0:· | 00000ad0:·7062·696e·643c·2f74·743e·2920·7761·7320··pbind</tt>)·was· | ||
| 00000ae0:· | 00000ae0:·7573·6564·2074·6f20·6269·6e64·2061·2073··used·to·bind·a·s | ||
| 00000af0:· | 00000af0:·7973·7465·6d20·746f·2061·6e20·4e49·5320··ystem·to·an·NIS· | ||
| 00000b00:· | 00000b00:·7365·7276·6572·0a61·6e64·2072·6563·6569··server.and·recei | ||
| 00000b10:· | 00000b10:·7665·2074·6865·2064·6973·7472·6962·7574··ve·the·distribut | ||
| 00000b20:·6 | 00000b20:·6564·2063·6f6e·6669·6775·7261·7469·6f6e··ed·configuration | ||
| 00000b30:· | 00000b30:·2066·696c·6573·2e0a·2020·2020·2020·3c2f···files..······</ | ||
| 00000b40:· | 00000b40:·7464·3e0a·2020·2020·2020·3c74·6420·786d··td>.······<td·xm | ||
| 00000b50:· | 00000b50:·6c3a·6c61·6e67·3d22·656e·2d55·5322·3e0a··l:lang="en-US">. | ||
| 00000b60:·20 | 00000b60:·2020·2020·2020·2020·5468·6520·4e49·5320··········The·NIS· | ||
| 00000b70:·7 | 00000b70:·7365·7276·6963·6520·6973·2069·6e68·6572··service·is·inher | ||
| 00000b80:·6 | 00000b80:·656e·746c·7920·616e·2069·6e73·6563·7572··ently·an·insecur | ||
| 00000b90:·6 | 00000b90:·6520·7379·7374·656d·2074·6861·7420·6861··e·system·that·ha | ||
| 00000ba0:· | 00000ba0:·7320·6265·656e·2076·756c·6e65·7261·626c··s·been·vulnerabl | ||
| 00000bb0:·6 | 00000bb0:·650a·746f·2044·4f53·2061·7474·6163·6b73··e.to·DOS·attacks | ||
| 00000bc0:·2 | 00000bc0:·2c20·6275·6666·6572·206f·7665·7266·6c6f··,·buffer·overflo | ||
| Max diff block lines reached; 1105653/1182955 bytes (93.47%) of diff not shown. | |||
| Offset 1, 125 lines modified | Offset 1, 125 lines modified | ||
| 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat | 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat |
| 2 | Enterprise·Linux·7 | 2 | Enterprise·Linux·7 |
| 3 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does | ||
| 4 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 5 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 6 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 7 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted | ||
| 8 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 9 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 10 | ············································································· | 3 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data |
| 4 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 5 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 6 | (R03) | ||
| 7 | ································Sendmail·is·not·the·default·mail·transfer | ||
| 8 | BP28··Uninstall·Sendmail········agent·and·is·not·installed·by·default.·The···The·sendmail·software·was·not·developed·with·security·in·mind·and·its·design | ||
| 9 | (R1)··Package···················sendmail·package·can·be·removed·with·the·····prevents·it·from·being·effectively·contained·by·SELinux.·Postfix·should·be | ||
| 10 | ································following·command:···························used·instead. | ||
| 11 | ································$·sudo·yum·erase·sendmail | ||
| 11 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's | 12 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's |
| 12 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. | 13 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. |
| 13 | ································$·sudo·yum·erase·xinetd | 14 | ································$·sudo·yum·erase·xinetd |
| 14 | ································The·talk·package·contains·the·client·program | ||
| 15 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 16 | ································the·user·to·chat·with·other·users·on | ||
| 17 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 18 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 19 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 20 | ································ | 15 | ································The·Network·Information·Service·(NIS), |
| 16 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 17 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 18 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 19 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 20 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 21 | ································distributed·configuration·files. | ||
| 22 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 23 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 24 | (R1)··Package···················The·dhcp·package·can·be·removed·with·the·····reactivated·and·disrupt·network·operation. | ||
| 21 | ································command: | 25 | ································following·command: |
| 22 | ································$·sudo·yum·erase· | 26 | ································$·sudo·yum·erase·dhcp |
| 27 | ·············································································Removing·the·tftp-server·package·decreases·the·risk·of·the·accidental·(or | ||
| 28 | ·············································································intentional)·activation·of·tftp·services. | ||
| 29 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 30 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 31 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| 32 | ·············································································Securty·Manager·(ISSM),·restricted·to·only·authorized·personnel,·and·have | ||
| 33 | ·············································································access·control·rules·established. | ||
| 23 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, | 34 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, |
| 24 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These | 35 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These |
| 25 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain | 36 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain |
| 26 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional | 37 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional |
| 27 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. | 38 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. |
| 28 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does | 39 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does |
| 29 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 40 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 30 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the | 41 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the |
| 31 | ·············································································privileged·user·password·could·be·compromised. | 42 | ·············································································privileged·user·password·could·be·compromised. |
| 32 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet | 43 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet |
| 33 | ·············································································service's·accidental·(or·intentional)·activation. | 44 | ·············································································service's·accidental·(or·intentional)·activation. |
| 34 | ································The·Network·Information·Service·(NIS), | ||
| 35 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 36 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 37 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 38 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 39 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 40 | ································dis | 45 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does |
| 46 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 47 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 48 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 49 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 50 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 51 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 52 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 53 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 54 | ·············································································rsh,rcp,·and·rlogin. | ||
| 55 | ································The·talk·package·contains·the·client·program | ||
| 56 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 57 | ································the·user·to·chat·with·other·users·on | ||
| 58 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 59 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 60 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 61 | ································package·can·be·removed·with·the·following | ||
| 62 | ································command: | ||
| 63 | ································$·sudo·yum·erase·talk | ||
| 41 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does | 64 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does |
| 42 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 65 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 43 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were | 66 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were |
| 44 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be | 67 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be |
| 45 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure | 68 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure |
| 46 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' | 69 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' |
| 47 | ·············································································accidental·(or·intentional)·activation. | 70 | ·············································································accidental·(or·intentional)·activation. |
| 48 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data | ||
| 49 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 50 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 51 | (R03) | ||
| 52 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a | 71 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a |
| 53 | ································simple·file·transfer·protocol,·typically | 72 | ································simple·file·transfer·protocol,·typically |
| 54 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for | 73 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for |
| 55 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when | 74 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when |
| 56 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. | 75 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. |
| 57 | ································hacked.·The·package·tftp·is·a·client·program | 76 | ································hacked.·The·package·tftp·is·a·client·program |
| 58 | ································that·allows·for·connections·to·a·tftp | 77 | ································that·allows·for·connections·to·a·tftp |
| 59 | ································server. | 78 | ································server. |
| 60 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 61 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 62 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 63 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 64 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 65 | ·············································································rsh,rcp,·and·rlogin. | ||
| 66 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 67 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 68 | (R1)··Package···················The·dhcp·package·can·be·removed·with·the·····reactivated·and·disrupt·network·operation. | ||
| 69 | ································following·command: | ||
| 70 | ································$·sudo·yum·erase·dhcp | ||
| 71 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | 79 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols |
| 72 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of | 80 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of |
| 73 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. | 81 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. |
| 82 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted | ||
| 83 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 84 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 74 | ·············································································Removing·the·tftp-server·package·decreases·the·risk·of·the·accidental·(or | ||
| 75 | ·············································································intentional)·activation·of·tftp·services. | ||
| 76 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 77 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 78 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| Max diff block lines reached; 221096/237460 bytes (93.11%) of diff not shown. | |||
| Offset 123, 117 lines modified | Offset 123, 117 lines modified | ||
| 000007a0:·206c·6f63·616c·2061·7474·6163·6b20·7375···local·attack·su | 000007a0:·206c·6f63·616c·2061·7474·6163·6b20·7375···local·attack·su | ||
| 000007b0:·7266·6163·650a·6f66·2074·6865·2073·6572··rface.of·the·ser | 000007b0:·7266·6163·650a·6f66·2074·6865·2073·6572··rface.of·the·ser | ||
| 000007c0:·7665·722e·0a20·2020·2020·203c·2f74·643e··ver..······</td> | 000007c0:·7665·722e·0a20·2020·2020·203c·2f74·643e··ver..······</td> | ||
| 000007d0:·0a20·2020·203c·2f74·723e·0a20·2020·203c··.····</tr>.····< | 000007d0:·0a20·2020·203c·2f74·723e·0a20·2020·203c··.····</tr>.····< | ||
| 000007e0:·7472·3e0a·2020·2020·2020·3c74·643e·312e··tr>.······<td>1. | 000007e0:·7472·3e0a·2020·2020·2020·3c74·643e·312e··tr>.······<td>1. | ||
| 000007f0:·312e·312e·323c·2f74·643e·0a20·2020·2020··1.1.2</td>.····· | 000007f0:·312e·312e·323c·2f74·643e·0a20·2020·2020··1.1.2</td>.····· | ||
| 00000800:·203c·7464·3e44·6973·6162·6c65·204d·6f75···<td>Disable·Mou | 00000800:·203c·7464·3e44·6973·6162·6c65·204d·6f75···<td>Disable·Mou | ||
| 00000810:·6e74·696e·6720·6f66·20 | 00000810:·6e74·696e·6720·6f66·2066·7265·6576·7866··nting·of·freevxf | ||
| 00000820:·733c·2f74·643e·0a20·2020·2020·203c·7464··s</td>.······<td | 00000820:·733c·2f74·643e·0a20·2020·2020·203c·7464··s</td>.······<td | ||
| 00000830:·2078·6d6c·3a6c·616e·673d·2265·6e2d·5553···xml:lang="en-US | 00000830:·2078·6d6c·3a6c·616e·673d·2265·6e2d·5553···xml:lang="en-US | ||
| 00000840:·223e·0a20·2020·2020·2020·200a·546f·2063··">.········.To·c | 00000840:·223e·0a20·2020·2020·2020·200a·546f·2063··">.········.To·c | ||
| 00000850:·6f6e·6669·6775·7265·2074·6865·2073·7973··onfigure·the·sys | 00000850:·6f6e·6669·6775·7265·2074·6865·2073·7973··onfigure·the·sys | ||
| 00000860:·7465·6d20·746f·2070·7265·7665·6e74·2074··tem·to·prevent·t | 00000860:·7465·6d20·746f·2070·7265·7665·6e74·2074··tem·to·prevent·t | ||
| 00000870:·6865·203c·636f·6465·3e | 00000870:·6865·203c·636f·6465·3e66·7265·6576·7866··he·<code>freevxf | ||
| 00000880:·733c·2f63·6f64·653e·0a6b·6572·6e65·6c20··s</code>.kernel· | 00000880:·733c·2f63·6f64·653e·0a6b·6572·6e65·6c20··s</code>.kernel· | ||
| 00000890:·6d6f·6475·6c65·2066·726f·6d20·6265·696e··module·from·bein | 00000890:·6d6f·6475·6c65·2066·726f·6d20·6265·696e··module·from·bein | ||
| 000008a0:·6720·6c6f·6164·6564·2c20·6164·6420·7468··g·loaded,·add·th | 000008a0:·6720·6c6f·6164·6564·2c20·6164·6420·7468··g·loaded,·add·th | ||
| 000008b0:·6520·666f·6c6c·6f77·696e·6720·6c69·6e65··e·following·line | 000008b0:·6520·666f·6c6c·6f77·696e·6720·6c69·6e65··e·following·line | ||
| 000008c0:·2074·6f20·7468·6520·6669·6c65·203c·636f···to·the·file·<co | 000008c0:·2074·6f20·7468·6520·6669·6c65·203c·636f···to·the·file·<co | ||
| 000008d0:·6465·3e2f·6574·632f·6d6f·6470·726f·6265··de>/etc/modprobe | 000008d0:·6465·3e2f·6574·632f·6d6f·6470·726f·6265··de>/etc/modprobe | ||
| 000008e0:·2e64·2f | 000008e0:·2e64·2f66·7265·6576·7866·732e·636f·6e66··.d/freevxfs.conf | ||
| 000008f0:·3c2f·636f·6465·3e3a·0a3c·7072·653e·696e··</code>:.<pre>in | 000008f0:·3c2f·636f·6465·3e3a·0a3c·7072·653e·696e··</code>:.<pre>in | ||
| 00000900:·7374·616c·6c20· | 00000900:·7374·616c·6c20·6672·6565·7678·6673·202f··stall·freevxfs·/ | ||
| 00000910:·6269·6e2f·7472·7565·3c2f·7072·653e·0a0a··bin/true</pre>.. | 00000910:·6269·6e2f·7472·7565·3c2f·7072·653e·0a0a··bin/true</pre>.. | ||
| 00000920:·546f·2063·6f6e·6669·6775·7265·2074·6865··To·configure·the | 00000920:·546f·2063·6f6e·6669·6775·7265·2074·6865··To·configure·the | ||
| 00000930:·2073·7973·7465·6d20·746f·2070·7265·7665···system·to·preve | 00000930:·2073·7973·7465·6d20·746f·2070·7265·7665···system·to·preve | ||
| 00000940:·6e74·2074·6865·203c·636f·6465·3e | 00000940:·6e74·2074·6865·203c·636f·6465·3e66·7265··nt·the·<code>fre | ||
| 00000950:·6 | 00000950:·6576·7866·733c·2f63·6f64·653e·2066·726f··evxfs</code>·fro | ||
| 00000960:·6d20·6265·696e·6720·7573·6564·2c0a·6164··m·being·used,.ad | 00000960:·6d20·6265·696e·6720·7573·6564·2c0a·6164··m·being·used,.ad | ||
| 00000970:·6420·7468·6520·666f·6c6c·6f77·696e·6720··d·the·following· | 00000970:·6420·7468·6520·666f·6c6c·6f77·696e·6720··d·the·following· | ||
| 00000980:·6c69·6e65·2074·6f20·6669·6c65·203c·636f··line·to·file·<co | 00000980:·6c69·6e65·2074·6f20·6669·6c65·203c·636f··line·to·file·<co | ||
| 00000990:·6465·3e2f·6574·632f·6d6f·6470·726f·6265··de>/etc/modprobe | 00000990:·6465·3e2f·6574·632f·6d6f·6470·726f·6265··de>/etc/modprobe | ||
| 000009a0:·2e64·2f | 000009a0:·2e64·2f66·7265·6576·7866·732e·636f·6e66··.d/freevxfs.conf | ||
| 000009b0:·3c2f·636f·6465·3e3a·0a3c·7072·653e·626c··</code>:.<pre>bl | 000009b0:·3c2f·636f·6465·3e3a·0a3c·7072·653e·626c··</code>:.<pre>bl | ||
| 000009c0:·6163·6b6c·6973·7420· | 000009c0:·6163·6b6c·6973·7420·6672·6565·7678·6673··acklist·freevxfs | ||
| 000009d0:·3c2f·7072·653e·0a0a·5468·6973·2065·6666··</pre>..This·eff | 000009d0:·3c2f·7072·653e·0a0a·5468·6973·2065·6666··</pre>..This·eff | ||
| 000009e0:·6563·7469·7665·6c79·2070·7265·7665·6e74··ectively·prevent | 000009e0:·6563·7469·7665·6c79·2070·7265·7665·6e74··ectively·prevent | ||
| 000009f0:·7320·7573·6167·6520·6f66·2074·6869·7320··s·usage·of·this· | 000009f0:·7320·7573·6167·6520·6f66·2074·6869·7320··s·usage·of·this· | ||
| 00000a00:·756e·636f·6d6d·6f6e·2066·696c·6573·7973··uncommon·filesys | 00000a00:·756e·636f·6d6d·6f6e·2066·696c·6573·7973··uncommon·filesys | ||
| 00000a10:·7465·6d2e·0a20·2020·2020·203c·2f74·643e··tem..······</td> | |||
| 00000a20:·0a20·2020·2020·203c·7464·2078·6d6c·3a6c··.······<td·xml:l | |||
| 00000a30:·616e·673d·2265·6e2d·5553·223e·0a20·2020··ang="en-US">.··· | |||
| 00000a40:·2020·2020·204c·696e·7578·206b·6572·6e65·······Linux·kerne | |||
| 00000a50:·6c20·6d6f·6475·6c65·7320·7768·6963·6820··l·modules·which· | |||
| 00000a60:·696d·706c·656d·656e·7420·6669·6c65·7379··implement·filesy | |||
| 00000a70:·7374·656d·7320·7468·6174·2061·7265·206e··stems·that·are·n | |||
| 00000a80:·6f74·206e·6565·6465·6420·6279·2074·6865··ot·needed·by·the | |||
| 00000a90:·0a6c·6f63·616c·2073·7973·7465·6d20·7368··.local·system·sh | |||
| 00000aa0:·6f75·6c64·2062·6520·6469·7361·626c·6564··ould·be·disabled | |||
| 00000ab0:·2e0a·2020·2020·2020·3c2f·7464·3e0a·2020··..······</td>.·· | |||
| 00000a10:·7465·6d2e·0a0a·5468·6520·3c74·743e·7371··tem...The·<tt>sq | |||
| 00000a20:·7561·7368·6673·3c2f·7474·3e20·6669·6c65··uashfs</tt>·file | |||
| 00000a30:·7379·7374·656d·2074·7970·6520·6973·2061··system·type·is·a | |||
| 00000a40:·2063·6f6d·7072·6573·7365·6420·7265·6164···compressed·read | |||
| 00000a50:·2d6f·6e6c·7920·4c69·6e75·780a·6669·6c65··-only·Linux.file | |||
| 00000a60:·7379·7374·656d·2065·6d62·6564·6465·6420··system·embedded· | |||
| 00000a70:·696e·2073·6d61·6c6c·2066·6f6f·7470·7269··in·small·footpri | |||
| 00000a80:·6e74·2073·7973·7465·6d73·2028·7369·6d69··nt·systems·(simi | |||
| 00000a90:·6c61·7220·746f·0a3c·7474·3e63·7261·6d66··lar·to.<tt>cramf | |||
| 00000aa0:·733c·2f74·743e·292e·2041·203c·7474·3e73··s</tt>).·A·<tt>s | |||
| 00000ab0:·7175·6173·6866·733c·2f74·743e·2069·6d61··quashfs</tt>·ima | |||
| 00000ac0:·6765·2063·616e·2062·6520·7573·6564·2077··ge·can·be·used·w | |||
| 00000ad0:·6974·686f·7574·2068·6176·696e·670a·746f··ithout·having.to | |||
| 00000ae0:·2066·6972·7374·2064·6563·6f6d·7072·6573···first·decompres | |||
| 00000af0:·7320·7468·6520·696d·6167·652e·0a20·2020··s·the·image..··· | |||
| 00000 | 00000ac0:·2020·3c2f·7472·3e0a·2020·2020·3c74·723e····</tr>.····<tr> | ||
| 00000ad0:·0a20·2020·2020·203c·7464·3e31·2e31·2e31··.······<td>1.1.1 | |||
| 00000b10:·7464·2078·6d6c·3a6c·616e·673d·2265·6e2d··td·xml:lang="en- | |||
| 00000b20:·5553·223e·0a20·2020·2020·2020·2052·656d··US">.········Rem | |||
| 00000b30:·6f76·696e·6720·7375·7070·6f72·7420·666f··oving·support·fo | |||
| 00000b40:·7220·756e·6e65·6564·6564·2066·696c·6573··r·unneeded·files | |||
| 00000b50:·7973·7465·6d20·7479·7065·7320·7265·6475··ystem·types·redu | |||
| 00000b60:·6365·7320·7468·6520·6c6f·6361·6c20·6174··ces·the·local·at | |||
| 00000b70:·7461·636b·0a73·7572·6661·6365·206f·6620··tack.surface·of· | |||
| 00000b80:·7468·6520·7379·7374·656d·2e0a·2020·2020··the·system..···· | |||
| 00000b90:·2020·3c2f·7464·3e0a·2020·2020·3c2f·7472····</td>.····</tr | |||
| 00000ba0:·3e0a·2020·2020·3c74·723e·0a20·2020·2020··>.····<tr>.····· | |||
| 00000bb0:·203c·7464·3e31·2e31·2e31·2e32·3c2f·7464···<td>1.1.1.2</td | |||
| 00000bc0:·3e0a·2020·2020·2020·3c74·643e·4469·7361··>.······<td>Disa | |||
| 00000bd0:·626c·6520·4d6f·756e·7469·6e67·206f·6620··ble·Mounting·of· | |||
| 00000be0:·6672·6565·7678·6673·3c2f·7464·3e0a·2020··freevxfs</td>.·· | |||
| 00000bf0:·2020·2020·3c74·6420·786d·6c3a·6c61·6e67······<td·xml:lang | |||
| 00000c00:·3d22·656e·2d55·5322·3e0a·2020·2020·2020··="en-US">.······ | |||
| 00000c10:·2020·0a54·6f20·636f·6e66·6967·7572·6520····.To·configure· | |||
| 00000c20:·7468·6520·7379·7374·656d·2074·6f20·7072··the·system·to·pr | |||
| 00000c30:·6576·656e·7420·7468·6520·3c63·6f64·653e··event·the·<code> | |||
| 00000c40:·6672·6565·7678·6673·3c2f·636f·6465·3e0a··freevxfs</code>. | |||
| 00000c50:·6b65·726e·656c·206d·6f64·756c·6520·6672··kernel·module·fr | |||
| 00000c60:·6f6d·2062·6569·6e67·206c·6f61·6465·642c··om·being·loaded, | |||
| 00000c70:·2061·6464·2074·6865·2066·6f6c·6c6f·7769···add·the·followi | |||
| 00000c80:·6e67·206c·696e·6520·746f·2074·6865·2066··ng·line·to·the·f | |||
| 00000c90:·696c·6520·3c63·6f64·653e·2f65·7463·2f6d··ile·<code>/etc/m | |||
| 00000ca0:·6f64·7072·6f62·652e·642f·6672·6565·7678··odprobe.d/freevx | |||
| 00000cb0:·6673·2e63·6f6e·663c·2f63·6f64·653e·3a0a··fs.conf</code>:. | |||
| 00000cc0:·3c70·7265·3e69·6e73·7461·6c6c·2066·7265··<pre>install·fre | |||
| 00000cd0:·6576·7866·7320·2f62·696e·2f74·7275·653c··evxfs·/bin/true< | |||
| 00000ce0:·2f70·7265·3e0a·0a54·6f20·636f·6e66·6967··/pre>..To·config | |||
| 00000cf0:·7572·6520·7468·6520·7379·7374·656d·2074··ure·the·system·t | |||
| 00000d00:·6f20·7072·6576·656e·7420·7468·6520·3c63··o·prevent·the·<c | |||
| 00000d10:·6f64·653e·6672·6565·7678·6673·3c2f·636f··ode>freevxfs</co | |||
| 00000d20:·6465·3e20·6672·6f6d·2062·6569·6e67·2075··de>·from·being·u | |||
| 00000d30:·7365·642c·0a61·6464·2074·6865·2066·6f6c··sed,.add·the·fol | |||
| 00000d40:·6c6f·7769·6e67·206c·696e·6520·746f·2066··lowing·line·to·f | |||
| 00000d50:·696c·6520·3c63·6f64·653e·2f65·7463·2f6d··ile·<code>/etc/m | |||
| 00000d60:·6f64·7072·6f62·652e·642f·6672·6565·7678··odprobe.d/freevx | |||
| 00000d70:·6673·2e63·6f6e·663c·2f63·6f64·653e·3a0a··fs.conf</code>:. | |||
| 00000d80:·3c70·7265·3e62·6c61·636b·6c69·7374·2066··<pre>blacklist·f | |||
| 00000d90:·7265·6576·7866·733c·2f70·7265·3e0a·0a54··reevxfs</pre>..T | |||
| 00000da0:·6869·7320·6566·6665·6374·6976·656c·7920··his·effectively· | |||
| 00000db0:·7072·6576·656e·7473·2075·7361·6765·206f··prevents·usage·o | |||
| 00000dc0:·6620·7468·6973·2075·6e63·6f6d·6d6f·6e20··f·this·uncommon· | |||
| 00000dd0:·6669·6c65·7379·7374·656d·2e0a·2020·2020··filesystem..···· | |||
| 00000 | 00000ae0:·2e32·3c2f·7464·3e0a·2020·2020·2020·3c74··.2</td>.······<t | ||
| 00000af0:·643e·4469·7361·626c·6520·4d6f·756e·7469··d>Disable·Mounti | |||
| 00000b00:·6e67·206f·6620·7371·7561·7368·6673·3c2f··ng·of·squashfs</ | |||
| 00000b10:·7464·3e0a·2020·2020·2020·3c74·6420·786d··td>.······<td·xm | |||
| 00000b20:·6c3a·6c61·6e67·3d22·656e·2d55·5322·3e0a··l:lang="en-US">. | |||
| 00000b30:·2020·2020·2020·2020·0a54·6f20·636f·6e66··········.To·conf | |||
| 00000b40:·6967·7572·6520·7468·6520·7379·7374·656d··igure·the·system | |||
| 00000b50:·2074·6f20·7072·6576·656e·7420·7468·6520···to·prevent·the· | |||
| 00000b60:·3c63·6f64·653e·7371·7561·7368·6673·3c2f··<code>squashfs</ | |||
| 00000b70:·636f·6465·3e0a·6b65·726e·656c·206d·6f64··code>.kernel·mod | |||
| 00000b80:·756c·6520·6672·6f6d·2062·6569·6e67·206c··ule·from·being·l | |||
| 00000b90:·6f61·6465·642c·2061·6464·2074·6865·2066··oaded,·add·the·f | |||
| 00000ba0:·6f6c·6c6f·7769·6e67·206c·696e·6520·746f··ollowing·line·to | |||
| 00000bb0:·2074·6865·2066·696c·6520·3c63·6f64·653e···the·file·<code> | |||
| 00000bc0:·2f65·7463·2f6d·6f64·7072·6f62·652e·642f··/etc/modprobe.d/ | |||
| Max diff block lines reached; 1399181/1412315 bytes (99.07%) of diff not shown. | |||
| Offset 13, 38 lines modified | Offset 13, 38 lines modified | ||
| 13 | 1.1.1.1···cramfs··············modprobe.d/cramfs.conf:·····························types·reduces·the | 13 | 1.1.1.1···cramfs··············modprobe.d/cramfs.conf:·····························types·reduces·the |
| 14 | ······························blacklist·cramfs····································local·attack·surface | 14 | ······························blacklist·cramfs····································local·attack·surface |
| 15 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·server. | 15 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·server. |
| 16 | ······························filesystem.·The·cramfs·filesystem·type·is·a | 16 | ······························filesystem.·The·cramfs·filesystem·type·is·a |
| 17 | ······························compressed·read-only·Linux·filesystem·embedded·in | 17 | ······························compressed·read-only·Linux·filesystem·embedded·in |
| 18 | ······························small·footprint·systems.·A·cramfs·image·can·be·used | 18 | ······························small·footprint·systems.·A·cramfs·image·can·be·used |
| 19 | ······························without·having·to·first·decompress·the·image. | 19 | ······························without·having·to·first·decompress·the·image. |
| 20 | ······························To·configure·the·system·to·prevent·the·freevxfs | ||
| 21 | ······························kernel·module·from·being·loaded,·add·the·following | ||
| 22 | ······························line·to·the·file·/etc/modprobe.d/freevxfs.conf:·····Linux·kernel·modules | ||
| 23 | ······························install·freevxfs·/bin/true··························which·implement | ||
| 24 | 1.1.1.2···Disable·Mounting·of·To·configure·the·system·to·prevent·the·freevxfs·····filesystems·that·are | ||
| 25 | ··········freevxfs············from·being·used,·add·the·following·line·to·file·/···not·needed·by·the | ||
| 26 | ······························etc/modprobe.d/freevxfs.conf:·······················local·system·should | ||
| 27 | ······························blacklist·freevxfs··································be·disabled. | ||
| 28 | ······························This·effectively·prevents·usage·of·this·uncommon | ||
| 29 | ······························filesystem. | ||
| 20 | ······························To·configure·the·system·to·prevent·the·squashfs | 30 | ······························To·configure·the·system·to·prevent·the·squashfs |
| 21 | ······························kernel·module·from·being·loaded,·add·the·following | 31 | ······························kernel·module·from·being·loaded,·add·the·following |
| 22 | ······························line·to·the·file·/etc/modprobe.d/squashfs.conf: | 32 | ······························line·to·the·file·/etc/modprobe.d/squashfs.conf: |
| 23 | ······························install·squashfs·/bin/true | 33 | ······························install·squashfs·/bin/true |
| 24 | ······························To·configure·the·system·to·prevent·the·squashfs·····Removing·support·for | 34 | ······························To·configure·the·system·to·prevent·the·squashfs·····Removing·support·for |
| 25 | ······························from·being·used,·add·the·following·line·to·file·/···unneeded·filesystem | 35 | ······························from·being·used,·add·the·following·line·to·file·/···unneeded·filesystem |
| 26 | 1.1.1.2···Disable·Mounting·of·etc/modprobe.d/squashfs.conf:·······················types·reduces·the | 36 | 1.1.1.2···Disable·Mounting·of·etc/modprobe.d/squashfs.conf:·······················types·reduces·the |
| 27 | ··········squashfs············blacklist·squashfs··································local·attack·surface | 37 | ··········squashfs············blacklist·squashfs··································local·attack·surface |
| 28 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·system. | 38 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·system. |
| 29 | ······························filesystem.·The·squashfs·filesystem·type·is·a | 39 | ······························filesystem.·The·squashfs·filesystem·type·is·a |
| 30 | ······························compressed·read-only·Linux·filesystem·embedded·in | 40 | ······························compressed·read-only·Linux·filesystem·embedded·in |
| 31 | ······························small·footprint·systems·(similar·to·cramfs).·A | 41 | ······························small·footprint·systems·(similar·to·cramfs).·A |
| 32 | ······························squashfs·image·can·be·used·without·having·to·first | 42 | ······························squashfs·image·can·be·used·without·having·to·first |
| 33 | ······························decompress·the·image. | 43 | ······························decompress·the·image. |
| 34 | ······························To·configure·the·system·to·prevent·the·freevxfs | ||
| 35 | ······························kernel·module·from·being·loaded,·add·the·following | ||
| 36 | ······························line·to·the·file·/etc/modprobe.d/freevxfs.conf:·····Linux·kernel·modules | ||
| 37 | ······························install·freevxfs·/bin/true··························which·implement | ||
| 38 | 1.1.1.2···Disable·Mounting·of·To·configure·the·system·to·prevent·the·freevxfs·····filesystems·that·are | ||
| 39 | ··········freevxfs············from·being·used,·add·the·following·line·to·file·/···not·needed·by·the | ||
| 40 | ······························etc/modprobe.d/freevxfs.conf:·······················local·system·should | ||
| 41 | ······························blacklist·freevxfs··································be·disabled. | ||
| 42 | ······························This·effectively·prevents·usage·of·this·uncommon | ||
| 43 | ······························filesystem. | ||
| 44 | ······························To·configure·the·system·to·prevent·the·jffs2·kernel | 44 | ······························To·configure·the·system·to·prevent·the·jffs2·kernel |
| 45 | ······························module·from·being·loaded,·add·the·following·line·to | 45 | ······························module·from·being·loaded,·add·the·following·line·to |
| 46 | ······························the·file·/etc/modprobe.d/jffs2.conf:················Linux·kernel·modules | 46 | ······························the·file·/etc/modprobe.d/jffs2.conf:················Linux·kernel·modules |
| 47 | ······························install·jffs2·/bin/true·····························which·implement | 47 | ······························install·jffs2·/bin/true·····························which·implement |
| 48 | 1.1.1.3···Disable·Mounting·of·To·configure·the·system·to·prevent·the·jffs2·from···filesystems·that·are | 48 | 1.1.1.3···Disable·Mounting·of·To·configure·the·system·to·prevent·the·jffs2·from···filesystems·that·are |
| 49 | ··········jffs2···············being·used,·add·the·following·line·to·file·/etc/····not·needed·by·the | 49 | ··········jffs2···············being·used,·add·the·following·line·to·file·/etc/····not·needed·by·the |
| 50 | ······························modprobe.d/jffs2.conf:······························local·system·should | 50 | ······························modprobe.d/jffs2.conf:······························local·system·should |
| Offset 331, 14 lines modified | Offset 331, 37 lines modified | ||
| 331 | ······························from·being·used,·add·the·following·line·to·file·/···software. | 331 | ······························from·being·used,·add·the·following·line·to·file·/···software. |
| 332 | ······························etc/modprobe.d/usb-storage.conf: | 332 | ······························etc/modprobe.d/usb-storage.conf: |
| 333 | ······························blacklist·usb-storage | 333 | ······························blacklist·usb-storage |
| 334 | ······························This·will·prevent·the·modprobe·program·from·loading | 334 | ······························This·will·prevent·the·modprobe·program·from·loading |
| 335 | ······························the·usb-storage·module,·but·will·not·prevent·an | 335 | ······························the·usb-storage·module,·but·will·not·prevent·an |
| 336 | ······························administrator·(or·another·program)·from·using·the | 336 | ······························administrator·(or·another·program)·from·using·the |
| 337 | ······························insmod·program·to·load·the·module·manually. | 337 | ······························insmod·program·to·load·the·module·manually. |
| 338 | ··················································································Verifying·the | ||
| 339 | ··················································································authenticity·of·the | ||
| 340 | ··················································································software·prior·to | ||
| 341 | ··················································································installation | ||
| 342 | ··················································································validates·the | ||
| 343 | ··················································································integrity·of·the | ||
| 344 | ··················································································patch·or·upgrade | ||
| 345 | ··················································································received·from·a | ||
| 346 | ··················································································vendor.·This·ensures | ||
| 347 | ··········Ensure·gpgcheck·····To·ensure·signature·checking·is·not·disabled·for····the·software·has·not | ||
| 348 | ··········Enabled·for·All·yum·any·repos,·remove·any·lines·from·files·in·/etc/·····been·tampered·with | ||
| 349 | 1.2.3·····Package·············yum.repos.d·of·the·form:····························and·that·it·has·been | ||
| 350 | ··········Repositories········gpgcheck=0··········································provided·by·a | ||
| 351 | ··················································································trusted·vendor. | ||
| 352 | ··················································································Self-signed | ||
| 353 | ··················································································certificates·are | ||
| 354 | ··················································································disallowed·by·this | ||
| 355 | ··················································································requirement. | ||
| 356 | ··················································································Certificates·used·to | ||
| 357 | ··················································································verify·the·software | ||
| 358 | ··················································································must·be·from·an | ||
| 359 | ··················································································approved·Certificate | ||
| 360 | ··················································································Authority·(CA)." | ||
| 338 | ··················································································Changes·to·any | 361 | ··················································································Changes·to·any |
| 339 | ··················································································software·components | 362 | ··················································································software·components |
| 340 | ··················································································can·have·significant | 363 | ··················································································can·have·significant |
| 341 | ··················································································effects·on·the | 364 | ··················································································effects·on·the |
| 342 | ··················································································overall·security·of | 365 | ··················································································overall·security·of |
| 343 | ··················································································the·operating | 366 | ··················································································the·operating |
| 344 | ··················································································system.·This | 367 | ··················································································system.·This |
| Offset 378, 37 lines modified | Offset 401, 14 lines modified | ||
| 378 | ··················································································disallowed·by·this | 401 | ··················································································disallowed·by·this |
| 379 | ··················································································requirement. | 402 | ··················································································requirement. |
| 380 | ··················································································Certificates·used·to | 403 | ··················································································Certificates·used·to |
| 381 | ··················································································verify·the·software | 404 | ··················································································verify·the·software |
| 382 | ··················································································must·be·from·an | 405 | ··················································································must·be·from·an |
| 383 | ··················································································approved·Certificate | 406 | ··················································································approved·Certificate |
| 384 | ··················································································Authority·(CA). | 407 | ··················································································Authority·(CA). |
| 385 | ··················································································Verifying·the | ||
| 386 | ··················································································authenticity·of·the | ||
| 387 | ··················································································software·prior·to | ||
| 388 | ··················································································installation | ||
| 389 | ··················································································validates·the | ||
| 390 | ··················································································integrity·of·the | ||
| 391 | ··················································································patch·or·upgrade | ||
| 392 | ··················································································received·from·a | ||
| 393 | ··················································································vendor.·This·ensures | ||
| 394 | ··········Ensure·gpgcheck·····To·ensure·signature·checking·is·not·disabled·for····the·software·has·not | ||
| 395 | ··········Enabled·for·All·yum·any·repos,·remove·any·lines·from·files·in·/etc/·····been·tampered·with | ||
| 396 | 1.2.3·····Package·············yum.repos.d·of·the·form:····························and·that·it·has·been | ||
| 397 | ··········Repositories········gpgcheck=0··········································provided·by·a | ||
| 398 | ··················································································trusted·vendor. | ||
| 399 | ··················································································Self-signed | ||
| 400 | ··················································································certificates·are | ||
| 401 | ··················································································disallowed·by·this | ||
| 402 | ··················································································requirement. | ||
| 403 | ··················································································Certificates·used·to | ||
| 404 | ··················································································verify·the·software | ||
| 405 | ··················································································must·be·from·an | ||
| 406 | ··················································································approved·Certificate | ||
| 407 | ··················································································Authority·(CA)." | ||
| 408 | ······························To·ensure·the·system·can·cryptographically·verify···Changes·to·software | 408 | ······························To·ensure·the·system·can·cryptographically·verify···Changes·to·software |
| 409 | ······························base·software·packages·come·from·Red·Hat·(and·to····components·can·have | 409 | ······························base·software·packages·come·from·Red·Hat·(and·to····components·can·have |
| 410 | ······························connect·to·the·Red·Hat·Network·to·receive·them),····significant·effects | 410 | ······························connect·to·the·Red·Hat·Network·to·receive·them),····significant·effects |
| 411 | ······························the·Red·Hat·GPG·key·must·properly·be·installed.·To··on·the·overall | 411 | ······························the·Red·Hat·GPG·key·must·properly·be·installed.·To··on·the·overall |
| 412 | ······························install·the·Red·Hat·GPG·key,·run:···················security·of·the | 412 | ······························install·the·Red·Hat·GPG·key,·run:···················security·of·the |
| 413 | ······························$·sudo·subscription-manager·register················operating·system. | 413 | ······························$·sudo·subscription-manager·register················operating·system. |
| 414 | ······························If·the·system·is·not·connected·to·the·Internet·or···This·requirement | 414 | ······························If·the·system·is·not·connected·to·the·Internet·or···This·requirement |
| Offset 435, 19 lines modified | Offset 435, 14 lines modified | ||
| 435 | ······························managed·as·such.·The·rhnsd·service·can·be·disabled··some·environments. | 435 | ······························managed·as·such.·The·rhnsd·service·can·be·disabled··some·environments. |
| 436 | ······························with·the·following·command:·························However,·if·the | 436 | ······························with·the·following·command:·························However,·if·the |
| Max diff block lines reached; 388054/399950 bytes (97.03%) of diff not shown. | |||
| Offset 40, 71 lines modified | Offset 40, 32 lines modified | ||
| 40 | ····<th>Mapping</th> | 40 | ····<th>Mapping</th> |
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>3.1.1<br/>3.1.6</td> | ||
| 48 | ······<td>Direct·root·Logins·Not·Allowed</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·further·limit·access·to·the·<tt>root</tt>·account,·administrators | ||
| 51 | can·disable·root·logins·at·the·console·by·editing·the·<tt>/etc/securetty</tt>·file. | ||
| 52 | This·file·lists·all·devices·the·root·user·is·allowed·to·login·to.·If·the·file·does | ||
| 53 | not·exist·at·all,·the·root·user·can·login·through·any·communication·device·on·the | ||
| 54 | system,·whether·via·the·console·or·via·a·raw·network·interface.·This·is·dangerous | ||
| 55 | as·user·can·login·to·the·system·as·root·via·Telnet,·which·sends·the·password·in | ||
| 56 | plain·text·over·the·network.·By·default,·Red·Hat·Enterprise·Linux·7's | ||
| 57 | <tt>/etc/securetty</tt>·file·only·allows·the·root·user·to·login·at·the·console | ||
| 58 | physically·attached·to·the·system.·To·prevent·root·from·logging·in,·remove·the | ||
| 59 | contents·of·this·file.·To·prevent·direct·root·logins,·remove·the·contents·of·this | ||
| 60 | file·by·typing·the·following·command: | ||
| 61 | <pre> | ||
| 62 | $·sudo·echo·>·/etc/securetty | ||
| 63 | </pre> | ||
| 64 | ······</td> | ||
| 65 | ······<td·xml:lang="en-US"> | ||
| 66 | ········Disabling·direct·root·logins·ensures·proper·accountability·and·multifactor | ||
| 67 | authentication·to·privileged·accounts.·Users·will·first·login,·then·escalate | ||
| 68 | to·privileged·(root)·access·via·su·/·sudo.·This·is·required·for·FISMA·Low | ||
| 69 | and·FISMA·Moderate·systems. | ||
| 70 | ······</td> | ||
| 71 | ····</tr> | ||
| 72 | ····<tr> | ||
| 73 | ······<td>3.1.1</td> | ||
| 74 | ······<td>Disable·GDM·Guest·Login</td> | ||
| 75 | ······<td·xml:lang="en-US"> | ||
| 76 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·login·without·credentials | ||
| 77 | which·can·be·useful·for·public·kiosk·scenarios.·Allowing·users·to·login·without·credentials | ||
| 78 | or·"guest"·account·access·has·inherent·security·risks·and·should·be·disabled.·To·do·disable | ||
| 79 | timed·logins·or·guest·account·access,·set·the·<tt>TimedLoginEnable</tt>·to·<tt>false</tt>·in | ||
| 80 | the·<tt>[daemon]</tt>·section·in·<tt>/etc/gdm/custom.conf</tt>.·For·example: | ||
| 81 | <pre>[daemon] | ||
| 82 | TimedLoginEnable=false</pre> | ||
| 83 | ······</td> | ||
| 84 | ······<td·xml:lang="en-US"> | ||
| 85 | ········Failure·to·restrict·system·access·to·authenticated·users·negatively·impacts·operating | ||
| 86 | system·security. | ||
| 87 | ······</td> | ||
| 88 | ····</tr> | ||
| 89 | ····<tr> | ||
| 90 | ······<td>3.1.1<br/>3.1.5</td> | 47 | ······<td>3.1.1<br/>3.1.5</td> |
| 91 | ······<td> | 48 | ······<td>Verify·Only·Root·Has·UID·0</td> |
| 92 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 93 | ········To·restrict·root·logins·through·the·(deprecated)·virtual·console·devices, | ||
| 94 | ensure·lines·of·this·form·do·not·appear·in·<tt>/etc/securetty</tt>: | ||
| 95 | <pre>vc/1 | ||
| 96 | vc/2 | ||
| 97 | vc/3 | ||
| 98 | 50 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | |
| 51 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 52 | their·UID·changed. | ||
| 53 | <br·/> | ||
| 54 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 55 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 56 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 57 | assigned. | ||
| 99 | ······</td> | 58 | ······</td> |
| 100 | ······<td·xml:lang="en-US"> | 59 | ······<td·xml:lang="en-US"> |
| 101 | ········Preventing·direct·root·login·to·virtual·console·devices | ||
| 102 | helps·ensure·accountability·for·actions·taken·on·the·system | ||
| 103 | usi | 60 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts |
| 61 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 62 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 63 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 64 | access·to·root·privileges·in·an·accountable·manner. | ||
| 104 | ······</td> | 65 | ······</td> |
| 105 | ····</tr> | 66 | ····</tr> |
| 106 | ····<tr> | 67 | ····<tr> |
| 107 | ······<td>3.1.1<br/>3.1.5</td> | 68 | ······<td>3.1.1<br/>3.1.5</td> |
| 108 | ······<td>Disable·SSH·Root·Login</td> | 69 | ······<td>Disable·SSH·Root·Login</td> |
| 109 | ······<td·xml:lang="en-US"> | 70 | ······<td·xml:lang="en-US"> |
| 110 | ········The·root·user·should·never·be·allowed·to·login·to·a | 71 | ········The·root·user·should·never·be·allowed·to·login·to·a |
| Offset 121, 32 lines modified | Offset 82, 28 lines modified | ||
| 121 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | 82 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. |
| 122 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | 83 | In·addition,·logging·in·with·a·user-specific·account·provides·individual |
| 123 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | 84 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize |
| 124 | direct·attack·attempts·on·root's·password. | 85 | direct·attack·attempts·on·root's·password. |
| 125 | ······</td> | 86 | ······</td> |
| 126 | ····</tr> | 87 | ····</tr> |
| 127 | ····<tr> | 88 | ····<tr> |
| 128 | ······<td>3.1.1<br/>3. | 89 | ······<td>3.1.1<br/>3.4.5</td> |
| 129 | ······<td> | 90 | ······<td>Require·Authentication·for·Emergency·Systemd·Target</td> |
| 130 | ······<td·xml:lang="en-US"> | 91 | ······<td·xml:lang="en-US"> |
| 92 | ········Emergency·mode·is·intended·as·a·system·recovery | ||
| 93 | method,·providing·a·single·user·root·access·to·the·system | ||
| 94 | during·a·failed·boot·sequence. | ||
| 95 | <br·/><br·/> | ||
| 96 | By·default,·Emergency·mode·is·protected·by·requiring·a·password·and·is·set | ||
| 97 | in·<tt>/usr/lib/systemd/system/emergency.service</tt>. | ||
| 131 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | ||
| 132 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 133 | their·UID·changed. | ||
| 134 | <br·/> | ||
| 135 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 136 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 137 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 138 | assigned. | ||
| 139 | ······</td> | 98 | ······</td> |
| 140 | ······<td·xml:lang="en-US"> | 99 | ······<td·xml:lang="en-US"> |
| 100 | ········This·prevents·attackers·with·physical·access·from·trivially·bypassing·security | ||
| 101 | on·the·machine·and·gaining·root·access.·Such·accesses·are·further·prevented | ||
| 102 | by·configuring·the·bootloader·password. | ||
| 141 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts | ||
| 142 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 143 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 144 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 145 | access·to·root·privileges·in·an·accountable·manner. | ||
| 146 | ······</td> | 103 | ······</td> |
| 147 | ····</tr> | 104 | ····</tr> |
| 148 | ····<tr> | 105 | ····<tr> |
| 149 | ······<td>3.1.1</td> | 106 | ······<td>3.1.1</td> |
| 150 | ······<td>Disable·GDM·Automatic·Login</td> | 107 | ······<td>Disable·GDM·Automatic·Login</td> |
| 151 | ······<td·xml:lang="en-US"> | 108 | ······<td·xml:lang="en-US"> |
| 152 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without | 109 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without |
| Offset 159, 43 lines modified | Offset 116, 28 lines modified | ||
| 159 | ······</td> | 116 | ······</td> |
| 160 | ······<td·xml:lang="en-US"> | 117 | ······<td·xml:lang="en-US"> |
| Max diff block lines reached; 428144/434071 bytes (98.63%) of diff not shown. | |||
| Offset 1, 85 lines modified | Offset 1, 57 lines modified | ||
| 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of·Red | 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of·Red |
| 2 | Hat·Enterprise·Linux·7 | 2 | Hat·Enterprise·Linux·7 |
| 3 | ·······································To·further·limit·access·to·the·root·account, | ||
| 4 | ·······································administrators·can·disable·root·logins·at·the·console | ||
| 5 | ·······································by·editing·the·/etc/securetty·file.·This·file·lists | ||
| 6 | ·······································all·devices·the·root·user·is·allowed·to·login·to.·If | ||
| 7 | ·······································the·file·does·not·exist·at·all,·the·root·user·can | ||
| 8 | ·······································login·through·any·communication·device·on·the·system,··Disabling·direct·root·logins·ensures·proper | ||
| 9 | ·······································whether·via·the·console·or·via·a·raw·network···········accountability·and·multifactor·authentication | ||
| 10 | 3.1.1··································interface.·This·is·dangerous·as·user·can·login·to·the··to·privileged·accounts.·Users·will·first | ||
| 11 | 3.1.6···Direct·root·Logins·Not·Allowed·system·as·root·via·Telnet,·which·sends·the·password·in·login,·then·escalate·to·privileged·(root) | ||
| 12 | ·······································plain·text·over·the·network.·By·default,·Red·Hat·······access·via·su·/·sudo.·This·is·required·for | ||
| 13 | ·······································Enterprise·Linux·7's·/etc/securetty·file·only·allows···FISMA·Low·and·FISMA·Moderate·systems. | ||
| 14 | ·······································the·root·user·to·login·at·the·console·physically | ||
| 15 | ·······································attached·to·the·system.·To·prevent·root·from·logging | ||
| 16 | ·······································in,·remove·the·contents·of·this·file.·To·prevent | ||
| 17 | ·······································direct·root·logins,·remove·the·contents·of·this·file | ||
| 18 | ·······································by·typing·the·following·command: | ||
| 19 | ·······································$·sudo·echo·>·/etc/securetty | ||
| 20 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 21 | ·······································login·without·credentials·which·can·be·useful·for | ||
| 22 | ·······································public·kiosk·scenarios.·Allowing·users·to·login | ||
| 23 | ·······································without·credentials·or·"guest"·account·access·has······Failure·to·restrict·system·access·to | ||
| 24 | 3.1.1···Disable·GDM·Guest·Login········inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users·negatively·impacts | ||
| 25 | ·······································disable·timed·logins·or·guest·account·access,·set·the··operating·system·security. | ||
| 26 | ·······································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/ | ||
| 27 | ·······································etc/gdm/custom.conf.·For·example: | ||
| 28 | ·······································[daemon] | ||
| 29 | ·······································TimedLoginEnable=false | ||
| 30 | ·······································To·restrict·root·logins·through·the·(deprecated) | ||
| 31 | ·······································virtual·console·devices,·ensure·lines·of·this·form·do··Preventing·direct·root·login·to·virtual | ||
| 32 | 3.1.1···Restrict·Virtual·Console·Root··not·appear·in·/etc/securetty:··························console·devices·helps·ensure·accountability | ||
| 33 | 3.1.5···Logins·························vc/1···················································for·actions·taken·on·the·system·using·the·root | ||
| 34 | ·······································vc/2···················································account. | ||
| 35 | ·······································vc/3 | ||
| 36 | ·······································vc/4 | ||
| 37 | ······························································································Even·though·the·communications·channel·may·be | ||
| 38 | ·······································The·root·user·should·never·be·allowed·to·login·to·a····encrypted,·an·additional·layer·of·security·is | ||
| 39 | ·······································system·directly·over·a·network.·To·disable·root·login··gained·by·extending·the·policy·of·not·logging | ||
| 40 | 3.1.1···Disable·SSH·Root·Login·········via·SSH,·add·or·correct·the·following·line·in·/etc/····directly·on·as·root.·In·addition,·logging·in | ||
| 41 | 3.1.5··································ssh/sshd_config:·······································with·a·user-specific·account·provides | ||
| 42 | ·······································PermitRootLogin·no·····································individual·accountability·of·actions·performed | ||
| 43 | ······························································································on·the·system·and·also·helps·to·minimize | ||
| 44 | ······························································································direct·attack·attempts·on·root's·password. | ||
| 45 | ·······································If·any·account·other·than·root·has·a·UID·of·0,·this | 3 | ·······································If·any·account·other·than·root·has·a·UID·of·0,·this |
| 46 | ·······································misconfiguration·should·be·investigated·and·the········An·account·has·root·authority·if·it·has·a·UID | 4 | ·······································misconfiguration·should·be·investigated·and·the········An·account·has·root·authority·if·it·has·a·UID |
| 47 | ·······································accounts·other·than·root·should·be·removed·or·have·····of·0.·Multiple·accounts·with·a·UID·of·0·afford | 5 | ·······································accounts·other·than·root·should·be·removed·or·have·····of·0.·Multiple·accounts·with·a·UID·of·0·afford |
| 48 | 3.1.1··································their·UID·changed.·····································more·opportunity·for·potential·intruders·to | 6 | 3.1.1··································their·UID·changed.·····································more·opportunity·for·potential·intruders·to |
| 49 | 3.1.5···Verify·Only·Root·Has·UID·0·····If·the·account·is·associated·with·system·commands·or···guess·a·password·for·a·privileged·account. | 7 | 3.1.5···Verify·Only·Root·Has·UID·0·····If·the·account·is·associated·with·system·commands·or···guess·a·password·for·a·privileged·account. |
| 50 | ·······································applications·the·UID·should·be·changed·to·one·greater··Proper·configuration·of·sudo·is·recommended·to | 8 | ·······································applications·the·UID·should·be·changed·to·one·greater··Proper·configuration·of·sudo·is·recommended·to |
| 51 | ·······································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··afford·multiple·system·administrators·access | 9 | ·······································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··afford·multiple·system·administrators·access |
| 52 | ·······································greater·than·"1000"·that·has·not·already·been··········to·root·privileges·in·an·accountable·manner. | 10 | ·······································greater·than·"1000"·that·has·not·already·been··········to·root·privileges·in·an·accountable·manner. |
| 53 | ·······································assigned. | 11 | ·······································assigned. |
| 12 | ······························································································Even·though·the·communications·channel·may·be | ||
| 13 | ·······································The·root·user·should·never·be·allowed·to·login·to·a····encrypted,·an·additional·layer·of·security·is | ||
| 14 | ·······································system·directly·over·a·network.·To·disable·root·login··gained·by·extending·the·policy·of·not·logging | ||
| 15 | 3.1.1···Disable·SSH·Root·Login·········via·SSH,·add·or·correct·the·following·line·in·/etc/····directly·on·as·root.·In·addition,·logging·in | ||
| 16 | 3.1.5··································ssh/sshd_config:·······································with·a·user-specific·account·provides | ||
| 17 | ·······································PermitRootLogin·no·····································individual·accountability·of·actions·performed | ||
| 18 | ······························································································on·the·system·and·also·helps·to·minimize | ||
| 19 | ······························································································direct·attack·attempts·on·root's·password. | ||
| 20 | ·······································Emergency·mode·is·intended·as·a·system·recovery | ||
| 21 | ·······································method,·providing·a·single·user·root·access·to·the·····This·prevents·attackers·with·physical·access | ||
| 22 | 3.1.1···Require·Authentication·for·····system·during·a·failed·boot·sequence.··················from·trivially·bypassing·security·on·the | ||
| 23 | 3.4.5···Emergency·Systemd·Target······························································machine·and·gaining·root·access.·Such·accesses | ||
| 24 | ·······································By·default,·Emergency·mode·is·protected·by·requiring·a·are·further·prevented·by·configuring·the | ||
| 25 | ·······································password·and·is·set·in·/usr/lib/systemd/system/········bootloader·password. | ||
| 26 | ·······································emergency.service. | ||
| 54 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | 27 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to |
| 55 | ·······································automatically·login·without·user·interaction·or | 28 | ·······································automatically·login·without·user·interaction·or |
| 56 | ·······································credentials.·User·should·always·be·required·to | 29 | ·······································credentials.·User·should·always·be·required·to |
| 57 | ·······································authenticate·themselves·to·the·system·that·they·are····Failure·to·restrict·system·access·to | 30 | ·······································authenticate·themselves·to·the·system·that·they·are····Failure·to·restrict·system·access·to |
| 58 | 3.1.1···Disable·GDM·Automatic·Login····authorized·to·use.·To·disable·user·ability·to··········authenticated·users·negatively·impacts | 31 | 3.1.1···Disable·GDM·Automatic·Login····authorized·to·use.·To·disable·user·ability·to··········authenticated·users·negatively·impacts |
| 59 | ·······································automatically·login·to·the·system,·set·the·············operating·system·security. | 32 | ·······································automatically·login·to·the·system,·set·the·············operating·system·security. |
| 60 | ·······································AutomaticLoginEnable·to·false·in·the·[daemon]·section | 33 | ·······································AutomaticLoginEnable·to·false·in·the·[daemon]·section |
| 61 | ·······································in·/etc/gdm/custom.conf.·For·example: | 34 | ·······································in·/etc/gdm/custom.conf.·For·example: |
| 62 | ·······································[daemon] | 35 | ·······································[daemon] |
| 63 | ·······································AutomaticLoginEnable=false | 36 | ·······································AutomaticLoginEnable=false |
| 37 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 38 | ·······································login·without·credentials·which·can·be·useful·for | ||
| 39 | ·······································public·kiosk·scenarios.·Allowing·users·to·login | ||
| 40 | ·······································without·credentials·or·"guest"·account·access·has······Failure·to·restrict·system·access·to | ||
| 41 | 3.1.1···Disable·GDM·Guest·Login········inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users·negatively·impacts | ||
| 42 | ·······································disable·timed·logins·or·guest·account·access,·set·the··operating·system·security. | ||
| 43 | ·······································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/ | ||
| 44 | ·······································etc/gdm/custom.conf.·For·example: | ||
| 64 | ·······································To·restrict·root·logins·on·serial·ports,·ensure·lines··Preventing·direct·root·login·to·serial·port | ||
| 65 | 3.1.1···Restrict·Serial·Port·Root······of·this·form·do·not·appear·in·/etc/securetty:··········interfaces·helps·ensure·accountability·for | ||
| 66 | 3.1.5···Logins·························ttyS0··················································actions·taken·on·the·systems·using·the·root | ||
| 67 | ·······································ttyS1··················································account. | ||
| 68 | ·······································Single-user·mode·is·intended·as·a·system·recovery | ||
| 69 | ·······································method,·providing·a·single·user·root·access·to·the·····This·prevents·attackers·with·physical·access | ||
| 70 | 3.1.1···Require·Authentication·for·····system·by·providing·a·boot·option·at·startup.··········from·trivially·bypassing·security·on·the | ||
| 71 | 3.4.5···Single·User·Mode······································································machine·and·gaining·root·access.·Such·accesses | ||
| 72 | ·······································By·default,·single-user·mode·is·protected·by·requiring·are·further·prevented·by·configuring·the | ||
| 73 | ·······································a·password·and·is·set·in·/usr/lib/systemd/system/······bootloader·password. | ||
| 74 | ······································· | 45 | ·······································[daemon] |
| 46 | ·······································TimedLoginEnable=false | ||
| 75 | ·······································If·an·account·is·configured·for·password···············If·an·account·has·an·empty·password,·anyone | 47 | ·······································If·an·account·is·configured·for·password···············If·an·account·has·an·empty·password,·anyone |
| 76 | ·······································authentication·but·does·not·have·an·assigned·password,·could·log·in·and·run·commands·with·the | 48 | ·······································authentication·but·does·not·have·an·assigned·password,·could·log·in·and·run·commands·with·the |
| 77 | 3.1.1···Prevent·Login·to·Accounts·With·it·may·be·possible·to·log·into·the·account·without·····privileges·of·that·account.·Accounts·with | 49 | 3.1.1···Prevent·Login·to·Accounts·With·it·may·be·possible·to·log·into·the·account·without·····privileges·of·that·account.·Accounts·with |
| 78 | 3.1.5···Empty·Password·················authentication.·Remove·any·instances·of·the·nullok·in··empty·passwords·should·never·be·used·in | 50 | 3.1.5···Empty·Password·················authentication.·Remove·any·instances·of·the·nullok·in··empty·passwords·should·never·be·used·in |
| 79 | ·······································/etc/pam.d/system-auth·and·/etc/pam.d/password-auth·to·operational·environments. | 51 | ·······································/etc/pam.d/system-auth·and·/etc/pam.d/password-auth·to·operational·environments. |
| 80 | ·······································prevent·logins·with·empty·passwords. | 52 | ·······································prevent·logins·with·empty·passwords. |
| 81 | ·······································Disallow·SSH·login·with·empty·passwords.·The·default | 53 | ·······································Disallow·SSH·login·with·empty·passwords.·The·default |
| Offset 90, 21 lines modified | Offset 62, 49 lines modified | ||
| 90 | 3.1.1···Disable·SSH·Access·via·Empty···empty·passwords,·add·or·correct·the·following·line·in··provides·additional·assurance·that·remote | 62 | 3.1.1···Disable·SSH·Access·via·Empty···empty·passwords,·add·or·correct·the·following·line·in··provides·additional·assurance·that·remote |
| 91 | 3.1.5···Passwords······················/etc/ssh/sshd_config:··································login·via·SSH·will·require·a·password,·even·in | 63 | 3.1.5···Passwords······················/etc/ssh/sshd_config:··································login·via·SSH·will·require·a·password,·even·in |
| 92 | ·······································PermitEmptyPasswords·no································the·event·of·misconfiguration·elsewhere. | 64 | ·······································PermitEmptyPasswords·no································the·event·of·misconfiguration·elsewhere. |
| 93 | ·······································Any·accounts·with·empty·passwords·should·be·disabled | 65 | ·······································Any·accounts·with·empty·passwords·should·be·disabled |
| 94 | ·······································immediately,·and·PAM·configuration·should·prevent | 66 | ·······································immediately,·and·PAM·configuration·should·prevent |
| 95 | ·······································users·from·being·able·to·assign·themselves·empty | 67 | ·······································users·from·being·able·to·assign·themselves·empty |
| 96 | ·······································passwords. | 68 | ·······································passwords. |
| 69 | ·······································To·restrict·root·logins·through·the·(deprecated) | ||
| 70 | ·······································virtual·console·devices,·ensure·lines·of·this·form·do··Preventing·direct·root·login·to·virtual | ||
| 71 | 3.1.1···Restrict·Virtual·Console·Root··not·appear·in·/etc/securetty:··························console·devices·helps·ensure·accountability | ||
| 72 | 3.1.5···Logins·························vc/1···················································for·actions·taken·on·the·system·using·the·root | ||
| 73 | ·······································vc/2···················································account. | ||
| 74 | ·······································vc/3 | ||
| 75 | ·······································vc/4 | ||
| 97 | ······································· | 76 | ·······································Single-user·mode·is·intended·as·a·system·recovery |
| 98 | ·······································method,·providing·a·single·user·root·access·to·the·····This·prevents·attackers·with·physical·access | 77 | ·······································method,·providing·a·single·user·root·access·to·the·····This·prevents·attackers·with·physical·access |
| 99 | 3.1.1···Require·Authentication·for·····system· | 78 | 3.1.1···Require·Authentication·for·····system·by·providing·a·boot·option·at·startup.··········from·trivially·bypassing·security·on·the |
| Max diff block lines reached; 604829/621942 bytes (97.25%) of diff not shown. | |||
| Offset 7676, 19 lines modified | Offset 7676, 19 lines modified | ||
| 0001dfb0:·2070·7265·7669·6f75·7320·7061·7373·776f···previous·passwo | 0001dfb0:·2070·7265·7669·6f75·7320·7061·7373·776f···previous·passwo | ||
| 0001dfc0:·7264·7320·6865·6c70·7320·656e·7375·7265··rds·helps·ensure | 0001dfc0:·7264·7320·6865·6c70·7320·656e·7375·7265··rds·helps·ensure | ||
| 0001dfd0:·2074·6861·7420·6120·636f·6d70·726f·6d69···that·a·compromi | 0001dfd0:·2074·6861·7420·6120·636f·6d70·726f·6d69···that·a·compromi | ||
| 0001dfe0:·7365·6420·7061·7373·776f·7264·2069·7320··sed·password·is· | 0001dfe0:·7365·6420·7061·7373·776f·7264·2069·7320··sed·password·is· | ||
| 0001dff0:·6e6f·7420·7265·2d75·7365·6420·6279·2061··not·re-used·by·a | 0001dff0:·6e6f·7420·7265·2d75·7365·6420·6279·2061··not·re-used·by·a | ||
| 0001e000:·2075·7365·722e·0a20·203c·2f74·643e·0a20···user..··</td>.· | 0001e000:·2075·7365·722e·0a20·203c·2f74·643e·0a20···user..··</td>.· | ||
| 0001e010:·203c·7464·3e76·6172·5f70·6173·7377·6f72···<td>var_passwor | 0001e010:·203c·7464·3e76·6172·5f70·6173·7377·6f72···<td>var_passwor | ||
| 0001e020:·645f·7061·6d5f·7265·6d65·6d62·6572·3d35··d_pam_remember=5 | |||
| 0001e030:·3c62·722f·3e76·6172·5f70·6173·7377·6f72··<br/>var_passwor | |||
| 0001e0 | 0001e040:·645f·7061·6d5f·7265·6d65·6d62·6572·5f63··d_pam_remember_c | ||
| 0001e0 | 0001e050:·6f6e·7472·6f6c·5f66·6c61·673d·7265·7175··ontrol_flag=requ | ||
| 0001e040:·6973·6974·653c·6272·2f3e·7661·725f·7061··isite<br/>var_pa | |||
| 0001e050:·7373·776f·7264·5f70·616d·5f72·656d·656d··ssword_pam_remem | |||
| 0001e060:·6 | 0001e060:·6973·6974·653c·2f74·643e·0a3c·2f74·723e··isite</td>.</tr> | ||
| 0001e070:·0a3c·7472·3e0a·2020·3c74·643e·4941·2d35··.<tr>.··<td>IA-5 | 0001e070:·0a3c·7472·3e0a·2020·3c74·643e·4941·2d35··.<tr>.··<td>IA-5 | ||
| 0001e080:·2866·293c·6272·2f3e·4941·2d35·2831·2928··(f)<br/>IA-5(1)( | 0001e080:·2866·293c·6272·2f3e·4941·2d35·2831·2928··(f)<br/>IA-5(1)( | ||
| 0001e090:·6529·3c2f·7464·3e0a·2020·3c74·643e·4343··e)</td>.··<td>CC | 0001e090:·6529·3c2f·7464·3e0a·2020·3c74·643e·4343··e)</td>.··<td>CC | ||
| 0001e0a0:·452d·3833·3437·392d·363c·2f74·643e·0a20··E-83479-6</td>.· | 0001e0a0:·452d·3833·3437·392d·363c·2f74·643e·0a20··E-83479-6</td>.· | ||
| 0001e0b0:·203c·7464·3e4c·696d·6974·2050·6173·7377···<td>Limit·Passw | 0001e0b0:·203c·7464·3e4c·696d·6974·2050·6173·7377···<td>Limit·Passw | ||
| 0001e0c0:·6f72·6420·5265·7573·653a·2073·7973·7465··ord·Reuse:·syste | 0001e0c0:·6f72·6420·5265·7573·653a·2073·7973·7465··ord·Reuse:·syste | ||
| 0001e0d0:·6d2d·6175·7468·3c2f·7464·3e0a·2020·3c74··m-auth</td>.··<t | 0001e0d0:·6d2d·6175·7468·3c2f·7464·3e0a·2020·3c74··m-auth</td>.··<t | ||
| Offset 7734, 18 lines modified | Offset 7734, 18 lines modified | ||
| 0001e350:·776f·7264·7320·6865·6c70·7320·656e·7375··words·helps·ensu | 0001e350:·776f·7264·7320·6865·6c70·7320·656e·7375··words·helps·ensu | ||
| 0001e360:·7265·2074·6861·7420·6120·636f·6d70·726f··re·that·a·compro | 0001e360:·7265·2074·6861·7420·6120·636f·6d70·726f··re·that·a·compro | ||
| 0001e370:·6d69·7365·6420·7061·7373·776f·7264·2069··mised·password·i | 0001e370:·6d69·7365·6420·7061·7373·776f·7264·2069··mised·password·i | ||
| 0001e380:·7320·6e6f·7420·7265·2d75·7365·6420·6279··s·not·re-used·by | 0001e380:·7320·6e6f·7420·7265·2d75·7365·6420·6279··s·not·re-used·by | ||
| 0001e390:·2061·2075·7365·722e·0a20·203c·2f74·643e···a·user..··</td> | 0001e390:·2061·2075·7365·722e·0a20·203c·2f74·643e···a·user..··</td> | ||
| 0001e3a0:·0a20·203c·7464·3e76·6172·5f70·6173·7377··.··<td>var_passw | 0001e3a0:·0a20·203c·7464·3e76·6172·5f70·6173·7377··.··<td>var_passw | ||
| 0001e3b0:·6f72·645f·7061·6d5f·7265·6d65·6d62·6572··ord_pam_remember | 0001e3b0:·6f72·645f·7061·6d5f·7265·6d65·6d62·6572··ord_pam_remember | ||
| 0001e3c0:·3d35·3c62·722f·3e76·6172·5f70·6173·7377··=5<br/>var_passw | |||
| 0001e3d0:·6f72·645f·7061·6d5f·7265·6d65·6d62·6572··ord_pam_remember | |||
| 0001e3 | 0001e3e0:·5f63·6f6e·7472·6f6c·5f66·6c61·673d·7265··_control_flag=re | ||
| 0001e3f0:·7175·6973·6974·653c·2f74·643e·0a3c·2f74··quisite</td>.</t | |||
| 0001e3d0:·7175·6973·6974·653c·6272·2f3e·7661·725f··quisite<br/>var_ | |||
| 0001e3e0:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | |||
| 0001e3f0:·656d·6265·723d·353c·2f74·643e·0a3c·2f74··ember=5</td>.</t | |||
| 0001e400:·723e·0a3c·7472·3e0a·2020·3c74·643e·4941··r>.<tr>.··<td>IA | 0001e400:·723e·0a3c·7472·3e0a·2020·3c74·643e·4941··r>.<tr>.··<td>IA | ||
| 0001e410:·2d35·2863·293c·6272·2f3e·4941·2d35·2831··-5(c)<br/>IA-5(1 | 0001e410:·2d35·2863·293c·6272·2f3e·4941·2d35·2831··-5(c)<br/>IA-5(1 | ||
| 0001e420:·2928·6129·3c62·722f·3e43·4d2d·3628·6129··)(a)<br/>CM-6(a) | 0001e420:·2928·6129·3c62·722f·3e43·4d2d·3628·6129··)(a)<br/>CM-6(a) | ||
| 0001e430:·3c62·722f·3e49·412d·3528·3429·3c2f·7464··<br/>IA-5(4)</td | 0001e430:·3c62·722f·3e49·412d·3528·3429·3c2f·7464··<br/>IA-5(4)</td | ||
| 0001e440:·3e0a·2020·3c74·643e·4343·452d·3237·3230··>.··<td>CCE-2720 | 0001e440:·3e0a·2020·3c74·643e·4343·452d·3237·3230··>.··<td>CCE-2720 | ||
| 0001e450:·302d·353c·2f74·643e·0a20·203c·7464·3e45··0-5</td>.··<td>E | 0001e450:·302d·353c·2f74·643e·0a20·203c·7464·3e45··0-5</td>.··<td>E | ||
| 0001e460:·6e73·7572·6520·5041·4d20·456e·666f·7263··nsure·PAM·Enforc | 0001e460:·6e73·7572·6520·5041·4d20·456e·666f·7263··nsure·PAM·Enforc | ||
| Offset 8578, 18 lines modified | Offset 8578, 18 lines modified | ||
| 00021810:·7573·6520·7468·6520·696e·666f·726d·6174··use·the·informat | 00021810:·7573·6520·7468·6520·696e·666f·726d·6174··use·the·informat | ||
| 00021820:·696f·6e20·746f·2070·6f74·656e·7469·616c··ion·to·potential | 00021820:·696f·6e20·746f·2070·6f74·656e·7469·616c··ion·to·potential | ||
| 00021830:·6c79·2063·6f6d·7072·6f6d·6973·6520·7468··ly·compromise·th | 00021830:·6c79·2063·6f6d·7072·6f6d·6973·6520·7468··ly·compromise·th | ||
| 00021840:·6520·696e·7465·6772·6974·7920·6f66·2074··e·integrity·of·t | 00021840:·6520·696e·7465·6772·6974·7920·6f66·2074··e·integrity·of·t | ||
| 00021850:·6865·2073·7973·7465·6d20·616e·640a·6e65··he·system·and.ne | 00021850:·6865·2073·7973·7465·6d20·616e·640a·6e65··he·system·and.ne | ||
| 00021860:·7477·6f72·6b28·7329·2e0a·2020·3c2f·7464··twork(s)..··</td | 00021860:·7477·6f72·6b28·7329·2e0a·2020·3c2f·7464··twork(s)..··</td | ||
| 00021870:·3e0a·2020·3c74·643e·7661·725f·736e·6d70··>.··<td>var_snmp | 00021870:·3e0a·2020·3c74·643e·7661·725f·736e·6d70··>.··<td>var_snmp | ||
| 00021880:·645f·72 | 00021880:·645f·7277·5f73·7472·696e·673d·6368·616e··d_rw_string=chan | ||
| 00021890:·6765·6d65·72 | 00021890:·6765·6d65·7277·3c62·722f·3e76·6172·5f73··gemerw<br/>var_s | ||
| 000218a0:·6e6d·7064·5f72· | 000218a0:·6e6d·7064·5f72·6f5f·7374·7269·6e67·3d63··nmpd_ro_string=c | ||
| 000218b0:·6861·6e67·656d·6572· | 000218b0:·6861·6e67·656d·6572·6f3c·2f74·643e·0a3c··hangemero</td>.< | ||
| 000218c0:·2f74·723e·0a3c·7472·3e0a·2020·3c74·643e··/tr>.<tr>.··<td> | 000218c0:·2f74·723e·0a3c·7472·3e0a·2020·3c74·643e··/tr>.<tr>.··<td> | ||
| 000218d0:·434d·2d35·2831·293c·6272·2f3e·4155·2d37··CM-5(1)<br/>AU-7 | 000218d0:·434d·2d35·2831·293c·6272·2f3e·4155·2d37··CM-5(1)<br/>AU-7 | ||
| 000218e0:·2861·293c·6272·2f3e·4155·2d37·2862·293c··(a)<br/>AU-7(b)< | 000218e0:·2861·293c·6272·2f3e·4155·2d37·2862·293c··(a)<br/>AU-7(b)< | ||
| 000218f0:·6272·2f3e·4155·2d38·2862·293c·6272·2f3e··br/>AU-8(b)<br/> | 000218f0:·6272·2f3e·4155·2d38·2862·293c·6272·2f3e··br/>AU-8(b)<br/> | ||
| 00021900:·4155·2d31·3228·3329·3c62·722f·3e41·432d··AU-12(3)<br/>AC- | 00021900:·4155·2d31·3228·3329·3c62·722f·3e41·432d··AU-12(3)<br/>AC- | ||
| 00021910:·3628·3929·3c2f·7464·3e0a·2020·3c74·643e··6(9)</td>.··<td> | 00021910:·3628·3929·3c2f·7464·3e0a·2020·3c74·643e··6(9)</td>.··<td> | ||
| 00021920:·4343·452d·3833·3535·352d·333c·2f74·643e··CCE-83555-3</td> | 00021920:·4343·452d·3833·3535·352d·333c·2f74·643e··CCE-83555-3</td> |
| Offset 1669, 30 lines modified | Offset 1669, 30 lines modified | ||
| 1669 | ··················································································search·space. | 1669 | ··················································································search·space. |
| 1670 | ······································Do·not·allow·users·to·reuse·recent | 1670 | ······································Do·not·allow·users·to·reuse·recent |
| 1671 | ······································passwords.·This·can·be·accomplished·by | 1671 | ······································passwords.·This·can·be·accomplished·by |
| 1672 | ······································using·the·remember·option·for·the | 1672 | ······································using·the·remember·option·for·the |
| 1673 | ······································pam_pwhistory·PAM·module. | 1673 | ······································pam_pwhistory·PAM·module. |
| 1674 | IA-5(f)·CCE-··························In·the·file·/etc/pam.d/password-auth,·make | 1674 | IA-5(f)·CCE-··························In·the·file·/etc/pam.d/password-auth,·make |
| 1675 | IA-5(1)·83476-·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember | 1675 | IA-5(1)·83476-·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember=5 |
| 1676 | (e)·····2······password-auth··········it·has·a·value·equal·to·or·greater·than·5.··compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember= | 1676 | (e)·····2······password-auth··········it·has·a·value·equal·to·or·greater·than·5.··compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember_control_flag=requisite |
| 1677 | ······································For·example: | 1677 | ······································For·example: |
| 1678 | ······································password·control_flag·pam_pwhistory.so | 1678 | ······································password·control_flag·pam_pwhistory.so |
| 1679 | ······································...existing_options...·remember=5 | 1679 | ······································...existing_options...·remember=5 |
| 1680 | ······································use_authtok | 1680 | ······································use_authtok |
| 1681 | ······································control_flag·should·be·one·of·the·next | 1681 | ······································control_flag·should·be·one·of·the·next |
| 1682 | ······································values:·requisite | 1682 | ······································values:·requisite |
| 1683 | ······································Do·not·allow·users·to·reuse·recent | 1683 | ······································Do·not·allow·users·to·reuse·recent |
| 1684 | ······································passwords.·This·can·be·accomplished·by | 1684 | ······································passwords.·This·can·be·accomplished·by |
| 1685 | ······································using·the·remember·option·for·the | 1685 | ······································using·the·remember·option·for·the |
| 1686 | ······································pam_pwhistory·PAM·module. | 1686 | ······································pam_pwhistory·PAM·module. |
| 1687 | IA-5(f)·CCE-··························In·the·file·/etc/pam.d/system-auth,·make | 1687 | IA-5(f)·CCE-··························In·the·file·/etc/pam.d/system-auth,·make |
| 1688 | IA-5(1)·83479-·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember | 1688 | IA-5(1)·83479-·Limit·Password·Reuse:··sure·the·parameter·remember·is·present·and··Preventing·re-use·of·previous·passwords·helps·ensure·that·a····var_password_pam_remember=5 |
| 1689 | (e)·····6······system-auth············it·has·a·value·equal·to·or·greater·than·5···compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember= | 1689 | (e)·····6······system-auth············it·has·a·value·equal·to·or·greater·than·5···compromised·password·is·not·re-used·by·a·user.·················var_password_pam_remember_control_flag=requisite |
| 1690 | ······································For·example: | 1690 | ······································For·example: |
| 1691 | ······································password·control_flag·pam_pwhistory.so | 1691 | ······································password·control_flag·pam_pwhistory.so |
| 1692 | ······································...existing_options...·remember=5 | 1692 | ······································...existing_options...·remember=5 |
| 1693 | ······································use_authtok | 1693 | ······································use_authtok |
| 1694 | ······································control_flag·should·be·one·of·the·next | 1694 | ······································control_flag·should·be·one·of·the·next |
| 1695 | ······································values:·requisite | 1695 | ······································values:·requisite |
| 1696 | ······································The·pam_pwquality·module's·ucredit=·········Use·of·a·complex·password·helps·to·increase·the·time·and | 1696 | ······································The·pam_pwquality·module's·ucredit=·········Use·of·a·complex·password·helps·to·increase·the·time·and |
| Offset 1839, 16 lines modified | Offset 1839, 16 lines modified | ||
| 1839 | ······································This·will·help·ensure·when·local·users······configuration·option·ensures·the·use·of·a·strong·hashing | 1839 | ······································This·will·help·ensure·when·local·users······configuration·option·ensures·the·use·of·a·strong·hashing |
| 1840 | ······································change·their·passwords,·hashes·for·the·new··algorithm·that·makes·password·cracking·attacks·more·difficult. | 1840 | ······································change·their·passwords,·hashes·for·the·new··algorithm·that·makes·password·cracking·attacks·more·difficult. |
| 1841 | ······································passwords·will·be·generated·using·the·SHA- | 1841 | ······································passwords·will·be·generated·using·the·SHA- |
| 1842 | ······································512·algorithm.·This·is·the·default. | 1842 | ······································512·algorithm.·This·is·the·default. |
| 1843 | ······································Edit·/etc/snmp/snmpd.conf,·remove·or·change | 1843 | ······································Edit·/etc/snmp/snmpd.conf,·remove·or·change |
| 1844 | ······································the·default·community·strings·of·public·and·Whether·active·or·not,·default·simple·network·management | 1844 | ······································the·default·community·strings·of·public·and·Whether·active·or·not,·default·simple·network·management |
| 1845 | ········CCE-··························private.·This·profile·configures·new·read-··protocol·(SNMP)·community·strings·must·be·changed·to·maintain | 1845 | ········CCE-··························private.·This·profile·configures·new·read-··protocol·(SNMP)·community·strings·must·be·changed·to·maintain |
| 1846 | IA-5(e)·27386-·Ensure·Default·SNMP····only·community·string·to·changemero·and·····security.·If·the·service·is·running·with·the·default···········var_snmpd_r | 1846 | IA-5(e)·27386-·Ensure·Default·SNMP····only·community·string·to·changemero·and·····security.·If·the·service·is·running·with·the·default···········var_snmpd_rw_string=changemerw |
| 1847 | ········2······Password·Is·Not·Used···read-write·community·string·to·changemerw.··authenticators,·then·anyone·can·gather·data·about·the·system···var_snmpd_r | 1847 | ········2······Password·Is·Not·Used···read-write·community·string·to·changemerw.··authenticators,·then·anyone·can·gather·data·about·the·system···var_snmpd_ro_string=changemero |
| 1848 | ······································Once·the·default·community·strings·have·····and·the·network·and·use·the·information·to·potentially | 1848 | ······································Once·the·default·community·strings·have·····and·the·network·and·use·the·information·to·potentially |
| 1849 | ······································been·changed,·restart·the·SNMP·service:·····compromise·the·integrity·of·the·system·and·network(s). | 1849 | ······································been·changed,·restart·the·SNMP·service:·····compromise·the·integrity·of·the·system·and·network(s). |
| 1850 | ······································$·sudo·service·snmpd·restart | 1850 | ······································$·sudo·service·snmpd·restart |
| 1851 | ······································Verify·the·system·generates·an·audit·record | 1851 | ······································Verify·the·system·generates·an·audit·record |
| 1852 | ······································when·privileged·functions·are·executed.·If | 1852 | ······································when·privileged·functions·are·executed.·If |
| 1853 | ······································audit·is·using·the·"auditctl"·tool·to·load | 1853 | ······································audit·is·using·the·"auditctl"·tool·to·load |
| 1854 | ······································the·rules,·run·the·following·command: | 1854 | ······································the·rules,·run·the·following·command: |
| Offset 70, 9292 lines modified | Offset 70, 9292 lines modified | ||
| 00000450:·6f64·793e·0a20·203c·7472·3e0a·2020·2020··ody>.··<tr>.···· | 00000450:·6f64·793e·0a20·203c·7472·3e0a·2020·2020··ody>.··<tr>.···· | ||
| 00000460:·2020·3c74·643e·4155·2d32·2864·293c·6272····<td>AU-2(d)<br | 00000460:·2020·3c74·643e·4155·2d32·2864·293c·6272····<td>AU-2(d)<br | ||
| 00000470:·2f3e·4155·2d31·3228·6329·3c62·722f·3e43··/>AU-12(c)<br/>C | 00000470:·2f3e·4155·2d31·3228·6329·3c62·722f·3e43··/>AU-12(c)<br/>C | ||
| 00000480:·4d2d·3628·6129·3c2f·7464·3e0a·2020·2020··M-6(a)</td>.···· | 00000480:·4d2d·3628·6129·3c2f·7464·3e0a·2020·2020··M-6(a)</td>.···· | ||
| 00000490:·2020·3c74·643e·5265·636f·7264·2055·6e73····<td>Record·Uns | 00000490:·2020·3c74·643e·5265·636f·7264·2055·6e73····<td>Record·Uns | ||
| 000004a0:·7563·6365·7373·6675·6c20·5065·726d·6973··uccessful·Permis | 000004a0:·7563·6365·7373·6675·6c20·5065·726d·6973··uccessful·Permis | Diff chunk too large, falling back to line-by-line diff (3145 lines added, 3145 lines removed) | |
| 000004b0:·7369·6f6e·2043·6861·6e67·6573·2074·6f20··sion·Changes·to· | 000004b0:·7369·6f6e·2043·6861·6e67·6573·2074·6f20··sion·Changes·to· | ||
| 000004c0:·4669·6c65·7320·2d20· | 000004c0:·4669·6c65·7320·2d20·7365·7478·6174·7472··Files·-·setxattr | ||
| 000004d0:· | 000004d0:·3c2f·7464·3e0a·2020·2020·2020·3c74·6420··</td>.······<td· | ||
| 000004e0:· | 000004e0:·786d·6c3a·6c61·6e67·3d22·656e·2d55·5322··xml:lang="en-US" | ||
| 000004f0:· | 000004f0:·3e0a·2020·2020·2020·2020·5468·6520·6175··>.········The·au | ||
| 00000500:· | 00000500:·6469·7420·7379·7374·656d·2073·686f·756c··dit·system·shoul | ||
| 00000510:·6 | 00000510:·6420·636f·6c6c·6563·7420·756e·7375·6363··d·collect·unsucc | ||
| 00000520:·6 | 00000520:·6573·7366·756c·2066·696c·6520·7065·726d··essful·file·perm | ||
| 00000530:·6 | 00000530:·6973·7369·6f6e·2063·6861·6e67·650a·6174··ission·change.at | ||
| 00000540:·74 | 00000540:·7465·6d70·7473·2066·6f72·2061·6c6c·2075··tempts·for·all·u | ||
| 00000550:·7 | 00000550:·7365·7273·2061·6e64·2072·6f6f·742e·0a49··sers·and·root..I | ||
| 00000560:· | 00000560:·6620·7468·6520·3c74·743e·6175·6469·7464··f·the·<tt>auditd | ||
| 00000570:· | 00000570:·3c2f·7474·3e20·6461·656d·6f6e·2069·7320··</tt>·daemon·is· | ||
| 00000580:· | 00000580:·636f·6e66·6967·7572·6564·0a74·6f20·7573··configured.to·us | ||
| 00000590:· | 00000590:·6520·7468·6520·3c74·743e·6175·6765·6e72··e·the·<tt>augenr | ||
| 000005a0:·7 | 000005a0:·756c·6573·3c2f·7474·3e20·7072·6f67·7261··ules</tt>·progra | ||
| 000005b0:·6 | 000005b0:·6d20·746f·2072·6561·6420·6175·6469·7420··m·to·read·audit· | ||
| 000005c0:· | 000005c0:·7275·6c65·7320·6475·7269·6e67·2064·6165··rules·during·dae | ||
| 000005d0:·6 | 000005d0:·6d6f·6e0a·7374·6172·7475·7020·2874·6865··mon.startup·(the | ||
| 000005e0:· | 000005e0:·2064·6566·6175·6c74·292c·2061·6464·2074···default),·add·t | ||
| 000005f0:· | 000005f0:·6865·2066·6f6c·6c6f·7769·6e67·206c·696e··he·following·lin | ||
| 00000600:·6 | 00000600:·6573·2074·6f20·6120·6669·6c65·2077·6974··es·to·a·file·wit | ||
| 00000610:· | 00000610:·6820·7375·6666·6978·0a3c·7474·3e2e·7275··h·suffix.<tt>.ru | ||
| 00000620:· | 00000620:·6c65·733c·2f74·743e·2069·6e20·7468·6520··les</tt>·in·the· | ||
| 00000630:· | 00000630:·6469·7265·6374·6f72·7920·3c74·743e·2f65··directory·<tt>/e | ||
| 00000640:· | 00000640:·7463·2f61·7564·6974·2f72·756c·6573·2e64··tc/audit/rules.d | ||
| 00000650:· | 00000650:·3c2f·7474·3e2e·0a49·6620·7468·6520·3c74··</tt>..If·the·<t | ||
| 00000660:·74 | 00000660:·743e·6175·6469·7464·3c2f·7474·3e20·6461··t>auditd</tt>·da | ||
| 00000670:·6 | 00000670:·656d·6f6e·2069·7320·636f·6e66·6967·7572··emon·is·configur | ||
| 00000680:· | 00000680:·6564·2074·6f20·7573·6520·7468·6520·3c74··ed·to·use·the·<t | ||
| 00000690:·74 | 00000690:·743e·6175·6469·7463·746c·3c2f·7474·3e0a··t>auditctl</tt>. | ||
| 000006a0:· | 000006a0:·7574·696c·6974·7920·746f·2072·6561·6420··utility·to·read· | ||
| 000006b0:· | 000006b0:·6175·6469·7420·7275·6c65·7320·6475·7269··audit·rules·duri | ||
| 000006c0:·6 | 000006c0:·6e67·2064·6165·6d6f·6e20·7374·6172·7475··ng·daemon·startu | ||
| 000006d0:·7 | 000006d0:·702c·2061·6464·2074·6865·2066·6f6c·6c6f··p,·add·the·follo | ||
| 000006e0:· | 000006e0:·7769·6e67·206c·696e·6573·2074·6f0a·3c74··wing·lines·to.<t | ||
| 000006f0:·74 | 000006f0:·743e·2f65·7463·2f61·7564·6974·2f61·7564··t>/etc/audit/aud | ||
| 00000700:·6 | 00000700:·6974·2e72·756c·6573·3c2f·7474·3e20·6669··it.rules</tt>·fi | ||
| 00000710:·6 | 00000710:·6c65·2e0a·3c70·7265·3e2d·6120·616c·7761··le..<pre>-a·alwa | ||
| 00000720:· | 00000720:·7973·2c65·7869·7420·2d46·2061·7263·683d··ys,exit·-F·arch= | ||
| 00000730:· | 00000730:·6233·3220·2d53·2073·6574·7861·7474·7220··b32·-S·setxattr· | ||
| 00000740:· | 00000740:·2d46·2065·7869·743d·2d45·4143·4345·5320··-F·exit=-EACCES· | ||
| 00000750:· | 00000750:·2d46·2061·7569·643e·3d31·3030·3020·2d46··-F·auid>=1000·-F | ||
| 00000760:·2 | 00000760:·2061·7569·6421·3d75·6e73·6574·202d·4620···auid!=unset·-F· | ||
| 00000770:· | 00000770:·6b65·793d·756e·7375·6363·6573·6675·6c2d··key=unsuccesful- | ||
| 00000780:· | 00000780:·7065·726d·2d63·6861·6e67·650a·2d61·2061··perm-change.-a·a | ||
| 00000790:· | 00000790:·6c77·6179·732c·6578·6974·202d·4620·6172··lways,exit·-F·ar | ||
| 000007a0:·6 | 000007a0:·6368·3d62·3332·202d·5320·7365·7478·6174··ch=b32·-S·setxat | ||
| 000007b0:·7 | 000007b0:·7472·202d·4620·6578·6974·3d2d·4550·4552··tr·-F·exit=-EPER | ||
| 000007c0:· | 000007c0:·4d20·2d46·2061·7569·643e·3d31·3030·3020··M·-F·auid>=1000· | ||
| 000007d0:· | 000007d0:·2d46·2061·7569·6421·3d75·6e73·6574·202d··-F·auid!=unset·- | ||
| 000007e0:· | 000007e0:·4620·6b65·793d·756e·7375·6363·6573·6675··F·key=unsuccesfu | ||
| 000007f0:· | 000007f0:·6c2d·7065·726d·2d63·6861·6e67·653c·2f70··l-perm-change</p | ||
| 00000800:· | 00000800:·7265·3e0a·4966·2074·6865·2073·7973·7465··re>.If·the·syste | ||
| 00000810:· | 00000810:·6d20·6973·2036·3420·6269·7420·7468·656e··m·is·64·bit·then | ||
| 00000820:·6 | 00000820:·2061·6c73·6f20·6164·6420·7468·6520·666f···also·add·the·fo | ||
| 00000830:· | 00000830:·6c6c·6f77·696e·6720·6c69·6e65·733a·0a3c··llowing·lines:.< | ||
| 00000840:· | 00000840:·7072·653e·2d61·2061·6c77·6179·732c·6578··pre>-a·always,ex | ||
| 00000850:· | 00000850:·6974·202d·4620·6172·6368·3d62·3634·202d··it·-F·arch=b64·- | ||
| 00000860:· | 00000860:·5320·7365·7478·6174·7472·202d·4620·6578··S·setxattr·-F·ex | ||
| 00000870:· | 00000870:·6974·3d2d·4541·4343·4553·202d·4620·6175··it=-EACCES·-F·au | ||
| 00000880:· | 00000880:·6964·3e3d·3130·3030·202d·4620·6175·6964··id>=1000·-F·auid | ||
| 00000890:· | 00000890:·213d·756e·7365·7420·2d46·206b·6579·3d75··!=unset·-F·key=u | ||
| 000008a0:·6 | 000008a0:·6e73·7563·6365·7366·756c·2d70·6572·6d2d··nsuccesful-perm- | ||
| 000008b0:·6 | 000008b0:·6368·616e·6765·0a2d·6120·616c·7761·7973··change.-a·always | ||
| 000008c0:· | 000008c0:·2c65·7869·7420·2d46·2061·7263·683d·6236··,exit·-F·arch=b6 | ||
| 000008d0:· | 000008d0:·3420·2d53·2073·6574·7861·7474·7220·2d46··4·-S·setxattr·-F | ||
| 000008e0:· | 000008e0:·2065·7869·743d·2d45·5045·524d·202d·4620···exit=-EPERM·-F· | ||
| 000008f0:· | 000008f0:·6175·6964·3e3d·3130·3030·202d·4620·6175··auid>=1000·-F·au | ||
| 00000900:· | 00000900:·6964·213d·756e·7365·7420·2d46·206b·6579··id!=unset·-F·key | ||
| 00000910:· | 00000910:·3d75·6e73·7563·6365·7366·756c·2d70·6572··=unsuccesful-per | ||
| 00000920:·6 | 00000920:·6d2d·6368·616e·6765·3c2f·7072·653e·0a20··m-change</pre>.· | ||
| 00000930:· | 00000930:·2020·2020·203c·2f74·643e·0a20·2020·2020·······</td>.····· | ||
| 00000940:·20 | 00000940:·203c·7464·2078·6d6c·3a6c·616e·673d·2265···<td·xml:lang="e | ||
| 00000950:·6e | 00000950:·6e2d·5553·223e·0a20·2020·2020·2020·2055··n-US">.········U | ||
| 00000960:· | 00000960:·6e73·7563·6365·7373·6675·6c20·6174·7465··nsuccessful·atte | ||
| 00000970:· | 00000970:·6d70·7473·2074·6f20·6368·616e·6765·2070··mpts·to·change·p | ||
| 00000980:·6 | 00000980:·6572·6d69·7373·696f·6e73·206f·6620·6669··ermissions·of·fi | ||
| 00000990:·6 | 00000990:·6c65·7320·636f·756c·6420·6265·2061·6e20··les·could·be·an· | ||
| 000009a0:·6 | 000009a0:·696e·6469·6361·746f·7220·6f66·206d·616c··indicator·of·mal | ||
| 000009b0:·6 | 000009b0:·6963·696f·7573·2061·6374·6976·6974·7920··icious·activity· | ||
| 000009c0:· | 000009c0:·6f6e·2061·2073·7973·7465·6d2e·2041·7564··on·a·system.·Aud | ||
| 000009d0:· | 000009d0:·6974·696e·670a·7468·6573·6520·6576·656e··iting.these·even | ||
| 000009e0:· | 000009e0:·7473·2063·6f75·6c64·2073·6572·7665·2061··ts·could·serve·a | ||
| 000009f0:·7 | 000009f0:·7320·6576·6964·656e·6365·206f·6620·706f··s·evidence·of·po | ||
| 00000a00:· | 00000a00:·7465·6e74·6961·6c20·7379·7374·656d·2063··tential·system·c | ||
| 00000a10:· | 00000a10:·6f6d·7072·6f6d·6973·652e·0a20·2020·2020··ompromise..····· | ||
| 00000a20:·20 | 00000a20:·203c·2f74·643e·0a20·2020·203c·2f74·723e···</td>.····</tr> | ||
| 00000a30:· | 00000a30:·0a20·2020·203c·7472·3e0a·2020·2020·2020··.····<tr>.······ | ||
| 00000a40:· | 00000a40:·3c74·643e·4155·2d32·2864·293c·6272·2f3e··<td>AU-2(d)<br/> | ||
| 00000a50:· | 00000a50:·4155·2d31·3228·6329·3c62·722f·3e43·4d2d··AU-12(c)<br/>CM- | ||
| 00000a60:· | 00000a60:·3628·6129·3c2f·7464·3e0a·2020·2020·2020··6(a)</td>.······ | ||
| 00000a70:· | 00000a70:·3c74·643e·456e·7375·7265·2061·7564·6974··<td>Ensure·audit | ||
| 00000a80:· | 00000a80:·6420·436f·6c6c·6563·7473·2055·6e61·7574··d·Collects·Unaut | ||
| 00000a90:·6 | 00000a90:·686f·7269·7a65·6420·4163·6365·7373·2041··horized·Access·A | ||
| 00000aa0:·74 | 00000aa0:·7474·656d·7074·7320·746f·2046·696c·6573··ttempts·to·Files | ||
| 00000ab0:· | 00000ab0:·2028·756e·7375·6363·6573·7366·756c·293c···(unsuccessful)< | ||
| 00000ac0:·2 | 00000ac0:·2f74·643e·0a20·2020·2020·203c·7464·2078··/td>.······<td·x | ||
| 00000ad0:· | 00000ad0:·6d6c·3a6c·616e·673d·2265·6e2d·5553·223e··ml:lang="en-US"> | ||
| 00000ae0:· | 00000ae0:·0a20·2020·2020·2020·2041·7420·6120·6d69··.········At·a·mi | ||
| 00000af0:·6 | 00000af0:·6e69·6d75·6d20·7468·6520·6175·6469·7420··nimum·the·audit· | ||
| 00000b00:· | 00000b00:·7379·7374·656d·2073·686f·756c·6420·636f··system·should·co | ||
| 00000b10:·6 | 00000b10:·6c6c·6563·7420·756e·6175·7468·6f72·697a··llect·unauthoriz | ||
| 00000b20:· | 00000b20:·6564·2066·696c·650a·6163·6365·7373·6573··ed·file.accesses | ||
| 00000b30:· | 00000b30:·2066·6f72·2061·6c6c·2075·7365·7273·2061···for·all·users·a | ||
| 00000b40:· | 00000b40:·6e64·2072·6f6f·742e·2049·6620·7468·6520··nd·root.·If·the· | ||
| 00000b50:· | 00000b50:·3c74·743e·6175·6469·7464·3c2f·7474·3e20··<tt>auditd</tt>· | ||
| 00000b60:· | 00000b60:·6461·656d·6f6e·2069·7320·636f·6e66·6967··daemon·is·config | ||
| 00000b70:·7 | 00000b70:·7572·6564·0a74·6f20·7573·6520·7468·6520··ured.to·use·the· | ||
| 00000b80:· | 00000b80:·3c74·743e·6175·6765·6e72·756c·6573·3c2f··<tt>augenrules</ | ||
| 00000b90:· | 00000b90:·7474·3e20·7072·6f67·7261·6d20·746f·2072··tt>·program·to·r | ||
| 00000ba0:· | 00000ba0:·6561·6420·6175·6469·7420·7275·6c65·7320··ead·audit·rules· | ||
| 00000bb0:·6 | 00000bb0:·6475·7269·6e67·2064·6165·6d6f·6e0a·7374··during·daemon.st | ||
| 00000bc0:·6 | 00000bc0:·6172·7475·7020·2874·6865·2064·6566·6175··artup·(the·defau | ||
| 00000bd0:· | 00000bd0:·6c74·292c·2061·6464·2074·6865·2066·6f6c··lt),·add·the·fol | ||
| 00000be0:·6 | 00000be0:·6c6f·7769·6e67·206c·696e·6573·2074·6f20··lowing·lines·to· | ||
| 00000bf0:· | 00000bf0:·6120·6669·6c65·2077·6974·6820·7375·6666··a·file·with·suff | ||
| 00000c00:· | 00000c00:·6978·0a3c·7474·3e2e·7275·6c65·733c·2f74··ix.<tt>.rules</t | ||
| 00000c10:· | 00000c10:·743e·2069·6e20·7468·6520·6469·7265·6374··t>·in·the·direct | ||
| 00000c20:·6 | 00000c20:·6f72·7920·3c74·743e·2f65·7463·2f61·7564··ory·<tt>/etc/aud | ||
| Max diff block lines reached; 5095761/5530347 bytes (92.14%) of diff not shown. | |||
| Offset 9, 216 lines modified | Offset 9, 112 lines modified | ||
| 9 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules | 9 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules |
| 10 | ·······························program·to·read·audit·rules·during·daemon·startup·(the | 10 | ·······························program·to·read·audit·rules·during·daemon·startup·(the |
| 11 | ·······························default),·add·the·following·lines·to·a·file·with | 11 | ·······························default),·add·the·following·lines·to·a·file·with |
| 12 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d.·If | 12 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d.·If |
| 13 | ·······························the·auditd·daemon·is·configured·to·use·the·auditctl | 13 | ·······························the·auditd·daemon·is·configured·to·use·the·auditctl |
| 14 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 14 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 15 | ·······························the·following·lines·to·/etc/audit/audit.rules·file. | 15 | ·······························the·following·lines·to·/etc/audit/audit.rules·file. |
| 16 | AU-2(d)························-a·always,exit·-F·arch=b32·-S· | 16 | AU-2(d)························-a·always,exit·-F·arch=b32·-S·setxattr·-F·exit=-EACCES |
| 17 | AU-12···Record·Unsuccessful···· | 17 | AU-12···Record·Unsuccessful····-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm-··Unsuccessful·attempts·to·change·permissions·of·files·could·be·an·indicator |
| 18 | (c)·····Permission·Changes·to·· | 18 | (c)·····Permission·Changes·to··change·················································of·malicious·activity·on·a·system.·Auditing·these·events·could·serve·as |
| 19 | CM-6(a)·Files·-· | 19 | CM-6(a)·Files·-·setxattr·······-a·always,exit·-F·arch=b32·-S·setxattr·-F·exit=-EPERM··evidence·of·potential·system·compromise. |
| 20 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | 20 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- |
| 21 | ·······························change | 21 | ·······························change |
| 22 | ·······························If·the·system·is·64·bit·then·also·add·the·following | 22 | ·······························If·the·system·is·64·bit·then·also·add·the·following |
| 23 | ·······························lines: | 23 | ·······························lines: |
| 24 | ·······························-a·always,exit·-F·arch=b64·-S· | 24 | ·······························-a·always,exit·-F·arch=b64·-S·setxattr·-F·exit=-EACCES |
| 25 | ·······························EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 26 | ·······························F·key=unsuccesful-perm-change | ||
| 27 | ·······························-a·always,exit·-F·arch=b64·-S·fsetxattr·-F·exit=-EPERM | ||
| 28 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | 25 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- |
| 29 | ·······························change | 26 | ·······························change |
| 27 | ·······························-a·always,exit·-F·arch=b64·-S·setxattr·-F·exit=-EPERM | ||
| 28 | ·······························-F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 29 | ·······························change | ||
| 30 | ······························· | 30 | ·······························At·a·minimum·the·audit·system·should·collect |
| 31 | ······························· | 31 | ·······························unauthorized·file·accesses·for·all·users·and·root.·If |
| 32 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules | 32 | ·······························the·auditd·daemon·is·configured·to·use·the·augenrules |
| 33 | ·······························program·to·read·audit·rules·during·daemon·startup·(the | 33 | ·······························program·to·read·audit·rules·during·daemon·startup·(the |
| 34 | ·······························default),·add·the·following·lines·to·a·file·with | 34 | ·······························default),·add·the·following·lines·to·a·file·with |
| 35 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d | 35 | ·······························suffix·.rules·in·the·directory·/etc/audit/rules.d: |
| 36 | ·······························-a·always,exit·-F·arch=b32·- | ||
| 36 | ·······························the·auditd·daemon·is·configured·to·use·the·auditctl | ||
| 37 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | ||
| 38 | ·······························the·following·lines·to·/etc/audit/audit.rules·file. | ||
| 39 | AU-2(d)························-a·always,exit·-F·arch=b32·-S·fchmod·-F·exit=-EACCES·- | ||
| 40 | AU-12···Record·Unsuccessful····F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm-···Unsuccessful·attempts·to·change·permissions·of·files·could·be·an·indicator | ||
| 41 | (c)·····Permission·Changes·to··change·················································of·malicious·activity·on·a·system.·Auditing·these·events·could·serve·as | ||
| 42 | CM-6(a)·Files·-·fchmod·········-a·always,exit·-F·arch=b32·-S·fchmod·-F·exit=-EPERM·-··evidence·of·potential·system·compromise. | ||
| 43 | ·······························F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 44 | ······························· | 37 | ·······························S |
| 38 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 39 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 40 | ·······························F·key=access | ||
| 41 | ·······························-a·always,exit·-F·arch=b32·- | ||
| 42 | ·······························S | ||
| 43 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 44 | ·······························-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·- | ||
| 45 | ·······························F·key=access | ||
| 45 | ·······························If·the·system·is·64·bit·then·also·add·the·following | 46 | ·······························If·the·system·is·64·bit·then·also·add·the·following |
| 46 | ·······························lines: | 47 | ·······························lines: |
| 47 | ·······························-a·always,exit·-F·arch=b64·- | 48 | ·······························-a·always,exit·-F·arch=b64·- |
| 48 | ·······························F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 49 | ······························· | 49 | ·······························S |
| 50 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 51 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 52 | ·······························F·key=access | ||
| 50 | ·······························-a·always,exit·-F·arch=b64·- | 53 | ·······························-a·always,exit·-F·arch=b64·- |
| 54 | AU-2(d)·Ensure·auditd·Collects·S | ||
| 55 | AU-12···Unauthorized·Access····creat,open,openat,open_by_handle_at,truncate,ftruncate·Unsuccessful·attempts·to·access·files·could·be·an·indicator·of·malicious | ||
| 56 | (c)·····Attempts·to·Files······-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·-··········activity·on·a·system.·Auditing·these·events·could·serve·as·evidence·of | ||
| 57 | CM-6(a)·(unsuccessful)·········F·key=access···········································potential·system·compromise. | ||
| 51 | ·······························F·auid>=1000·-F·auid!=unset·-F·key=unsuccesful-perm- | ||
| 52 | ·······························change | ||
| 53 | ·······························At·a·minimum,·the·audit·system·should·collect·file | ||
| 54 | ·······························permission·changes·for·all·users·and·root.·If·the | ||
| 55 | ·······························auditd·daemon·is·configured·to·use·the·augenrules | ||
| 56 | ·······························program·to·read·audit·rules·during·daemon·startup·(the | ||
| 57 | ·······························default),·add·the·following·line·to·a·file·with·suffix | ||
| 58 | ·······························.rules·in·the·directory·/etc/audit/rules.d: | ||
| 59 | ·······························-a·always,exit·-F·arch=b32·-S·fchmod·-F·auid>=1000·- | ||
| 60 | ·······························F·auid!=unset·-F·key=perm_mod | ||
| 61 | AU-2(d)·Record·Events·that·····If·the·system·is·64·bit·then·also·add·the·following····The·changing·of·file·permissions·could·indicate·that·a·user·is·attempting·to | ||
| 62 | AU-12···Modify·the·System's····line:··················································gain·access·to·information·that·would·otherwise·be·disallowed.·Auditing·DAC | ||
| 63 | (c)·····Discretionary·Access···-a·always,exit·-F·arch=b64·-S·fchmod·-F·auid>=1000·-···modifications·can·facilitate·the·identification·of·patterns·of·abuse·among | ||
| 64 | CM-6(a)·Controls·-·fchmod······F·auid!=unset·-F·key=perm_mod··························both·authorized·and·unauthorized·users. | ||
| 65 | ·······························If·the·auditd·daemon·is·configured·to·use·the·auditctl | 58 | ·······························If·the·auditd·daemon·is·configured·to·use·the·auditctl |
| 66 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 59 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 67 | ·······························the·following·line·to·/etc/audit/audit.rules·file: | 60 | ·······························the·following·lines·to·/etc/audit/audit.rules·file: |
| 68 | ·······························-a·always,exit·-F·arch=b32·- | 61 | ·······························-a·always,exit·-F·arch=b32·- |
| 69 | ······························· | 62 | ·······························S |
| 63 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 64 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 65 | ·······························F·key=access | ||
| 66 | ·······························-a·always,exit·-F·arch=b32·- | ||
| 67 | ·······························S | ||
| 68 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 69 | ·······························-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·- | ||
| 70 | ·······························F·key=access | ||
| 70 | ·······························If·the·system·is·64·bit·then·also·add·the·following | 71 | ·······························If·the·system·is·64·bit·then·also·add·the·following |
| 71 | ·······························line: | 72 | ·······························lines: |
| 72 | ·······························-a·always,exit·-F·arch=b64·- | 73 | ·······························-a·always,exit·-F·arch=b64·- |
| 73 | ······························· | 74 | ·······························S |
| 75 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 76 | ·······························-F·exit=-EACCES·-F·auid>=1000·-F·auid!=unset·- | ||
| 77 | ·······························F·key=access | ||
| 78 | ·······························-a·always,exit·-F·arch=b64·- | ||
| 79 | ·······························S | ||
| 80 | ·······························creat,open,openat,open_by_handle_at,truncate,ftruncate | ||
| 81 | ·······························-F·exit=-EPERM·-F·auid>=1000·-F·auid!=unset·- | ||
| 82 | ·······························F·key=access | ||
| 74 | ·······························The·audit·system·already·collects·login·information | 83 | ·······························The·audit·system·already·collects·login·information |
| 75 | ·······························for·all·users·and·root.·If·the·auditd·daemon·is | 84 | ·······························for·all·users·and·root.·If·the·auditd·daemon·is |
| 76 | ·······························configured·to·use·the·augenrules·program·to·read·audit | 85 | ·······························configured·to·use·the·augenrules·program·to·read·audit |
| 77 | ·······························rules·during·daemon·startup·(the·default),·add·the | 86 | ·······························rules·during·daemon·startup·(the·default),·add·the |
| 78 | ·······························following·lines·to·a·file·with·suffix·.rules·in·the | 87 | ·······························following·lines·to·a·file·with·suffix·.rules·in·the |
| 79 | AU-2(d)························directory·/etc/audit/rules.d·in·order·to·watch·for | 88 | AU-2(d)························directory·/etc/audit/rules.d·in·order·to·watch·for |
| 80 | AU-12···Record·Attempts·to·····attempted·manual·edits·of·files·involved·in·storing····Manual·editing·of·these·files·may·indicate·nefarious·activity,·such·as·an | 89 | AU-12···Record·Attempts·to·····attempted·manual·edits·of·files·involved·in·storing····Manual·editing·of·these·files·may·indicate·nefarious·activity,·such·as·an |
| 81 | (c)·····Alter·Logon·and·Logout·logon·events:··········································attacker·attempting·to·remove·evidence·of·an·intrusion. | 90 | (c)·····Alter·Logon·and·Logout·logon·events:··········································attacker·attempting·to·remove·evidence·of·an·intrusion. |
| 82 | AC-6(9)·Events·-· | 91 | AC-6(9)·Events·-·lastlog·······-w·/var/log/lastlog·-p·wa·-k·logins |
| 83 | CM-6(a)························If·the·auditd·daemon·is·configured·to·use·the·auditctl | 92 | CM-6(a)························If·the·auditd·daemon·is·configured·to·use·the·auditctl |
| 84 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 93 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 85 | ·······························the·following·lines·to·/etc/audit/audit.rules·file·in | 94 | ·······························the·following·lines·to·/etc/audit/audit.rules·file·in |
| 86 | ·······························order·to·watch·for·unattempted·manual·edits·of·files | 95 | ·······························order·to·watch·for·unattempted·manual·edits·of·files |
| 87 | ·······························involved·in·storing·logon·events: | 96 | ·······························involved·in·storing·logon·events: |
| 88 | ·······························-w·/var/log/ | 97 | ·······························-w·/var/log/lastlog·-p·wa·-k·logins |
| 89 | ······························· | 98 | ·······························At·a·minimum,·the·audit·system·should·collect·file |
| 90 | ······························· | 99 | ·······························deletion·events·for·all·users·and·root.·If·the·auditd |
| 91 | ······························· | 100 | ·······························daemon·is·configured·to·use·the·augenrules·program·to |
| 92 | ······························· | 101 | ·······························read·audit·rules·during·daemon·startup·(the·default), |
| 93 | ······························· | 102 | ·······························add·the·following·line·to·a·file·with·suffix·.rules·in |
| 94 | ······························· | 103 | ·······························the·directory·/etc/audit/rules.d,·setting·ARCH·to |
| 95 | ··········· | 104 | AU-2(d)·Ensure·auditd·Collects·either·b32·or·b64·as·appropriate·for·your·system:······Auditing·file·deletions·will·create·an·audit·trail·for·files·that·are |
| 105 | AU-12···File·Deletion·Events···-a·always,exit·-F·arch=ARCH·-S·renameat·-F·auid>=1000··removed·from·the·system.·The·audit·trail·could·aid·in·system | ||
| 106 | (c)·····by·User·-·renameat·····-F·auid!=unset·-F·key=delete···························troubleshooting,·as·well·as,·detecting·malicious·processes·that·attempt·to | ||
| 107 | CM-6(a)························If·the·auditd·daemon·is·configured·to·use·the·auditctl·delete·log·files·to·conceal·their·presence. | ||
| 96 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add | 108 | ·······························utility·to·read·audit·rules·during·daemon·startup,·add |
| 97 | ·······························the·following·line | 109 | ·······························the·following·line·to·/etc/audit/audit.rules·file, |
| Max diff block lines reached; 1186442/1212756 bytes (97.83%) of diff not shown. | |||
| Offset 75, 33 lines modified | Offset 75, 31 lines modified | ||
| 75 | ········<tt>openscap-scanner</tt>·contains·the·<tt>oscap</tt>·command·line·tool.·This·tool·is·a | 75 | ········<tt>openscap-scanner</tt>·contains·the·<tt>oscap</tt>·command·line·tool.·This·tool·is·a |
| 76 | configuration·and·vulnerability·scanner,·capable·of·performing·compliance·checking·using | 76 | configuration·and·vulnerability·scanner,·capable·of·performing·compliance·checking·using |
| 77 | SCAP·content. | 77 | SCAP·content. |
| 78 | ······</td> | 78 | ······</td> |
| 79 | ····</tr> | 79 | ····</tr> |
| 80 | ····<tr> | 80 | ····<tr> |
| 81 | ······<td>FAU_GEN.1</td> | 81 | ······<td>FAU_GEN.1</td> |
| 82 | ······<td>Disable·SSH·Root·Login</td> | ||
| 82 | ······<td>Include·Local·Events·in·Audit·Logs</td> | ||
| 83 | ······<td·xml:lang="en-US"> | ||
| 84 | ········To·configure·Audit·daemon·to·include·local·events·in·Audit·logs,·set | ||
| 85 | <tt>local_events</tt>·to·<tt>yes</tt>·in·<tt>/etc/audit/auditd.conf</tt>. | ||
| 86 | This·is·the·default·setting. | ||
| 87 | ······</td> | ||
| 88 | ······<td·xml:lang="en-US"> | ||
| 89 | ········If·option·<tt>local_events</tt>·isn't·set·to·<tt>yes</tt>·only·events·from | ||
| 90 | network·will·be·aggregated. | ||
| 91 | ······</td> | ||
| 92 | ····</tr> | ||
| 93 | ····<tr> | ||
| 94 | ······<td>FAU_GEN.1</td> | ||
| 95 | ······<td>Ensure·the·audit·Subsystem·is·Installed</td> | ||
| 96 | ······<td·xml:lang="en-US"> | 83 | ······<td·xml:lang="en-US"> |
| 97 | ········The· | 84 | ········The·root·user·should·never·be·allowed·to·login·to·a |
| 85 | system·directly·over·a·network. | ||
| 86 | To·disable·root·login·via·SSH,·add·or·correct·the·following·line·in | ||
| 87 | <tt>/etc/ssh/sshd_config</tt>: | ||
| 88 | <pre>PermitRootLogin·no</pre> | ||
| 98 | ······</td> | 89 | ······</td> |
| 99 | ······<td·xml:lang="en-US"> | 90 | ······<td·xml:lang="en-US"> |
| 100 | ········ | 91 | ········Even·though·the·communications·channel·may·be·encrypted,·an·additional·layer·of |
| 92 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | ||
| 93 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | ||
| 94 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | ||
| 95 | direct·attack·attempts·on·root's·password. | ||
| 101 | ······</td> | 96 | ······</td> |
| 102 | ····</tr> | 97 | ····</tr> |
| 103 | ····<tr> | 98 | ····<tr> |
| 104 | ······<td>FAU_GEN.1</td> | 99 | ······<td>FAU_GEN.1</td> |
| 105 | ······<td>Enable·Auditing·for·Processes·Which·Start·Prior·to·the·Audit·Daemon</td> | 100 | ······<td>Enable·Auditing·for·Processes·Which·Start·Prior·to·the·Audit·Daemon</td> |
| 106 | ······<td·xml:lang="en-US"> | 101 | ······<td·xml:lang="en-US"> |
| 107 | ········To·ensure·all·processes·can·be·audited,·even·those·which·start | 102 | ········To·ensure·all·processes·can·be·audited,·even·those·which·start |
| Offset 119, 45 lines modified | Offset 117, 33 lines modified | ||
| 119 | its·activities·can·be·audited.·Although·<tt>auditd</tt>·takes·care·of·enabling | 117 | its·activities·can·be·audited.·Although·<tt>auditd</tt>·takes·care·of·enabling |
| 120 | this·for·all·processes·which·launch·after·it·does,·adding·the·kernel·argument | 118 | this·for·all·processes·which·launch·after·it·does,·adding·the·kernel·argument |
| 121 | ensures·it·is·set·for·every·process·during·boot. | 119 | ensures·it·is·set·for·every·process·during·boot. |
| 122 | ······</td> | 120 | ······</td> |
| 123 | ····</tr> | 121 | ····</tr> |
| 124 | ····<tr> | 122 | ····<tr> |
| 125 | ······<td>FAU_GEN.1</td> | 123 | ······<td>FAU_GEN.1</td> |
| 126 | ······<td> | 124 | ······<td>Ensure·the·audit·Subsystem·is·Installed</td> |
| 127 | ······<td·xml:lang="en-US"> | 125 | ······<td·xml:lang="en-US"> |
| 126 | ········The·audit·package·should·be·installed. | ||
| 128 | ········To·configure·Audit·daemon·to·issue·an·explicit·flush·to·disk·command | ||
| 129 | after·writing·<abbr·title="$var_auditd_freq"><tt>50</tt></abbr>·records,·set·<tt>freq</tt>·to·<tt><abbr·title="$var_auditd_freq"><tt>50</tt></abbr></tt> | ||
| 130 | in·<tt>/etc/audit/auditd.conf</tt>. | ||
| 131 | ······</td> | 127 | ······</td> |
| 132 | ······<td·xml:lang="en-US"> | 128 | ······<td·xml:lang="en-US"> |
| 129 | ········The·auditd·service·is·an·access·monitoring·and·accounting·daemon,·watching·system·calls·to·audit·any·access,·in·comparison·with·potential·local·access·control·policy·such·as·SELinux·policy. | ||
| 133 | ········If·option·<tt>freq</tt>·isn't·set·to·<tt><sub·idref="var_auditd_freq"·/></tt>,·the·flush·to·disk | ||
| 134 | may·happen·after·higher·number·of·records,·increasing·the·danger | ||
| 135 | of·audit·loss. | ||
| 136 | ······</td> | 130 | ······</td> |
| 137 | ····</tr> | 131 | ····</tr> |
| 138 | ····<tr> | 132 | ····<tr> |
| 139 | ······<td>FAU_GEN.1</td> | 133 | ······<td>FAU_GEN.1</td> |
| 140 | ······<td> | 134 | ······<td>Include·Local·Events·in·Audit·Logs</td> |
| 141 | ······<td·xml:lang="en-US"> | 135 | ······<td·xml:lang="en-US"> |
| 136 | ········To·configure·Audit·daemon·to·include·local·events·in·Audit·logs,·set | ||
| 137 | <tt>local_events</tt>·to·<tt>yes</tt>·in·<tt>/etc/audit/auditd.conf</tt>. | ||
| 138 | This·is·the·default·setting. | ||
| 142 | ········The·root·user·should·never·be·allowed·to·login·to·a | ||
| 143 | system·directly·over·a·network. | ||
| 144 | To·disable·root·login·via·SSH,·add·or·correct·the·following·line·in | ||
| 145 | <tt>/etc/ssh/sshd_config</tt>: | ||
| 146 | <pre>PermitRootLogin·no</pre> | ||
| 147 | ······</td> | 139 | ······</td> |
| 148 | ······<td·xml:lang="en-US"> | 140 | ······<td·xml:lang="en-US"> |
| 141 | ········If·option·<tt>local_events</tt>·isn't·set·to·<tt>yes</tt>·only·events·from | ||
| 142 | network·will·be·aggregated. | ||
| 149 | ········Even·though·the·communications·channel·may·be·encrypted,·an·additional·layer·of | ||
| 150 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | ||
| 151 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | ||
| 152 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | ||
| 153 | direct·attack·attempts·on·root's·password. | ||
| 154 | ······</td> | 143 | ······</td> |
| 155 | ····</tr> | 144 | ····</tr> |
| 156 | ····<tr> | 145 | ····<tr> |
| 157 | ······<td>FAU_GEN.1</td> | 146 | ······<td>FAU_GEN.1</td> |
| 158 | ······<td>Enable·auditd·Service</td> | 147 | ······<td>Enable·auditd·Service</td> |
| 159 | ······<td·xml:lang="en-US"> | 148 | ······<td·xml:lang="en-US"> |
| 160 | ········The·<tt>auditd</tt>·service·is·an·essential·userspace·component·of | 149 | ········The·<tt>auditd</tt>·service·is·an·essential·userspace·component·of |
| Offset 175, 236 lines modified | Offset 161, 85 lines modified | ||
| 175 | <br·/><br·/> | 161 | <br·/><br·/> |
| 176 | Additionally,·a·properly·configured·audit·subsystem·ensures·that·actions·of | 162 | Additionally,·a·properly·configured·audit·subsystem·ensures·that·actions·of |
| 177 | individual·system·users·can·be·uniquely·traced·to·those·users·so·they | 163 | individual·system·users·can·be·uniquely·traced·to·those·users·so·they |
| 178 | can·be·held·accountable·for·their·actions. | 164 | can·be·held·accountable·for·their·actions. |
| 179 | ······</td> | 165 | ······</td> |
| 180 | ····</tr> | 166 | ····</tr> |
| 181 | ····<tr> | 167 | ····<tr> |
| 182 | ······<td>FAU_GEN.1 | 168 | ······<td>FAU_GEN.1</td> |
| 169 | ······<td>Set·number·of·records·to·cause·an·explicit·flush·to·audit·logs</td> | ||
| 183 | ······<td>Ensure·auditd·Collects·Information·on·the·Use·of·Privileged·Commands·-·newgidmap</td> | ||
| 184 | ······<td·xml:lang="en-US"> | ||
| 185 | ········At·a·minimum,·the·audit·system·should·collect·the·execution·of | ||
| 186 | privileged·commands·for·all·users·and·root.·If·the·<tt>auditd</tt>·daemon·is | ||
| 187 | configured·to·use·the·<tt>augenrules</tt>·program·to·read·audit·rules·during | ||
| 188 | daemon·startup·(the·default),·add·a·line·of·the·following·form·to·a·file·with | ||
| 189 | suffix·<tt>.rules</tt>·in·the·directory·<tt>/etc/audit/rules.d</tt>: | ||
| 190 | <pre>-a·always,exit·-F·path=/usr/bin/newgidmap·-F·auid>=1000·-F·auid!=unset·-F·key=privileged</pre> | ||
| 191 | If·the·<tt>auditd</tt>·daemon·is·configured·to·use·the·<tt>auditctl</tt> | ||
| 192 | utility·to·read·audit·rules·during·daemon·startup,·add·a·line·of·the·following | ||
| 193 | form·to·<tt>/etc/audit/audit.rules</tt>: | ||
| 194 | <pre>-a·always,exit·-F·path=/usr/bin/newgidmap·-F·auid>=1000·-F·auid!=unset·-F·key=privileged</pre> | ||
| 195 | ······</td> | ||
| 196 | ······<td·xml:lang="en-US"> | ||
| 197 | ········Misuse·of·privileged·functions,·either·intentionally·or·unintentionally·by | ||
| 198 | authorized·users,·or·by·unauthorized·external·entities·that·have·compromised·system·accounts, | ||
| 199 | is·a·serious·and·ongoing·concern·and·can·have·significant·adverse·impacts·on·organizations. | ||
| 200 | Auditing·the·use·of·privileged·functions·is·one·way·to·detect·such·misuse·and·identify | ||
| 201 | the·risk·from·insider·and·advanced·persistent·threats. | ||
| Max diff block lines reached; 315235/323534 bytes (97.43%) of diff not shown. | |||
| Offset 22, 23 lines modified | Offset 22, 22 lines modified | ||
| 22 | ···············································································provided·guidelines.·Refer·to·the·scap- | 22 | ···············································································provided·guidelines.·Refer·to·the·scap- |
| 23 | ···············································································security-guide(8)·manual·page·for·futher | 23 | ···············································································security-guide(8)·manual·page·for·futher |
| 24 | ···············································································information. | 24 | ···············································································information. |
| 25 | ···································The·openscap-scanner·package·can·be·········openscap-scanner·contains·the·oscap·command | 25 | ···································The·openscap-scanner·package·can·be·········openscap-scanner·contains·the·oscap·command |
| 26 | AGD_PRE.1········Install·openscap-·installed·with·the·following·command:·······line·tool.·This·tool·is·a·configuration·and | 26 | AGD_PRE.1········Install·openscap-·installed·with·the·following·command:·······line·tool.·This·tool·is·a·configuration·and |
| 27 | AGD_OPE.1········scanner·Package···$·sudo·yum·install·openscap-scanner·········vulnerability·scanner,·capable·of·performing | 27 | AGD_OPE.1········scanner·Package···$·sudo·yum·install·openscap-scanner·········vulnerability·scanner,·capable·of·performing |
| 28 | ···············································································compliance·checking·using·SCAP·content. | 28 | ···············································································compliance·checking·using·SCAP·content. |
| 29 | ·················Include·Local·····To·configure·Audit·daemon·to·include·local | ||
| 30 | FAU_GEN.1········Events·in·Audit···events·in·Audit·logs,·set·local_events·to···If·option·local_events·isn't·set·to·yes·only | ||
| 31 | ·················Logs··············yes·in·/etc/audit/auditd.conf.·This·is·the··events·from·network·will·be·aggregated. | ||
| 32 | ···································default·setting. | ||
| 33 | ··············································································· | 29 | ···············································································Even·though·the·communications·channel·may·be |
| 34 | ·················Ensure·the·audit··············································accounting·daemon,·watching·system·calls·to | ||
| 35 | FAU_GEN.1········Subsystem·is······The·audit·package·should·be·installed.······audit·any·access,·in·comparison·with·potential | ||
| 36 | ················· | 30 | ···································The·root·user·should·never·be·allowed·to····encrypted,·an·additional·layer·of·security·is |
| 31 | ···································login·to·a·system·directly·over·a·network.··gained·by·extending·the·policy·of·not·logging | ||
| 32 | FAU_GEN.1········Disable·SSH·Root··To·disable·root·login·via·SSH,·add·or·······directly·on·as·root.·In·addition,·logging·in | ||
| 33 | ·················Login·············correct·the·following·line·in·/etc/ssh/·····with·a·user-specific·account·provides | ||
| 34 | ···································sshd_config:································individual·accountability·of·actions·performed | ||
| 35 | ···································PermitRootLogin·no··························on·the·system·and·also·helps·to·minimize | ||
| 37 | ···············································································po | 36 | ···············································································direct·attack·attempts·on·root's·password. |
| 38 | ···································To·ensure·all·processes·can·be·audited, | 37 | ···································To·ensure·all·processes·can·be·audited, |
| 39 | ···································even·those·which·start·prior·to·the·audit | 38 | ···································even·those·which·start·prior·to·the·audit |
| 40 | ···································daemon,·add·the·argument·audit=1·to·the | 39 | ···································daemon,·add·the·argument·audit=1·to·the |
| 41 | ···································default·GRUB·2·command·line·for·the·Linux | 40 | ···································default·GRUB·2·command·line·for·the·Linux |
| 42 | ···································operating·system.·To·ensure·that·audit=1·is·Each·process·on·the·system·carries·an | 41 | ···································operating·system.·To·ensure·that·audit=1·is·Each·process·on·the·system·carries·an |
| 43 | ·················Enable·Auditing···added·as·a·kernel·command·line·argument·to··"auditable"·flag·which·indicates·whether·its | 42 | ·················Enable·Auditing···added·as·a·kernel·command·line·argument·to··"auditable"·flag·which·indicates·whether·its |
| 44 | ·················for·Processes·····newly·installed·kernels,·add·audit=1·to·the·activities·can·be·audited.·Although·auditd | 43 | ·················for·Processes·····newly·installed·kernels,·add·audit=1·to·the·activities·can·be·audited.·Although·auditd |
| Offset 46, 304 lines modified | Offset 45, 161 lines modified | ||
| 46 | ·················to·the·Audit······operating·systems.·Modify·the·line·within·/·which·launch·after·it·does,·adding·the·kernel | 45 | ·················to·the·Audit······operating·systems.·Modify·the·line·within·/·which·launch·after·it·does,·adding·the·kernel |
| 47 | ·················Daemon············etc/default/grub·as·shown·below:············argument·ensures·it·is·set·for·every·process | 46 | ·················Daemon············etc/default/grub·as·shown·below:············argument·ensures·it·is·set·for·every·process |
| 48 | ···································GRUB_CMDLINE_LINUX="...·audit=1·..."········during·boot. | 47 | ···································GRUB_CMDLINE_LINUX="...·audit=1·..."········during·boot. |
| 49 | ···································Run·the·following·command·to·update·command | 48 | ···································Run·the·following·command·to·update·command |
| 50 | ···································line·for·already·installed·kernels: | 49 | ···································line·for·already·installed·kernels: |
| 51 | ···································#·grubby·--update-kernel=ALL·-- | 50 | ···································#·grubby·--update-kernel=ALL·-- |
| 52 | ···································args="audit=1" | 51 | ···································args="audit=1" |
| 52 | ···············································································The·auditd·service·is·an·access·monitoring·and | ||
| 53 | ·················Ensure·the·audit··············································accounting·daemon,·watching·system·calls·to | ||
| 54 | FAU_GEN.1········Subsystem·is······The·audit·package·should·be·installed.······audit·any·access,·in·comparison·with·potential | ||
| 55 | ·················Installed·····················································local·access·control·policy·such·as·SELinux | ||
| 53 | ·················Set·number·of·····To·configure·Audit·daemon·to·issue·an·······If·option·freq·isn't·set·to·,·the·flush·to | ||
| 54 | FAU_GEN.1········records·to·cause··explicit·flush·to·disk·command·after········disk·may·happen·after·higher·number·of | ||
| 55 | ·················an·explicit·flush·writing·50·records,·set·freq·to·50·in·/etc/·records,·increasing·the·danger·of·audit·loss. | ||
| 56 | ·················to·audit·logs·····audit/auditd.conf. | ||
| 57 | ···············································································Even·though·the·communications·channel·may·be | ||
| 58 | ···································The·root·user·should·never·be·allowed·to····encrypted,·an·additional·layer·of·security·is | ||
| 59 | ···································login·to·a·system·directly·over·a·network.··gained·by·extending·the·policy·of·not·logging | ||
| 60 | FAU_GEN.1········Disable·SSH·Root··To·disable·root·login·via·SSH,·add·or·······directly·on·as·root.·In·addition,·logging·in | ||
| 61 | ·················Login·············correct·the·following·line·in·/etc/ssh/·····with·a·user-specific·account·provides | ||
| 62 | ···································sshd_config:································individual·accountability·of·actions·performed | ||
| 63 | ···································PermitRootLogin·no··························on·the·system·and·also·helps·to·minimize | ||
| 64 | ··············································································· | 56 | ···············································································policy. |
| 57 | ·················Include·Local·····To·configure·Audit·daemon·to·include·local | ||
| 58 | FAU_GEN.1········Events·in·Audit···events·in·Audit·logs,·set·local_events·to···If·option·local_events·isn't·set·to·yes·only | ||
| 59 | ·················Logs··············yes·in·/etc/audit/auditd.conf.·This·is·the··events·from·network·will·be·aggregated. | ||
| 60 | ···································default·setting. | ||
| 65 | ···············································································Without·establishing·what·type·of·events | 61 | ···············································································Without·establishing·what·type·of·events |
| 66 | ···············································································occurred,·it·would·be·difficult·to·establish, | 62 | ···············································································occurred,·it·would·be·difficult·to·establish, |
| 67 | ···············································································correlate,·and·investigate·the·events·leading | 63 | ···············································································correlate,·and·investigate·the·events·leading |
| 68 | ···································The·auditd·service·is·an·essential··········up·to·an·outage·or·attack.·Ensuring·the·auditd | 64 | ···································The·auditd·service·is·an·essential··········up·to·an·outage·or·attack.·Ensuring·the·auditd |
| 69 | ···································userspace·component·of·the·Linux·Auditing···service·is·active·ensures·audit·records | 65 | ···································userspace·component·of·the·Linux·Auditing···service·is·active·ensures·audit·records |
| 70 | ·················Enable·auditd·····System,·as·it·is·responsible·for·writing····generated·by·the·kernel·are·appropriately | 66 | ·················Enable·auditd·····System,·as·it·is·responsible·for·writing····generated·by·the·kernel·are·appropriately |
| 71 | FAU_GEN.1········Service···········audit·records·to·disk.·The·auditd·service···recorded. | 67 | FAU_GEN.1········Service···········audit·records·to·disk.·The·auditd·service···recorded. |
| 72 | ···································can·be·enabled·with·the·following·command: | 68 | ···································can·be·enabled·with·the·following·command: |
| 73 | ···································$·sudo·systemctl·enable·auditd.service······Additionally,·a·properly·configured·audit | 69 | ···································$·sudo·systemctl·enable·auditd.service······Additionally,·a·properly·configured·audit |
| 74 | ···············································································subsystem·ensures·that·actions·of·individual | 70 | ···············································································subsystem·ensures·that·actions·of·individual |
| 75 | ···············································································system·users·can·be·uniquely·traced·to·those | 71 | ···············································································system·users·can·be·uniquely·traced·to·those |
| 76 | ···············································································users·so·they·can·be·held·accountable·for | 72 | ···············································································users·so·they·can·be·held·accountable·for |
| 77 | ···············································································their·actions. | 73 | ···············································································their·actions. |
| 74 | ·················Set·number·of·····To·configure·Audit·daemon·to·issue·an·······If·option·freq·isn't·set·to·,·the·flush·to | ||
| 75 | FAU_GEN.1········records·to·cause··explicit·flush·to·disk·command·after········disk·may·happen·after·higher·number·of | ||
| 76 | ·················an·explicit·flush·writing·50·records,·set·freq·to·50·in·/etc/·records,·increasing·the·danger·of·audit·loss. | ||
| 77 | ·················to·audit·logs·····audit/auditd.conf. | ||
| 78 | ···································At·a·minimum,·the·audit·system·should | ||
| 79 | ···································collect·the·execution·of·privileged·········Misuse·of·privileged·functions,·either | ||
| 80 | ···································commands·for·all·users·and·root.·If·the·····intentionally·or·unintentionally·by·authorized | ||
| 81 | ···································auditd·daemon·is·configured·to·use·the······users,·or·by·unauthorized·external·entities | ||
| 82 | ···································augenrules·program·to·read·audit·rules······that·have·compromised·system·accounts,·is·a | ||
| 83 | ···································during·daemon·startup·(the·default),·add·a··serious·and·ongoing·concern·and·can·have | ||
| 84 | ·················Ensure·auditd·····line·of·the·following·form·to·a·file·with···significant·adverse·impacts·on·organizations. | ||
| 85 | ·················Collects··········suffix·.rules·in·the·directory·/etc/audit/··Auditing·the·use·of·privileged·functions·is | ||
| 86 | ·················Information·on····rules.d:····································one·way·to·detect·such·misuse·and·identify·the | ||
| 87 | FAU_GEN.1.1.c····the·Use·of········-a·always,exit·-F·path=/usr/bin/newgidmap·-·risk·from·insider·and·advanced·persistent | ||
| 88 | ·················Privileged········F·auid>=1000·-F·auid!=unset·-···············threats. | ||
| 89 | ·················Commands·-········F·key=privileged | ||
| 90 | ·················newgidmap·········If·the·auditd·daemon·is·configured·to·use···Privileged·programs·are·subject·to·escalation- | ||
| 91 | ···································the·auditctl·utility·to·read·audit·rules····of-privilege·attacks,·which·attempt·to·subvert | ||
| 92 | ···································during·daemon·startup,·add·a·line·of·the····their·normal·role·of·providing·some·necessary | ||
| 93 | ···································following·form·to·/etc/audit/audit.rules:···but·limited·capability.·As·such,·motivation | ||
| 94 | ···································-a·always,exit·-F·path=/usr/bin/newgidmap·-·exists·to·monitor·these·programs·for·unusual | ||
| 95 | ···································F·auid>=1000·-F·auid!=unset·-···············activity. | ||
| 96 | ···································F·key=privileged | ||
| 97 | ···································At·a·minimum,·the·audit·system·should | ||
| 98 | ···································collect·file·permission·changes·for·all | ||
| 99 | ···································users·and·root.·If·the·auditd·daemon·is | ||
| 100 | ···································configured·to·use·the·augenrules·program·to | ||
| 101 | ···································read·audit·rules·during·daemon·startup·(the | ||
| 102 | ···································default),·add·the·following·line·to·a·file | ||
| 103 | ···································with·suffix·.rules·in·the·directory·/etc/ | ||
| 104 | ···································audit/rules.d: | ||
| 105 | ···································-a·always,exit·-F·arch=b32·-S·fchmod·-······The·changing·of·file·permissions·could | ||
| 106 | ·················Record·Events·····F·auid>=1000·-F·auid!=unset·-F·key=perm_mod·indicate·that·a·user·is·attempting·to·gain | ||
| 107 | ·················that·Modify·the···If·the·system·is·64·bit·then·also·add·the···access·to·information·that·would·otherwise·be | ||
| 108 | FAU_GEN.1.1.c····System's··········following·line:·····························disallowed.·Auditing·DAC·modifications·can | ||
| 109 | ·················Discretionary·····-a·always,exit·-F·arch=b64·-S·fchmod·-······facilitate·the·identification·of·patterns·of | ||
| 110 | ·················Access·Controls·-·F·auid>=1000·-F·auid!=unset·-F·key=perm_mod·abuse·among·both·authorized·and·unauthorized | ||
| 111 | ·················fchmod············If·the·auditd·daemon·is·configured·to·use···users. | ||
| 112 | ···································the·auditctl·utility·to·read·audit·rules | ||
| 113 | ···································during·daemon·startup,·add·the·following | ||
| 114 | ···································line·to·/etc/audit/audit.rules·file: | ||
| 115 | ···································-a·always,exit·-F·arch=b32·-S·fchmod·- | ||
| 116 | ···································F·auid>=1000·-F·auid!=unset·-F·key=perm_mod | ||
| 117 | ···································If·the·system·is·64·bit·then·also·add·the | ||
| 118 | ···································following·line: | ||
| 119 | ···································-a·always,exit·-F·arch=b64·-S·fchmod·- | ||
| 120 | ···································F·auid>=1000·-F·auid!=unset·-F·key=perm_mod | ||
| 121 | ···································At·a·minimum,·the·audit·system·should | ||
| 122 | ···································collect·the·execution·of·privileged·········Misuse·of·privileged·functions,·either | ||
| 123 | ···································commands·for·all·users·and·root.·If·the·····intentionally·or·unintentionally·by·authorized | ||
| 124 | ···································auditd·daemon·is·configured·to·use·the······users,·or·by·unauthorized·external·entities | ||
| 125 | ···································augenrules·program·to·read·audit·rules······that·have·compromised·system·accounts,·is·a | ||
| 126 | ···································during·daemon·startup·(the·default),·add·a··serious·and·ongoing·concern·and·can·have | ||
| 127 | ·················Ensure·auditd·····line·of·the·following·form·to·a·file·with···significant·adverse·impacts·on·organizations. | ||
| 128 | ·················Collects··········suffix·.rules·in·the·directory·/etc/audit/··Auditing·the·use·of·privileged·functions·is | ||
| 129 | ·················Information·on····rules.d:····································one·way·to·detect·such·misuse·and·identify·the | ||
| 130 | FAU_GEN.1.1.c····the·Use·of········-a·always,exit·-F·path=/usr/bin/newgrp·-····risk·from·insider·and·advanced·persistent | ||
| 131 | ·················Privileged········F·perm=x·-F·auid>=1000·-F·auid!=unset·-·····threats. | ||
| Max diff block lines reached; 432338/447129 bytes (96.69%) of diff not shown. | |||
| Offset 41, 28 lines modified | Offset 41, 14 lines modified | ||
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> |
| 48 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 51 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 52 | ······</td> | ||
| 53 | ······<td·xml:lang="en-US"> | ||
| 54 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 55 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 56 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 57 | the·network. | ||
| 58 | ······</td> | ||
| 59 | ····</tr> | ||
| 60 | ····<tr> | ||
| 61 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 62 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> | 48 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> |
| 63 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 64 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, | 50 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, |
| 65 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default | 51 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default |
| 66 | GRUB2·command·line·for·the·Linux·operating·system. | 52 | GRUB2·command·line·for·the·Linux·operating·system. |
| 67 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line | 53 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line |
| 68 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the | 54 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the |
| Offset 73, 14 lines modified | Offset 59, 28 lines modified | ||
| 73 | ······</td> | 59 | ······</td> |
| 74 | ······<td·xml:lang="en-US"> | 60 | ······<td·xml:lang="en-US"> |
| 75 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce | 61 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce |
| 76 | the·vulnerability·to·exploitation. | 62 | the·vulnerability·to·exploitation. |
| 77 | ······</td> | 63 | ······</td> |
| 78 | ····</tr> | 64 | ····</tr> |
| 79 | ····<tr> | 65 | ····<tr> |
| 66 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 67 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 68 | ······<td·xml:lang="en-US"> | ||
| 69 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 70 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 71 | ······</td> | ||
| 72 | ······<td·xml:lang="en-US"> | ||
| 73 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 74 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 75 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 76 | the·network. | ||
| 77 | ······</td> | ||
| 78 | ····</tr> | ||
| 79 | ····<tr> | ||
| 80 | ······<td>Req-1.3.3</td> | 80 | ······<td>Req-1.3.3</td> |
| 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> | 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> |
| 82 | ······<td·xml:lang="en-US"> | 82 | ······<td·xml:lang="en-US"> |
| 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless | 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless |
| 84 | capability. | 84 | capability. |
| 85 | <br·/><br·/> | 85 | <br·/><br·/> |
| Offset 111, 30 lines modified | Offset 111, 14 lines modified | ||
| 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, | 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, |
| 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an | 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 113 | anti-spoofing·measure. | 113 | anti-spoofing·measure. |
| 114 | ······</td> | 114 | ······</td> |
| 115 | ····</tr> | 115 | ····</tr> |
| 116 | ····<tr> | 116 | ····<tr> |
| 117 | ······<td>Req-1.4.1</td> | 117 | ······<td>Req-1.4.1</td> |
| 118 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 119 | ······<td·xml:lang="en-US"> | ||
| 120 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 121 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 122 | ······</td> | ||
| 123 | ······<td·xml:lang="en-US"> | ||
| 124 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 125 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 126 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 127 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 128 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 129 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 130 | ······</td> | ||
| 131 | ····</tr> | ||
| 132 | ····<tr> | ||
| 133 | ······<td>Req-1.4.1</td> | ||
| 134 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> | 118 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> |
| 135 | ······<td·xml:lang="en-US"> | 119 | ······<td·xml:lang="en-US"> |
| 136 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for | 120 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for |
| 137 | the·built-in·INPUT·chain·which·processes·incoming·packets, | 121 | the·built-in·INPUT·chain·which·processes·incoming·packets, |
| 138 | add·or·correct·the·following·line·in | 122 | add·or·correct·the·following·line·in |
| 139 | <tt>/etc/sysconfig/ip6tables</tt>: | 123 | <tt>/etc/sysconfig/ip6tables</tt>: |
| 140 | <pre>:INPUT·DROP·[0:0]</pre> | 124 | <pre>:INPUT·DROP·[0:0]</pre> |
| Offset 176, 14 lines modified | Offset 160, 30 lines modified | ||
| 176 | typically·critical·to·operation·of·the·system.·The·loopback·interface· | 160 | typically·critical·to·operation·of·the·system.·The·loopback·interface· |
| 177 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· | 161 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· |
| 178 | other·interfaces·should·ignore·traffic·on·this·network·as·an | 162 | other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 179 | anti-spoofing·measure. | 163 | anti-spoofing·measure. |
| 180 | ······</td> | 164 | ······</td> |
| 181 | ····</tr> | 165 | ····</tr> |
| 182 | ····<tr> | 166 | ····<tr> |
| 167 | ······<td>Req-1.4.1</td> | ||
| 168 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 169 | ······<td·xml:lang="en-US"> | ||
| 170 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 171 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 172 | ······</td> | ||
| 173 | ······<td·xml:lang="en-US"> | ||
| 174 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 175 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 176 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 177 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 178 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 179 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 180 | ······</td> | ||
| 181 | ····</tr> | ||
| 182 | ····<tr> | ||
| 183 | ······<td>Req-1.4.2</td> | 183 | ······<td>Req-1.4.2</td> |
| 184 | ······<td>Disable·SCTP·Support</td> | 184 | ······<td>Disable·SCTP·Support</td> |
| 185 | ······<td·xml:lang="en-US"> | 185 | ······<td·xml:lang="en-US"> |
| 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a | 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a |
| 187 | transport·layer·protocol,·designed·to·support·the·idea·of | 187 | transport·layer·protocol,·designed·to·support·the·idea·of |
| 188 | message-oriented·communication,·with·several·streams·of·messages | 188 | message-oriented·communication,·with·several·streams·of·messages |
| 189 | within·one·connection. | 189 | within·one·connection. |
| Offset 248, 14 lines modified | Offset 248, 41 lines modified | ||
| 248 | <br·/> | 248 | <br·/> |
| 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast | 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast |
| 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. | 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. |
| 251 | ······</td> | 251 | ······</td> |
| 252 | ····</tr> | 252 | ····</tr> |
| 253 | ····<tr> | 253 | ····<tr> |
| 254 | ······<td>Req-1.4.3</td> | 254 | ······<td>Req-1.4.3</td> |
| Max diff block lines reached; 247700/255439 bytes (96.97%) of diff not shown. | |||
| Offset 1, 13 lines modified | Offset 1, 25 lines modified | ||
| 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat | 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat |
| 2 | Enterprise·Linux·7 | 2 | Enterprise·Linux·7 |
| 3 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 4 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 5 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 6 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 7 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 8 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 9 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 10 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 11 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 12 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 13 | ·····························already·installed·kernels: | ||
| 14 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 3 | ····················································································Routing·protocol | 15 | ····················································································Routing·protocol |
| 4 | ····················································································daemons·are | 16 | ····················································································daemons·are |
| 5 | ····················································································typically·used·on | 17 | ····················································································typically·used·on |
| 6 | ····················································································routers·to·exchange | 18 | ····················································································routers·to·exchange |
| 7 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology | 19 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology |
| 8 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with | 20 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with |
| 9 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If | 21 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If |
| Offset 15, 26 lines modified | Offset 27, 14 lines modified | ||
| 15 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not | 27 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not |
| 16 | ·····························sysctl.d:··············································required,·system | 28 | ·····························sysctl.d:··············································required,·system |
| 17 | ·····························net.ipv4.ip_forward·=·0································network·information | 29 | ·····························net.ipv4.ip_forward·=·0································network·information |
| 18 | ····················································································may·be | 30 | ····················································································may·be |
| 19 | ····················································································unnecessarily | 31 | ····················································································unnecessarily |
| 20 | ····················································································transmitted·across | 32 | ····················································································transmitted·across |
| 21 | ····················································································the·network. | 33 | ····················································································the·network. |
| 22 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 23 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 24 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 25 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 26 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 27 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 28 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 29 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 30 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 31 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 32 | ·····························already·installed·kernels: | ||
| 33 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 34 | ····················································································The·use·of·wireless | 34 | ····················································································The·use·of·wireless |
| 35 | ····················································································networking·can | 35 | ····················································································networking·can |
| 36 | ····················································································introduce·many | 36 | ····················································································introduce·many |
| 37 | ····················································································different·attack | 37 | ····················································································different·attack |
| 38 | ····················································································vectors·into·the | 38 | ····················································································vectors·into·the |
| 39 | ····················································································organization's | 39 | ····················································································organization's |
| 40 | ····················································································network.·Common | 40 | ····················································································network.·Common |
| Offset 73, 40 lines modified | Offset 73, 14 lines modified | ||
| 73 | ····················································································network·traffic | 73 | ····················································································network·traffic |
| 74 | ····················································································should·be·seen,·all | 74 | ····················································································should·be·seen,·all |
| 75 | ····················································································other·interfaces | 75 | ····················································································other·interfaces |
| 76 | ····················································································should·ignore | 76 | ····················································································should·ignore |
| 77 | ····················································································traffic·on·this | 77 | ····················································································traffic·on·this |
| 78 | ····················································································network·as·an·anti- | 78 | ····················································································network·as·an·anti- |
| 79 | ····················································································spoofing·measure. | 79 | ····················································································spoofing·measure. |
| 80 | ····················································································A·TCP·SYN·flood | ||
| 81 | ····················································································attack·can·cause·a | ||
| 82 | ····················································································denial·of·service | ||
| 83 | ····················································································by·filling·a | ||
| 84 | ····················································································system's·TCP | ||
| 85 | ····················································································connection·table | ||
| 86 | ····················································································with·connections·in | ||
| 87 | ····················································································the·SYN_RCVD·state. | ||
| 88 | ····················································································Syncookies·can·be | ||
| 89 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 90 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 91 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 92 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 93 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 94 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 95 | ·····························sysctl.d:··············································connection·and·is | ||
| 96 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 97 | ····················································································This·feature·is | ||
| 98 | ····················································································activated·when·a | ||
| 99 | ····················································································flood·condition·is | ||
| 100 | ····················································································detected,·and | ||
| 101 | ····················································································enables·the·system | ||
| 102 | ····················································································to·continue | ||
| 103 | ····················································································servicing·valid | ||
| 104 | ····················································································connection | ||
| 105 | ····················································································requests. | ||
| 106 | ····················································································In·ip6tables,·the | 80 | ····················································································In·ip6tables,·the |
| 107 | ····················································································default·policy·is | 81 | ····················································································default·policy·is |
| 108 | ····················································································applied·only·after | 82 | ····················································································applied·only·after |
| 109 | ····················································································all·the·applicable | 83 | ····················································································all·the·applicable |
| 110 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table | 84 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table |
| 111 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a | 85 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a |
| 112 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the | 86 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the |
| Offset 140, 14 lines modified | Offset 114, 40 lines modified | ||
| 140 | ····················································································network·traffic | 114 | ····················································································network·traffic |
| 141 | ····················································································should·be·seen,·all | 115 | ····················································································should·be·seen,·all |
| 142 | ····················································································other·interfaces | 116 | ····················································································other·interfaces |
| 143 | ····················································································should·ignore | 117 | ····················································································should·ignore |
| 144 | ····················································································traffic·on·this | 118 | ····················································································traffic·on·this |
| 145 | ····················································································network·as·an·anti- | 119 | ····················································································network·as·an·anti- |
| 146 | ····················································································spoofing·measure. | 120 | ····················································································spoofing·measure. |
| 121 | ····················································································A·TCP·SYN·flood | ||
| 122 | ····················································································attack·can·cause·a | ||
| 123 | ····················································································denial·of·service | ||
| 124 | ····················································································by·filling·a | ||
| 125 | ····················································································system's·TCP | ||
| 126 | ····················································································connection·table | ||
| 127 | ····················································································with·connections·in | ||
| 128 | ····················································································the·SYN_RCVD·state. | ||
| 129 | ····················································································Syncookies·can·be | ||
| 130 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 131 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 132 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 133 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 134 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 135 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 136 | ·····························sysctl.d:··············································connection·and·is | ||
| 137 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 138 | ····················································································This·feature·is | ||
| 139 | ····················································································activated·when·a | ||
| 140 | ····················································································flood·condition·is | ||
| 141 | ····················································································detected,·and | ||
| 142 | ····················································································enables·the·system | ||
| 143 | ····················································································to·continue | ||
| 144 | ····················································································servicing·valid | ||
| 145 | ····················································································connection | ||
| 146 | ····················································································requests. | ||
| Max diff block lines reached; 402204/414236 bytes (97.10%) of diff not shown. | |||
| Offset 64, 571 lines modified | Offset 64, 571 lines modified | ||
| 000003f0:·3c74·683e·5275·6c65·2054·6974·6c65·3c2f··<th>Rule·Title</ | 000003f0:·3c74·683e·5275·6c65·2054·6974·6c65·3c2f··<th>Rule·Title</ | ||
| 00000400:·7468·3e0a·2020·2020·3c74·683e·4465·7363··th>.····<th>Desc | 00000400:·7468·3e0a·2020·2020·3c74·683e·4465·7363··th>.····<th>Desc | ||
| 00000410:·7269·7074·696f·6e3c·2f74·683e·0a20·2020··ription</th>.··· | 00000410:·7269·7074·696f·6e3c·2f74·683e·0a20·2020··ription</th>.··· | ||
| 00000420:·203c·7468·3e52·6174·696f·6e61·6c65·3c2f···<th>Rationale</ | 00000420:·203c·7468·3e52·6174·696f·6e61·6c65·3c2f···<th>Rationale</ | ||
| 00000430:·7468·3e0a·2020·3c2f·7468·6561·643e·0a20··th>.··</thead>.· | 00000430:·7468·3e0a·2020·3c2f·7468·6561·643e·0a20··th>.··</thead>.· | ||
| 00000440:·203c·7462·6f64·793e·0a20·203c·7472·3e0a···<tbody>.··<tr>. | 00000440:·203c·7462·6f64·793e·0a20·203c·7472·3e0a···<tbody>.··<tr>. | Diff chunk too large, falling back to line-by-line diff (557 lines added, 557 lines removed) | |
| 00000450:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | 00000450:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | ||
| 00000460:·3129·3c | 00000460:·3129·3c62·722f·3e4e·5430·3037·2852·3033··1)<br/>NT007(R03 | ||
| 00000470:· | 00000470:·293c·2f74·643e·0a20·2020·2020·203c·7464··)</td>.······<td | ||
| 00000480:· | 00000480:·3e55·6e69·6e73·7461·6c6c·2074·6865·2074··>Uninstall·the·t | ||
| 00000490:· | 00000490:·656c·6e65·7420·7365·7276·6572·3c2f·7464··elnet·server</td | ||
| 000004a0:· | 000004a0:·3e0a·2020·2020·2020·3c74·6420·786d·6c3a··>.······<td·xml: | ||
| 000004b0:· | 000004b0:·6c61·6e67·3d22·656e·2d55·5322·3e0a·2020··lang="en-US">.·· | ||
| 000004c0:· | 000004c0:·2020·2020·2020·5468·6520·7465·6c6e·6574········The·telnet | ||
| 000004d0:· | 000004d0:·2064·6165·6d6f·6e20·7368·6f75·6c64·2062···daemon·should·b | ||
| 000004e0:·65 | 000004e0:·6520·756e·696e·7374·616c·6c65·642e·0a20··e·uninstalled..· | ||
| 000004f0:· | 000004f0:·2020·2020·203c·2f74·643e·0a20·2020·2020·······</td>.····· | ||
| 00000500:· | 00000500:·203c·7464·2078·6d6c·3a6c·616e·673d·2265···<td·xml:lang="e | ||
| 00000510:·6 | 00000510:·6e2d·5553·223e·0a20·2020·2020·2020·203c··n-US">.········< | ||
| 00000520:· | 00000520:·7474·3e74·656c·6e65·743c·2f74·743e·2061··tt>telnet</tt>·a | ||
| 00000530:· | 00000530:·6c6c·6f77·7320·636c·6561·7220·7465·7874··llows·clear·text | ||
| 00000540:· | 00000540:·2063·6f6d·6d75·6e69·6361·7469·6f6e·732c···communications, | ||
| 00000550:·20 | 00000550:·2061·6e64·2064·6f65·7320·6e6f·7420·7072···and·does·not·pr | ||
| 00000560:·6 | 00000560:·6f74·6563·740a·616e·7920·6461·7461·2074··otect.any·data·t | ||
| 00000570:· | 00000570:·7261·6e73·6d69·7373·696f·6e20·6265·7477··ransmission·betw | ||
| 00000580:·6 | 00000580:·6565·6e20·636c·6965·6e74·2061·6e64·2073··een·client·and·s | ||
| 00000590:·65 | 00000590:·6572·7665·722e·2041·6e79·2063·6f6e·6669··erver.·Any·confi | ||
| 000005a0:· | 000005a0:·6465·6e74·6961·6c20·6461·7461·0a63·616e··dential·data.can | ||
| 000005b0:·206 | 000005b0:·2062·6520·6c69·7374·656e·6564·2061·6e64···be·listened·and | ||
| 000005c0:·206 | 000005c0:·206e·6f20·696e·7465·6772·6974·7920·6368···no·integrity·ch | ||
| 000005d0:·6 | 000005d0:·6563·6b69·6e67·2069·7320·6d61·6465·2e27··ecking·is·made.' | ||
| 000005e0:· | 000005e0:·0a20·2020·2020·203c·2f74·643e·0a20·2020··.······</td>.··· | ||
| 000005f0:· | 000005f0:·203c·2f74·723e·0a20·2020·203c·7472·3e0a···</tr>.····<tr>. | ||
| 00000600:· | 00000600:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | ||
| 00000610:·3c2f·74 | 00000610:·3129·3c2f·7464·3e0a·2020·2020·2020·3c74··1)</td>.······<t | ||
| 00000620:·6 | 00000620:·643e·556e·696e·7374·616c·6c20·5365·6e64··d>Uninstall·Send | ||
| 00000630:· | 00000630:·6d61·696c·2050·6163·6b61·6765·3c2f·7464··mail·Package</td | ||
| 00000640:· | 00000640:·3e0a·2020·2020·2020·3c74·6420·786d·6c3a··>.······<td·xml: | ||
| 00000650:·6 | 00000650:·6c61·6e67·3d22·656e·2d55·5322·3e0a·2020··lang="en-US">.·· | ||
| 00000660:· | 00000660:·2020·2020·2020·5365·6e64·6d61·696c·2069········Sendmail·i | ||
| 00000670:·7 | 00000670:·7320·6e6f·7420·7468·6520·6465·6661·756c··s·not·the·defaul | ||
| 00000680:·74 | 00000680:·7420·6d61·696c·2074·7261·6e73·6665·7220··t·mail·transfer· | ||
| 00000690:· | 00000690:·6167·656e·7420·616e·6420·6973·0a6e·6f74··agent·and·is.not | ||
| 000006a0:· | 000006a0:·2069·6e73·7461·6c6c·6564·2062·7920·6465···installed·by·de | ||
| 000006b0:· | 000006b0:·6661·756c·742e·0a54·6865·203c·636f·6465··fault..The·<code | ||
| 000006c0:· | 000006c0:·3e73·656e·646d·6169·6c3c·2f63·6f64·653e··>sendmail</code> | ||
| 000006d0:· | 000006d0:·2070·6163·6b61·6765·2063·616e·2062·6520···package·can·be· | ||
| 000006e0:· | 000006e0:·7265·6d6f·7665·6420·7769·7468·2074·6865··removed·with·the | ||
| 000006f0:·20 | 000006f0:·2066·6f6c·6c6f·7769·6e67·2063·6f6d·6d61···following·comma | ||
| 00000700:·6 | 00000700:·6e64·3a0a·3c70·7265·3e0a·2420·7375·646f··nd:.<pre>.$·sudo | ||
| 00000710:·207 | 00000710:·2079·756d·2065·7261·7365·2073·656e·646d···yum·erase·sendm | ||
| 00000720:·6 | 00000720:·6169·6c3c·2f70·7265·3e0a·2020·2020·2020··ail</pre>.······ | ||
| 00000730:· | 00000730:·3c2f·7464·3e0a·2020·2020·2020·3c74·6420··</td>.······<td· | ||
| 00000740:· | 00000740:·786d·6c3a·6c61·6e67·3d22·656e·2d55·5322··xml:lang="en-US" | ||
| 00000750:· | 00000750:·3e0a·2020·2020·2020·2020·5468·6520·7365··>.········The·se | ||
| 00000760:· | 00000760:·6e64·6d61·696c·2073·6f66·7477·6172·6520··ndmail·software· | ||
| 00000770:· | 00000770:·7761·7320·6e6f·7420·6465·7665·6c6f·7065··was·not·develope | ||
| 00000780:· | 00000780:·6420·7769·7468·2073·6563·7572·6974·7920··d·with·security· | ||
| 00000790:·6 | 00000790:·696e·206d·696e·6420·616e·640a·6974·7320··in·mind·and.its· | ||
| 000007a0:·6 | 000007a0:·6465·7369·676e·2070·7265·7665·6e74·7320··design·prevents· | ||
| 000007b0:·6 | 000007b0:·6974·2066·726f·6d20·6265·696e·6720·6566··it·from·being·ef | ||
| 000007c0:· | 000007c0:·6665·6374·6976·656c·7920·636f·6e74·6169··fectively·contai | ||
| 000007d0:·6 | 000007d0:·6e65·6420·6279·2053·454c·696e·7578·2e20··ned·by·SELinux.· | ||
| 000007e0:·6 | 000007e0:·2050·6f73·7466·6978·0a73·686f·756c·6420···Postfix.should· | ||
| 000007f0:· | 000007f0:·6265·2075·7365·6420·696e·7374·6561·642e··be·used·instead. | ||
| 00000800:· | 00000800:·0a20·2020·2020·203c·2f74·643e·0a20·2020··.······</td>.··· | ||
| 00000810:· | 00000810:·203c·2f74·723e·0a20·2020·203c·7472·3e0a···</tr>.····<tr>. | ||
| 00000820:· | 00000820:·2020·2020·2020·3c74·643e·4250·3238·2852········<td>BP28(R | ||
| 00000830:·3c2f·74 | 00000830:·3129·3c2f·7464·3e0a·2020·2020·2020·3c74··1)</td>.······<t | ||
| 00000840:·6 | 00000840:·643e·556e·696e·7374·616c·6c20·7869·6e65··d>Uninstall·xine | ||
| 00000850:·746 | 00000850:·7464·2050·6163·6b61·6765·3c2f·7464·3e0a··td·Package</td>. | ||
| 00000860:· | 00000860:·2020·2020·2020·3c74·6420·786d·6c3a·6c61········<td·xml:la | ||
| 00000870:· | 00000870:·6e67·3d22·656e·2d55·5322·3e0a·2020·2020··ng="en-US">.···· | ||
| 00000880:· | 00000880:·2020·2020·5468·6520·3c63·6f64·653e·7869······The·<code>xi | ||
| 00000890:·6 | 00000890:·6e65·7464·3c2f·636f·6465·3e20·7061·636b··netd</code>·pack | ||
| 000008a0:· | 000008a0:·6167·6520·6361·6e20·6265·2072·656d·6f76··age·can·be·remov | ||
| 000008b0:· | 000008b0:·6564·2077·6974·6820·7468·6520·666f·6c6c··ed·with·the·foll | ||
| 000008c0:· | 000008c0:·6f77·696e·6720·636f·6d6d·616e·643a·0a3c··owing·command:.< | ||
| 000008d0:· | 000008d0:·7072·653e·0a24·2073·7564·6f20·7975·6d20··pre>.$·sudo·yum· | ||
| 000008e0:·6 | 000008e0:·6572·6173·6520·7869·6e65·7464·3c2f·7072··erase·xinetd</pr | ||
| 000008f0:· | 000008f0:·653e·0a20·2020·2020·203c·2f74·643e·0a20··e>.······</td>.· | ||
| 00000900:·2020·2020·20 | 00000900:·2020·2020·203c·7464·2078·6d6c·3a6c·616e·······<td·xml:lan | ||
| 00000910:·6 | 00000910:·673d·2265·6e2d·5553·223e·0a20·2020·2020··g="en-US">.····· | ||
| 00000920:·2020·20 | 00000920:·2020·2052·656d·6f76·696e·6720·7468·6520·····Removing·the· | ||
| 00000930:· | 00000930:·3c74·743e·7869·6e65·7464·3c2f·7474·3e20··<tt>xinetd</tt>· | ||
| 00000940:· | 00000940:·7061·636b·6167·6520·6465·6372·6561·7365··package·decrease | ||
| 00000950:· | 00000950:·7320·7468·6520·7269·736b·206f·6620·7468··s·the·risk·of·th | ||
| 00000960:·6 | 00000960:·650a·7869·6e65·7464·2073·6572·7669·6365··e.xinetd·service | ||
| 00000970:· | 00000970:·2773·2061·6363·6964·656e·7461·6c20·286f··'s·accidental·(o | ||
| 00000980:· | 00000980:·7220·696e·7465·6e74·696f·6e61·6c29·2061··r·intentional)·a | ||
| 00000990:·6 | 00000990:·6374·6976·6174·696f·6e2e·0a20·2020·2020··ctivation..····· | ||
| 000009a0:·20 | 000009a0:·203c·2f74·643e·0a20·2020·203c·2f74·723e···</td>.····</tr> | ||
| 000009b0:· | 000009b0:·0a20·2020·203c·7472·3e0a·2020·2020·2020··.····<tr>.······ | ||
| 000009c0:· | 000009c0:·3c74·643e·4250·3238·2852·3129·3c2f·7464··<td>BP28(R1)</td | ||
| 000009d0:·3 | 000009d0:·3e0a·2020·2020·2020·3c74·643e·5265·6d6f··>.······<td>Remo | ||
| 000009e0:·7 | 000009e0:·7665·204e·4953·2043·6c69·656e·743c·2f74··ve·NIS·Client</t | ||
| 000009f0:· | 000009f0:·643e·0a20·2020·2020·203c·7464·2078·6d6c··d>.······<td·xml | ||
| 00000a00:· | 00000a00:·3a6c·616e·673d·2265·6e2d·5553·223e·0a20··:lang="en-US">.· | ||
| 00000a10:·2 | 00000a10:·2020·2020·2020·2054·6865·204e·6574·776f·········The·Netwo | ||
| 00000a20:·72 | 00000a20:·726b·2049·6e66·6f72·6d61·7469·6f6e·2053··rk·Information·S | ||
| 00000a30:·6 | 00000a30:·6572·7669·6365·2028·4e49·5329·2c20·666f··ervice·(NIS),·fo | ||
| 00000a40:· | 00000a40:·726d·6572·6c79·206b·6e6f·776e·2061·7320··rmerly·known·as· | ||
| 00000a50:· | 00000a50:·5965·6c6c·6f77·2050·6167·6573·2c0a·6973··Yellow·Pages,.is | ||
| 00000a60:· | 00000a60:·2061·2063·6c69·656e·742d·7365·7276·6572···a·client-server | ||
| 00000a70:· | 00000a70:·2064·6972·6563·746f·7279·2073·6572·7669···directory·servi | ||
| 00000a80:· | 00000a80:·6365·2070·726f·746f·636f·6c20·7573·6564··ce·protocol·used | ||
| 00000a90:· | 00000a90:·2074·6f20·6469·7374·7269·6275·7465·2073···to·distribute·s | ||
| 00000aa0:· | 00000aa0:·7973·7465·6d20·636f·6e66·6967·7572·6174··ystem·configurat | ||
| 00000ab0:· | 00000ab0:·696f·6e0a·6669·6c65·732e·2054·6865·204e··ion.files.·The·N | ||
| 00000ac0:· | 00000ac0:·4953·2063·6c69·656e·7420·283c·7474·3e79··IS·client·(<tt>y | ||
| 00000ad0:· | 00000ad0:·7062·696e·643c·2f74·743e·2920·7761·7320··pbind</tt>)·was· | ||
| 00000ae0:· | 00000ae0:·7573·6564·2074·6f20·6269·6e64·2061·2073··used·to·bind·a·s | ||
| 00000af0:· | 00000af0:·7973·7465·6d20·746f·2061·6e20·4e49·5320··ystem·to·an·NIS· | ||
| 00000b00:· | 00000b00:·7365·7276·6572·0a61·6e64·2072·6563·6569··server.and·recei | ||
| 00000b10:· | 00000b10:·7665·2074·6865·2064·6973·7472·6962·7574··ve·the·distribut | ||
| 00000b20:·6 | 00000b20:·6564·2063·6f6e·6669·6775·7261·7469·6f6e··ed·configuration | ||
| 00000b30:· | 00000b30:·2066·696c·6573·2e0a·2020·2020·2020·3c2f···files..······</ | ||
| 00000b40:· | 00000b40:·7464·3e0a·2020·2020·2020·3c74·6420·786d··td>.······<td·xm | ||
| 00000b50:· | 00000b50:·6c3a·6c61·6e67·3d22·656e·2d55·5322·3e0a··l:lang="en-US">. | ||
| 00000b60:·20 | 00000b60:·2020·2020·2020·2020·5468·6520·4e49·5320··········The·NIS· | ||
| 00000b70:·7 | 00000b70:·7365·7276·6963·6520·6973·2069·6e68·6572··service·is·inher | ||
| 00000b80:·6 | 00000b80:·656e·746c·7920·616e·2069·6e73·6563·7572··ently·an·insecur | ||
| 00000b90:·6 | 00000b90:·6520·7379·7374·656d·2074·6861·7420·6861··e·system·that·ha | ||
| 00000ba0:· | 00000ba0:·7320·6265·656e·2076·756c·6e65·7261·626c··s·been·vulnerabl | ||
| 00000bb0:·6 | 00000bb0:·650a·746f·2044·4f53·2061·7474·6163·6b73··e.to·DOS·attacks | ||
| 00000bc0:·2 | 00000bc0:·2c20·6275·6666·6572·206f·7665·7266·6c6f··,·buffer·overflo | ||
| Max diff block lines reached; 1139356/1216796 bytes (93.64%) of diff not shown. | |||
| Offset 1, 130 lines modified | Offset 1, 130 lines modified | ||
| 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat | 1 | Rules·with·ANSSI·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat |
| 2 | Enterprise·Linux·8 | 2 | Enterprise·Linux·8 |
| 3 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does | ||
| 4 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 5 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 6 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 7 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted | ||
| 8 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 9 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 10 | ············································································· | 3 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data |
| 4 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 5 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 6 | (R03) | ||
| 7 | ································Sendmail·is·not·the·default·mail·transfer | ||
| 8 | BP28··Uninstall·Sendmail········agent·and·is·not·installed·by·default.·The···The·sendmail·software·was·not·developed·with·security·in·mind·and·its·design | ||
| 9 | (R1)··Package···················sendmail·package·can·be·removed·with·the·····prevents·it·from·being·effectively·contained·by·SELinux.·Postfix·should·be | ||
| 10 | ································following·command:···························used·instead. | ||
| 11 | ································$·sudo·yum·erase·sendmail | ||
| 11 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's | 12 | BP28····························The·xinetd·package·can·be·removed·with·the···Removing·the·xinetd·package·decreases·the·risk·of·the·xinetd·service's |
| 12 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. | 13 | (R1)··Uninstall·xinetd·Package··following·command:···························accidental·(or·intentional)·activation. |
| 13 | ································$·sudo·yum·erase·xinetd | 14 | ································$·sudo·yum·erase·xinetd |
| 14 | ································The·talk·package·contains·the·client·program | ||
| 15 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 16 | ································the·user·to·chat·with·other·users·on | ||
| 17 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 18 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 19 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 20 | ································ | 15 | ································The·Network·Information·Service·(NIS), |
| 16 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 17 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 18 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 19 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 20 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 21 | ································distributed·configuration·files. | ||
| 22 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 23 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 24 | (R1)··Package···················The·dhcp-server·package·can·be·removed·with··reactivated·and·disrupt·network·operation. | ||
| 21 | ································command: | 25 | ································the·following·command: |
| 22 | ································$·sudo·yum·erase· | 26 | ································$·sudo·yum·erase·dhcp-server |
| 27 | ·············································································Removing·the·tftp-server·package·decreases·the·risk·of·the·accidental·(or | ||
| 28 | ·············································································intentional)·activation·of·tftp·services. | ||
| 29 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 30 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 31 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| 32 | ·············································································Securty·Manager·(ISSM),·restricted·to·only·authorized·personnel,·and·have | ||
| 33 | ·············································································access·control·rules·established. | ||
| 23 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, | 34 | ·············································································It·is·detrimental·for·operating·systems·to·provide,·or·install·by·default, |
| 24 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These | 35 | ·············································································functionality·exceeding·requirements·or·mission·objectives.·These |
| 25 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain | 36 | ·············································································unnecessary·capabilities·are·often·overlooked·and·therefore·may·remain |
| 26 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional | 37 | ·············································································unsecure.·They·increase·the·risk·to·the·platform·by·providing·additional |
| 27 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. | 38 | BP28··Uninstall·telnet-server···The·telnet-server·package·can·be·removed·····attack·vectors. |
| 28 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does | 39 | (R1)··Package···················with·the·following·command:··················The·telnet·service·provides·an·unencrypted·remote·access·service·which·does |
| 29 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 40 | ································$·sudo·yum·erase·telnet-server···············not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 30 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the | 41 | ·············································································remote·session.·If·a·privileged·user·were·to·login·using·this·service,·the |
| 31 | ·············································································privileged·user·password·could·be·compromised. | 42 | ·············································································privileged·user·password·could·be·compromised. |
| 32 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet | 43 | ·············································································Removing·the·telnet-server·package·decreases·the·risk·of·the·telnet |
| 33 | ·············································································service's·accidental·(or·intentional)·activation. | 44 | ·············································································service's·accidental·(or·intentional)·activation. |
| 34 | ································The·Network·Information·Service·(NIS), | ||
| 35 | ································formerly·known·as·Yellow·Pages,·is·a·client-·The·NIS·service·is·inherently·an·insecure·system·that·has·been·vulnerable·to | ||
| 36 | BP28····························server·directory·service·protocol·used·to····DOS·attacks,·buffer·overflows·and·has·poor·authentication·for·querying·NIS | ||
| 37 | (R1)··Remove·NIS·Client·········distribute·system·configuration·files.·The···maps.·NIS·generally·has·been·replaced·by·such·protocols·as·Lightweight | ||
| 38 | ································NIS·client·(ypbind)·was·used·to·bind·a·······Directory·Access·Protocol·(LDAP).·It·is·recommended·that·the·service·be | ||
| 39 | ································system·to·an·NIS·server·and·receive·the······removed. | ||
| 40 | ································dis | 45 | ································The·ypserv·package·can·be·removed·with·the···The·NIS·service·provides·an·unencrypted·authentication·service·which·does |
| 46 | BP28··Uninstall·ypserv·Package··following·command:···························not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | ||
| 47 | (R1)····························$·sudo·yum·erase·ypserv······················remote·session.·Removing·the·ypserv·package·decreases·the·risk·of·the | ||
| 48 | ·············································································accidental·(or·intentional)·activation·of·NIS·or·NIS+·services. | ||
| 49 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 50 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 51 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 52 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 53 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 54 | ·············································································rsh,rcp,·and·rlogin. | ||
| 55 | ································The·talk·package·contains·the·client·program | ||
| 56 | ································for·the·Internet·talk·protocol,·which·allows | ||
| 57 | ································the·user·to·chat·with·other·users·on | ||
| 58 | BP28····························different·systems.·Talk·is·a·communication···The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | ||
| 59 | (R1)··Uninstall·talk·Package····program·which·copies·lines·from·one·terminal·for·communications.·Removing·the·talk·package·decreases·the·risk·of·the | ||
| 60 | ································to·the·terminal·of·another·user.·The·talk····accidental·(or·intentional)·activation·of·talk·client·program. | ||
| 61 | ································package·can·be·removed·with·the·following | ||
| 62 | ································command: | ||
| 63 | ································$·sudo·yum·erase·talk | ||
| 41 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does | 64 | ·············································································The·rsh-server·service·provides·unencrypted·remote·access·service·which·does |
| 42 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the | 65 | ·············································································not·provide·for·the·confidentiality·and·integrity·of·user·passwords·or·the |
| 43 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were | 66 | BP28··Uninstall·rsh-server······The·rsh-server·package·can·be·removed·with···remote·session·and·has·very·weak·authentication.·If·a·privileged·user·were |
| 44 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be | 67 | (R1)··Package···················the·following·command:·······················to·login·using·this·service,·the·privileged·user·password·could·be |
| 45 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure | 68 | ································$·sudo·yum·erase·rsh-server··················compromised.·The·rsh-server·package·provides·several·obsolete·and·insecure |
| 46 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' | 69 | ·············································································network·services.·Removing·it·decreases·the·risk·of·those·services' |
| 47 | ·············································································accidental·(or·intentional)·activation. | 70 | ·············································································accidental·(or·intentional)·activation. |
| 48 | BP28·········································································telnet·allows·clear·text·communications,·and·does·not·protect·any·data | ||
| 49 | (R1)··Uninstall·the·telnet······The·telnet·daemon·should·be·uninstalled.·····transmission·between·client·and·server.·Any·confidential·data·can·be | ||
| 50 | NT007·server·································································listened·and·no·integrity·checking·is·made.' | ||
| 51 | (R03) | ||
| 52 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a | 71 | ································Trivial·File·Transfer·Protocol·(TFTP)·is·a |
| 53 | ································simple·file·transfer·protocol,·typically | 72 | ································simple·file·transfer·protocol,·typically |
| 54 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for | 73 | ································used·to·automatically·transfer·configuration·It·is·recommended·that·TFTP·be·removed,·unless·there·is·a·specific·need·for |
| 55 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when | 74 | BP28··Remove·tftp·Daemon········or·boot·files·between·systems.·TFTP·does·not·TFTP·(such·as·a·boot·server).·In·that·case,·use·extreme·caution·when |
| 56 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. | 75 | (R1)····························support·authentication·and·can·be·easily·····configuring·the·services. |
| 57 | ································hacked.·The·package·tftp·is·a·client·program | 76 | ································hacked.·The·package·tftp·is·a·client·program |
| 58 | ································that·allows·for·connections·to·a·tftp | 77 | ································that·allows·for·connections·to·a·tftp |
| 59 | ································server. | 78 | ································server. |
| 60 | ·············································································These·legacy·clients·contain·numerous·security·exposures·and·have·been | ||
| 61 | ·············································································replaced·with·the·more·secure·SSH·package.·Even·if·the·server·is·removed,·it | ||
| 62 | BP28··Uninstall·rsh·Package·····The·rsh·package·contains·the·client·commands·is·best·to·ensure·the·clients·are·also·removed·to·prevent·users·from | ||
| 63 | (R1)····························for·the·rsh·services·························inadvertently·attempting·to·use·these·commands·and·therefore·exposing·their | ||
| 64 | ·············································································credentials.·Note·that·removing·the·rsh·package·removes·the·clients·for | ||
| 65 | ·············································································rsh,rcp,·and·rlogin. | ||
| 66 | ································If·the·system·does·not·need·to·act·as·a·DHCP | ||
| 67 | BP28··Uninstall·DHCP·Server·····server,·the·dhcp·package·can·be·uninstalled.·Removing·the·DHCP·server·ensures·that·it·cannot·be·easily·or·accidentally | ||
| 68 | (R1)··Package···················The·dhcp-server·package·can·be·removed·with··reactivated·and·disrupt·network·operation. | ||
| 69 | ································the·following·command: | ||
| 70 | ································$·sudo·yum·erase·dhcp-server | ||
| 71 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols | 79 | BP28··Uninstall·talk-server·····The·talk-server·package·can·be·removed·with··The·talk·software·presents·a·security·risk·as·it·uses·unencrypted·protocols |
| 72 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of | 80 | (R1)··Package···················the·following·command:·······················for·communications.·Removing·the·talk-server·package·decreases·the·risk·of |
| 73 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. | 81 | ·································$·sudo·yum·erase·talk-server················the·accidental·(or·intentional)·activation·of·talk·services. |
| 82 | ································The·telnet·client·allows·users·to·start······The·telnet·protocol·is·insecure·and·unencrypted.·The·use·of·an·unencrypted | ||
| 83 | BP28··Remove·telnet·Clients·····connections·to·other·systems·via·the·telnet··transmission·medium·could·allow·an·unauthorized·user·to·steal·credentials. | ||
| 84 | (R1)····························protocol.····································The·ssh·package·provides·an·encrypted·session·and·stronger·security·and·is | ||
| 74 | ·············································································Removing·the·tftp-server·package·decreases·the·risk·of·the·accidental·(or | ||
| 75 | ·············································································intentional)·activation·of·tftp·services. | ||
| 76 | BP28··Uninstall·tftp-server·····The·tftp-server·package·can·be·removed·with | ||
| 77 | (R1)··Package···················the·following·command:·······················If·TFTP·is·required·for·operational·support·(such·as·transmission·of·router | ||
| 78 | ·································$·sudo·yum·erase·tftp-server················configurations),·its·use·must·be·documented·with·the·Information·Systems | ||
| Max diff block lines reached; 227898/244284 bytes (93.29%) of diff not shown. | |||
| Offset 123, 128 lines modified | Offset 123, 128 lines modified | ||
| 000007a0:·206c·6f63·616c·2061·7474·6163·6b20·7375···local·attack·su | 000007a0:·206c·6f63·616c·2061·7474·6163·6b20·7375···local·attack·su | ||
| 000007b0:·7266·6163·650a·6f66·2074·6865·2073·6572··rface.of·the·ser | 000007b0:·7266·6163·650a·6f66·2074·6865·2073·6572··rface.of·the·ser | ||
| 000007c0:·7665·722e·0a20·2020·2020·203c·2f74·643e··ver..······</td> | 000007c0:·7665·722e·0a20·2020·2020·203c·2f74·643e··ver..······</td> | ||
| 000007d0:·0a20·2020·203c·2f74·723e·0a20·2020·203c··.····</tr>.····< | 000007d0:·0a20·2020·203c·2f74·723e·0a20·2020·203c··.····</tr>.····< | ||
| 000007e0:·7472·3e0a·2020·2020·2020·3c74·643e·312e··tr>.······<td>1. | 000007e0:·7472·3e0a·2020·2020·2020·3c74·643e·312e··tr>.······<td>1. | ||
| 000007f0:·312e·312e·323c·2f74·643e·0a20·2020·2020··1.1.2</td>.····· | 000007f0:·312e·312e·323c·2f74·643e·0a20·2020·2020··1.1.2</td>.····· | ||
| 00000800:·203c·7464·3e44·6973·6162·6c65·204d·6f75···<td>Disable·Mou | 00000800:·203c·7464·3e44·6973·6162·6c65·204d·6f75···<td>Disable·Mou | ||
| 00000810:·6e74·696e·6720·6f66·207 | 00000810:·6e74·696e·6720·6f66·2076·4641·5420·6669··nting·of·vFAT·fi | ||
| 00000820:·733c·2f74·643e·0a20·2020·2020·203c·7464··s</td>.······<td | |||
| 00000830:·2078·6d6c·3a6c·616e·673d·2265·6e2d·5553···xml:lang="en-US | |||
| 00000840:·223e·0a20·2020·2020·2020·200a·546f·2063··">.········.To·c | |||
| 00000850:·6f6e·6669·6775·7265·2074·6865·2073·7973··onfigure·the·sys | |||
| 00000860:·7465·6d20·746f·2070·7265·7665·6e74·2074··tem·to·prevent·t | |||
| 000008 | 00000820:·6c65·7379·7374·656d·733c·2f74·643e·0a20··lesystems</td>.· | ||
| 00000830:·2020·2020·203c·7464·2078·6d6c·3a6c·616e·······<td·xml:lan | |||
| 00000840:·673d·2265·6e2d·5553·223e·0a20·2020·2020··g="en-US">.····· | |||
| 00000850:·2020·200a·546f·2063·6f6e·6669·6775·7265·····.To·configure | |||
| 00000860:·2074·6865·2073·7973·7465·6d20·746f·2070···the·system·to·p | |||
| 00000870:·7265·7665·6e74·2074·6865·203c·636f·6465··revent·the·<code | |||
| 00000880:·7 | 00000880:·3e76·6661·743c·2f63·6f64·653e·0a6b·6572··>vfat</code>.ker | ||
| 00000890:·6d6f·6475·6c65·2066·726f·6d20· | 00000890:·6e65·6c20·6d6f·6475·6c65·2066·726f·6d20··nel·module·from· | ||
| 000008a0:·6720·6c6f·6164·6564·2c20·6164· | 000008a0:·6265·696e·6720·6c6f·6164·6564·2c20·6164··being·loaded,·ad | ||
| 000008b0:·6520·666f·6c6c·6f77·696e·6720· | 000008b0:·6420·7468·6520·666f·6c6c·6f77·696e·6720··d·the·following· | ||
| 000008c0:·2074·6f20·7468·6520·6669·6c65· | 000008c0:·6c69·6e65·2074·6f20·7468·6520·6669·6c65··line·to·the·file | ||
| 000008d0:·6465·3e2f·6574·632f·6d6f·6470· | 000008d0:·203c·636f·6465·3e2f·6574·632f·6d6f·6470···<code>/etc/modp | ||
| 000008e0:· | 000008e0:·726f·6265·2e64·2f76·6661·742e·636f·6e66··robe.d/vfat.conf | ||
| 000008f0:·3c2f·636f·6465·3e3a·0a3c·7072·653e·696e··</code>:.<pre>in | 000008f0:·3c2f·636f·6465·3e3a·0a3c·7072·653e·696e··</code>:.<pre>in | ||
| 00000900:·7374·616c·6c20·7 | 00000900:·7374·616c·6c20·7666·6174·202f·6269·6e2f··stall·vfat·/bin/ | ||
| 00000910:· | 00000910:·7472·7565·3c2f·7072·653e·0a0a·546f·2063··true</pre>..To·c | ||
| 00000920:· | 00000920:·6f6e·6669·6775·7265·2074·6865·2073·7973··onfigure·the·sys | ||
| 00000930:· | 00000930:·7465·6d20·746f·2070·7265·7665·6e74·2074··tem·to·prevent·t | ||
| 00000940:·6865·203c·636f·6465·3e76·6661·743c·2f63··he·<code>vfat</c | |||
| 00000950:·6f64·653e·2066·726f·6d20·6265·696e·6720··ode>·from·being· | |||
| 00000960:·7573·6564·2c0a·6164·6420·7468·6520·666f··used,.add·the·fo | |||
| 00000970:·6c6c·6f77·696e·6720·6c69·6e65·2074·6f20··llowing·line·to· | |||
| 00000980:·6669·6c65·203c·636f·6465·3e2f·6574·632f··file·<code>/etc/ | |||
| 00000990:·6d6f·6470·726f·6265·2e64·2f76·6661·742e··modprobe.d/vfat. | |||
| 00000940:·6e74·2074·6865·203c·636f·6465·3e73·7175··nt·the·<code>squ | |||
| 00000950:·6173·6866·733c·2f63·6f64·653e·2066·726f··ashfs</code>·fro | |||
| 00000960:·6d20·6265·696e·6720·7573·6564·2c0a·6164··m·being·used,.ad | |||
| 00000970:·6420·7468·6520·666f·6c6c·6f77·696e·6720··d·the·following· | |||
| 00000980:·6c69·6e65·2074·6f20·6669·6c65·203c·636f··line·to·file·<co | |||
| 00000990:·6465·3e2f·6574·632f·6d6f·6470·726f·6265··de>/etc/modprobe | |||
| 000009a0:·2e64·2f73·7175·6173·6866·732e·636f·6e66··.d/squashfs.conf | |||
| 000009 | 000009a0:·636f·6e66·3c2f·636f·6465·3e3a·0a3c·7072··conf</code>:.<pr | ||
| 000009 | 000009b0:·653e·626c·6163·6b6c·6973·7420·7666·6174··e>blacklist·vfat | ||
| 000009 | 000009c0:·3c2f·7072·653e·0a0a·5468·6973·2065·6666··</pre>..This·eff | ||
| 000009 | 000009d0:·6563·7469·7665·6c79·2070·7265·7665·6e74··ectively·prevent | ||
| 000009 | 000009e0:·7320·7573·6167·6520·6f66·2074·6869·7320··s·usage·of·this· | ||
| 00000 | 000009f0:·756e·636f·6d6d·6f6e·2066·696c·6573·7973··uncommon·filesys | ||
| 00000a | 00000a00:·7465·6d2e·0a0a·5468·6520·3c74·743e·7646··tem...The·<tt>vF | ||
| 00000a10:·4154·3c2f·7474·3e20·6669·6c65·7379·7374··AT</tt>·filesyst | |||
| 00000a20:·656d·2066·6f72·6d61·7420·6973·2070·7269··em·format·is·pri | |||
| 00000a30:·6d61·7269·6c79·2075·7365·6420·6f6e·206f··marily·used·on·o | |||
| 00000a40:·6c64·6572·0a77·696e·646f·7773·2073·7973··lder.windows·sys | |||
| 00000a50:·7465·6d73·2061·6e64·2070·6f72·7461·626c··tems·and·portabl | |||
| 00000a60:·6520·5553·4220·6472·6976·6573·206f·7220··e·USB·drives·or· | |||
| 00000a70:·666c·6173·6820·6d6f·6475·6c65·732e·2049··flash·modules.·I | |||
| 00000a80:·7420·636f·6d65·730a·696e·2074·6872·6565··t·comes.in·three | |||
| 00000a90:·2074·7970·6573·203c·7474·3e46·4154·3132···types·<tt>FAT12 | |||
| 00000aa0:·3c2f·7474·3e2c·203c·7474·3e46·4154·3136··</tt>,·<tt>FAT16 | |||
| 00000ab0:·3c2f·7474·3e2c·2061·6e64·203c·7474·3e46··</tt>,·and·<tt>F | |||
| 00000ac0:·4154·3332·3c2f·7474·3e0a·616c·6c20·6f66··AT32</tt>.all·of | |||
| 00000ad0:·2077·6869·6368·2061·7265·2073·7570·706f···which·are·suppo | |||
| 00000ae0:·7274·6564·2062·7920·7468·6520·3c74·743e··rted·by·the·<tt> | |||
| 00000af0:·7666·6174·3c2f·7474·3e20·6b65·726e·656c··vfat</tt>·kernel | |||
| 00000b00:·206d·6f64·756c·652e·0a20·2020·2020·203c···module..······< | |||
| 00000b10:·2f74·643e·0a20·2020·2020·203c·7464·2078··/td>.······<td·x | |||
| 00000b20:·6d6c·3a6c·616e·673d·2265·6e2d·5553·223e··ml:lang="en-US"> | |||
| 00000b30:·0a20·2020·2020·2020·2052·656d·6f76·696e··.········Removin | |||
| 00000b40:·6720·7375·7070·6f72·7420·666f·7220·756e··g·support·for·un | |||
| 00000b50:·6e65·6564·6564·2066·696c·6573·7973·7465··needed·filesyste | |||
| 00000b60:·6d73·2072·6564·7563·6573·2074·6865·206c··ms·reduces·the·l | |||
| 00000b70:·6f63·616c·2061·7474·6163·6b0a·7375·7266··ocal·attack.surf | |||
| 00000b80:·6163·6520·6f66·2074·6865·2073·7973·7465··ace·of·the·syste | |||
| 00000b90:·6d2e·0a20·2020·2020·203c·2f74·643e·0a20··m..······</td>.· | |||
| 00000ba0:·2020·203c·2f74·723e·0a20·2020·203c·7472·····</tr>.····<tr | |||
| 00000bb0:·3e0a·2020·2020·2020·3c74·643e·312e·312e··>.······<td>1.1. | |||
| 00000bc0:·312e·323c·2f74·643e·0a20·2020·2020·203c··1.2</td>.······< | |||
| 00000bd0:·7464·3e44·6973·6162·6c65·204d·6f75·6e74··td>Disable·Mount | |||
| 00000be0:·696e·6720·6f66·2073·7175·6173·6866·733c··ing·of·squashfs< | |||
| 00000bf0:·2f74·643e·0a20·2020·2020·203c·7464·2078··/td>.······<td·x | |||
| 00000c00:·6d6c·3a6c·616e·673d·2265·6e2d·5553·223e··ml:lang="en-US"> | |||
| 00000c10:·0a20·2020·2020·2020·200a·546f·2063·6f6e··.········.To·con | |||
| 00000c20:·6669·6775·7265·2074·6865·2073·7973·7465··figure·the·syste | |||
| 00000c30:·6d20·746f·2070·7265·7665·6e74·2074·6865··m·to·prevent·the | |||
| 00000c40:·203c·636f·6465·3e73·7175·6173·6866·733c···<code>squashfs< | |||
| 00000c50:·2f63·6f64·653e·0a6b·6572·6e65·6c20·6d6f··/code>.kernel·mo | |||
| 00000c60:·6475·6c65·2066·726f·6d20·6265·696e·6720··dule·from·being· | |||
| 00000c70:·6c6f·6164·6564·2c20·6164·6420·7468·6520··loaded,·add·the· | |||
| 00000c80:·666f·6c6c·6f77·696e·6720·6c69·6e65·2074··following·line·t | |||
| 00000c90:·6f20·7468·6520·6669·6c65·203c·636f·6465··o·the·file·<code | |||
| 00000ca0:·3e2f·6574·632f·6d6f·6470·726f·6265·2e64··>/etc/modprobe.d | |||
| 00000cb0:·2f73·7175·6173·6866·732e·636f·6e66·3c2f··/squashfs.conf</ | |||
| 00000cc0:·636f·6465·3e3a·0a3c·7072·653e·696e·7374··code>:.<pre>inst | |||
| 00000cd0:·616c·6c20·7371·7561·7368·6673·202f·6269··all·squashfs·/bi | |||
| 00000ce0:·6e2f·7472·7565·3c2f·7072·653e·0a0a·546f··n/true</pre>..To | |||
| 00000cf0:·2063·6f6e·6669·6775·7265·2074·6865·2073···configure·the·s | |||
| 00000d00:·7973·7465·6d20·746f·2070·7265·7665·6e74··ystem·to·prevent | |||
| 00000d10:·2074·6865·203c·636f·6465·3e73·7175·6173···the·<code>squas | |||
| 00000d20:·6866·733c·2f63·6f64·653e·2066·726f·6d20··hfs</code>·from· | |||
| 00000d30:·6265·696e·6720·7573·6564·2c0a·6164·6420··being·used,.add· | |||
| 00000d40:·7468·6520·666f·6c6c·6f77·696e·6720·6c69··the·following·li | |||
| 00000d50:·6e65·2074·6f20·6669·6c65·203c·636f·6465··ne·to·file·<code | |||
| 00000d60:·3e2f·6574·632f·6d6f·6470·726f·6265·2e64··>/etc/modprobe.d | |||
| 00000d70:·2f73·7175·6173·6866·732e·636f·6e66·3c2f··/squashfs.conf</ | |||
| 00000d80:·636f·6465·3e3a·0a3c·7072·653e·626c·6163··code>:.<pre>blac | |||
| 00000d90:·6b6c·6973·7420·7371·7561·7368·6673·3c2f··klist·squashfs</ | |||
| 00000da0:·7072·653e·0a0a·5468·6973·2065·6666·6563··pre>..This·effec | |||
| 00000db0:·7469·7665·6c79·2070·7265·7665·6e74·7320··tively·prevents· | |||
| 00000dc0:·7573·6167·6520·6f66·2074·6869·7320·756e··usage·of·this·un | |||
| 00000dd0:·636f·6d6d·6f6e·2066·696c·6573·7973·7465··common·filesyste | |||
| 00000de0:·6d2e·0a0a·5468·6520·3c74·743e·7371·7561··m...The·<tt>squa | |||
| 00000 | 00000df0:·7368·6673·3c2f·7474·3e20·6669·6c65·7379··shfs</tt>·filesy | ||
| 00000 | 00000e00:·7374·656d·2074·7970·6520·6973·2061·2063··stem·type·is·a·c | ||
| 00000 | 00000e10:·6f6d·7072·6573·7365·6420·7265·6164·2d6f··ompressed·read-o | ||
| 00000 | 00000e20:·6e6c·7920·4c69·6e75·780a·6669·6c65·7379··nly·Linux.filesy | ||
| 00000 | 00000e30:·7374·656d·2065·6d62·6564·6465·6420·696e··stem·embedded·in | ||
| 00000 | 00000e40:·2073·6d61·6c6c·2066·6f6f·7470·7269·6e74···small·footprint | ||
| 00000 | 00000e50:·2073·7973·7465·6d73·2028·7369·6d69·6c61···systems·(simila | ||
| 00000 | 00000e60:·7220·746f·0a3c·7474·3e63·7261·6d66·733c··r·to.<tt>cramfs< | ||
| 00000 | 00000e70:·2f74·743e·292e·2041·203c·7474·3e73·7175··/tt>).·A·<tt>squ | ||
| 00000 | 00000e80:·6173·6866·733c·2f74·743e·2069·6d61·6765··ashfs</tt>·image | ||
| 00000 | 00000e90:·2063·616e·2062·6520·7573·6564·2077·6974···can·be·used·wit | ||
| 00000 | 00000ea0:·686f·7574·2068·6176·696e·670a·746f·2066··hout·having.to·f | ||
| 00000 | 00000eb0:·6972·7374·2064·6563·6f6d·7072·6573·7320··irst·decompress· | ||
| 00000 | 00000ec0:·7468·6520·696d·6167·652e·0a20·2020·2020··the·image..····· | ||
| Max diff block lines reached; 1015162/1031401 bytes (98.43%) of diff not shown. | |||
| Offset 13, 42 lines modified | Offset 13, 42 lines modified | ||
| 13 | 1.1.1.1···cramfs··············modprobe.d/cramfs.conf:·····························types·reduces·the | 13 | 1.1.1.1···cramfs··············modprobe.d/cramfs.conf:·····························types·reduces·the |
| 14 | ······························blacklist·cramfs····································local·attack·surface | 14 | ······························blacklist·cramfs····································local·attack·surface |
| 15 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·server. | 15 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·server. |
| 16 | ······························filesystem.·The·cramfs·filesystem·type·is·a | 16 | ······························filesystem.·The·cramfs·filesystem·type·is·a |
| 17 | ······························compressed·read-only·Linux·filesystem·embedded·in | 17 | ······························compressed·read-only·Linux·filesystem·embedded·in |
| 18 | ······························small·footprint·systems.·A·cramfs·image·can·be·used | 18 | ······························small·footprint·systems.·A·cramfs·image·can·be·used |
| 19 | ······························without·having·to·first·decompress·the·image. | 19 | ······························without·having·to·first·decompress·the·image. |
| 20 | ······························To·configure·the·system·to·prevent·the·squashfs | ||
| 21 | ······························kernel·module·from·being·loaded,·add·the·following | ||
| 22 | ······························line·to·the·file·/etc/modprobe.d/squashfs.conf: | ||
| 23 | ······························install·squashfs·/bin/true | ||
| 24 | ······························To·configure·the·system·to·prevent·the·squashfs·····Removing·support·for | ||
| 25 | ······························from·being·used,·add·the·following·line·to·file·/···unneeded·filesystem | ||
| 26 | 1.1.1.2···Disable·Mounting·of·etc/modprobe.d/squashfs.conf:·······················types·reduces·the | ||
| 27 | ··········squashfs············blacklist·squashfs··································local·attack·surface | ||
| 28 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·system. | ||
| 29 | ······························filesystem.·The·squashfs·filesystem·type·is·a | ||
| 30 | ······························compressed·read-only·Linux·filesystem·embedded·in | ||
| 31 | ······························small·footprint·systems·(similar·to·cramfs).·A | ||
| 32 | ······························squashfs·image·can·be·used·without·having·to·first | ||
| 33 | ······························decompress·the·image. | ||
| 34 | ······························To·configure·the·system·to·prevent·the·vfat·kernel | 20 | ······························To·configure·the·system·to·prevent·the·vfat·kernel |
| 35 | ······························module·from·being·loaded,·add·the·following·line·to | 21 | ······························module·from·being·loaded,·add·the·following·line·to |
| 36 | ······························the·file·/etc/modprobe.d/vfat.conf: | 22 | ······························the·file·/etc/modprobe.d/vfat.conf: |
| 37 | ······························install·vfat·/bin/true | 23 | ······························install·vfat·/bin/true |
| 38 | ······························To·configure·the·system·to·prevent·the·vfat·from····Removing·support·for | 24 | ······························To·configure·the·system·to·prevent·the·vfat·from····Removing·support·for |
| 39 | ······························being·used,·add·the·following·line·to·file·/etc/····unneeded·filesystems | 25 | ······························being·used,·add·the·following·line·to·file·/etc/····unneeded·filesystems |
| 40 | 1.1.1.2···Disable·Mounting·of·modprobe.d/vfat.conf:·······························reduces·the·local | 26 | 1.1.1.2···Disable·Mounting·of·modprobe.d/vfat.conf:·······························reduces·the·local |
| 41 | ··········vFAT·filesystems····blacklist·vfat······································attack·surface·of | 27 | ··········vFAT·filesystems····blacklist·vfat······································attack·surface·of |
| 42 | ······························This·effectively·prevents·usage·of·this·uncommon····the·system. | 28 | ······························This·effectively·prevents·usage·of·this·uncommon····the·system. |
| 43 | ······························filesystem.·The·vFAT·filesystem·format·is·primarily | 29 | ······························filesystem.·The·vFAT·filesystem·format·is·primarily |
| 44 | ······························used·on·older·windows·systems·and·portable·USB | 30 | ······························used·on·older·windows·systems·and·portable·USB |
| 45 | ······························drives·or·flash·modules.·It·comes·in·three·types | 31 | ······························drives·or·flash·modules.·It·comes·in·three·types |
| 46 | ······························FAT12,·FAT16,·and·FAT32·all·of·which·are·supported | 32 | ······························FAT12,·FAT16,·and·FAT32·all·of·which·are·supported |
| 47 | ······························by·the·vfat·kernel·module. | 33 | ······························by·the·vfat·kernel·module. |
| 34 | ······························To·configure·the·system·to·prevent·the·squashfs | ||
| 35 | ······························kernel·module·from·being·loaded,·add·the·following | ||
| 36 | ······························line·to·the·file·/etc/modprobe.d/squashfs.conf: | ||
| 37 | ······························install·squashfs·/bin/true | ||
| 38 | ······························To·configure·the·system·to·prevent·the·squashfs·····Removing·support·for | ||
| 39 | ······························from·being·used,·add·the·following·line·to·file·/···unneeded·filesystem | ||
| 40 | 1.1.1.2···Disable·Mounting·of·etc/modprobe.d/squashfs.conf:·······················types·reduces·the | ||
| 41 | ··········squashfs············blacklist·squashfs··································local·attack·surface | ||
| 42 | ······························This·effectively·prevents·usage·of·this·uncommon····of·the·system. | ||
| 43 | ······························filesystem.·The·squashfs·filesystem·type·is·a | ||
| 44 | ······························compressed·read-only·Linux·filesystem·embedded·in | ||
| 45 | ······························small·footprint·systems·(similar·to·cramfs).·A | ||
| 46 | ······························squashfs·image·can·be·used·without·having·to·first | ||
| 47 | ······························decompress·the·image. | ||
| 48 | ······························To·configure·the·system·to·prevent·the·udf·kernel | 48 | ······························To·configure·the·system·to·prevent·the·udf·kernel |
| 49 | ······························module·from·being·loaded,·add·the·following·line·to | 49 | ······························module·from·being·loaded,·add·the·following·line·to |
| 50 | ······························the·file·/etc/modprobe.d/udf.conf: | 50 | ······························the·file·/etc/modprobe.d/udf.conf: |
| 51 | ······························install·udf·/bin/true | 51 | ······························install·udf·/bin/true |
| 52 | ······························To·configure·the·system·to·prevent·the·udf·from | 52 | ······························To·configure·the·system·to·prevent·the·udf·from |
| 53 | ······························being·used,·add·the·following·line·to·file·/etc/····Removing·support·for | 53 | ······························being·used,·add·the·following·line·to·file·/etc/····Removing·support·for |
| 54 | ······························modprobe.d/udf.conf:································unneeded·filesystem | 54 | ······························modprobe.d/udf.conf:································unneeded·filesystem |
| Offset 403, 30 lines modified | Offset 403, 14 lines modified | ||
| 403 | ······························Preventing·the·direct·execution·of·binaries·from····execute·binaries | 403 | ······························Preventing·the·direct·execution·of·binaries·from····execute·binaries |
| 404 | ··········Add·noexec·Option···removable·media·(such·as·a·USB·key)·provides·a······from·removable·media | 404 | ··········Add·noexec·Option···removable·media·(such·as·a·USB·key)·provides·a······from·removable·media |
| 405 | 1.1.20····to·Removable·Media··defense·against·malicious·software·that·may·be······such·as·USB·keys | 405 | 1.1.20····to·Removable·Media··defense·against·malicious·software·that·may·be······such·as·USB·keys |
| 406 | ··········Partitions··········present·on·such·untrusted·media.·Add·the·noexec·····exposes·the·system | 406 | ··········Partitions··········present·on·such·untrusted·media.·Add·the·noexec·····exposes·the·system |
| 407 | ······························option·to·the·fourth·column·of·/etc/fstab·for·the···to·potential | 407 | ······························option·to·the·fourth·column·of·/etc/fstab·for·the···to·potential |
| 408 | ······························line·which·controls·mounting·of·any·removable·media·compromise. | 408 | ······························line·which·controls·mounting·of·any·removable·media·compromise. |
| 409 | ······························partitions. | 409 | ······························partitions. |
| 410 | ··················································································Although·systems | ||
| 411 | ··················································································management·and | ||
| 412 | ··················································································patching·is | ||
| 413 | ··················································································extremely·important | ||
| 414 | ······························The·Red·Hat·Network·service·automatically·queries···to·system·security, | ||
| 415 | ······························Red·Hat·Network·servers·to·determine·whether·there··management·by·a | ||
| 416 | ··········Disable·Red·Hat·····are·any·actions·that·should·be·executed,·such·as····system·outside·the | ||
| 417 | 1.2.2·····Network·Service·····package·updates.·This·only·occurs·if·the·system·was·enterprise·enclave | ||
| 418 | ··········(rhnsd)·············registered·to·an·RHN·server·or·satellite·and········is·not·desirable·for | ||
| 419 | ······························managed·as·such.·The·rhnsd·service·can·be·disabled··some·environments. | ||
| 420 | ······························with·the·following·command:·························However,·if·the | ||
| 421 | ······························$·sudo·systemctl·mask·--now·rhnsd.service···········system·is·being | ||
| 422 | ··················································································managed·by·RHN·or | ||
| 423 | ··················································································RHN·Satellite·Server | ||
| 424 | ··················································································the·rhnsd·daemon·can | ||
| 425 | ··················································································remain·on. | ||
| 426 | ······························To·ensure·the·system·can·cryptographically·verify···Changes·to·software | 410 | ······························To·ensure·the·system·can·cryptographically·verify···Changes·to·software |
| 427 | ······························base·software·packages·come·from·Red·Hat·(and·to····components·can·have | 411 | ······························base·software·packages·come·from·Red·Hat·(and·to····components·can·have |
| 428 | ······························connect·to·the·Red·Hat·Network·to·receive·them),····significant·effects | 412 | ······························connect·to·the·Red·Hat·Network·to·receive·them),····significant·effects |
| 429 | ······························the·Red·Hat·GPG·key·must·properly·be·installed.·To··on·the·overall | 413 | ······························the·Red·Hat·GPG·key·must·properly·be·installed.·To··on·the·overall |
| 430 | ······························install·the·Red·Hat·GPG·key,·run:···················security·of·the | 414 | ······························install·the·Red·Hat·GPG·key,·run:···················security·of·the |
| 431 | ······························$·sudo·subscription-manager·register················operating·system. | 415 | ······························$·sudo·subscription-manager·register················operating·system. |
| 432 | ······························If·the·system·is·not·connected·to·the·Internet·or···This·requirement | 416 | ······························If·the·system·is·not·connected·to·the·Internet·or···This·requirement |
| Offset 437, 14 lines modified | Offset 421, 30 lines modified | ||
| 437 | ······························user·to·import·it·into·the·keyring:·················provided·by·a | 421 | ······························user·to·import·it·into·the·keyring:·················provided·by·a |
| 438 | ······························$·sudo·rpm·--import·/media/cdrom/RPM-GPG-KEY········trusted·vendor.·The | 422 | ······························$·sudo·rpm·--import·/media/cdrom/RPM-GPG-KEY········trusted·vendor.·The |
| 439 | ······························Alternatively,·the·key·may·be·pre-loaded·during·the·Red·Hat·GPG·key·is | 423 | ······························Alternatively,·the·key·may·be·pre-loaded·during·the·Red·Hat·GPG·key·is |
| 440 | ······························RHEL·installation.·In·such·cases,·the·key·can·be····necessary·to | 424 | ······························RHEL·installation.·In·such·cases,·the·key·can·be····necessary·to |
| 441 | ······························installed·by·running·the·following·command:·········cryptographically | 425 | ······························installed·by·running·the·following·command:·········cryptographically |
| 442 | ······························sudo·rpm·--import·/etc/pki/rpm-gpg/RPM-GPG-KEY-·····verify·packages·are | 426 | ······························sudo·rpm·--import·/etc/pki/rpm-gpg/RPM-GPG-KEY-·····verify·packages·are |
| 443 | ······························redhat-release······································from·Red·Hat. | 427 | ······························redhat-release······································from·Red·Hat. |
| 428 | ··················································································Although·systems | ||
| 429 | ··················································································management·and | ||
| 430 | ··················································································patching·is | ||
| 431 | ··················································································extremely·important | ||
| 432 | ······························The·Red·Hat·Network·service·automatically·queries···to·system·security, | ||
| 433 | ······························Red·Hat·Network·servers·to·determine·whether·there··management·by·a | ||
| 434 | ··········Disable·Red·Hat·····are·any·actions·that·should·be·executed,·such·as····system·outside·the | ||
| 435 | 1.2.2·····Network·Service·····package·updates.·This·only·occurs·if·the·system·was·enterprise·enclave | ||
| 436 | ··········(rhnsd)·············registered·to·an·RHN·server·or·satellite·and········is·not·desirable·for | ||
| 437 | ······························managed·as·such.·The·rhnsd·service·can·be·disabled··some·environments. | ||
| 438 | ······························with·the·following·command:·························However,·if·the | ||
| 439 | ······························$·sudo·systemctl·mask·--now·rhnsd.service···········system·is·being | ||
| 440 | ··················································································managed·by·RHN·or | ||
| 441 | ··················································································RHN·Satellite·Server | ||
| 442 | ··················································································the·rhnsd·daemon·can | ||
| 443 | ··················································································remain·on. | ||
| 444 | ··················································································Changes·to·any | 444 | ··················································································Changes·to·any |
| 445 | ··················································································software·components | 445 | ··················································································software·components |
| 446 | ··················································································can·have·significant | 446 | ··················································································can·have·significant |
| 447 | ··················································································effects·on·the | 447 | ··················································································effects·on·the |
| 448 | ··················································································overall·security·of | 448 | ··················································································overall·security·of |
| 449 | ··················································································the·operating | 449 | ··················································································the·operating |
| 450 | ··················································································system.·This | 450 | ··················································································system.·This |
| Offset 505, 19 lines modified | Offset 505, 14 lines modified | ||
| 505 | ··················································································breakage·of | 505 | ··················································································breakage·of |
| 506 | ··················································································configuration,·as·it | 506 | ··················································································configuration,·as·it |
| 507 | ··················································································ships·several·tested | 507 | ··················································································ships·several·tested |
| 508 | ··················································································profiles·that·are | 508 | ··················································································profiles·that·are |
| 509 | ··················································································well·tested·and | 509 | ··················································································well·tested·and |
| 510 | ··················································································supported·to·solve | 510 | ··················································································supported·to·solve |
| 511 | ··················································································different·use-cases. | 511 | ··················································································different·use-cases. |
| 512 | ··················································································The·AIDE·package | ||
| Max diff block lines reached; 277111/289161 bytes (95.83%) of diff not shown. | |||
| Offset 40, 71 lines modified | Offset 40, 32 lines modified | ||
| 40 | ····<th>Mapping</th> | 40 | ····<th>Mapping</th> |
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>3.1.1<br/>3.1.6</td> | ||
| 48 | ······<td>Direct·root·Logins·Not·Allowed</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·further·limit·access·to·the·<tt>root</tt>·account,·administrators | ||
| 51 | can·disable·root·logins·at·the·console·by·editing·the·<tt>/etc/securetty</tt>·file. | ||
| 52 | This·file·lists·all·devices·the·root·user·is·allowed·to·login·to.·If·the·file·does | ||
| 53 | not·exist·at·all,·the·root·user·can·login·through·any·communication·device·on·the | ||
| 54 | system,·whether·via·the·console·or·via·a·raw·network·interface.·This·is·dangerous | ||
| 55 | as·user·can·login·to·the·system·as·root·via·Telnet,·which·sends·the·password·in | ||
| 56 | plain·text·over·the·network.·By·default,·Red·Hat·Enterprise·Linux·8's | ||
| 57 | <tt>/etc/securetty</tt>·file·only·allows·the·root·user·to·login·at·the·console | ||
| 58 | physically·attached·to·the·system.·To·prevent·root·from·logging·in,·remove·the | ||
| 59 | contents·of·this·file.·To·prevent·direct·root·logins,·remove·the·contents·of·this | ||
| 60 | file·by·typing·the·following·command: | ||
| 61 | <pre> | ||
| 62 | $·sudo·echo·>·/etc/securetty | ||
| 63 | </pre> | ||
| 64 | ······</td> | ||
| 65 | ······<td·xml:lang="en-US"> | ||
| 66 | ········Disabling·direct·root·logins·ensures·proper·accountability·and·multifactor | ||
| 67 | authentication·to·privileged·accounts.·Users·will·first·login,·then·escalate | ||
| 68 | to·privileged·(root)·access·via·su·/·sudo.·This·is·required·for·FISMA·Low | ||
| 69 | and·FISMA·Moderate·systems. | ||
| 70 | ······</td> | ||
| 71 | ····</tr> | ||
| 72 | ····<tr> | ||
| 73 | ······<td>3.1.1</td> | ||
| 74 | ······<td>Disable·GDM·Guest·Login</td> | ||
| 75 | ······<td·xml:lang="en-US"> | ||
| 76 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·login·without·credentials | ||
| 77 | which·can·be·useful·for·public·kiosk·scenarios.·Allowing·users·to·login·without·credentials | ||
| 78 | or·"guest"·account·access·has·inherent·security·risks·and·should·be·disabled.·To·do·disable | ||
| 79 | timed·logins·or·guest·account·access,·set·the·<tt>TimedLoginEnable</tt>·to·<tt>false</tt>·in | ||
| 80 | the·<tt>[daemon]</tt>·section·in·<tt>/etc/gdm/custom.conf</tt>.·For·example: | ||
| 81 | <pre>[daemon] | ||
| 82 | TimedLoginEnable=false</pre> | ||
| 83 | ······</td> | ||
| 84 | ······<td·xml:lang="en-US"> | ||
| 85 | ········Failure·to·restrict·system·access·to·authenticated·users·negatively·impacts·operating | ||
| 86 | system·security. | ||
| 87 | ······</td> | ||
| 88 | ····</tr> | ||
| 89 | ····<tr> | ||
| 90 | ······<td>3.1.1<br/>3.1.5</td> | 47 | ······<td>3.1.1<br/>3.1.5</td> |
| 91 | ······<td> | 48 | ······<td>Verify·Only·Root·Has·UID·0</td> |
| 92 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 93 | ········To·restrict·root·logins·through·the·(deprecated)·virtual·console·devices, | ||
| 94 | ensure·lines·of·this·form·do·not·appear·in·<tt>/etc/securetty</tt>: | ||
| 95 | <pre>vc/1 | ||
| 96 | vc/2 | ||
| 97 | vc/3 | ||
| 98 | 50 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | |
| 51 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 52 | their·UID·changed. | ||
| 53 | <br·/> | ||
| 54 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 55 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 56 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 57 | assigned. | ||
| 99 | ······</td> | 58 | ······</td> |
| 100 | ······<td·xml:lang="en-US"> | 59 | ······<td·xml:lang="en-US"> |
| 101 | ········Preventing·direct·root·login·to·virtual·console·devices | ||
| 102 | helps·ensure·accountability·for·actions·taken·on·the·system | ||
| 103 | usi | 60 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts |
| 61 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 62 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 63 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 64 | access·to·root·privileges·in·an·accountable·manner. | ||
| 104 | ······</td> | 65 | ······</td> |
| 105 | ····</tr> | 66 | ····</tr> |
| 106 | ····<tr> | 67 | ····<tr> |
| 107 | ······<td>3.1.1<br/>3.1.5</td> | 68 | ······<td>3.1.1<br/>3.1.5</td> |
| 108 | ······<td>Disable·SSH·Root·Login</td> | 69 | ······<td>Disable·SSH·Root·Login</td> |
| 109 | ······<td·xml:lang="en-US"> | 70 | ······<td·xml:lang="en-US"> |
| 110 | ········The·root·user·should·never·be·allowed·to·login·to·a | 71 | ········The·root·user·should·never·be·allowed·to·login·to·a |
| Offset 121, 32 lines modified | Offset 82, 28 lines modified | ||
| 121 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. | 82 | security·is·gained·by·extending·the·policy·of·not·logging·directly·on·as·root. |
| 122 | In·addition,·logging·in·with·a·user-specific·account·provides·individual | 83 | In·addition,·logging·in·with·a·user-specific·account·provides·individual |
| 123 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize | 84 | accountability·of·actions·performed·on·the·system·and·also·helps·to·minimize |
| 124 | direct·attack·attempts·on·root's·password. | 85 | direct·attack·attempts·on·root's·password. |
| 125 | ······</td> | 86 | ······</td> |
| 126 | ····</tr> | 87 | ····</tr> |
| 127 | ····<tr> | 88 | ····<tr> |
| 128 | ······<td>3.1.1<br/>3. | 89 | ······<td>3.1.1<br/>3.4.5</td> |
| 129 | ······<td> | 90 | ······<td>Require·Authentication·for·Emergency·Systemd·Target</td> |
| 130 | ······<td·xml:lang="en-US"> | 91 | ······<td·xml:lang="en-US"> |
| 92 | ········Emergency·mode·is·intended·as·a·system·recovery | ||
| 93 | method,·providing·a·single·user·root·access·to·the·system | ||
| 94 | during·a·failed·boot·sequence. | ||
| 95 | <br·/><br·/> | ||
| 96 | By·default,·Emergency·mode·is·protected·by·requiring·a·password·and·is·set | ||
| 97 | in·<tt>/usr/lib/systemd/system/emergency.service</tt>. | ||
| 131 | ········If·any·account·other·than·root·has·a·UID·of·0,·this·misconfiguration·should | ||
| 132 | be·investigated·and·the·accounts·other·than·root·should·be·removed·or·have | ||
| 133 | their·UID·changed. | ||
| 134 | <br·/> | ||
| 135 | If·the·account·is·associated·with·system·commands·or·applications·the·UID | ||
| 136 | should·be·changed·to·one·greater·than·"0"·but·less·than·"1000." | ||
| 137 | Otherwise·assign·a·UID·greater·than·"1000"·that·has·not·already·been | ||
| 138 | assigned. | ||
| 139 | ······</td> | 98 | ······</td> |
| 140 | ······<td·xml:lang="en-US"> | 99 | ······<td·xml:lang="en-US"> |
| 100 | ········This·prevents·attackers·with·physical·access·from·trivially·bypassing·security | ||
| 101 | on·the·machine·and·gaining·root·access.·Such·accesses·are·further·prevented | ||
| 102 | by·configuring·the·bootloader·password. | ||
| 141 | ········An·account·has·root·authority·if·it·has·a·UID·of·0.·Multiple·accounts | ||
| 142 | with·a·UID·of·0·afford·more·opportunity·for·potential·intruders·to | ||
| 143 | guess·a·password·for·a·privileged·account.·Proper·configuration·of | ||
| 144 | sudo·is·recommended·to·afford·multiple·system·administrators | ||
| 145 | access·to·root·privileges·in·an·accountable·manner. | ||
| 146 | ······</td> | 103 | ······</td> |
| 147 | ····</tr> | 104 | ····</tr> |
| 148 | ····<tr> | 105 | ····<tr> |
| 149 | ······<td>3.1.1</td> | 106 | ······<td>3.1.1</td> |
| 150 | ······<td>Disable·GDM·Automatic·Login</td> | 107 | ······<td>Disable·GDM·Automatic·Login</td> |
| 151 | ······<td·xml:lang="en-US"> | 108 | ······<td·xml:lang="en-US"> |
| 152 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without | 109 | ········The·GNOME·Display·Manager·(GDM)·can·allow·users·to·automatically·login·without |
| Offset 159, 43 lines modified | Offset 116, 28 lines modified | ||
| 159 | ······</td> | 116 | ······</td> |
| 160 | ······<td·xml:lang="en-US"> | 117 | ······<td·xml:lang="en-US"> |
| Max diff block lines reached; 429967/435894 bytes (98.64%) of diff not shown. | |||
| Offset 1, 48 lines modified | Offset 1, 31 lines modified | ||
| 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of·Red | 1 | Rules·with·NIST-800-171·Reference·in·Guide·to·the·Secure·Configuration·of·Red |
| 2 | Hat·Enterprise·Linux·8 | 2 | Hat·Enterprise·Linux·8 |
| 3 | ·······································To·further·limit·access·to·the·root·account, | ||
| 4 | ·······································administrators·can·disable·root·logins·at·the·console··Disabling·direct | ||
| 5 | ·······································by·editing·the·/etc/securetty·file.·This·file·lists····root·logins·ensures | ||
| 6 | ·······································all·devices·the·root·user·is·allowed·to·login·to.·If···proper | ||
| 7 | ·······································the·file·does·not·exist·at·all,·the·root·user·can······accountability·and | ||
| 8 | ·······································login·through·any·communication·device·on·the·system,··multifactor | ||
| 9 | ·······································whether·via·the·console·or·via·a·raw·network···········authentication·to | ||
| 10 | 3.1.1··································interface.·This·is·dangerous·as·user·can·login·to·the··privileged·accounts. | ||
| 11 | 3.1.6···Direct·root·Logins·Not·Allowed·system·as·root·via·Telnet,·which·sends·the·password·in·Users·will·first | ||
| 12 | ·······································plain·text·over·the·network.·By·default,·Red·Hat·······login,·then·escalate | ||
| 13 | ·······································Enterprise·Linux·8's·/etc/securetty·file·only·allows···to·privileged·(root) | ||
| 14 | ·······································the·root·user·to·login·at·the·console·physically·······access·via·su·/ | ||
| 15 | ·······································attached·to·the·system.·To·prevent·root·from·logging···sudo.·This·is | ||
| 16 | ·······································in,·remove·the·contents·of·this·file.·To·prevent·······required·for·FISMA | ||
| 17 | ·······································direct·root·logins,·remove·the·contents·of·this·file···Low·and·FISMA | ||
| 18 | ·······································by·typing·the·following·command:·······················Moderate·systems. | ||
| 19 | ·······································$·sudo·echo·>·/etc/securetty | ||
| 20 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 21 | ·······································login·without·credentials·which·can·be·useful·for | ||
| 22 | ·······································public·kiosk·scenarios.·Allowing·users·to·login········Failure·to·restrict | ||
| 23 | ·······································without·credentials·or·"guest"·account·access·has······system·access·to | ||
| 24 | 3.1.1···Disable·GDM·Guest·Login········inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users | ||
| 25 | ·······································disable·timed·logins·or·guest·account·access,·set·the··negatively·impacts | ||
| 26 | ·······································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/·operating·system | ||
| 27 | ·······································etc/gdm/custom.conf.·For·example:······················security. | ||
| 28 | ·······································[daemon] | ||
| 29 | ·······································TimedLoginEnable=false | ||
| 30 | ·······································To·restrict·root·logins·through·the·(deprecated)·······Preventing·direct | ||
| 31 | ·······································virtual·console·devices,·ensure·lines·of·this·form·do··root·login·to | ||
| 32 | ·······································not·appear·in·/etc/securetty:··························virtual·console | ||
| 33 | 3.1.1···Restrict·Virtual·Console·Root··vc/1···················································devices·helps·ensure | ||
| 34 | 3.1.5···Logins·························vc/2···················································accountability·for | ||
| 35 | ·······································vc/3···················································actions·taken·on·the | ||
| 36 | ·······································vc/4···················································system·using·the | ||
| 37 | ······························································································ | 3 | ······························································································An·account·has·root |
| 4 | ······························································································authority·if·it·has | ||
| 5 | ······························································································a·UID·of·0.·Multiple | ||
| 6 | ······························································································accounts·with·a·UID | ||
| 7 | ·······································If·any·account·other·than·root·has·a·UID·of·0,·this····of·0·afford·more | ||
| 8 | ·······································misconfiguration·should·be·investigated·and·the········opportunity·for | ||
| 9 | ·······································accounts·other·than·root·should·be·removed·or·have·····potential·intruders | ||
| 10 | ·······································their·UID·changed.·····································to·guess·a·password | ||
| 11 | 3.1.1···Verify·Only·Root·Has·UID·0·····If·the·account·is·associated·with·system·commands·or···for·a·privileged | ||
| 12 | 3.1.5··································applications·the·UID·should·be·changed·to·one·greater··account.·Proper | ||
| 13 | ·······································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··configuration·of | ||
| 14 | ·······································greater·than·"1000"·that·has·not·already·been··········sudo·is·recommended | ||
| 15 | ·······································assigned.··············································to·afford·multiple | ||
| 16 | ······························································································system | ||
| 17 | ······························································································administrators | ||
| 18 | ······························································································access·to·root | ||
| 19 | ······························································································privileges·in·an | ||
| 20 | ······························································································accountable·manner. | ||
| 38 | ······························································································Even·though·the | 21 | ······························································································Even·though·the |
| 39 | ······························································································communications | 22 | ······························································································communications |
| 40 | ······························································································channel·may·be | 23 | ······························································································channel·may·be |
| 41 | ······························································································encrypted,·an | 24 | ······························································································encrypted,·an |
| 42 | ······························································································additional·layer·of | 25 | ······························································································additional·layer·of |
| 43 | ······························································································security·is·gained | 26 | ······························································································security·is·gained |
| 44 | ······························································································by·extending·the | 27 | ······························································································by·extending·the |
| Offset 56, 61 lines modified | Offset 39, 45 lines modified | ||
| 56 | ······························································································accountability·of | 39 | ······························································································accountability·of |
| 57 | ······························································································actions·performed·on | 40 | ······························································································actions·performed·on |
| 58 | ······························································································the·system·and·also | 41 | ······························································································the·system·and·also |
| 59 | ······························································································helps·to·minimize | 42 | ······························································································helps·to·minimize |
| 60 | ······························································································direct·attack | 43 | ······························································································direct·attack |
| 61 | ······························································································attempts·on·root's | 44 | ······························································································attempts·on·root's |
| 62 | ······························································································password. | 45 | ······························································································password. |
| 63 | ······························································································An·account·has·root | ||
| 64 | ······························································································authority·if·it·has | ||
| 65 | ······························································································a·UID·of·0.·Multiple | ||
| 66 | ······························································································accounts·with·a·UID | ||
| 67 | ·······································If·any·account·other·than·root·has·a·UID·of·0,·this····of·0·afford·more | ||
| 68 | ·······································misconfiguration·should·be·investigated·and·the········opportunity·for | ||
| 69 | ·······································accounts·other·than·root·should·be·removed·or·have·····potential·intruders | ||
| 70 | ·······································their·UID·changed.·····································to·guess·a·password | ||
| 71 | 3.1.1···Verify·Only·Root·Has·UID·0·····If·the·account·is·associated·with·system·commands·or···for·a·privileged | ||
| 72 | 3.1.5··································applications·the·UID·should·be·changed·to·one·greater··account.·Proper | ||
| 73 | ·······································than·"0"·but·less·than·"1000."·Otherwise·assign·a·UID··configuration·of | ||
| 74 | ·······································greater·than·"1000"·that·has·not·already·been··········sudo·is·recommended | ||
| 75 | ·······································assigned.··············································to·afford·multiple | ||
| 76 | ······························································································s | 46 | ······························································································This·prevents |
| 77 | ······························································································administrators | ||
| 78 | ······························································································a | 47 | ······························································································attackers·with |
| 48 | ·······································Emergency·mode·is·intended·as·a·system·recovery········physical·access·from | ||
| 49 | ·······································method,·providing·a·single·user·root·access·to·the·····trivially·bypassing | ||
| 50 | 3.1.1···Require·Authentication·for·····system·during·a·failed·boot·sequence.··················security·on·the | ||
| 51 | 3.4.5···Emergency·Systemd·Target······························································machine·and·gaining | ||
| 52 | ·······································By·default,·Emergency·mode·is·protected·by·requiring·a·root·access.·Such | ||
| 53 | ·······································password·and·is·set·in·/usr/lib/systemd/system/········accesses·are·further | ||
| 79 | ······································· | 54 | ·······································emergency.service.·····································prevented·by |
| 80 | ······························································································ | 55 | ······························································································configuring·the |
| 56 | ······························································································bootloader·password. | ||
| 81 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | 57 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to |
| 82 | ·······································automatically·login·without·user·interaction·or | 58 | ·······································automatically·login·without·user·interaction·or |
| 83 | ·······································credentials.·User·should·always·be·required·to·········Failure·to·restrict | 59 | ·······································credentials.·User·should·always·be·required·to·········Failure·to·restrict |
| 84 | ·······································authenticate·themselves·to·the·system·that·they·are····system·access·to | 60 | ·······································authenticate·themselves·to·the·system·that·they·are····system·access·to |
| 85 | 3.1.1···Disable·GDM·Automatic·Login····authorized·to·use.·To·disable·user·ability·to··········authenticated·users | 61 | 3.1.1···Disable·GDM·Automatic·Login····authorized·to·use.·To·disable·user·ability·to··········authenticated·users |
| 86 | ·······································automatically·login·to·the·system,·set·the·············negatively·impacts | 62 | ·······································automatically·login·to·the·system,·set·the·············negatively·impacts |
| 87 | ·······································AutomaticLoginEnable·to·false·in·the·[daemon]·section··operating·system | 63 | ·······································AutomaticLoginEnable·to·false·in·the·[daemon]·section··operating·system |
| 88 | ·······································in·/etc/gdm/custom.conf.·For·example:··················security. | 64 | ·······································in·/etc/gdm/custom.conf.·For·example:··················security. |
| 89 | ·······································[daemon] | 65 | ·······································[daemon] |
| 90 | ·······································AutomaticLoginEnable=false | 66 | ·······································AutomaticLoginEnable=false |
| 67 | ·······································The·GNOME·Display·Manager·(GDM)·can·allow·users·to | ||
| 68 | ·······································login·without·credentials·which·can·be·useful·for | ||
| 69 | ·······································public·kiosk·scenarios.·Allowing·users·to·login········Failure·to·restrict | ||
| 70 | ·······································without·credentials·or·"guest"·account·access·has······system·access·to | ||
| 71 | 3.1.1···Disable·GDM·Guest·Login········inherent·security·risks·and·should·be·disabled.·To·do··authenticated·users | ||
| 72 | ·······································disable·timed·logins·or·guest·account·access,·set·the··negatively·impacts | ||
| 73 | ·······································TimedLoginEnable·to·false·in·the·[daemon]·section·in·/·operating·system | ||
| 74 | ·······································etc/gdm/custom.conf.·For·example:······················security. | ||
| 75 | ·······································[daemon] | ||
| 76 | ·······································TimedLoginEnable=false | ||
| 91 | ······························································································Preventing·direct | ||
| 92 | ······························································································root·login·to·serial | ||
| 93 | ·······································To·restrict·root·logins·on·serial·ports,·ensure·lines··port·interfaces | ||
| 94 | 3.1.1···Restrict·Serial·Port·Root······of·this·form·do·not·appear·in·/etc/securetty:··········helps·ensure | ||
| 95 | 3.1.5···Logins·························ttyS0··················································accountability·for | ||
| 96 | ·······································ttyS1··················································actions·taken·on·the | ||
| 97 | ······························································································systems·using·the | ||
| 98 | ······························································································root·account. | ||
| 99 | ······························································································This·prevents | ||
| Max diff block lines reached; 762256/777154 bytes (98.08%) of diff not shown. | |||
| Offset 4020, 15 lines modified | Offset 4020, 15 lines modified | ||
| 4020 | <tt>RekeyLimit</tt>. | 4020 | <tt>RekeyLimit</tt>. |
| 4021 | ··</td> | 4021 | ··</td> |
| 4022 | ··<td·xml:lang="en-US"> | 4022 | ··<td·xml:lang="en-US"> |
| 4023 | By·decreasing·the·limit·based·on·the·amount·of·data·and·enabling | 4023 | By·decreasing·the·limit·based·on·the·amount·of·data·and·enabling |
| 4024 | time-based·limit,·effects·of·potential·attacks·against | 4024 | time-based·limit,·effects·of·potential·attacks·against |
| 4025 | encryption·keys·are·limited. | 4025 | encryption·keys·are·limited. |
| 4026 | ··</td> | 4026 | ··</td> |
| 4027 | ··<td>var_ssh_client_rekey_limit_ | 4027 | ··<td>var_ssh_client_rekey_limit_time=1hour<br/>var_ssh_client_rekey_limit_size=1G</td> |
| 4028 | </tr> | 4028 | </tr> |
| 4029 | <tr> | 4029 | <tr> |
| 4030 | ··<td></td> | 4030 | ··<td></td> |
| 4031 | ··<td>CCE-83349-1</td> | 4031 | ··<td>CCE-83349-1</td> |
| 4032 | ··<td>SSH·client·uses·strong·entropy·to·seed·(for·CSH·like·shells)</td> | 4032 | ··<td>SSH·client·uses·strong·entropy·to·seed·(for·CSH·like·shells)</td> |
| 4033 | ··<td·xml:lang="en-US"> | 4033 | ··<td·xml:lang="en-US"> |
| 4034 | To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure | 4034 | To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure |
| Offset 1864, 16 lines modified | Offset 1864, 16 lines modified | ||
| 1864 | ·····CCE-···Ensure·/var/tmp··The·/var/tmp·directory·is·a·world-writable·directory·used·for·temporary·file·storage.····The·/var/tmp·partition·is·used·as·temporary·storage·by·many | 1864 | ·····CCE-···Ensure·/var/tmp··The·/var/tmp·directory·is·a·world-writable·directory·used·for·temporary·file·storage.····The·/var/tmp·partition·is·used·as·temporary·storage·by·many |
| 1865 | ·····82730-·Located·On·······Ensure·it·has·its·own·partition·or·logical·volume·at·installation·time,·or·migrate·it····programs.·Placing·/var/tmp·in·its·own·partition·enables·the | 1865 | ·····82730-·Located·On·······Ensure·it·has·its·own·partition·or·logical·volume·at·installation·time,·or·migrate·it····programs.·Placing·/var/tmp·in·its·own·partition·enables·the |
| 1866 | ·····3······Separate·········using·LVM.···············································································setting·of·more·restrictive·mount·options,·which·can·help | 1866 | ·····3······Separate·········using·LVM.···············································································setting·of·more·restrictive·mount·options,·which·can·help |
| 1867 | ············Partition·································································································protect·programs·which·use·it. | 1867 | ············Partition·································································································protect·programs·which·use·it. |
| 1868 | ·····························The·RekeyLimit·parameter·specifies·how·often·the·session·key·is·renegotiated,·both·in | 1868 | ·····························The·RekeyLimit·parameter·specifies·how·often·the·session·key·is·renegotiated,·both·in |
| 1869 | ·····························terms·of·amount·of·data·that·may·be·transmitted·and·the·time·elapsed.·To·decrease·the | 1869 | ·····························terms·of·amount·of·data·that·may·be·transmitted·and·the·time·elapsed.·To·decrease·the |
| 1870 | ·····CCE-···Configure········default·limits,·put·line·RekeyLimit·1G·1hour·to·file·/etc/ssh/ssh_config.d/02-rekey-·····By·decreasing·the·limit·based·on·the·amount·of·data·and | 1870 | ·····CCE-···Configure········default·limits,·put·line·RekeyLimit·1G·1hour·to·file·/etc/ssh/ssh_config.d/02-rekey-·····By·decreasing·the·limit·based·on·the·amount·of·data·and |
| 1871 | ·····82880-·session··········limit.conf.·Make·sure·that·there·is·no·other·RekeyLimit·configuration·preceding·the······enabling·time-based·limit,·effects·of·potential·attacks········var_ssh_client_rekey_limit_ | 1871 | ·····82880-·session··········limit.conf.·Make·sure·that·there·is·no·other·RekeyLimit·configuration·preceding·the······enabling·time-based·limit,·effects·of·potential·attacks········var_ssh_client_rekey_limit_time=1hour |
| 1872 | ·····6······renegotiation····include·directive·in·the·main·config·file·/etc/ssh/ssh_config.·Check·also·other·files·in·against·encryption·keys·are·limited.···························var_ssh_client_rekey_limit_ | 1872 | ·····6······renegotiation····include·directive·in·the·main·config·file·/etc/ssh/ssh_config.·Check·also·other·files·in·against·encryption·keys·are·limited.···························var_ssh_client_rekey_limit_size=1G |
| 1873 | ············for·SSH·client···/etc/ssh/ssh_config.d·directory.·Files·are·processed·according·to·lexicographical·order | 1873 | ············for·SSH·client···/etc/ssh/ssh_config.d·directory.·Files·are·processed·according·to·lexicographical·order |
| 1874 | ·····························of·file·names.·Make·sure·that·there·is·no·file·processed·before·02-rekey-limit.conf | 1874 | ·····························of·file·names.·Make·sure·that·there·is·no·file·processed·before·02-rekey-limit.conf |
| 1875 | ·····························containing·definition·of·RekeyLimit. | 1875 | ·····························containing·definition·of·RekeyLimit. |
| 1876 | ·····························To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure·that·the·······Some·SSH·implementations·use·the·openssl·library·for·entropy, | 1876 | ·····························To·set·up·SSH·client·to·use·entropy·from·a·high-quality·source,·make·sure·that·the·······Some·SSH·implementations·use·the·openssl·library·for·entropy, |
| 1877 | ············SSH·client·uses··appropriate·shell·environment·variable·is·configured.·The·SSH_USE_STRONG_RNG·environment·which·by·default,·doesn't·use·high-entropy·sources.·Randomness | 1877 | ············SSH·client·uses··appropriate·shell·environment·variable·is·configured.·The·SSH_USE_STRONG_RNG·environment·which·by·default,·doesn't·use·high-entropy·sources.·Randomness |
| 1878 | ·····CCE-···strong·entropy···variable·determines·how·many·bytes·of·entropy·to·use.·Make·sure·that·the·file·/etc/······is·needed·to·generate·considerably·more·secure·data-encryption | 1878 | ·····CCE-···strong·entropy···variable·determines·how·many·bytes·of·entropy·to·use.·Make·sure·that·the·file·/etc/······is·needed·to·generate·considerably·more·secure·data-encryption |
| 1879 | ·····83349-·to·seed·(for·CSH·profile.d/cc-ssh-strong-rng.csh·contains·line············································keys.·Plaintext·padding,·initialization·vectors·in·encryption | 1879 | ·····83349-·to·seed·(for·CSH·profile.d/cc-ssh-strong-rng.csh·contains·line············································keys.·Plaintext·padding,·initialization·vectors·in·encryption |
| Offset 7842, 18 lines modified | Offset 7842, 18 lines modified | ||
| 0001ea10:·2070·6173·7377·6f72·6473·2068·656c·7073···passwords·helps | 0001ea10:·2070·6173·7377·6f72·6473·2068·656c·7073···passwords·helps | ||
| 0001ea20:·2065·6e73·7572·6520·7468·6174·2061·2063···ensure·that·a·c | 0001ea20:·2065·6e73·7572·6520·7468·6174·2061·2063···ensure·that·a·c | ||
| 0001ea30:·6f6d·7072·6f6d·6973·6564·2070·6173·7377··ompromised·passw | 0001ea30:·6f6d·7072·6f6d·6973·6564·2070·6173·7377··ompromised·passw | ||
| 0001ea40:·6f72·6420·6973·206e·6f74·2072·652d·7573··ord·is·not·re-us | 0001ea40:·6f72·6420·6973·206e·6f74·2072·652d·7573··ord·is·not·re-us | ||
| 0001ea50:·6564·2062·7920·6120·7573·6572·2e0a·2020··ed·by·a·user..·· | 0001ea50:·6564·2062·7920·6120·7573·6572·2e0a·2020··ed·by·a·user..·· | ||
| 0001ea60:·3c2f·7464·3e0a·2020·3c74·643e·7661·725f··</td>.··<td>var_ | 0001ea60:·3c2f·7464·3e0a·2020·3c74·643e·7661·725f··</td>.··<td>var_ | ||
| 0001ea70:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | 0001ea70:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | ||
| 0001ea80:·656d·6265·723d·353c·6272·2f3e·7661·725f··ember=5<br/>var_ | |||
| 0001ea90:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | |||
| 0001ea | 0001eaa0:·656d·6265·725f·636f·6e74·726f·6c5f·666c··ember_control_fl | ||
| 0001ea | 0001eab0:·6167·3d72·6571·7569·7265·643c·2f74·643e··ag=required</td> | ||
| 0001eaa0:·7661·725f·7061·7373·776f·7264·5f70·616d··var_password_pam | |||
| 0001eab0:·5f72·656d·656d·6265·723d·353c·2f74·643e··_remember=5</td> | |||
| 0001eac0:·0a3c·2f74·723e·0a3c·7472·3e0a·2020·3c74··.</tr>.<tr>.··<t | 0001eac0:·0a3c·2f74·723e·0a3c·7472·3e0a·2020·3c74··.</tr>.<tr>.··<t | ||
| 0001ead0:·643e·4941·2d35·2866·293c·6272·2f3e·4941··d>IA-5(f)<br/>IA | 0001ead0:·643e·4941·2d35·2866·293c·6272·2f3e·4941··d>IA-5(f)<br/>IA | ||
| 0001eae0:·2d35·2831·2928·6529·3c2f·7464·3e0a·2020··-5(1)(e)</td>.·· | 0001eae0:·2d35·2831·2928·6529·3c2f·7464·3e0a·2020··-5(1)(e)</td>.·· | ||
| 0001eaf0:·3c74·643e·4343·452d·3833·3438·302d·343c··<td>CCE-83480-4< | 0001eaf0:·3c74·643e·4343·452d·3833·3438·302d·343c··<td>CCE-83480-4< | ||
| 0001eb00:·2f74·643e·0a20·203c·7464·3e4c·696d·6974··/td>.··<td>Limit | 0001eb00:·2f74·643e·0a20·203c·7464·3e4c·696d·6974··/td>.··<td>Limit | ||
| 0001eb10:·2050·6173·7377·6f72·6420·5265·7573·653a···Password·Reuse: | 0001eb10:·2050·6173·7377·6f72·6420·5265·7573·653a···Password·Reuse: | ||
| 0001eb20:·2073·7973·7465·6d2d·6175·7468·3c2f·7464···system-auth</td | 0001eb20:·2073·7973·7465·6d2d·6175·7468·3c2f·7464···system-auth</td | ||
| Offset 7899, 18 lines modified | Offset 7899, 18 lines modified | ||
| 0001eda0:·2070·6173·7377·6f72·6473·2068·656c·7073···passwords·helps | 0001eda0:·2070·6173·7377·6f72·6473·2068·656c·7073···passwords·helps | ||
| 0001edb0:·2065·6e73·7572·6520·7468·6174·2061·2063···ensure·that·a·c | 0001edb0:·2065·6e73·7572·6520·7468·6174·2061·2063···ensure·that·a·c | ||
| 0001edc0:·6f6d·7072·6f6d·6973·6564·2070·6173·7377··ompromised·passw | 0001edc0:·6f6d·7072·6f6d·6973·6564·2070·6173·7377··ompromised·passw | ||
| 0001edd0:·6f72·6420·6973·206e·6f74·2072·652d·7573··ord·is·not·re-us | 0001edd0:·6f72·6420·6973·206e·6f74·2072·652d·7573··ord·is·not·re-us | ||
| 0001ede0:·6564·2062·7920·6120·7573·6572·2e0a·2020··ed·by·a·user..·· | 0001ede0:·6564·2062·7920·6120·7573·6572·2e0a·2020··ed·by·a·user..·· | ||
| 0001edf0:·3c2f·7464·3e0a·2020·3c74·643e·7661·725f··</td>.··<td>var_ | 0001edf0:·3c2f·7464·3e0a·2020·3c74·643e·7661·725f··</td>.··<td>var_ | ||
| 0001ee00:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | 0001ee00:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | ||
| 0001ee10:·656d·6265·723d·353c·6272·2f3e·7661·725f··ember=5<br/>var_ | |||
| 0001ee20:·7061·7373·776f·7264·5f70·616d·5f72·656d··password_pam_rem | |||
| 0001ee | 0001ee30:·656d·6265·725f·636f·6e74·726f·6c5f·666c··ember_control_fl | ||
| 0001ee | 0001ee40:·6167·3d72·6571·7569·7265·643c·2f74·643e··ag=required</td> | ||
| 0001ee30:·7661·725f·7061·7373·776f·7264·5f70·616d··var_password_pam | |||
| 0001ee40:·5f72·656d·656d·6265·723d·353c·2f74·643e··_remember=5</td> | |||
| 0001ee50:·0a3c·2f74·723e·0a3c·7472·3e0a·2020·3c74··.</tr>.<tr>.··<t | 0001ee50:·0a3c·2f74·723e·0a3c·7472·3e0a·2020·3c74··.</tr>.<tr>.··<t | ||
| 0001ee60:·643e·4941·2d35·2863·293c·6272·2f3e·4941··d>IA-5(c)<br/>IA | 0001ee60:·643e·4941·2d35·2863·293c·6272·2f3e·4941··d>IA-5(c)<br/>IA | ||
| 0001ee70:·2d35·2831·2928·6129·3c62·722f·3e43·4d2d··-5(1)(a)<br/>CM- | 0001ee70:·2d35·2831·2928·6129·3c62·722f·3e43·4d2d··-5(1)(a)<br/>CM- | ||
| 0001ee80:·3628·6129·3c62·722f·3e49·412d·3528·3429··6(a)<br/>IA-5(4) | 0001ee80:·3628·6129·3c62·722f·3e49·412d·3528·3429··6(a)<br/>IA-5(4) | ||
| 0001ee90:·3c2f·7464·3e0a·2020·3c74·643e·4343·452d··</td>.··<td>CCE- | 0001ee90:·3c2f·7464·3e0a·2020·3c74·643e·4343·452d··</td>.··<td>CCE- | ||
| 0001eea0:·3830·3636·352d·333c·2f74·643e·0a20·203c··80665-3</td>.··< | 0001eea0:·3830·3636·352d·333c·2f74·643e·0a20·203c··80665-3</td>.··< | ||
| 0001eeb0:·7464·3e45·6e73·7572·6520·5041·4d20·456e··td>Ensure·PAM·En | 0001eeb0:·7464·3e45·6e73·7572·6520·5041·4d20·456e··td>Ensure·PAM·En |
| Offset 1472, 27 lines modified | Offset 1472, 27 lines modified | ||
| 1472 | ·····································pwquality.conf·to·equal·1·to·require·use·of·a·special·is·compromised.·Requiring·a·minimum·number·of·special·characters·makes | 1472 | ·····································pwquality.conf·to·equal·1·to·require·use·of·a·special·is·compromised.·Requiring·a·minimum·number·of·special·characters·makes |
| 1473 | ·····································character·in·passwords.·······························password·guessing·attacks·more·difficult·by·ensuring·a·larger·search | 1473 | ·····································character·in·passwords.·······························password·guessing·attacks·more·difficult·by·ensuring·a·larger·search |
| 1474 | ···························································································space. | 1474 | ···························································································space. |
| 1475 | ·····································Do·not·allow·users·to·reuse·recent·passwords.·This | 1475 | ·····································Do·not·allow·users·to·reuse·recent·passwords.·This |
| 1476 | ·····································can·be·accomplished·by·using·the·remember·option·for | 1476 | ·····································can·be·accomplished·by·using·the·remember·option·for |
| 1477 | ·····································the·pam_pwhistory·PAM·module. | 1477 | ·····································the·pam_pwhistory·PAM·module. |
| 1478 | IA-5(f)·CCE-···Limit·Password·Reuse:·In·the·file·/etc/pam.d/password-auth,·make·sure·the···Preventing·re-use·of·previous·passwords·helps·ensure·that·a·compromised····var_password_pam_remember | 1478 | IA-5(f)·CCE-···Limit·Password·Reuse:·In·the·file·/etc/pam.d/password-auth,·make·sure·the···Preventing·re-use·of·previous·passwords·helps·ensure·that·a·compromised····var_password_pam_remember=5 |
| 1479 | IA-5(1)·83478-·password-auth·········parameter·remember·is·present·and·it·has·a·value······password·is·not·re-used·by·a·user.·········································var_password_pam_remember= | 1479 | IA-5(1)·83478-·password-auth·········parameter·remember·is·present·and·it·has·a·value······password·is·not·re-used·by·a·user.·········································var_password_pam_remember_control_flag=required |
| 1480 | (e)·····8····························equal·to·or·greater·than·5.·For·example: | 1480 | (e)·····8····························equal·to·or·greater·than·5.·For·example: |
| 1481 | ·····································password·control_flag·pam_pwhistory.so | 1481 | ·····································password·control_flag·pam_pwhistory.so |
| 1482 | ·····································...existing_options...·remember=5·use_authtok | 1482 | ·····································...existing_options...·remember=5·use_authtok |
| 1483 | ·····································control_flag·should·be·one·of·the·next·values: | 1483 | ·····································control_flag·should·be·one·of·the·next·values: |
| 1484 | ·····································required | 1484 | ·····································required |
| 1485 | ·····································Do·not·allow·users·to·reuse·recent·passwords.·This | 1485 | ·····································Do·not·allow·users·to·reuse·recent·passwords.·This |
| 1486 | ·····································can·be·accomplished·by·using·the·remember·option·for | 1486 | ·····································can·be·accomplished·by·using·the·remember·option·for |
| 1487 | ·····································the·pam_pwhistory·PAM·module. | 1487 | ·····································the·pam_pwhistory·PAM·module. |
| 1488 | IA-5(f)·CCE-···Limit·Password·Reuse:·In·the·file·/etc/pam.d/system-auth,·make·sure·the·····Preventing·re-use·of·previous·passwords·helps·ensure·that·a·compromised····var_password_pam_remember | 1488 | IA-5(f)·CCE-···Limit·Password·Reuse:·In·the·file·/etc/pam.d/system-auth,·make·sure·the·····Preventing·re-use·of·previous·passwords·helps·ensure·that·a·compromised····var_password_pam_remember=5 |
| 1489 | IA-5(1)·83480-·system-auth···········parameter·remember·is·present·and·it·has·a·value······password·is·not·re-used·by·a·user.·········································var_password_pam_remember= | 1489 | IA-5(1)·83480-·system-auth···········parameter·remember·is·present·and·it·has·a·value······password·is·not·re-used·by·a·user.·········································var_password_pam_remember_control_flag=required |
| 1490 | (e)·····4····························equal·to·or·greater·than·5·For·example: | 1490 | (e)·····4····························equal·to·or·greater·than·5·For·example: |
| 1491 | ·····································password·control_flag·pam_pwhistory.so | 1491 | ·····································password·control_flag·pam_pwhistory.so |
| 1492 | ·····································...existing_options...·remember=5·use_authtok | 1492 | ·····································...existing_options...·remember=5·use_authtok |
| 1493 | ·····································control_flag·should·be·one·of·the·next·values: | 1493 | ·····································control_flag·should·be·one·of·the·next·values: |
| 1494 | ·····································required | 1494 | ·····································required |
| 1495 | ·····································The·pam_pwquality·module's·ucredit=·parameter·········Use·of·a·complex·password·helps·to·increase·the·time·and·resources | 1495 | ·····································The·pam_pwquality·module's·ucredit=·parameter·········Use·of·a·complex·password·helps·to·increase·the·time·and·resources |
| 1496 | ·····································controls·requirements·for·usage·of·uppercase·letters··required·to·compromise·the·password.·Password·complexity,·or·strength,·is | 1496 | ·····································controls·requirements·for·usage·of·uppercase·letters··required·to·compromise·the·password.·Password·complexity,·or·strength,·is |
| Offset 64, 11692 lines modified | Offset 64, 11692 lines modified | ||
| 000003f0:·6e67·3c2f·7468·3e0a·2020·2020·3c74·683e··ng</th>.····<th> | 000003f0:·6e67·3c2f·7468·3e0a·2020·2020·3c74·683e··ng</th>.····<th> | ||
| 00000400:·5275·6c65·2054·6974·6c65·3c2f·7468·3e0a··Rule·Title</th>. | 00000400:·5275·6c65·2054·6974·6c65·3c2f·7468·3e0a··Rule·Title</th>. | ||
| 00000410:·2020·2020·3c74·683e·4465·7363·7269·7074······<th>Descript | 00000410:·2020·2020·3c74·683e·4465·7363·7269·7074······<th>Descript | ||
| 00000420:·696f·6e3c·2f74·683e·0a20·2020·203c·7468··ion</th>.····<th | 00000420:·696f·6e3c·2f74·683e·0a20·2020·203c·7468··ion</th>.····<th | ||
| 00000430:·3e52·6174·696f·6e61·6c65·3c2f·7468·3e0a··>Rationale</th>. | 00000430:·3e52·6174·696f·6e61·6c65·3c2f·7468·3e0a··>Rationale</th>. | ||
| 00000440:·2020·3c2f·7468·6561·643e·0a20·203c·7462····</thead>.··<tb | 00000440:·2020·3c2f·7468·6561·643e·0a20·203c·7462····</thead>.··<tb | Diff chunk too large, falling back to line-by-line diff (2642 lines added, 2642 lines removed) | |
| 00000450:·6f64·793e·0a20·203c·7472·3e0a·2020·2020··ody>.··<tr>.···· | 00000450:·6f64·793e·0a20·203c·7472·3e0a·2020·2020··ody>.··<tr>.···· | ||
| 00000460:·2020·3c74·643e·4155·2d32·286 | 00000460:·2020·3c74·643e·4155·2d32·2861·293c·2f74····<td>AU-2(a)</t | ||
| 00000470:· | 00000470:·643e·0a20·2020·2020·203c·7464·3e43·6f6e··d>.······<td>Con | ||
| 00000480:· | 00000480:·6669·6775·7265·2061·7564·6974·696e·6720··figure·auditing· | ||
| 00000490:· | 00000490:·6f66·2075·6e73·7563·6365·7373·6675·6c20··of·unsuccessful· | ||
| 000004a0:· | 000004a0:·6669·6c65·2061·6363·6573·7365·733c·2f74··file·accesses</t | ||
| 000004b0:· | 000004b0:·643e·0a20·2020·2020·203c·7464·2078·6d6c··d>.······<td·xml | ||
| 000004c0:· | 000004c0:·3a6c·616e·673d·2265·6e2d·5553·223e·0a20··:lang="en-US">.· | ||
| 000004d0:· | 000004d0:·2020·2020·2020·2045·6e73·7572·6520·7468·········Ensure·th | ||
| 000004e0:·207 | 000004e0:·6174·2075·6e73·7563·6365·7373·6675·6c20··at·unsuccessful· | ||
| 000004f0:· | 000004f0:·6174·7465·6d70·7473·2074·6f20·6163·6365··attempts·to·acce | ||
| 00000500:·7 | 00000500:·7373·2061·2066·696c·6520·6172·6520·6175··ss·a·file·are·au | ||
| 00000510:·6 | 00000510:·6469·7465·642e·0a0a·5468·6520·666f·6c6c··dited...The·foll | ||
| 00000520:·6 | 00000520:·6f77·696e·6720·7275·6c65·7320·636f·6e66··owing·rules·conf | ||
| 00000530:·6 | 00000530:·6967·7572·6520·6175·6469·7420·6173·2064··igure·audit·as·d | ||
| 00000540:· | 00000540:·6573·6372·6962·6564·2061·626f·7665·3a0a··escribed·above:. | ||
| 00000550:· | 00000550:·3c70·7265·3e23·2320·556e·7375·6363·6573··<pre>##·Unsucces | ||
| 00000560:· | 00000560:·7366·756c·2066·696c·6520·6163·6365·7373··sful·file·access | ||
| 00000570:· | 00000570:·2028·616e·7920·6f74·6865·7220·6f70·656e···(any·other·open | ||
| 00000580:· | 00000580:·7329·2054·6869·7320·6861·7320·746f·2067··s)·This·has·to·g | ||
| 00000590:· | 00000590:·6f20·6c61·7374·2e0a·2d61·2061·6c77·6179··o·last..-a·alway | ||
| 000005a0:·7 | 000005a0:·732c·6578·6974·202d·4620·6172·6368·3d62··s,exit·-F·arch=b | ||
| 000005b0:· | 000005b0:·3332·202d·5320·6f70·656e·2c6f·7065·6e61··32·-S·open,opena | ||
| 000005c0:· | 000005c0:·742c·6f70·656e·6174·322c·6f70·656e·5f62··t,openat2,open_b | ||
| 000005d0:· | 000005d0:·795f·6861·6e64·6c65·5f61·7420·2d46·2065··y_handle_at·-F·e | ||
| 000005e0:· | 000005e0:·7869·743d·2d45·4143·4345·5320·2d46·2061··xit=-EACCES·-F·a | ||
| 000005f0:·7 | 000005f0:·7569·643e·3d31·3030·3020·2d46·2061·7569··uid>=1000·-F·aui | ||
| 00000600:·6 | 00000600:·6421·3d75·6e73·6574·202d·4620·6b65·793d··d!=unset·-F·key= | ||
| 00000610:·7 | 00000610:·756e·7375·6363·6573·7366·756c·2d61·6363··unsuccessful-acc | ||
| 00000620:· | 00000620:·6573·730a·2d61·2061·6c77·6179·732c·6578··ess.-a·always,ex | ||
| 00000630:· | 00000630:·6974·202d·4620·6172·6368·3d62·3634·202d··it·-F·arch=b64·- | ||
| 00000640:· | 00000640:·5320·6f70·656e·2c6f·7065·6e61·742c·6f70··S·open,openat,op | ||
| 00000650:·6 | 00000650:·656e·6174·322c·6f70·656e·5f62·795f·6861··enat2,open_by_ha | ||
| 00000660:· | 00000660:·6e64·6c65·5f61·7420·2d46·2065·7869·743d··ndle_at·-F·exit= | ||
| 00000670:· | 00000670:·2d45·4143·4345·5320·2d46·2061·7569·643e··-EACCES·-F·auid> | ||
| 00000680:· | 00000680:·3d31·3030·3020·2d46·2061·7569·6421·3d75··=1000·-F·auid!=u | ||
| 00000690:· | 00000690:·6e73·6574·202d·4620·6b65·793d·756e·7375··nset·-F·key=unsu | ||
| 000006a0:· | 000006a0:·6363·6573·7366·756c·2d61·6363·6573·730a··ccessful-access. | ||
| 000006b0:·2 | 000006b0:·2d61·2061·6c77·6179·732c·6578·6974·202d··-a·always,exit·- | ||
| 000006c0:· | 000006c0:·4620·6172·6368·3d62·3332·202d·5320·6f70··F·arch=b32·-S·op | ||
| 000006d0:· | 000006d0:·656e·2c6f·7065·6e61·742c·6f70·656e·6174··en,openat,openat | ||
| 000006e0:· | 000006e0:·322c·6f70·656e·5f62·795f·6861·6e64·6c65··2,open_by_handle | ||
| 000006f0:· | 000006f0:·5f61·7420·2d46·2065·7869·743d·2d45·5045··_at·-F·exit=-EPE | ||
| 00000700:· | 00000700:·524d·202d·4620·6175·6964·3e3d·3130·3030··RM·-F·auid>=1000 | ||
| 00000710:· | 00000710:·202d·4620·6175·6964·213d·756e·7365·7420···-F·auid!=unset· | ||
| 00000720:· | 00000720:·2d46·206b·6579·3d75·6e73·7563·6365·7373··-F·key=unsuccess | ||
| 00000730:· | 00000730:·6675·6c2d·6163·6365·7373·0a2d·6120·616c··ful-access.-a·al | ||
| 00000740:·7 | 00000740:·7761·7973·2c65·7869·7420·2d46·2061·7263··ways,exit·-F·arc | ||
| 00000750:· | 00000750:·683d·6236·3420·2d53·206f·7065·6e2c·6f70··h=b64·-S·open,op | ||
| 00000760:· | 00000760:·656e·6174·2c6f·7065·6e61·7432·2c6f·7065··enat,openat2,ope | ||
| 00000770:· | 00000770:·6e5f·6279·5f68·616e·646c·655f·6174·202d··n_by_handle_at·- | ||
| 00000780:· | 00000780:·4620·6578·6974·3d2d·4550·4552·4d20·2d46··F·exit=-EPERM·-F | ||
| 00000790:·2061· | 00000790:·2061·7569·643e·3d31·3030·3020·2d46·2061···auid>=1000·-F·a | ||
| 000007a0:· | 000007a0:·7569·6421·3d75·6e73·6574·202d·4620·6b65··uid!=unset·-F·ke | ||
| 000007b0:·7 | 000007b0:·793d·756e·7375·6363·6573·7366·756c·2d61··y=unsuccessful-a | ||
| 000007c0:· | 000007c0:·6363·6573·7320·2020·203c·2f70·7265·3e0a··ccess····</pre>. | ||
| 000007d0:· | 000007d0:·0a4c·6f61·6420·6e65·7720·4175·6469·7420··.Load·new·Audit· | ||
| 000007e0:·7 | 000007e0:·7275·6c65·7320·696e·746f·206b·6572·6e65··rules·into·kerne | ||
| 000007f0:· | 000007f0:·6c20·6279·2072·756e·6e69·6e67·3a0a·3c70··l·by·running:.<p | ||
| 00000800:· | 00000800:·7265·3e61·7567·656e·7275·6c65·7320·2d2d··re>augenrules·-- | ||
| 00000810:· | 00000810:·6c6f·6164·3c2f·7072·653e·0a0a·4e6f·7465··load</pre>..Note | ||
| 00000820:· | 00000820:·3a20·5468·6973·2072·756c·6520·7573·6573··:·This·rule·uses | ||
| 00000830:·206 | 00000830:·2061·2073·7065·6369·616c·2073·6574·206f···a·special·set·o | ||
| 00000840:· | 00000840:·6620·4175·6469·7420·7275·6c65·7320·746f··f·Audit·rules·to | ||
| 00000850:·2 | 00000850:·2063·6f6d·706c·7920·7769·7468·204f·5350···comply·with·OSP | ||
| 00000860:· | 00000860:·5020·342e·322e·312e·2059·6f75·206d·6179··P·4.2.1.·You·may | ||
| 00000870:· | 00000870:·2072·6575·7365·2074·6869·7320·7275·6c65···reuse·this·rule | ||
| 00000880:· | 00000880:·2069·6e20·6469·6666·6572·656e·7420·7072···in·different·pr | ||
| 00000890:·6 | 00000890:·6f66·696c·6573·2e20·4966·2079·6f75·2064··ofiles.·If·you·d | ||
| 000008a0:·65 | 000008a0:·6563·6964·6520·746f·2064·6f20·736f·2c20··ecide·to·do·so,· | ||
| 000008b0:·6 | 000008b0:·6974·2069·7320·7265·636f·6d6d·656e·6465··it·is·recommende | ||
| 000008c0:· | 000008c0:·6420·7468·6174·2079·6f75·2069·6e73·7065··d·that·you·inspe | ||
| 000008d0:·6 | 000008d0:·6374·2063·6f6e·7465·6e74·7320·6f66·2074··ct·contents·of·t | ||
| 000008e0:· | 000008e0:·6865·2066·696c·6520·636c·6f73·656c·7920··he·file·closely· | ||
| 000008f0:· | 000008f0:·616e·6420·6d61·6b65·2073·7572·6520·7468··and·make·sure·th | ||
| 00000900:· | 00000900:·6174·2074·6865·7920·6172·6520·616c·6c69··at·they·are·alli | ||
| 00000910:· | 00000910:·676e·6564·2077·6974·6820·796f·7572·206e··gned·with·your·n | ||
| 00000920:·6 | 00000920:·6565·6473·2e0a·2020·2020·2020·3c2f·7464··eeds..······</td | ||
| 00000930:· | 00000930:·3e0a·2020·2020·2020·3c74·6420·786d·6c3a··>.······<td·xml: | ||
| 00000940:· | 00000940:·6c61·6e67·3d22·656e·2d55·5322·3e0a·2020··lang="en-US">.·· | ||
| 00000950:· | 00000950:·2020·2020·2020·556e·7375·6363·6573·7366········Unsuccessf | ||
| 00000960:· | 00000960:·756c·2061·7474·656d·7074·7320·746f·2061··ul·attempts·to·a | ||
| 00000970:· | 00000970:·6363·6573·7320·6120·6669·6c65·206d·6967··ccess·a·file·mig | ||
| 00000980:·6 | 00000980:·6874·2062·6520·7369·676e·7320·6f66·206d··ht·be·signs·of·m | ||
| 00000990:·6 | 00000990:·616c·6963·696f·7573·2061·6374·6976·6974··alicious·activit | ||
| 000009a0:· | 000009a0:·7920·6861·7070·656e·696e·6720·7769·7468··y·happening·with | ||
| 000009b0:·6 | 000009b0:·696e·2074·6865·2073·7973·7465·6d2e·2041··in·the·system.·A | ||
| 000009c0:·7 | 000009c0:·7564·6974·696e·6720·6f66·2073·7563·6820··uditing·of·such· | ||
| 000009d0:· | 000009d0:·6163·7469·7669·7469·6573·2068·656c·7073··activities·helps | ||
| 000009e0:·206 | 000009e0:·2069·6e20·7468·6569·7220·6d6f·6e69·746f···in·their·monito | ||
| 000009f0:·72 | 000009f0:·7269·6e67·2061·6e64·2069·6e76·6573·7469··ring·and·investi | ||
| 00000a00:·6 | 00000a00:·6761·7469·6f6e·2e0a·2020·2020·2020·3c2f··gation..······</ | ||
| 00000a10:·746 | 00000a10:·7464·3e0a·2020·2020·3c2f·7472·3e0a·2020··td>.····</tr>.·· | ||
| 00000a20:·2020· | 00000a20:·2020·3c74·723e·0a20·2020·2020·203c·7464····<tr>.······<td | ||
| 00000a30:·3 | 00000a30:·3e41·552d·3228·6429·3c62·722f·3e41·552d··>AU-2(d)<br/>AU- | ||
| 00000a40:· | 00000a40:·3132·2863·293c·6272·2f3e·434d·2d36·2861··12(c)<br/>CM-6(a | ||
| 00000a50:·3c | 00000a50:·293c·2f74·643e·0a20·2020·2020·203c·7464··)</td>.······<td | ||
| 00000a60:· | 00000a60:·3e52·6563·6f72·6420·556e·7375·6363·6573··>Record·Unsucces | ||
| 00000a70:· | 00000a70:·7366·756c·2050·6572·6d69·7373·696f·6e20··sful·Permission· | ||
| 00000a80:· | 00000a80:·4368·616e·6765·7320·746f·2046·696c·6573··Changes·to·Files | ||
| 00000a90:· | 00000a90:·202d·2073·6574·7861·7474·723c·2f74·643e···-·setxattr</td> | ||
| 00000aa0:· | 00000aa0:·0a20·2020·2020·203c·7464·2078·6d6c·3a6c··.······<td·xml:l | ||
| 00000ab0:·6 | 00000ab0:·616e·673d·2265·6e2d·5553·223e·0a20·2020··ang="en-US">.··· | ||
| 00000ac0:·20 | 00000ac0:·2020·2020·2054·6865·2061·7564·6974·2073·······The·audit·s | ||
| 00000ad0:· | 00000ad0:·7973·7465·6d20·7368·6f75·6c64·2063·6f6c··ystem·should·col | ||
| 00000ae0:· | 00000ae0:·6c65·6374·2075·6e73·7563·6365·7373·6675··lect·unsuccessfu | ||
| 00000af0:·6c | 00000af0:·6c20·6669·6c65·2070·6572·6d69·7373·696f··l·file·permissio | ||
| 00000b00:·6 | 00000b00:·6e20·6368·616e·6765·0a61·7474·656d·7074··n·change.attempt | ||
| 00000b10:· | 00000b10:·7320·666f·7220·616c·6c20·7573·6572·7320··s·for·all·users· | ||
| 00000b20:· | 00000b20:·616e·6420·726f·6f74·2e0a·4966·2074·6865··and·root..If·the | ||
| 00000b30:· | 00000b30:·203c·7474·3e61·7564·6974·643c·2f74·743e···<tt>auditd</tt> | ||
| 00000b40:· | 00000b40:·2064·6165·6d6f·6e20·6973·2063·6f6e·6669···daemon·is·confi | ||
| 00000b50:·6 | 00000b50:·6775·7265·640a·746f·2075·7365·2074·6865··gured.to·use·the | ||
| 00000b60:·20 | 00000b60:·203c·7474·3e61·7567·656e·7275·6c65·733c···<tt>augenrules< | ||
| 00000b70:· | 00000b70:·2f74·743e·2070·726f·6772·616d·2074·6f20··/tt>·program·to· | ||
| 00000b80:·72 | 00000b80:·7265·6164·2061·7564·6974·2072·756c·6573··read·audit·rules | ||
| 00000b90:· | 00000b90:·2064·7572·696e·6720·6461·656d·6f6e·0a73···during·daemon.s | ||
| 00000ba0:· | 00000ba0:·7461·7274·7570·2028·7468·6520·6465·6661··tartup·(the·defa | ||
| 00000bb0:· | 00000bb0:·756c·7429·2c20·6164·6420·7468·6520·666f··ult),·add·the·fo | ||
| 00000bc0:·6 | 00000bc0:·6c6c·6f77·696e·6720·6c69·6e65·7320·746f··llowing·lines·to | ||
| Max diff block lines reached; 5827443/6192617 bytes (94.10%) of diff not shown. | |||
| Offset 41, 28 lines modified | Offset 41, 14 lines modified | ||
| 41 | ····<th>Rule·Title</th> | 41 | ····<th>Rule·Title</th> |
| 42 | ····<th>Description</th> | 42 | ····<th>Description</th> |
| 43 | ····<th>Rationale</th> | 43 | ····<th>Rationale</th> |
| 44 | ··</thead> | 44 | ··</thead> |
| 45 | ··<tbody> | 45 | ··<tbody> |
| 46 | ··<tr> | 46 | ··<tr> |
| 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | 47 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> |
| 48 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 49 | ······<td·xml:lang="en-US"> | ||
| 50 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 51 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 52 | ······</td> | ||
| 53 | ······<td·xml:lang="en-US"> | ||
| 54 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 55 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 56 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 57 | the·network. | ||
| 58 | ······</td> | ||
| 59 | ····</tr> | ||
| 60 | ····<tr> | ||
| 61 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 62 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> | 48 | ······<td>Ensure·IPv6·is·disabled·through·kernel·boot·parameter</td> |
| 63 | ······<td·xml:lang="en-US"> | 49 | ······<td·xml:lang="en-US"> |
| 64 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, | 50 | ········To·disable·IPv6·protocol·support·in·the·Linux·kernel, |
| 65 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default | 51 | add·the·argument·<tt>ipv6.disable=1</tt>·to·the·default |
| 66 | GRUB2·command·line·for·the·Linux·operating·system. | 52 | GRUB2·command·line·for·the·Linux·operating·system. |
| 67 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line | 53 | To·ensure·that·<tt>ipv6.disable=1</tt>·is·added·as·a·kernel·command·line |
| 68 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the | 54 | argument·to·newly·installed·kernels,·add·<tt>ipv6.disable=1</tt>·to·the |
| Offset 73, 14 lines modified | Offset 59, 28 lines modified | ||
| 73 | ······</td> | 59 | ······</td> |
| 74 | ······<td·xml:lang="en-US"> | 60 | ······<td·xml:lang="en-US"> |
| 75 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce | 61 | ········Any·unnecessary·network·stacks,·including·IPv6,·should·be·disabled·to·reduce |
| 76 | the·vulnerability·to·exploitation. | 62 | the·vulnerability·to·exploitation. |
| 77 | ······</td> | 63 | ······</td> |
| 78 | ····</tr> | 64 | ····</tr> |
| 79 | ····<tr> | 65 | ····<tr> |
| 66 | ······<td>Req-1.3.1<br/>Req-1.3.2</td> | ||
| 67 | ······<td>Disable·Kernel·Parameter·for·IP·Forwarding·on·IPv4·Interfaces</td> | ||
| 68 | ······<td·xml:lang="en-US"> | ||
| 69 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.ip_forward</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.ip_forward=0</pre> | ||
| 70 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.ip_forward·=·0</pre> | ||
| 71 | ······</td> | ||
| 72 | ······<td·xml:lang="en-US"> | ||
| 73 | ········Routing·protocol·daemons·are·typically·used·on·routers·to·exchange | ||
| 74 | network·topology·information·with·other·routers.·If·this·capability·is·used·when | ||
| 75 | not·required,·system·network·information·may·be·unnecessarily·transmitted·across | ||
| 76 | the·network. | ||
| 77 | ······</td> | ||
| 78 | ····</tr> | ||
| 79 | ····<tr> | ||
| 80 | ······<td>Req-1.3.3</td> | 80 | ······<td>Req-1.3.3</td> |
| 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> | 81 | ······<td>Deactivate·Wireless·Network·Interfaces</td> |
| 82 | ······<td·xml:lang="en-US"> | 82 | ······<td·xml:lang="en-US"> |
| 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless | 83 | ········Deactivating·wireless·network·interfaces·should·prevent·normal·usage·of·the·wireless |
| 84 | capability. | 84 | capability. |
| 85 | <br·/><br·/> | 85 | <br·/><br·/> |
| Offset 111, 30 lines modified | Offset 111, 14 lines modified | ||
| 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, | 111 | is·the·only·place·that·loopback·network·traffic·should·be·seen, |
| 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an | 112 | all·other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 113 | anti-spoofing·measure. | 113 | anti-spoofing·measure. |
| 114 | ······</td> | 114 | ······</td> |
| 115 | ····</tr> | 115 | ····</tr> |
| 116 | ····<tr> | 116 | ····<tr> |
| 117 | ······<td>Req-1.4.1</td> | 117 | ······<td>Req-1.4.1</td> |
| 118 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 119 | ······<td·xml:lang="en-US"> | ||
| 120 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 121 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 122 | ······</td> | ||
| 123 | ······<td·xml:lang="en-US"> | ||
| 124 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 125 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 126 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 127 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 128 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 129 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 130 | ······</td> | ||
| 131 | ····</tr> | ||
| 132 | ····<tr> | ||
| 133 | ······<td>Req-1.4.1</td> | ||
| 134 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> | 118 | ······<td>Set·Default·ip6tables·Policy·for·Incoming·Packets</td> |
| 135 | ······<td·xml:lang="en-US"> | 119 | ······<td·xml:lang="en-US"> |
| 136 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for | 120 | ········To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)·for |
| 137 | the·built-in·INPUT·chain·which·processes·incoming·packets, | 121 | the·built-in·INPUT·chain·which·processes·incoming·packets, |
| 138 | add·or·correct·the·following·line·in | 122 | add·or·correct·the·following·line·in |
| 139 | <tt>/etc/sysconfig/ip6tables</tt>: | 123 | <tt>/etc/sysconfig/ip6tables</tt>: |
| 140 | <pre>:INPUT·DROP·[0:0]</pre> | 124 | <pre>:INPUT·DROP·[0:0]</pre> |
| Offset 176, 14 lines modified | Offset 160, 30 lines modified | ||
| 176 | typically·critical·to·operation·of·the·system.·The·loopback·interface· | 160 | typically·critical·to·operation·of·the·system.·The·loopback·interface· |
| 177 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· | 161 | is·the·only·place·that·loopback·network·traffic·should·be·seen,·all· |
| 178 | other·interfaces·should·ignore·traffic·on·this·network·as·an | 162 | other·interfaces·should·ignore·traffic·on·this·network·as·an |
| 179 | anti-spoofing·measure. | 163 | anti-spoofing·measure. |
| 180 | ······</td> | 164 | ······</td> |
| 181 | ····</tr> | 165 | ····</tr> |
| 182 | ····<tr> | 166 | ····<tr> |
| 167 | ······<td>Req-1.4.1</td> | ||
| 168 | ······<td>Enable·Kernel·Parameter·to·Use·TCP·Syncookies·on·Network·Interfaces</td> | ||
| 169 | ······<td·xml:lang="en-US"> | ||
| 170 | ········To·set·the·runtime·status·of·the·<code>net.ipv4.tcp_syncookies</code>·kernel·parameter,·run·the·following·command:·<pre>$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1</pre> | ||
| 171 | To·make·sure·that·the·setting·is·persistent,·add·the·following·line·to·a·file·in·the·directory·<tt>/etc/sysctl.d</tt>:·<pre>net.ipv4.tcp_syncookies·=·1</pre> | ||
| 172 | ······</td> | ||
| 173 | ······<td·xml:lang="en-US"> | ||
| 174 | ········A·TCP·SYN·flood·attack·can·cause·a·denial·of·service·by·filling·a | ||
| 175 | system's·TCP·connection·table·with·connections·in·the·SYN_RCVD·state. | ||
| 176 | Syncookies·can·be·used·to·track·a·connection·when·a·subsequent·ACK·is·received, | ||
| 177 | verifying·the·initiator·is·attempting·a·valid·connection·and·is·not·a·flood | ||
| 178 | source.·This·feature·is·activated·when·a·flood·condition·is·detected,·and | ||
| 179 | enables·the·system·to·continue·servicing·valid·connection·requests. | ||
| 180 | ······</td> | ||
| 181 | ····</tr> | ||
| 182 | ····<tr> | ||
| 183 | ······<td>Req-1.4.2</td> | 183 | ······<td>Req-1.4.2</td> |
| 184 | ······<td>Disable·SCTP·Support</td> | 184 | ······<td>Disable·SCTP·Support</td> |
| 185 | ······<td·xml:lang="en-US"> | 185 | ······<td·xml:lang="en-US"> |
| 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a | 186 | ········The·Stream·Control·Transmission·Protocol·(SCTP)·is·a |
| 187 | transport·layer·protocol,·designed·to·support·the·idea·of | 187 | transport·layer·protocol,·designed·to·support·the·idea·of |
| 188 | message-oriented·communication,·with·several·streams·of·messages | 188 | message-oriented·communication,·with·several·streams·of·messages |
| 189 | within·one·connection. | 189 | within·one·connection. |
| Offset 248, 14 lines modified | Offset 248, 41 lines modified | ||
| 248 | <br·/> | 248 | <br·/> |
| 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast | 249 | Ignoring·ICMP·echo·requests·(pings)·sent·to·broadcast·or·multicast |
| 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. | 250 | addresses·makes·the·system·slightly·more·difficult·to·enumerate·on·the·network. |
| 251 | ······</td> | 251 | ······</td> |
| 252 | ····</tr> | 252 | ····</tr> |
| 253 | ····<tr> | 253 | ····<tr> |
| 254 | ······<td>Req-1.4.3</td> | 254 | ······<td>Req-1.4.3</td> |
| Max diff block lines reached; 253353/261092 bytes (97.04%) of diff not shown. | |||
| Offset 1, 13 lines modified | Offset 1, 25 lines modified | ||
| 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat | 1 | Rules·with·PCI-DSS·Reference·in·Guide·to·the·Secure·Configuration·of·Red·Hat |
| 2 | Enterprise·Linux·8 | 2 | Enterprise·Linux·8 |
| 3 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 4 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 5 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 6 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 7 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 8 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 9 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 10 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 11 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 12 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 13 | ·····························already·installed·kernels: | ||
| 14 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 3 | ····················································································Routing·protocol | 15 | ····················································································Routing·protocol |
| 4 | ····················································································daemons·are | 16 | ····················································································daemons·are |
| 5 | ····················································································typically·used·on | 17 | ····················································································typically·used·on |
| 6 | ····················································································routers·to·exchange | 18 | ····················································································routers·to·exchange |
| 7 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology | 19 | ·····························To·set·the·runtime·status·of·the·net.ipv4.ip_forward···network·topology |
| 8 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with | 20 | Req-·····Disable·Kernel······kernel·parameter,·run·the·following·command:···········information·with |
| 9 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If | 21 | 1.3.1····Parameter·for·IP····$·sudo·sysctl·-w·net.ipv4.ip_forward=0·················other·routers.·If |
| Offset 15, 26 lines modified | Offset 27, 14 lines modified | ||
| 15 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not | 27 | 1.3.2····Interfaces··········following·line·to·a·file·in·the·directory·/etc/········used·when·not |
| 16 | ·····························sysctl.d:··············································required,·system | 28 | ·····························sysctl.d:··············································required,·system |
| 17 | ·····························net.ipv4.ip_forward·=·0································network·information | 29 | ·····························net.ipv4.ip_forward·=·0································network·information |
| 18 | ····················································································may·be | 30 | ····················································································may·be |
| 19 | ····················································································unnecessarily | 31 | ····················································································unnecessarily |
| 20 | ····················································································transmitted·across | 32 | ····················································································transmitted·across |
| 21 | ····················································································the·network. | 33 | ····················································································the·network. |
| 22 | ·····························To·disable·IPv6·protocol·support·in·the·Linux·kernel, | ||
| 23 | ·····························add·the·argument·ipv6.disable=1·to·the·default·GRUB2 | ||
| 24 | ·····························command·line·for·the·Linux·operating·system.·To·ensure·Any·unnecessary | ||
| 25 | ·····························that·ipv6.disable=1·is·added·as·a·kernel·command·line··network·stacks, | ||
| 26 | Req-·····Ensure·IPv6·is······argument·to·newly·installed·kernels,·add···············including·IPv6, | ||
| 27 | 1.3.1····disabled·through····ipv6.disable=1·to·the·default·Grub2·command·line·for···should·be·disabled | ||
| 28 | Req-·····kernel·boot·········Linux·operating·systems.·Modify·the·line·within·/etc/··to·reduce·the | ||
| 29 | 1.3.2····parameter···········default/grub·as·shown·below:···························vulnerability·to | ||
| 30 | ·····························GRUB_CMDLINE_LINUX="...·ipv6.disable=1·..."············exploitation. | ||
| 31 | ·····························Run·the·following·command·to·update·command·line·for | ||
| 32 | ·····························already·installed·kernels: | ||
| 33 | ·····························#·grubby·--update-kernel=ALL·--args="ipv6.disable=1" | ||
| 34 | ····················································································The·use·of·wireless | 34 | ····················································································The·use·of·wireless |
| 35 | ····················································································networking·can | 35 | ····················································································networking·can |
| 36 | ····················································································introduce·many | 36 | ····················································································introduce·many |
| 37 | ····················································································different·attack | 37 | ····················································································different·attack |
| 38 | ····················································································vectors·into·the | 38 | ····················································································vectors·into·the |
| 39 | ····················································································organization's | 39 | ····················································································organization's |
| 40 | ····················································································network.·Common | 40 | ····················································································network.·Common |
| Offset 73, 40 lines modified | Offset 73, 14 lines modified | ||
| 73 | ····················································································network·traffic | 73 | ····················································································network·traffic |
| 74 | ····················································································should·be·seen,·all | 74 | ····················································································should·be·seen,·all |
| 75 | ····················································································other·interfaces | 75 | ····················································································other·interfaces |
| 76 | ····················································································should·ignore | 76 | ····················································································should·ignore |
| 77 | ····················································································traffic·on·this | 77 | ····················································································traffic·on·this |
| 78 | ····················································································network·as·an·anti- | 78 | ····················································································network·as·an·anti- |
| 79 | ····················································································spoofing·measure. | 79 | ····················································································spoofing·measure. |
| 80 | ····················································································A·TCP·SYN·flood | ||
| 81 | ····················································································attack·can·cause·a | ||
| 82 | ····················································································denial·of·service | ||
| 83 | ····················································································by·filling·a | ||
| 84 | ····················································································system's·TCP | ||
| 85 | ····················································································connection·table | ||
| 86 | ····················································································with·connections·in | ||
| 87 | ····················································································the·SYN_RCVD·state. | ||
| 88 | ····················································································Syncookies·can·be | ||
| 89 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 90 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 91 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 92 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 93 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 94 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 95 | ·····························sysctl.d:··············································connection·and·is | ||
| 96 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 97 | ····················································································This·feature·is | ||
| 98 | ····················································································activated·when·a | ||
| 99 | ····················································································flood·condition·is | ||
| 100 | ····················································································detected,·and | ||
| 101 | ····················································································enables·the·system | ||
| 102 | ····················································································to·continue | ||
| 103 | ····················································································servicing·valid | ||
| 104 | ····················································································connection | ||
| 105 | ····················································································requests. | ||
| 106 | ····················································································In·ip6tables,·the | 80 | ····················································································In·ip6tables,·the |
| 107 | ····················································································default·policy·is | 81 | ····················································································default·policy·is |
| 108 | ····················································································applied·only·after | 82 | ····················································································applied·only·after |
| 109 | ····················································································all·the·applicable | 83 | ····················································································all·the·applicable |
| 110 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table | 84 | ·····························To·set·the·default·policy·to·DROP·(instead·of·ACCEPT)··rules·in·the·table |
| 111 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a | 85 | ·········Set·Default·········for·the·built-in·INPUT·chain·which·processes·incoming··are·examined·for·a |
| 112 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the | 86 | Req-·····ip6tables·Policy····packets,·add·or·correct·the·following·line·in·/etc/····match.·Setting·the |
| Offset 140, 14 lines modified | Offset 114, 40 lines modified | ||
| 140 | ····················································································network·traffic | 114 | ····················································································network·traffic |
| 141 | ····················································································should·be·seen,·all | 115 | ····················································································should·be·seen,·all |
| 142 | ····················································································other·interfaces | 116 | ····················································································other·interfaces |
| 143 | ····················································································should·ignore | 117 | ····················································································should·ignore |
| 144 | ····················································································traffic·on·this | 118 | ····················································································traffic·on·this |
| 145 | ····················································································network·as·an·anti- | 119 | ····················································································network·as·an·anti- |
| 146 | ····················································································spoofing·measure. | 120 | ····················································································spoofing·measure. |
| 121 | ····················································································A·TCP·SYN·flood | ||
| 122 | ····················································································attack·can·cause·a | ||
| 123 | ····················································································denial·of·service | ||
| 124 | ····················································································by·filling·a | ||
| 125 | ····················································································system's·TCP | ||
| 126 | ····················································································connection·table | ||
| 127 | ····················································································with·connections·in | ||
| 128 | ····················································································the·SYN_RCVD·state. | ||
| 129 | ····················································································Syncookies·can·be | ||
| 130 | ·····························To·set·the·runtime·status·of·the·······················used·to·track·a | ||
| 131 | ·····························net.ipv4.tcp_syncookies·kernel·parameter,·run·the······connection·when·a | ||
| 132 | ·········Enable·Kernel·······following·command:·····································subsequent·ACK·is | ||
| 133 | Req-·····Parameter·to·Use····$·sudo·sysctl·-w·net.ipv4.tcp_syncookies=1·············received,·verifying | ||
| 134 | 1.4.1····TCP·Syncookies·on···To·make·sure·that·the·setting·is·persistent,·add·the···the·initiator·is | ||
| 135 | ·········Network·Interfaces··following·line·to·a·file·in·the·directory·/etc/········attempting·a·valid | ||
| 136 | ·····························sysctl.d:··············································connection·and·is | ||
| 137 | ·····························net.ipv4.tcp_syncookies·=·1····························not·a·flood·source. | ||
| 138 | ····················································································This·feature·is | ||
| 139 | ····················································································activated·when·a | ||
| 140 | ····················································································flood·condition·is | ||
| 141 | ····················································································detected,·and | ||
| 142 | ····················································································enables·the·system | ||
| 143 | ····················································································to·continue | ||
| 144 | ····················································································servicing·valid | ||
| 145 | ····················································································connection | ||
| 146 | ····················································································requests. | ||
| Max diff block lines reached; 410922/422954 bytes (97.16%) of diff not shown. | |||
| Offset 2609, 16 lines modified | Offset 2609, 16 lines modified | ||
| 2609 | ······-·no_reboot_needed | 2609 | ······-·no_reboot_needed |
| 2610 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2610 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2611 | ······stat: | 2611 | ······stat: |
| 2612 | ········path:·/boot/grub2/grub.cfg | 2612 | ········path:·/boot/grub2/grub.cfg |
| 2613 | ······register:·file_exists | 2613 | ······register:·file_exists |
| 2614 | ······when: | 2614 | ······when: |
| 2615 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2616 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2615 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2616 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2617 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2617 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2618 | ······tags: | 2618 | ······tags: |
| 2619 | ······-·CJIS-5.5.2.2 | 2619 | ······-·CJIS-5.5.2.2 |
| 2620 | ······-·NIST-800-171-3.4.5 | 2620 | ······-·NIST-800-171-3.4.5 |
| 2621 | ······-·NIST-800-53-AC-6(1) | 2621 | ······-·NIST-800-53-AC-6(1) |
| 2622 | ······-·NIST-800-53-CM-6(a) | 2622 | ······-·NIST-800-53-CM-6(a) |
| 2623 | ······-·PCI-DSS-Req-7.1 | 2623 | ······-·PCI-DSS-Req-7.1 |
| Offset 2630, 16 lines modified | Offset 2630, 16 lines modified | ||
| 2630 | ······-·no_reboot_needed | 2630 | ······-·no_reboot_needed |
| 2631 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 2631 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 2632 | ······file: | 2632 | ······file: |
| 2633 | ········path:·/boot/grub2/grub.cfg | 2633 | ········path:·/boot/grub2/grub.cfg |
| 2634 | ········group:·'0' | 2634 | ········group:·'0' |
| 2635 | ······when: | 2635 | ······when: |
| 2636 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2637 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2636 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2637 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2638 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2638 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2639 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 2639 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 2640 | ······tags: | 2640 | ······tags: |
| 2641 | ······-·CJIS-5.5.2.2 | 2641 | ······-·CJIS-5.5.2.2 |
| 2642 | ······-·NIST-800-171-3.4.5 | 2642 | ······-·NIST-800-171-3.4.5 |
| 2643 | ······-·NIST-800-53-AC-6(1) | 2643 | ······-·NIST-800-53-AC-6(1) |
| 2644 | ······-·NIST-800-53-CM-6(a) | 2644 | ······-·NIST-800-53-CM-6(a) |
| Offset 2669, 16 lines modified | Offset 2669, 16 lines modified | ||
| 2669 | ······-·no_reboot_needed | 2669 | ······-·no_reboot_needed |
| 2670 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2670 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2671 | ······stat: | 2671 | ······stat: |
| 2672 | ········path:·/boot/grub2/grub.cfg | 2672 | ········path:·/boot/grub2/grub.cfg |
| 2673 | ······register:·file_exists | 2673 | ······register:·file_exists |
| 2674 | ······when: | 2674 | ······when: |
| 2675 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2676 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2675 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2676 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2677 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2677 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2678 | ······tags: | 2678 | ······tags: |
| 2679 | ······-·CJIS-5.5.2.2 | 2679 | ······-·CJIS-5.5.2.2 |
| 2680 | ······-·NIST-800-171-3.4.5 | 2680 | ······-·NIST-800-171-3.4.5 |
| 2681 | ······-·NIST-800-53-AC-6(1) | 2681 | ······-·NIST-800-53-AC-6(1) |
| 2682 | ······-·NIST-800-53-CM-6(a) | 2682 | ······-·NIST-800-53-CM-6(a) |
| 2683 | ······-·PCI-DSS-Req-7.1 | 2683 | ······-·PCI-DSS-Req-7.1 |
| Offset 2690, 16 lines modified | Offset 2690, 16 lines modified | ||
| 2690 | ······-·no_reboot_needed | 2690 | ······-·no_reboot_needed |
| 2691 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 2691 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 2692 | ······file: | 2692 | ······file: |
| 2693 | ········path:·/boot/grub2/grub.cfg | 2693 | ········path:·/boot/grub2/grub.cfg |
| 2694 | ········owner:·'0' | 2694 | ········owner:·'0' |
| 2695 | ······when: | 2695 | ······when: |
| 2696 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2697 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2696 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2697 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2698 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2698 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2699 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 2699 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 2700 | ······tags: | 2700 | ······tags: |
| 2701 | ······-·CJIS-5.5.2.2 | 2701 | ······-·CJIS-5.5.2.2 |
| 2702 | ······-·NIST-800-171-3.4.5 | 2702 | ······-·NIST-800-171-3.4.5 |
| 2703 | ······-·NIST-800-53-AC-6(1) | 2703 | ······-·NIST-800-53-AC-6(1) |
| 2704 | ······-·NIST-800-53-CM-6(a) | 2704 | ······-·NIST-800-53-CM-6(a) |
| Offset 2727, 16 lines modified | Offset 2727, 16 lines modified | ||
| 2727 | ······-·no_reboot_needed | 2727 | ······-·no_reboot_needed |
| 2728 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2728 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2729 | ······stat: | 2729 | ······stat: |
| 2730 | ········path:·/boot/grub2/grub.cfg | 2730 | ········path:·/boot/grub2/grub.cfg |
| 2731 | ······register:·file_exists | 2731 | ······register:·file_exists |
| 2732 | ······when: | 2732 | ······when: |
| 2733 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2734 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2733 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2734 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2735 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2735 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2736 | ······tags: | 2736 | ······tags: |
| 2737 | ······-·NIST-800-171-3.4.5 | 2737 | ······-·NIST-800-171-3.4.5 |
| 2738 | ······-·NIST-800-53-AC-6(1) | 2738 | ······-·NIST-800-53-AC-6(1) |
| 2739 | ······-·NIST-800-53-CM-6(a) | 2739 | ······-·NIST-800-53-CM-6(a) |
| 2740 | ······-·configure_strategy | 2740 | ······-·configure_strategy |
| 2741 | ······-·file_permissions_grub2_cfg | 2741 | ······-·file_permissions_grub2_cfg |
| Offset 2746, 16 lines modified | Offset 2746, 16 lines modified | ||
| 2746 | ······-·no_reboot_needed | 2746 | ······-·no_reboot_needed |
| 2747 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 2747 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 2748 | ······file: | 2748 | ······file: |
| 2749 | ········path:·/boot/grub2/grub.cfg | 2749 | ········path:·/boot/grub2/grub.cfg |
| 2750 | ········mode:·u-xs,g-xwrs,o-xwrt | 2750 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 2751 | ······when: | 2751 | ······when: |
| 2752 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2753 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2752 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2753 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2754 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2754 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2755 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 2755 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 2756 | ······tags: | 2756 | ······tags: |
| 2757 | ······-·NIST-800-171-3.4.5 | 2757 | ······-·NIST-800-171-3.4.5 |
| 2758 | ······-·NIST-800-53-AC-6(1) | 2758 | ······-·NIST-800-53-AC-6(1) |
| 2759 | ······-·NIST-800-53-CM-6(a) | 2759 | ······-·NIST-800-53-CM-6(a) |
| 2760 | ······-·configure_strategy | 2760 | ······-·configure_strategy |
| Offset 2783, 16 lines modified | Offset 2783, 16 lines modified | ||
| 2783 | ······-·no_reboot_needed | 2783 | ······-·no_reboot_needed |
| 2784 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2784 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2785 | ······stat: | 2785 | ······stat: |
| 2786 | ········path:·/boot/grub2/grub.cfg | 2786 | ········path:·/boot/grub2/grub.cfg |
| 2787 | ······register:·file_exists | 2787 | ······register:·file_exists |
| 2788 | ······when: | 2788 | ······when: |
| 2789 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2790 | ······-·'"grub2-common"·in·ansible_facts.packages' | 2789 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 2790 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 2791 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2791 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2792 | ······tags: | 2792 | ······tags: |
| 2793 | ······-·CJIS-5.5.2.2 | 2793 | ······-·CJIS-5.5.2.2 |
| 2794 | ······-·NIST-800-171-3.4.5 | 2794 | ······-·NIST-800-171-3.4.5 |
| 2795 | ······-·NIST-800-53-AC-6(1) | 2795 | ······-·NIST-800-53-AC-6(1) |
| 2796 | ······-·NIST-800-53-CM-6(a) | 2796 | ······-·NIST-800-53-CM-6(a) |
| 2797 | ······-·PCI-DSS-Req-7.1 | 2797 | ······-·PCI-DSS-Req-7.1 |
| Offset 2804, 16 lines modified | Offset 2804, 16 lines modified | ||
| 2804 | ······-·no_reboot_needed | 2804 | ······-·no_reboot_needed |
| Max diff block lines reached; 3280/7980 bytes (41.10%) of diff not shown. | |||
| Offset 1056, 16 lines modified | Offset 1056, 16 lines modified | ||
| 1056 | ······-·no_reboot_needed | 1056 | ······-·no_reboot_needed |
| 1057 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1057 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1058 | ······stat: | 1058 | ······stat: |
| 1059 | ········path:·/boot/grub2/grub.cfg | 1059 | ········path:·/boot/grub2/grub.cfg |
| 1060 | ······register:·file_exists | 1060 | ······register:·file_exists |
| 1061 | ······when: | 1061 | ······when: |
| 1062 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1063 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1062 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1063 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1064 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1064 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1065 | ······tags: | 1065 | ······tags: |
| 1066 | ······-·CJIS-5.5.2.2 | 1066 | ······-·CJIS-5.5.2.2 |
| 1067 | ······-·NIST-800-171-3.4.5 | 1067 | ······-·NIST-800-171-3.4.5 |
| 1068 | ······-·NIST-800-53-AC-6(1) | 1068 | ······-·NIST-800-53-AC-6(1) |
| 1069 | ······-·NIST-800-53-CM-6(a) | 1069 | ······-·NIST-800-53-CM-6(a) |
| 1070 | ······-·PCI-DSS-Req-7.1 | 1070 | ······-·PCI-DSS-Req-7.1 |
| Offset 1077, 16 lines modified | Offset 1077, 16 lines modified | ||
| 1077 | ······-·no_reboot_needed | 1077 | ······-·no_reboot_needed |
| 1078 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 1078 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 1079 | ······file: | 1079 | ······file: |
| 1080 | ········path:·/boot/grub2/grub.cfg | 1080 | ········path:·/boot/grub2/grub.cfg |
| 1081 | ········group:·'0' | 1081 | ········group:·'0' |
| 1082 | ······when: | 1082 | ······when: |
| 1083 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1084 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1083 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1084 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1085 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1085 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1086 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1086 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1087 | ······tags: | 1087 | ······tags: |
| 1088 | ······-·CJIS-5.5.2.2 | 1088 | ······-·CJIS-5.5.2.2 |
| 1089 | ······-·NIST-800-171-3.4.5 | 1089 | ······-·NIST-800-171-3.4.5 |
| 1090 | ······-·NIST-800-53-AC-6(1) | 1090 | ······-·NIST-800-53-AC-6(1) |
| 1091 | ······-·NIST-800-53-CM-6(a) | 1091 | ······-·NIST-800-53-CM-6(a) |
| Offset 1116, 16 lines modified | Offset 1116, 16 lines modified | ||
| 1116 | ······-·no_reboot_needed | 1116 | ······-·no_reboot_needed |
| 1117 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1117 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1118 | ······stat: | 1118 | ······stat: |
| 1119 | ········path:·/boot/grub2/grub.cfg | 1119 | ········path:·/boot/grub2/grub.cfg |
| 1120 | ······register:·file_exists | 1120 | ······register:·file_exists |
| 1121 | ······when: | 1121 | ······when: |
| 1122 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1123 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1122 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1123 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1124 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1124 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1125 | ······tags: | 1125 | ······tags: |
| 1126 | ······-·CJIS-5.5.2.2 | 1126 | ······-·CJIS-5.5.2.2 |
| 1127 | ······-·NIST-800-171-3.4.5 | 1127 | ······-·NIST-800-171-3.4.5 |
| 1128 | ······-·NIST-800-53-AC-6(1) | 1128 | ······-·NIST-800-53-AC-6(1) |
| 1129 | ······-·NIST-800-53-CM-6(a) | 1129 | ······-·NIST-800-53-CM-6(a) |
| 1130 | ······-·PCI-DSS-Req-7.1 | 1130 | ······-·PCI-DSS-Req-7.1 |
| Offset 1137, 16 lines modified | Offset 1137, 16 lines modified | ||
| 1137 | ······-·no_reboot_needed | 1137 | ······-·no_reboot_needed |
| 1138 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 1138 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 1139 | ······file: | 1139 | ······file: |
| 1140 | ········path:·/boot/grub2/grub.cfg | 1140 | ········path:·/boot/grub2/grub.cfg |
| 1141 | ········owner:·'0' | 1141 | ········owner:·'0' |
| 1142 | ······when: | 1142 | ······when: |
| 1143 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1144 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1143 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1144 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1145 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1145 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1146 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1146 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1147 | ······tags: | 1147 | ······tags: |
| 1148 | ······-·CJIS-5.5.2.2 | 1148 | ······-·CJIS-5.5.2.2 |
| 1149 | ······-·NIST-800-171-3.4.5 | 1149 | ······-·NIST-800-171-3.4.5 |
| 1150 | ······-·NIST-800-53-AC-6(1) | 1150 | ······-·NIST-800-53-AC-6(1) |
| 1151 | ······-·NIST-800-53-CM-6(a) | 1151 | ······-·NIST-800-53-CM-6(a) |
| Offset 1174, 16 lines modified | Offset 1174, 16 lines modified | ||
| 1174 | ······-·no_reboot_needed | 1174 | ······-·no_reboot_needed |
| 1175 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1175 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1176 | ······stat: | 1176 | ······stat: |
| 1177 | ········path:·/boot/grub2/grub.cfg | 1177 | ········path:·/boot/grub2/grub.cfg |
| 1178 | ······register:·file_exists | 1178 | ······register:·file_exists |
| 1179 | ······when: | 1179 | ······when: |
| 1180 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1181 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1180 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1181 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1182 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1182 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1183 | ······tags: | 1183 | ······tags: |
| 1184 | ······-·NIST-800-171-3.4.5 | 1184 | ······-·NIST-800-171-3.4.5 |
| 1185 | ······-·NIST-800-53-AC-6(1) | 1185 | ······-·NIST-800-53-AC-6(1) |
| 1186 | ······-·NIST-800-53-CM-6(a) | 1186 | ······-·NIST-800-53-CM-6(a) |
| 1187 | ······-·configure_strategy | 1187 | ······-·configure_strategy |
| 1188 | ······-·file_permissions_grub2_cfg | 1188 | ······-·file_permissions_grub2_cfg |
| Offset 1193, 16 lines modified | Offset 1193, 16 lines modified | ||
| 1193 | ······-·no_reboot_needed | 1193 | ······-·no_reboot_needed |
| 1194 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 1194 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 1195 | ······file: | 1195 | ······file: |
| 1196 | ········path:·/boot/grub2/grub.cfg | 1196 | ········path:·/boot/grub2/grub.cfg |
| 1197 | ········mode:·u-xs,g-xwrs,o-xwrt | 1197 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 1198 | ······when: | 1198 | ······when: |
| 1199 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1200 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1199 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1200 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1201 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1201 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1202 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1202 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1203 | ······tags: | 1203 | ······tags: |
| 1204 | ······-·NIST-800-171-3.4.5 | 1204 | ······-·NIST-800-171-3.4.5 |
| 1205 | ······-·NIST-800-53-AC-6(1) | 1205 | ······-·NIST-800-53-AC-6(1) |
| 1206 | ······-·NIST-800-53-CM-6(a) | 1206 | ······-·NIST-800-53-CM-6(a) |
| 1207 | ······-·configure_strategy | 1207 | ······-·configure_strategy |
| Offset 1230, 16 lines modified | Offset 1230, 16 lines modified | ||
| 1230 | ······-·no_reboot_needed | 1230 | ······-·no_reboot_needed |
| 1231 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1231 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1232 | ······stat: | 1232 | ······stat: |
| 1233 | ········path:·/boot/grub2/grub.cfg | 1233 | ········path:·/boot/grub2/grub.cfg |
| 1234 | ······register:·file_exists | 1234 | ······register:·file_exists |
| 1235 | ······when: | 1235 | ······when: |
| 1236 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1237 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1236 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1237 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1238 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1238 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1239 | ······tags: | 1239 | ······tags: |
| 1240 | ······-·CJIS-5.5.2.2 | 1240 | ······-·CJIS-5.5.2.2 |
| 1241 | ······-·NIST-800-171-3.4.5 | 1241 | ······-·NIST-800-171-3.4.5 |
| 1242 | ······-·NIST-800-53-AC-6(1) | 1242 | ······-·NIST-800-53-AC-6(1) |
| 1243 | ······-·NIST-800-53-CM-6(a) | 1243 | ······-·NIST-800-53-CM-6(a) |
| 1244 | ······-·PCI-DSS-Req-7.1 | 1244 | ······-·PCI-DSS-Req-7.1 |
| Offset 1251, 16 lines modified | Offset 1251, 16 lines modified | ||
| 1251 | ······-·no_reboot_needed | 1251 | ······-·no_reboot_needed |
| Max diff block lines reached; 3280/7980 bytes (41.10%) of diff not shown. | |||
| Offset 2766, 16 lines modified | Offset 2766, 16 lines modified | ||
| 2766 | ······-·no_reboot_needed | 2766 | ······-·no_reboot_needed |
| 2767 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2767 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2768 | ······stat: | 2768 | ······stat: |
| 2769 | ········path:·/boot/grub2/grub.cfg | 2769 | ········path:·/boot/grub2/grub.cfg |
| 2770 | ······register:·file_exists | 2770 | ······register:·file_exists |
| 2771 | ······when: | 2771 | ······when: |
| 2772 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2773 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 2772 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 2773 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2774 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2774 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2775 | ······tags: | 2775 | ······tags: |
| 2776 | ······-·CJIS-5.5.2.2 | 2776 | ······-·CJIS-5.5.2.2 |
| 2777 | ······-·NIST-800-171-3.4.5 | 2777 | ······-·NIST-800-171-3.4.5 |
| 2778 | ······-·NIST-800-53-AC-6(1) | 2778 | ······-·NIST-800-53-AC-6(1) |
| 2779 | ······-·NIST-800-53-CM-6(a) | 2779 | ······-·NIST-800-53-CM-6(a) |
| 2780 | ······-·PCI-DSS-Req-7.1 | 2780 | ······-·PCI-DSS-Req-7.1 |
| Offset 2787, 16 lines modified | Offset 2787, 16 lines modified | ||
| 2787 | ······-·no_reboot_needed | 2787 | ······-·no_reboot_needed |
| 2788 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 2788 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 2789 | ······file: | 2789 | ······file: |
| 2790 | ········path:·/boot/grub2/grub.cfg | 2790 | ········path:·/boot/grub2/grub.cfg |
| 2791 | ········group:·'0' | 2791 | ········group:·'0' |
| 2792 | ······when: | 2792 | ······when: |
| 2793 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2794 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 2793 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 2794 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2795 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2795 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2796 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 2796 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 2797 | ······tags: | 2797 | ······tags: |
| 2798 | ······-·CJIS-5.5.2.2 | 2798 | ······-·CJIS-5.5.2.2 |
| 2799 | ······-·NIST-800-171-3.4.5 | 2799 | ······-·NIST-800-171-3.4.5 |
| 2800 | ······-·NIST-800-53-AC-6(1) | 2800 | ······-·NIST-800-53-AC-6(1) |
| 2801 | ······-·NIST-800-53-CM-6(a) | 2801 | ······-·NIST-800-53-CM-6(a) |
| Offset 2826, 16 lines modified | Offset 2826, 16 lines modified | ||
| 2826 | ······-·no_reboot_needed | 2826 | ······-·no_reboot_needed |
| 2827 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2827 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2828 | ······stat: | 2828 | ······stat: |
| 2829 | ········path:·/boot/grub2/grub.cfg | 2829 | ········path:·/boot/grub2/grub.cfg |
| 2830 | ······register:·file_exists | 2830 | ······register:·file_exists |
| 2831 | ······when: | 2831 | ······when: |
| 2832 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2833 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 2832 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 2833 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2834 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2834 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2835 | ······tags: | 2835 | ······tags: |
| 2836 | ······-·CJIS-5.5.2.2 | 2836 | ······-·CJIS-5.5.2.2 |
| 2837 | ······-·NIST-800-171-3.4.5 | 2837 | ······-·NIST-800-171-3.4.5 |
| 2838 | ······-·NIST-800-53-AC-6(1) | 2838 | ······-·NIST-800-53-AC-6(1) |
| 2839 | ······-·NIST-800-53-CM-6(a) | 2839 | ······-·NIST-800-53-CM-6(a) |
| 2840 | ······-·PCI-DSS-Req-7.1 | 2840 | ······-·PCI-DSS-Req-7.1 |
| Offset 2847, 16 lines modified | Offset 2847, 16 lines modified | ||
| 2847 | ······-·no_reboot_needed | 2847 | ······-·no_reboot_needed |
| 2848 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 2848 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 2849 | ······file: | 2849 | ······file: |
| 2850 | ········path:·/boot/grub2/grub.cfg | 2850 | ········path:·/boot/grub2/grub.cfg |
| 2851 | ········owner:·'0' | 2851 | ········owner:·'0' |
| 2852 | ······when: | 2852 | ······when: |
| 2853 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2854 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 2853 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 2854 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2855 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2855 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2856 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 2856 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 2857 | ······tags: | 2857 | ······tags: |
| 2858 | ······-·CJIS-5.5.2.2 | 2858 | ······-·CJIS-5.5.2.2 |
| 2859 | ······-·NIST-800-171-3.4.5 | 2859 | ······-·NIST-800-171-3.4.5 |
| 2860 | ······-·NIST-800-53-AC-6(1) | 2860 | ······-·NIST-800-53-AC-6(1) |
| 2861 | ······-·NIST-800-53-CM-6(a) | 2861 | ······-·NIST-800-53-CM-6(a) |
| Offset 2884, 16 lines modified | Offset 2884, 16 lines modified | ||
| 2884 | ······-·no_reboot_needed | 2884 | ······-·no_reboot_needed |
| 2885 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 2885 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 2886 | ······stat: | 2886 | ······stat: |
| 2887 | ········path:·/boot/grub2/grub.cfg | 2887 | ········path:·/boot/grub2/grub.cfg |
| 2888 | ······register:·file_exists | 2888 | ······register:·file_exists |
| 2889 | ······when: | 2889 | ······when: |
| 2890 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2891 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 2890 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 2891 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2892 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2892 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2893 | ······tags: | 2893 | ······tags: |
| 2894 | ······-·NIST-800-171-3.4.5 | 2894 | ······-·NIST-800-171-3.4.5 |
| 2895 | ······-·NIST-800-53-AC-6(1) | 2895 | ······-·NIST-800-53-AC-6(1) |
| 2896 | ······-·NIST-800-53-CM-6(a) | 2896 | ······-·NIST-800-53-CM-6(a) |
| 2897 | ······-·configure_strategy | 2897 | ······-·configure_strategy |
| 2898 | ······-·file_permissions_efi_grub2_cfg | 2898 | ······-·file_permissions_efi_grub2_cfg |
| Offset 2903, 16 lines modified | Offset 2903, 16 lines modified | ||
| 2903 | ······-·no_reboot_needed | 2903 | ······-·no_reboot_needed |
| 2904 | ····-·name:·Ensure·permission·u-s,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 2904 | ····-·name:·Ensure·permission·u-s,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 2905 | ······file: | 2905 | ······file: |
| 2906 | ········path:·/boot/grub2/grub.cfg | 2906 | ········path:·/boot/grub2/grub.cfg |
| 2907 | ········mode:·u-s,g-xwrs,o-xwrt | 2907 | ········mode:·u-s,g-xwrs,o-xwrt |
| 2908 | ······when: | 2908 | ······when: |
| 2909 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2910 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 2909 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 2910 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 2911 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 2911 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 2912 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 2912 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 2913 | ······tags: | 2913 | ······tags: |
| 2914 | ······-·NIST-800-171-3.4.5 | 2914 | ······-·NIST-800-171-3.4.5 |
| 2915 | ······-·NIST-800-53-AC-6(1) | 2915 | ······-·NIST-800-53-AC-6(1) |
| 2916 | ······-·NIST-800-53-CM-6(a) | 2916 | ······-·NIST-800-53-CM-6(a) |
| 2917 | ······-·configure_strategy | 2917 | ······-·configure_strategy |
| Offset 1199, 16 lines modified | Offset 1199, 16 lines modified | ||
| 1199 | ······-·no_reboot_needed | 1199 | ······-·no_reboot_needed |
| 1200 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1200 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1201 | ······stat: | 1201 | ······stat: |
| 1202 | ········path:·/boot/grub2/grub.cfg | 1202 | ········path:·/boot/grub2/grub.cfg |
| 1203 | ······register:·file_exists | 1203 | ······register:·file_exists |
| 1204 | ······when: | 1204 | ······when: |
| 1205 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1206 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1205 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1206 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1207 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1207 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1208 | ······tags: | 1208 | ······tags: |
| 1209 | ······-·CJIS-5.5.2.2 | 1209 | ······-·CJIS-5.5.2.2 |
| 1210 | ······-·NIST-800-171-3.4.5 | 1210 | ······-·NIST-800-171-3.4.5 |
| 1211 | ······-·NIST-800-53-AC-6(1) | 1211 | ······-·NIST-800-53-AC-6(1) |
| 1212 | ······-·NIST-800-53-CM-6(a) | 1212 | ······-·NIST-800-53-CM-6(a) |
| 1213 | ······-·PCI-DSS-Req-7.1 | 1213 | ······-·PCI-DSS-Req-7.1 |
| Offset 1220, 16 lines modified | Offset 1220, 16 lines modified | ||
| 1220 | ······-·no_reboot_needed | 1220 | ······-·no_reboot_needed |
| 1221 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 1221 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 1222 | ······file: | 1222 | ······file: |
| 1223 | ········path:·/boot/grub2/grub.cfg | 1223 | ········path:·/boot/grub2/grub.cfg |
| 1224 | ········group:·'0' | 1224 | ········group:·'0' |
| 1225 | ······when: | 1225 | ······when: |
| 1226 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1227 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1226 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1227 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1228 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1228 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1229 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1229 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1230 | ······tags: | 1230 | ······tags: |
| 1231 | ······-·CJIS-5.5.2.2 | 1231 | ······-·CJIS-5.5.2.2 |
| 1232 | ······-·NIST-800-171-3.4.5 | 1232 | ······-·NIST-800-171-3.4.5 |
| 1233 | ······-·NIST-800-53-AC-6(1) | 1233 | ······-·NIST-800-53-AC-6(1) |
| 1234 | ······-·NIST-800-53-CM-6(a) | 1234 | ······-·NIST-800-53-CM-6(a) |
| Offset 1259, 16 lines modified | Offset 1259, 16 lines modified | ||
| 1259 | ······-·no_reboot_needed | 1259 | ······-·no_reboot_needed |
| 1260 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1260 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1261 | ······stat: | 1261 | ······stat: |
| 1262 | ········path:·/boot/grub2/grub.cfg | 1262 | ········path:·/boot/grub2/grub.cfg |
| 1263 | ······register:·file_exists | 1263 | ······register:·file_exists |
| 1264 | ······when: | 1264 | ······when: |
| 1265 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1266 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1265 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1266 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1267 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1267 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1268 | ······tags: | 1268 | ······tags: |
| 1269 | ······-·CJIS-5.5.2.2 | 1269 | ······-·CJIS-5.5.2.2 |
| 1270 | ······-·NIST-800-171-3.4.5 | 1270 | ······-·NIST-800-171-3.4.5 |
| 1271 | ······-·NIST-800-53-AC-6(1) | 1271 | ······-·NIST-800-53-AC-6(1) |
| 1272 | ······-·NIST-800-53-CM-6(a) | 1272 | ······-·NIST-800-53-CM-6(a) |
| 1273 | ······-·PCI-DSS-Req-7.1 | 1273 | ······-·PCI-DSS-Req-7.1 |
| Offset 1280, 16 lines modified | Offset 1280, 16 lines modified | ||
| 1280 | ······-·no_reboot_needed | 1280 | ······-·no_reboot_needed |
| 1281 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 1281 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 1282 | ······file: | 1282 | ······file: |
| 1283 | ········path:·/boot/grub2/grub.cfg | 1283 | ········path:·/boot/grub2/grub.cfg |
| 1284 | ········owner:·'0' | 1284 | ········owner:·'0' |
| 1285 | ······when: | 1285 | ······when: |
| 1286 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1287 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1286 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1287 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1288 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1288 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1289 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1289 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1290 | ······tags: | 1290 | ······tags: |
| 1291 | ······-·CJIS-5.5.2.2 | 1291 | ······-·CJIS-5.5.2.2 |
| 1292 | ······-·NIST-800-171-3.4.5 | 1292 | ······-·NIST-800-171-3.4.5 |
| 1293 | ······-·NIST-800-53-AC-6(1) | 1293 | ······-·NIST-800-53-AC-6(1) |
| 1294 | ······-·NIST-800-53-CM-6(a) | 1294 | ······-·NIST-800-53-CM-6(a) |
| Offset 1317, 16 lines modified | Offset 1317, 16 lines modified | ||
| 1317 | ······-·no_reboot_needed | 1317 | ······-·no_reboot_needed |
| 1318 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1318 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1319 | ······stat: | 1319 | ······stat: |
| 1320 | ········path:·/boot/grub2/grub.cfg | 1320 | ········path:·/boot/grub2/grub.cfg |
| 1321 | ······register:·file_exists | 1321 | ······register:·file_exists |
| 1322 | ······when: | 1322 | ······when: |
| 1323 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1324 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1323 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1324 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1325 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1325 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1326 | ······tags: | 1326 | ······tags: |
| 1327 | ······-·NIST-800-171-3.4.5 | 1327 | ······-·NIST-800-171-3.4.5 |
| 1328 | ······-·NIST-800-53-AC-6(1) | 1328 | ······-·NIST-800-53-AC-6(1) |
| 1329 | ······-·NIST-800-53-CM-6(a) | 1329 | ······-·NIST-800-53-CM-6(a) |
| 1330 | ······-·configure_strategy | 1330 | ······-·configure_strategy |
| 1331 | ······-·file_permissions_efi_grub2_cfg | 1331 | ······-·file_permissions_efi_grub2_cfg |
| Offset 1336, 16 lines modified | Offset 1336, 16 lines modified | ||
| 1336 | ······-·no_reboot_needed | 1336 | ······-·no_reboot_needed |
| 1337 | ····-·name:·Ensure·permission·u-s,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 1337 | ····-·name:·Ensure·permission·u-s,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 1338 | ······file: | 1338 | ······file: |
| 1339 | ········path:·/boot/grub2/grub.cfg | 1339 | ········path:·/boot/grub2/grub.cfg |
| 1340 | ········mode:·u-s,g-xwrs,o-xwrt | 1340 | ········mode:·u-s,g-xwrs,o-xwrt |
| 1341 | ······when: | 1341 | ······when: |
| 1342 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1343 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | 1342 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 1343 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 1344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1345 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1345 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1346 | ······tags: | 1346 | ······tags: |
| 1347 | ······-·NIST-800-171-3.4.5 | 1347 | ······-·NIST-800-171-3.4.5 |
| 1348 | ······-·NIST-800-53-AC-6(1) | 1348 | ······-·NIST-800-53-AC-6(1) |
| 1349 | ······-·NIST-800-53-CM-6(a) | 1349 | ······-·NIST-800-53-CM-6(a) |
| 1350 | ······-·configure_strategy | 1350 | ······-·configure_strategy |
| Offset 1074, 16 lines modified | Offset 1074, 16 lines modified | ||
| 1074 | ······-·no_reboot_needed | 1074 | ······-·no_reboot_needed |
| 1075 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1075 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1076 | ······stat: | 1076 | ······stat: |
| 1077 | ········path:·/boot/grub2/grub.cfg | 1077 | ········path:·/boot/grub2/grub.cfg |
| 1078 | ······register:·file_exists | 1078 | ······register:·file_exists |
| 1079 | ······when: | 1079 | ······when: |
| 1080 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1081 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1080 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1081 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1082 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1082 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1083 | ······tags: | 1083 | ······tags: |
| 1084 | ······-·CJIS-5.5.2.2 | 1084 | ······-·CJIS-5.5.2.2 |
| 1085 | ······-·NIST-800-171-3.4.5 | 1085 | ······-·NIST-800-171-3.4.5 |
| 1086 | ······-·NIST-800-53-AC-6(1) | 1086 | ······-·NIST-800-53-AC-6(1) |
| 1087 | ······-·NIST-800-53-CM-6(a) | 1087 | ······-·NIST-800-53-CM-6(a) |
| 1088 | ······-·PCI-DSS-Req-7.1 | 1088 | ······-·PCI-DSS-Req-7.1 |
| Offset 1095, 16 lines modified | Offset 1095, 16 lines modified | ||
| 1095 | ······-·no_reboot_needed | 1095 | ······-·no_reboot_needed |
| 1096 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 1096 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 1097 | ······file: | 1097 | ······file: |
| 1098 | ········path:·/boot/grub2/grub.cfg | 1098 | ········path:·/boot/grub2/grub.cfg |
| 1099 | ········group:·'0' | 1099 | ········group:·'0' |
| 1100 | ······when: | 1100 | ······when: |
| 1101 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1102 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1101 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1102 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1103 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1103 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1104 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1104 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1105 | ······tags: | 1105 | ······tags: |
| 1106 | ······-·CJIS-5.5.2.2 | 1106 | ······-·CJIS-5.5.2.2 |
| 1107 | ······-·NIST-800-171-3.4.5 | 1107 | ······-·NIST-800-171-3.4.5 |
| 1108 | ······-·NIST-800-53-AC-6(1) | 1108 | ······-·NIST-800-53-AC-6(1) |
| 1109 | ······-·NIST-800-53-CM-6(a) | 1109 | ······-·NIST-800-53-CM-6(a) |
| Offset 1134, 16 lines modified | Offset 1134, 16 lines modified | ||
| 1134 | ······-·no_reboot_needed | 1134 | ······-·no_reboot_needed |
| 1135 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1135 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1136 | ······stat: | 1136 | ······stat: |
| 1137 | ········path:·/boot/grub2/grub.cfg | 1137 | ········path:·/boot/grub2/grub.cfg |
| 1138 | ······register:·file_exists | 1138 | ······register:·file_exists |
| 1139 | ······when: | 1139 | ······when: |
| 1140 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1141 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1140 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1141 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1142 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1142 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1143 | ······tags: | 1143 | ······tags: |
| 1144 | ······-·CJIS-5.5.2.2 | 1144 | ······-·CJIS-5.5.2.2 |
| 1145 | ······-·NIST-800-171-3.4.5 | 1145 | ······-·NIST-800-171-3.4.5 |
| 1146 | ······-·NIST-800-53-AC-6(1) | 1146 | ······-·NIST-800-53-AC-6(1) |
| 1147 | ······-·NIST-800-53-CM-6(a) | 1147 | ······-·NIST-800-53-CM-6(a) |
| 1148 | ······-·PCI-DSS-Req-7.1 | 1148 | ······-·PCI-DSS-Req-7.1 |
| Offset 1155, 16 lines modified | Offset 1155, 16 lines modified | ||
| 1155 | ······-·no_reboot_needed | 1155 | ······-·no_reboot_needed |
| 1156 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 1156 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 1157 | ······file: | 1157 | ······file: |
| 1158 | ········path:·/boot/grub2/grub.cfg | 1158 | ········path:·/boot/grub2/grub.cfg |
| 1159 | ········owner:·'0' | 1159 | ········owner:·'0' |
| 1160 | ······when: | 1160 | ······when: |
| 1161 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1162 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1161 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1162 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1163 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1163 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1164 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1164 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1165 | ······tags: | 1165 | ······tags: |
| 1166 | ······-·CJIS-5.5.2.2 | 1166 | ······-·CJIS-5.5.2.2 |
| 1167 | ······-·NIST-800-171-3.4.5 | 1167 | ······-·NIST-800-171-3.4.5 |
| 1168 | ······-·NIST-800-53-AC-6(1) | 1168 | ······-·NIST-800-53-AC-6(1) |
| 1169 | ······-·NIST-800-53-CM-6(a) | 1169 | ······-·NIST-800-53-CM-6(a) |
| Offset 1192, 16 lines modified | Offset 1192, 16 lines modified | ||
| 1192 | ······-·no_reboot_needed | 1192 | ······-·no_reboot_needed |
| 1193 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 1193 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 1194 | ······stat: | 1194 | ······stat: |
| 1195 | ········path:·/boot/grub2/grub.cfg | 1195 | ········path:·/boot/grub2/grub.cfg |
| 1196 | ······register:·file_exists | 1196 | ······register:·file_exists |
| 1197 | ······when: | 1197 | ······when: |
| 1198 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1199 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1198 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1199 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1200 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1200 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1201 | ······tags: | 1201 | ······tags: |
| 1202 | ······-·NIST-800-171-3.4.5 | 1202 | ······-·NIST-800-171-3.4.5 |
| 1203 | ······-·NIST-800-53-AC-6(1) | 1203 | ······-·NIST-800-53-AC-6(1) |
| 1204 | ······-·NIST-800-53-CM-6(a) | 1204 | ······-·NIST-800-53-CM-6(a) |
| 1205 | ······-·configure_strategy | 1205 | ······-·configure_strategy |
| 1206 | ······-·file_permissions_grub2_cfg | 1206 | ······-·file_permissions_grub2_cfg |
| Offset 1211, 16 lines modified | Offset 1211, 16 lines modified | ||
| 1211 | ······-·no_reboot_needed | 1211 | ······-·no_reboot_needed |
| 1212 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 1212 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 1213 | ······file: | 1213 | ······file: |
| 1214 | ········path:·/boot/grub2/grub.cfg | 1214 | ········path:·/boot/grub2/grub.cfg |
| 1215 | ········mode:·u-xs,g-xwrs,o-xwrt | 1215 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 1216 | ······when: | 1216 | ······when: |
| 1217 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1218 | ······-·'"grub2-common"·in·ansible_facts.packages' | 1217 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 1218 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 1219 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1219 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1220 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 1220 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 1221 | ······tags: | 1221 | ······tags: |
| 1222 | ······-·NIST-800-171-3.4.5 | 1222 | ······-·NIST-800-171-3.4.5 |
| 1223 | ······-·NIST-800-53-AC-6(1) | 1223 | ······-·NIST-800-53-AC-6(1) |
| 1224 | ······-·NIST-800-53-CM-6(a) | 1224 | ······-·NIST-800-53-CM-6(a) |
| 1225 | ······-·configure_strategy | 1225 | ······-·configure_strategy |
| Offset 4494, 16 lines modified | Offset 4494, 16 lines modified | ||
| 4494 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 4494 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 4495 | ······find: | 4495 | ······find: |
| 4496 | ········paths:·/etc/audit/rules.d/ | 4496 | ········paths:·/etc/audit/rules.d/ |
| 4497 | ········patterns:·'*.rules' | 4497 | ········patterns:·'*.rules' |
| 4498 | ······register:·find_rules_d | 4498 | ······register:·find_rules_d |
| 4499 | ······when: | 4499 | ······when: |
| 4500 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4501 | ······-·'"audit"·in·ansible_facts.packages' | 4500 | ······-·'"audit"·in·ansible_facts.packages' |
| 4501 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4502 | ······tags: | 4502 | ······tags: |
| 4503 | ······-·CJIS-5.4.1.1 | 4503 | ······-·CJIS-5.4.1.1 |
| 4504 | ······-·NIST-800-171-3.3.1 | 4504 | ······-·NIST-800-171-3.3.1 |
| 4505 | ······-·NIST-800-171-3.4.3 | 4505 | ······-·NIST-800-171-3.4.3 |
| 4506 | ······-·NIST-800-53-AC-6(9) | 4506 | ······-·NIST-800-53-AC-6(9) |
| 4507 | ······-·NIST-800-53-CM-6(a) | 4507 | ······-·NIST-800-53-CM-6(a) |
| 4508 | ······-·PCI-DSS-Req-10.5.2 | 4508 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4518, 16 lines modified | Offset 4518, 16 lines modified | ||
| 4518 | ······lineinfile: | 4518 | ······lineinfile: |
| 4519 | ········path:·'{{·item·}}' | 4519 | ········path:·'{{·item·}}' |
| 4520 | ········regexp:·^\s*(?:-e)\s+.*$ | 4520 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 4521 | ········state:·absent | 4521 | ········state:·absent |
| 4522 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 4522 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 4523 | ········}}' | 4523 | ········}}' |
| 4524 | ······when: | 4524 | ······when: |
| 4525 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4526 | ······-·'"audit"·in·ansible_facts.packages' | 4525 | ······-·'"audit"·in·ansible_facts.packages' |
| 4526 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4527 | ······tags: | 4527 | ······tags: |
| 4528 | ······-·CJIS-5.4.1.1 | 4528 | ······-·CJIS-5.4.1.1 |
| 4529 | ······-·NIST-800-171-3.3.1 | 4529 | ······-·NIST-800-171-3.3.1 |
| 4530 | ······-·NIST-800-171-3.4.3 | 4530 | ······-·NIST-800-171-3.4.3 |
| 4531 | ······-·NIST-800-53-AC-6(9) | 4531 | ······-·NIST-800-53-AC-6(9) |
| 4532 | ······-·NIST-800-53-CM-6(a) | 4532 | ······-·NIST-800-53-CM-6(a) |
| 4533 | ······-·PCI-DSS-Req-10.5.2 | 4533 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4544, 16 lines modified | Offset 4544, 16 lines modified | ||
| 4544 | ········create:·true | 4544 | ········create:·true |
| 4545 | ········line:·-e·2 | 4545 | ········line:·-e·2 |
| 4546 | ········mode:·o-rwx | 4546 | ········mode:·o-rwx |
| 4547 | ······loop: | 4547 | ······loop: |
| 4548 | ······-·/etc/audit/audit.rules | 4548 | ······-·/etc/audit/audit.rules |
| 4549 | ······-·/etc/audit/rules.d/immutable.rules | 4549 | ······-·/etc/audit/rules.d/immutable.rules |
| 4550 | ······when: | 4550 | ······when: |
| 4551 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4552 | ······-·'"audit"·in·ansible_facts.packages' | 4551 | ······-·'"audit"·in·ansible_facts.packages' |
| 4552 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4553 | ······tags: | 4553 | ······tags: |
| 4554 | ······-·CJIS-5.4.1.1 | 4554 | ······-·CJIS-5.4.1.1 |
| 4555 | ······-·NIST-800-171-3.3.1 | 4555 | ······-·NIST-800-171-3.3.1 |
| 4556 | ······-·NIST-800-171-3.4.3 | 4556 | ······-·NIST-800-171-3.4.3 |
| 4557 | ······-·NIST-800-53-AC-6(9) | 4557 | ······-·NIST-800-53-AC-6(9) |
| 4558 | ······-·NIST-800-53-CM-6(a) | 4558 | ······-·NIST-800-53-CM-6(a) |
| 4559 | ······-·PCI-DSS-Req-10.5.2 | 4559 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4585, 16 lines modified | Offset 4585, 16 lines modified | ||
| 4585 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 4585 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 4586 | ······find: | 4586 | ······find: |
| 4587 | ········paths:·/etc/audit/rules.d | 4587 | ········paths:·/etc/audit/rules.d |
| 4588 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 4588 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 4589 | ········patterns:·'*.rules' | 4589 | ········patterns:·'*.rules' |
| 4590 | ······register:·find_existing_watch_rules_d | 4590 | ······register:·find_existing_watch_rules_d |
| 4591 | ······when: | 4591 | ······when: |
| 4592 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4593 | ······-·'"audit"·in·ansible_facts.packages' | 4592 | ······-·'"audit"·in·ansible_facts.packages' |
| 4593 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4594 | ······tags: | 4594 | ······tags: |
| 4595 | ······-·CJIS-5.4.1.1 | 4595 | ······-·CJIS-5.4.1.1 |
| 4596 | ······-·NIST-800-171-3.1.8 | 4596 | ······-·NIST-800-171-3.1.8 |
| 4597 | ······-·NIST-800-53-AU-12(c) | 4597 | ······-·NIST-800-53-AU-12(c) |
| 4598 | ······-·NIST-800-53-AU-2(d) | 4598 | ······-·NIST-800-53-AU-2(d) |
| 4599 | ······-·NIST-800-53-CM-6(a) | 4599 | ······-·NIST-800-53-CM-6(a) |
| 4600 | ······-·PCI-DSS-Req-10.5.5 | 4600 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 4608, 16 lines modified | Offset 4608, 16 lines modified | ||
| 4608 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 4608 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 4609 | ······find: | 4609 | ······find: |
| 4610 | ········paths:·/etc/audit/rules.d | 4610 | ········paths:·/etc/audit/rules.d |
| 4611 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 4611 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 4612 | ········patterns:·'*.rules' | 4612 | ········patterns:·'*.rules' |
| 4613 | ······register:·find_watch_key | 4613 | ······register:·find_watch_key |
| 4614 | ······when: | 4614 | ······when: |
| 4615 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4616 | ······-·'"audit"·in·ansible_facts.packages' | 4615 | ······-·'"audit"·in·ansible_facts.packages' |
| 4616 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4617 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 4617 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 4618 | ········==·0 | 4618 | ········==·0 |
| 4619 | ······tags: | 4619 | ······tags: |
| 4620 | ······-·CJIS-5.4.1.1 | 4620 | ······-·CJIS-5.4.1.1 |
| 4621 | ······-·NIST-800-171-3.1.8 | 4621 | ······-·NIST-800-171-3.1.8 |
| 4622 | ······-·NIST-800-53-AU-12(c) | 4622 | ······-·NIST-800-53-AU-12(c) |
| 4623 | ······-·NIST-800-53-AU-2(d) | 4623 | ······-·NIST-800-53-AU-2(d) |
| Offset 4631, 16 lines modified | Offset 4631, 16 lines modified | ||
| 4631 | ······-·restrict_strategy | 4631 | ······-·restrict_strategy |
| 4632 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 4632 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 4633 | ······set_fact: | 4633 | ······set_fact: |
| 4634 | ········all_files: | 4634 | ········all_files: |
| 4635 | ········-·/etc/audit/rules.d/MAC-policy.rules | 4635 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 4636 | ······when: | 4636 | ······when: |
| 4637 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4638 | ······-·'"audit"·in·ansible_facts.packages' | 4637 | ······-·'"audit"·in·ansible_facts.packages' |
| 4638 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4639 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 4639 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 4640 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4640 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4641 | ······tags: | 4641 | ······tags: |
| 4642 | ······-·CJIS-5.4.1.1 | 4642 | ······-·CJIS-5.4.1.1 |
| 4643 | ······-·NIST-800-171-3.1.8 | 4643 | ······-·NIST-800-171-3.1.8 |
| 4644 | ······-·NIST-800-53-AU-12(c) | 4644 | ······-·NIST-800-53-AU-12(c) |
| 4645 | ······-·NIST-800-53-AU-2(d) | 4645 | ······-·NIST-800-53-AU-2(d) |
| Offset 4654, 16 lines modified | Offset 4654, 16 lines modified | ||
| 4654 | ······-·restrict_strategy | 4654 | ······-·restrict_strategy |
| 4655 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 4655 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 4656 | ······set_fact: | 4656 | ······set_fact: |
| 4657 | ········all_files: | 4657 | ········all_files: |
| 4658 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 4658 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 4659 | ······when: | 4659 | ······when: |
| 4660 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4661 | ······-·'"audit"·in·ansible_facts.packages' | 4660 | ······-·'"audit"·in·ansible_facts.packages' |
| 4661 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4662 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 4662 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 4663 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4663 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4664 | ······tags: | 4664 | ······tags: |
| 4665 | ······-·CJIS-5.4.1.1 | 4665 | ······-·CJIS-5.4.1.1 |
| 4666 | ······-·NIST-800-171-3.1.8 | 4666 | ······-·NIST-800-171-3.1.8 |
| 4667 | ······-·NIST-800-53-AU-12(c) | 4667 | ······-·NIST-800-53-AU-12(c) |
| 4668 | ······-·NIST-800-53-AU-2(d) | 4668 | ······-·NIST-800-53-AU-2(d) |
| Offset 4679, 16 lines modified | Offset 4679, 16 lines modified | ||
| 4679 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 4679 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 103988/109023 bytes (95.38%) of diff not shown. | |||
| Offset 644, 16 lines modified | Offset 644, 16 lines modified | ||
| 644 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 644 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 645 | ······find: | 645 | ······find: |
| 646 | ········paths:·/etc/audit/rules.d | 646 | ········paths:·/etc/audit/rules.d |
| 647 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 647 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 648 | ········patterns:·'*.rules' | 648 | ········patterns:·'*.rules' |
| 649 | ······register:·find_existing_watch_rules_d | 649 | ······register:·find_existing_watch_rules_d |
| 650 | ······when: | 650 | ······when: |
| 651 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 652 | ······-·'"audit"·in·ansible_facts.packages' | 651 | ······-·'"audit"·in·ansible_facts.packages' |
| 652 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 653 | ······tags: | 653 | ······tags: |
| 654 | ······-·CJIS-5.4.1.1 | 654 | ······-·CJIS-5.4.1.1 |
| 655 | ······-·NIST-800-171-3.1.8 | 655 | ······-·NIST-800-171-3.1.8 |
| 656 | ······-·NIST-800-53-AU-12(c) | 656 | ······-·NIST-800-53-AU-12(c) |
| 657 | ······-·NIST-800-53-AU-2(d) | 657 | ······-·NIST-800-53-AU-2(d) |
| 658 | ······-·NIST-800-53-CM-6(a) | 658 | ······-·NIST-800-53-CM-6(a) |
| 659 | ······-·PCI-DSS-Req-10.5.5 | 659 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 667, 16 lines modified | Offset 667, 16 lines modified | ||
| 667 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 667 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 668 | ······find: | 668 | ······find: |
| 669 | ········paths:·/etc/audit/rules.d | 669 | ········paths:·/etc/audit/rules.d |
| 670 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 670 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 671 | ········patterns:·'*.rules' | 671 | ········patterns:·'*.rules' |
| 672 | ······register:·find_watch_key | 672 | ······register:·find_watch_key |
| 673 | ······when: | 673 | ······when: |
| 674 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 675 | ······-·'"audit"·in·ansible_facts.packages' | 674 | ······-·'"audit"·in·ansible_facts.packages' |
| 675 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 676 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 676 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 677 | ········==·0 | 677 | ········==·0 |
| 678 | ······tags: | 678 | ······tags: |
| 679 | ······-·CJIS-5.4.1.1 | 679 | ······-·CJIS-5.4.1.1 |
| 680 | ······-·NIST-800-171-3.1.8 | 680 | ······-·NIST-800-171-3.1.8 |
| 681 | ······-·NIST-800-53-AU-12(c) | 681 | ······-·NIST-800-53-AU-12(c) |
| 682 | ······-·NIST-800-53-AU-2(d) | 682 | ······-·NIST-800-53-AU-2(d) |
| Offset 690, 16 lines modified | Offset 690, 16 lines modified | ||
| 690 | ······-·restrict_strategy | 690 | ······-·restrict_strategy |
| 691 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 691 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 692 | ······set_fact: | 692 | ······set_fact: |
| 693 | ········all_files: | 693 | ········all_files: |
| 694 | ········-·/etc/audit/rules.d/MAC-policy.rules | 694 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 695 | ······when: | 695 | ······when: |
| 696 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 697 | ······-·'"audit"·in·ansible_facts.packages' | 696 | ······-·'"audit"·in·ansible_facts.packages' |
| 697 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 698 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 698 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 699 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 699 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 700 | ······tags: | 700 | ······tags: |
| 701 | ······-·CJIS-5.4.1.1 | 701 | ······-·CJIS-5.4.1.1 |
| 702 | ······-·NIST-800-171-3.1.8 | 702 | ······-·NIST-800-171-3.1.8 |
| 703 | ······-·NIST-800-53-AU-12(c) | 703 | ······-·NIST-800-53-AU-12(c) |
| 704 | ······-·NIST-800-53-AU-2(d) | 704 | ······-·NIST-800-53-AU-2(d) |
| Offset 713, 16 lines modified | Offset 713, 16 lines modified | ||
| 713 | ······-·restrict_strategy | 713 | ······-·restrict_strategy |
| 714 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 714 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 715 | ······set_fact: | 715 | ······set_fact: |
| 716 | ········all_files: | 716 | ········all_files: |
| 717 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 717 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 718 | ······when: | 718 | ······when: |
| 719 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 720 | ······-·'"audit"·in·ansible_facts.packages' | 719 | ······-·'"audit"·in·ansible_facts.packages' |
| 720 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 721 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 721 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 722 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 722 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 723 | ······tags: | 723 | ······tags: |
| 724 | ······-·CJIS-5.4.1.1 | 724 | ······-·CJIS-5.4.1.1 |
| 725 | ······-·NIST-800-171-3.1.8 | 725 | ······-·NIST-800-171-3.1.8 |
| 726 | ······-·NIST-800-53-AU-12(c) | 726 | ······-·NIST-800-53-AU-12(c) |
| 727 | ······-·NIST-800-53-AU-2(d) | 727 | ······-·NIST-800-53-AU-2(d) |
| Offset 738, 16 lines modified | Offset 738, 16 lines modified | ||
| 738 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 738 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| 739 | ······lineinfile: | 739 | ······lineinfile: |
| 740 | ········path:·'{{·all_files[0]·}}' | 740 | ········path:·'{{·all_files[0]·}}' |
| 741 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 741 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 742 | ········create:·true | 742 | ········create:·true |
| 743 | ········mode:·'0640' | 743 | ········mode:·'0640' |
| 744 | ······when: | 744 | ······when: |
| 745 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 746 | ······-·'"audit"·in·ansible_facts.packages' | 745 | ······-·'"audit"·in·ansible_facts.packages' |
| 746 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 747 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 747 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 748 | ········==·0 | 748 | ········==·0 |
| 749 | ······tags: | 749 | ······tags: |
| 750 | ······-·CJIS-5.4.1.1 | 750 | ······-·CJIS-5.4.1.1 |
| 751 | ······-·NIST-800-171-3.1.8 | 751 | ······-·NIST-800-171-3.1.8 |
| 752 | ······-·NIST-800-53-AU-12(c) | 752 | ······-·NIST-800-53-AU-12(c) |
| 753 | ······-·NIST-800-53-AU-2(d) | 753 | ······-·NIST-800-53-AU-2(d) |
| Offset 763, 16 lines modified | Offset 763, 16 lines modified | ||
| 763 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules | 763 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules |
| 764 | ······find: | 764 | ······find: |
| 765 | ········paths:·/etc/audit/ | 765 | ········paths:·/etc/audit/ |
| 766 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 766 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 767 | ········patterns:·audit.rules | 767 | ········patterns:·audit.rules |
| 768 | ······register:·find_existing_watch_audit_rules | 768 | ······register:·find_existing_watch_audit_rules |
| 769 | ······when: | 769 | ······when: |
| 770 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 771 | ······-·'"audit"·in·ansible_facts.packages' | 770 | ······-·'"audit"·in·ansible_facts.packages' |
| 771 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 772 | ······tags: | 772 | ······tags: |
| 773 | ······-·CJIS-5.4.1.1 | 773 | ······-·CJIS-5.4.1.1 |
| 774 | ······-·NIST-800-171-3.1.8 | 774 | ······-·NIST-800-171-3.1.8 |
| 775 | ······-·NIST-800-53-AU-12(c) | 775 | ······-·NIST-800-53-AU-12(c) |
| 776 | ······-·NIST-800-53-AU-2(d) | 776 | ······-·NIST-800-53-AU-2(d) |
| 777 | ······-·NIST-800-53-CM-6(a) | 777 | ······-·NIST-800-53-CM-6(a) |
| 778 | ······-·PCI-DSS-Req-10.5.5 | 778 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 787, 16 lines modified | Offset 787, 16 lines modified | ||
| 787 | ······lineinfile: | 787 | ······lineinfile: |
| 788 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 788 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 789 | ········state:·present | 789 | ········state:·present |
| 790 | ········dest:·/etc/audit/audit.rules | 790 | ········dest:·/etc/audit/audit.rules |
| 791 | ········create:·true | 791 | ········create:·true |
| 792 | ········mode:·'0640' | 792 | ········mode:·'0640' |
| 793 | ······when: | 793 | ······when: |
| 794 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 795 | ······-·'"audit"·in·ansible_facts.packages' | 794 | ······-·'"audit"·in·ansible_facts.packages' |
| 795 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 796 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched | 796 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched |
| 797 | ········==·0 | 797 | ········==·0 |
| 798 | ······tags: | 798 | ······tags: |
| 799 | ······-·CJIS-5.4.1.1 | 799 | ······-·CJIS-5.4.1.1 |
| 800 | ······-·NIST-800-171-3.1.8 | 800 | ······-·NIST-800-171-3.1.8 |
| 801 | ······-·NIST-800-53-AU-12(c) | 801 | ······-·NIST-800-53-AU-12(c) |
| 802 | ······-·NIST-800-53-AU-2(d) | 802 | ······-·NIST-800-53-AU-2(d) |
| Offset 829, 16 lines modified | Offset 829, 16 lines modified | ||
| 829 | ······-·reboot_required | 829 | ······-·reboot_required |
| Max diff block lines reached; 81679/86895 bytes (94.00%) of diff not shown. | |||
| Offset 21830, 16 lines modified | Offset 21830, 16 lines modified | ||
| 21830 | ······-·no_reboot_needed | 21830 | ······-·no_reboot_needed |
| 21831 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 21831 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 21832 | ······stat: | 21832 | ······stat: |
| 21833 | ········path:·/boot/grub2/grub.cfg | 21833 | ········path:·/boot/grub2/grub.cfg |
| 21834 | ······register:·file_exists | 21834 | ······register:·file_exists |
| 21835 | ······when: | 21835 | ······when: |
| 21836 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21837 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21836 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21837 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21838 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21838 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21839 | ······tags: | 21839 | ······tags: |
| 21840 | ······-·CJIS-5.5.2.2 | 21840 | ······-·CJIS-5.5.2.2 |
| 21841 | ······-·NIST-800-171-3.4.5 | 21841 | ······-·NIST-800-171-3.4.5 |
| 21842 | ······-·NIST-800-53-AC-6(1) | 21842 | ······-·NIST-800-53-AC-6(1) |
| 21843 | ······-·NIST-800-53-CM-6(a) | 21843 | ······-·NIST-800-53-CM-6(a) |
| 21844 | ······-·PCI-DSS-Req-7.1 | 21844 | ······-·PCI-DSS-Req-7.1 |
| Offset 21851, 16 lines modified | Offset 21851, 16 lines modified | ||
| 21851 | ······-·no_reboot_needed | 21851 | ······-·no_reboot_needed |
| 21852 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 21852 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 21853 | ······file: | 21853 | ······file: |
| 21854 | ········path:·/boot/grub2/grub.cfg | 21854 | ········path:·/boot/grub2/grub.cfg |
| 21855 | ········group:·'0' | 21855 | ········group:·'0' |
| 21856 | ······when: | 21856 | ······when: |
| 21857 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21858 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21857 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21858 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21859 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21859 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21860 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 21860 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 21861 | ······tags: | 21861 | ······tags: |
| 21862 | ······-·CJIS-5.5.2.2 | 21862 | ······-·CJIS-5.5.2.2 |
| 21863 | ······-·NIST-800-171-3.4.5 | 21863 | ······-·NIST-800-171-3.4.5 |
| 21864 | ······-·NIST-800-53-AC-6(1) | 21864 | ······-·NIST-800-53-AC-6(1) |
| 21865 | ······-·NIST-800-53-CM-6(a) | 21865 | ······-·NIST-800-53-CM-6(a) |
| Offset 21890, 16 lines modified | Offset 21890, 16 lines modified | ||
| 21890 | ······-·no_reboot_needed | 21890 | ······-·no_reboot_needed |
| 21891 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 21891 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 21892 | ······stat: | 21892 | ······stat: |
| 21893 | ········path:·/boot/grub2/user.cfg | 21893 | ········path:·/boot/grub2/user.cfg |
| 21894 | ······register:·file_exists | 21894 | ······register:·file_exists |
| 21895 | ······when: | 21895 | ······when: |
| 21896 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21897 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21896 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21897 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21898 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21898 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21899 | ······tags: | 21899 | ······tags: |
| 21900 | ······-·CJIS-5.5.2.2 | 21900 | ······-·CJIS-5.5.2.2 |
| 21901 | ······-·NIST-800-171-3.4.5 | 21901 | ······-·NIST-800-171-3.4.5 |
| 21902 | ······-·NIST-800-53-AC-6(1) | 21902 | ······-·NIST-800-53-AC-6(1) |
| 21903 | ······-·NIST-800-53-CM-6(a) | 21903 | ······-·NIST-800-53-CM-6(a) |
| 21904 | ······-·PCI-DSS-Req-7.1 | 21904 | ······-·PCI-DSS-Req-7.1 |
| Offset 21911, 16 lines modified | Offset 21911, 16 lines modified | ||
| 21911 | ······-·no_reboot_needed | 21911 | ······-·no_reboot_needed |
| 21912 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 21912 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 21913 | ······file: | 21913 | ······file: |
| 21914 | ········path:·/boot/grub2/user.cfg | 21914 | ········path:·/boot/grub2/user.cfg |
| 21915 | ········group:·'0' | 21915 | ········group:·'0' |
| 21916 | ······when: | 21916 | ······when: |
| 21917 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21918 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21917 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21918 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21919 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21919 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21920 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 21920 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 21921 | ······tags: | 21921 | ······tags: |
| 21922 | ······-·CJIS-5.5.2.2 | 21922 | ······-·CJIS-5.5.2.2 |
| 21923 | ······-·NIST-800-171-3.4.5 | 21923 | ······-·NIST-800-171-3.4.5 |
| 21924 | ······-·NIST-800-53-AC-6(1) | 21924 | ······-·NIST-800-53-AC-6(1) |
| 21925 | ······-·NIST-800-53-CM-6(a) | 21925 | ······-·NIST-800-53-CM-6(a) |
| Offset 21950, 16 lines modified | Offset 21950, 16 lines modified | ||
| 21950 | ······-·no_reboot_needed | 21950 | ······-·no_reboot_needed |
| 21951 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 21951 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 21952 | ······stat: | 21952 | ······stat: |
| 21953 | ········path:·/boot/grub2/grub.cfg | 21953 | ········path:·/boot/grub2/grub.cfg |
| 21954 | ······register:·file_exists | 21954 | ······register:·file_exists |
| 21955 | ······when: | 21955 | ······when: |
| 21956 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21957 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21956 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21957 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21958 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21958 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21959 | ······tags: | 21959 | ······tags: |
| 21960 | ······-·CJIS-5.5.2.2 | 21960 | ······-·CJIS-5.5.2.2 |
| 21961 | ······-·NIST-800-171-3.4.5 | 21961 | ······-·NIST-800-171-3.4.5 |
| 21962 | ······-·NIST-800-53-AC-6(1) | 21962 | ······-·NIST-800-53-AC-6(1) |
| 21963 | ······-·NIST-800-53-CM-6(a) | 21963 | ······-·NIST-800-53-CM-6(a) |
| 21964 | ······-·PCI-DSS-Req-7.1 | 21964 | ······-·PCI-DSS-Req-7.1 |
| Offset 21971, 16 lines modified | Offset 21971, 16 lines modified | ||
| 21971 | ······-·no_reboot_needed | 21971 | ······-·no_reboot_needed |
| 21972 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 21972 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 21973 | ······file: | 21973 | ······file: |
| 21974 | ········path:·/boot/grub2/grub.cfg | 21974 | ········path:·/boot/grub2/grub.cfg |
| 21975 | ········owner:·'0' | 21975 | ········owner:·'0' |
| 21976 | ······when: | 21976 | ······when: |
| 21977 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21978 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21977 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21978 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21979 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21979 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21980 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 21980 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 21981 | ······tags: | 21981 | ······tags: |
| 21982 | ······-·CJIS-5.5.2.2 | 21982 | ······-·CJIS-5.5.2.2 |
| 21983 | ······-·NIST-800-171-3.4.5 | 21983 | ······-·NIST-800-171-3.4.5 |
| 21984 | ······-·NIST-800-53-AC-6(1) | 21984 | ······-·NIST-800-53-AC-6(1) |
| 21985 | ······-·NIST-800-53-CM-6(a) | 21985 | ······-·NIST-800-53-CM-6(a) |
| Offset 22010, 16 lines modified | Offset 22010, 16 lines modified | ||
| 22010 | ······-·no_reboot_needed | 22010 | ······-·no_reboot_needed |
| 22011 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 22011 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 22012 | ······stat: | 22012 | ······stat: |
| 22013 | ········path:·/boot/grub2/user.cfg | 22013 | ········path:·/boot/grub2/user.cfg |
| 22014 | ······register:·file_exists | 22014 | ······register:·file_exists |
| 22015 | ······when: | 22015 | ······when: |
| 22016 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22017 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22016 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22017 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22018 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22018 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22019 | ······tags: | 22019 | ······tags: |
| 22020 | ······-·CJIS-5.5.2.2 | 22020 | ······-·CJIS-5.5.2.2 |
| 22021 | ······-·NIST-800-171-3.4.5 | 22021 | ······-·NIST-800-171-3.4.5 |
| 22022 | ······-·NIST-800-53-AC-6(1) | 22022 | ······-·NIST-800-53-AC-6(1) |
| 22023 | ······-·NIST-800-53-CM-6(a) | 22023 | ······-·NIST-800-53-CM-6(a) |
| 22024 | ······-·PCI-DSS-Req-7.1 | 22024 | ······-·PCI-DSS-Req-7.1 |
| Offset 22031, 16 lines modified | Offset 22031, 16 lines modified | ||
| 22031 | ······-·no_reboot_needed | 22031 | ······-·no_reboot_needed |
| Max diff block lines reached; 11553/16224 bytes (71.21%) of diff not shown. | |||
| Offset 5312, 16 lines modified | Offset 5312, 16 lines modified | ||
| 5312 | ······-·no_reboot_needed | 5312 | ······-·no_reboot_needed |
| 5313 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5313 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5314 | ······stat: | 5314 | ······stat: |
| 5315 | ········path:·/boot/grub2/grub.cfg | 5315 | ········path:·/boot/grub2/grub.cfg |
| 5316 | ······register:·file_exists | 5316 | ······register:·file_exists |
| 5317 | ······when: | 5317 | ······when: |
| 5318 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5319 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5318 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5319 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5320 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5320 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5321 | ······tags: | 5321 | ······tags: |
| 5322 | ······-·CJIS-5.5.2.2 | 5322 | ······-·CJIS-5.5.2.2 |
| 5323 | ······-·NIST-800-171-3.4.5 | 5323 | ······-·NIST-800-171-3.4.5 |
| 5324 | ······-·NIST-800-53-AC-6(1) | 5324 | ······-·NIST-800-53-AC-6(1) |
| 5325 | ······-·NIST-800-53-CM-6(a) | 5325 | ······-·NIST-800-53-CM-6(a) |
| 5326 | ······-·PCI-DSS-Req-7.1 | 5326 | ······-·PCI-DSS-Req-7.1 |
| Offset 5333, 16 lines modified | Offset 5333, 16 lines modified | ||
| 5333 | ······-·no_reboot_needed | 5333 | ······-·no_reboot_needed |
| 5334 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5334 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5335 | ······file: | 5335 | ······file: |
| 5336 | ········path:·/boot/grub2/grub.cfg | 5336 | ········path:·/boot/grub2/grub.cfg |
| 5337 | ········group:·'0' | 5337 | ········group:·'0' |
| 5338 | ······when: | 5338 | ······when: |
| 5339 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5340 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5339 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5340 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5341 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5341 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5342 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5342 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5343 | ······tags: | 5343 | ······tags: |
| 5344 | ······-·CJIS-5.5.2.2 | 5344 | ······-·CJIS-5.5.2.2 |
| 5345 | ······-·NIST-800-171-3.4.5 | 5345 | ······-·NIST-800-171-3.4.5 |
| 5346 | ······-·NIST-800-53-AC-6(1) | 5346 | ······-·NIST-800-53-AC-6(1) |
| 5347 | ······-·NIST-800-53-CM-6(a) | 5347 | ······-·NIST-800-53-CM-6(a) |
| Offset 5372, 16 lines modified | Offset 5372, 16 lines modified | ||
| 5372 | ······-·no_reboot_needed | 5372 | ······-·no_reboot_needed |
| 5373 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5373 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5374 | ······stat: | 5374 | ······stat: |
| 5375 | ········path:·/boot/grub2/user.cfg | 5375 | ········path:·/boot/grub2/user.cfg |
| 5376 | ······register:·file_exists | 5376 | ······register:·file_exists |
| 5377 | ······when: | 5377 | ······when: |
| 5378 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5379 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5378 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5379 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5380 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5380 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5381 | ······tags: | 5381 | ······tags: |
| 5382 | ······-·CJIS-5.5.2.2 | 5382 | ······-·CJIS-5.5.2.2 |
| 5383 | ······-·NIST-800-171-3.4.5 | 5383 | ······-·NIST-800-171-3.4.5 |
| 5384 | ······-·NIST-800-53-AC-6(1) | 5384 | ······-·NIST-800-53-AC-6(1) |
| 5385 | ······-·NIST-800-53-CM-6(a) | 5385 | ······-·NIST-800-53-CM-6(a) |
| 5386 | ······-·PCI-DSS-Req-7.1 | 5386 | ······-·PCI-DSS-Req-7.1 |
| Offset 5393, 16 lines modified | Offset 5393, 16 lines modified | ||
| 5393 | ······-·no_reboot_needed | 5393 | ······-·no_reboot_needed |
| 5394 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5394 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5395 | ······file: | 5395 | ······file: |
| 5396 | ········path:·/boot/grub2/user.cfg | 5396 | ········path:·/boot/grub2/user.cfg |
| 5397 | ········group:·'0' | 5397 | ········group:·'0' |
| 5398 | ······when: | 5398 | ······when: |
| 5399 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5400 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5399 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5400 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5401 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5401 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5402 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5402 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5403 | ······tags: | 5403 | ······tags: |
| 5404 | ······-·CJIS-5.5.2.2 | 5404 | ······-·CJIS-5.5.2.2 |
| 5405 | ······-·NIST-800-171-3.4.5 | 5405 | ······-·NIST-800-171-3.4.5 |
| 5406 | ······-·NIST-800-53-AC-6(1) | 5406 | ······-·NIST-800-53-AC-6(1) |
| 5407 | ······-·NIST-800-53-CM-6(a) | 5407 | ······-·NIST-800-53-CM-6(a) |
| Offset 5432, 16 lines modified | Offset 5432, 16 lines modified | ||
| 5432 | ······-·no_reboot_needed | 5432 | ······-·no_reboot_needed |
| 5433 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5433 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5434 | ······stat: | 5434 | ······stat: |
| 5435 | ········path:·/boot/grub2/grub.cfg | 5435 | ········path:·/boot/grub2/grub.cfg |
| 5436 | ······register:·file_exists | 5436 | ······register:·file_exists |
| 5437 | ······when: | 5437 | ······when: |
| 5438 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5439 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5438 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5439 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5440 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5440 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5441 | ······tags: | 5441 | ······tags: |
| 5442 | ······-·CJIS-5.5.2.2 | 5442 | ······-·CJIS-5.5.2.2 |
| 5443 | ······-·NIST-800-171-3.4.5 | 5443 | ······-·NIST-800-171-3.4.5 |
| 5444 | ······-·NIST-800-53-AC-6(1) | 5444 | ······-·NIST-800-53-AC-6(1) |
| 5445 | ······-·NIST-800-53-CM-6(a) | 5445 | ······-·NIST-800-53-CM-6(a) |
| 5446 | ······-·PCI-DSS-Req-7.1 | 5446 | ······-·PCI-DSS-Req-7.1 |
| Offset 5453, 16 lines modified | Offset 5453, 16 lines modified | ||
| 5453 | ······-·no_reboot_needed | 5453 | ······-·no_reboot_needed |
| 5454 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5454 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5455 | ······file: | 5455 | ······file: |
| 5456 | ········path:·/boot/grub2/grub.cfg | 5456 | ········path:·/boot/grub2/grub.cfg |
| 5457 | ········owner:·'0' | 5457 | ········owner:·'0' |
| 5458 | ······when: | 5458 | ······when: |
| 5459 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5460 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5459 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5460 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5461 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5461 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5462 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5462 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5463 | ······tags: | 5463 | ······tags: |
| 5464 | ······-·CJIS-5.5.2.2 | 5464 | ······-·CJIS-5.5.2.2 |
| 5465 | ······-·NIST-800-171-3.4.5 | 5465 | ······-·NIST-800-171-3.4.5 |
| 5466 | ······-·NIST-800-53-AC-6(1) | 5466 | ······-·NIST-800-53-AC-6(1) |
| 5467 | ······-·NIST-800-53-CM-6(a) | 5467 | ······-·NIST-800-53-CM-6(a) |
| Offset 5492, 16 lines modified | Offset 5492, 16 lines modified | ||
| 5492 | ······-·no_reboot_needed | 5492 | ······-·no_reboot_needed |
| 5493 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5493 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5494 | ······stat: | 5494 | ······stat: |
| 5495 | ········path:·/boot/grub2/user.cfg | 5495 | ········path:·/boot/grub2/user.cfg |
| 5496 | ······register:·file_exists | 5496 | ······register:·file_exists |
| 5497 | ······when: | 5497 | ······when: |
| 5498 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5499 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5498 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5499 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5500 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5500 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5501 | ······tags: | 5501 | ······tags: |
| 5502 | ······-·CJIS-5.5.2.2 | 5502 | ······-·CJIS-5.5.2.2 |
| 5503 | ······-·NIST-800-171-3.4.5 | 5503 | ······-·NIST-800-171-3.4.5 |
| 5504 | ······-·NIST-800-53-AC-6(1) | 5504 | ······-·NIST-800-53-AC-6(1) |
| 5505 | ······-·NIST-800-53-CM-6(a) | 5505 | ······-·NIST-800-53-CM-6(a) |
| 5506 | ······-·PCI-DSS-Req-7.1 | 5506 | ······-·PCI-DSS-Req-7.1 |
| Offset 5513, 16 lines modified | Offset 5513, 16 lines modified | ||
| 5513 | ······-·no_reboot_needed | 5513 | ······-·no_reboot_needed |
| Max diff block lines reached; 11521/16176 bytes (71.22%) of diff not shown. | |||
| Offset 5312, 16 lines modified | Offset 5312, 16 lines modified | ||
| 5312 | ······-·no_reboot_needed | 5312 | ······-·no_reboot_needed |
| 5313 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5313 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5314 | ······stat: | 5314 | ······stat: |
| 5315 | ········path:·/boot/grub2/grub.cfg | 5315 | ········path:·/boot/grub2/grub.cfg |
| 5316 | ······register:·file_exists | 5316 | ······register:·file_exists |
| 5317 | ······when: | 5317 | ······when: |
| 5318 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5319 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5318 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5319 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5320 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5320 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5321 | ······tags: | 5321 | ······tags: |
| 5322 | ······-·CJIS-5.5.2.2 | 5322 | ······-·CJIS-5.5.2.2 |
| 5323 | ······-·NIST-800-171-3.4.5 | 5323 | ······-·NIST-800-171-3.4.5 |
| 5324 | ······-·NIST-800-53-AC-6(1) | 5324 | ······-·NIST-800-53-AC-6(1) |
| 5325 | ······-·NIST-800-53-CM-6(a) | 5325 | ······-·NIST-800-53-CM-6(a) |
| 5326 | ······-·PCI-DSS-Req-7.1 | 5326 | ······-·PCI-DSS-Req-7.1 |
| Offset 5333, 16 lines modified | Offset 5333, 16 lines modified | ||
| 5333 | ······-·no_reboot_needed | 5333 | ······-·no_reboot_needed |
| 5334 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5334 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5335 | ······file: | 5335 | ······file: |
| 5336 | ········path:·/boot/grub2/grub.cfg | 5336 | ········path:·/boot/grub2/grub.cfg |
| 5337 | ········group:·'0' | 5337 | ········group:·'0' |
| 5338 | ······when: | 5338 | ······when: |
| 5339 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5340 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5339 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5340 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5341 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5341 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5342 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5342 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5343 | ······tags: | 5343 | ······tags: |
| 5344 | ······-·CJIS-5.5.2.2 | 5344 | ······-·CJIS-5.5.2.2 |
| 5345 | ······-·NIST-800-171-3.4.5 | 5345 | ······-·NIST-800-171-3.4.5 |
| 5346 | ······-·NIST-800-53-AC-6(1) | 5346 | ······-·NIST-800-53-AC-6(1) |
| 5347 | ······-·NIST-800-53-CM-6(a) | 5347 | ······-·NIST-800-53-CM-6(a) |
| Offset 5372, 16 lines modified | Offset 5372, 16 lines modified | ||
| 5372 | ······-·no_reboot_needed | 5372 | ······-·no_reboot_needed |
| 5373 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5373 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5374 | ······stat: | 5374 | ······stat: |
| 5375 | ········path:·/boot/grub2/user.cfg | 5375 | ········path:·/boot/grub2/user.cfg |
| 5376 | ······register:·file_exists | 5376 | ······register:·file_exists |
| 5377 | ······when: | 5377 | ······when: |
| 5378 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5379 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5378 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5379 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5380 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5380 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5381 | ······tags: | 5381 | ······tags: |
| 5382 | ······-·CJIS-5.5.2.2 | 5382 | ······-·CJIS-5.5.2.2 |
| 5383 | ······-·NIST-800-171-3.4.5 | 5383 | ······-·NIST-800-171-3.4.5 |
| 5384 | ······-·NIST-800-53-AC-6(1) | 5384 | ······-·NIST-800-53-AC-6(1) |
| 5385 | ······-·NIST-800-53-CM-6(a) | 5385 | ······-·NIST-800-53-CM-6(a) |
| 5386 | ······-·PCI-DSS-Req-7.1 | 5386 | ······-·PCI-DSS-Req-7.1 |
| Offset 5393, 16 lines modified | Offset 5393, 16 lines modified | ||
| 5393 | ······-·no_reboot_needed | 5393 | ······-·no_reboot_needed |
| 5394 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5394 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5395 | ······file: | 5395 | ······file: |
| 5396 | ········path:·/boot/grub2/user.cfg | 5396 | ········path:·/boot/grub2/user.cfg |
| 5397 | ········group:·'0' | 5397 | ········group:·'0' |
| 5398 | ······when: | 5398 | ······when: |
| 5399 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5400 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5399 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5400 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5401 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5401 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5402 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5402 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5403 | ······tags: | 5403 | ······tags: |
| 5404 | ······-·CJIS-5.5.2.2 | 5404 | ······-·CJIS-5.5.2.2 |
| 5405 | ······-·NIST-800-171-3.4.5 | 5405 | ······-·NIST-800-171-3.4.5 |
| 5406 | ······-·NIST-800-53-AC-6(1) | 5406 | ······-·NIST-800-53-AC-6(1) |
| 5407 | ······-·NIST-800-53-CM-6(a) | 5407 | ······-·NIST-800-53-CM-6(a) |
| Offset 5432, 16 lines modified | Offset 5432, 16 lines modified | ||
| 5432 | ······-·no_reboot_needed | 5432 | ······-·no_reboot_needed |
| 5433 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5433 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5434 | ······stat: | 5434 | ······stat: |
| 5435 | ········path:·/boot/grub2/grub.cfg | 5435 | ········path:·/boot/grub2/grub.cfg |
| 5436 | ······register:·file_exists | 5436 | ······register:·file_exists |
| 5437 | ······when: | 5437 | ······when: |
| 5438 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5439 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5438 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5439 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5440 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5440 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5441 | ······tags: | 5441 | ······tags: |
| 5442 | ······-·CJIS-5.5.2.2 | 5442 | ······-·CJIS-5.5.2.2 |
| 5443 | ······-·NIST-800-171-3.4.5 | 5443 | ······-·NIST-800-171-3.4.5 |
| 5444 | ······-·NIST-800-53-AC-6(1) | 5444 | ······-·NIST-800-53-AC-6(1) |
| 5445 | ······-·NIST-800-53-CM-6(a) | 5445 | ······-·NIST-800-53-CM-6(a) |
| 5446 | ······-·PCI-DSS-Req-7.1 | 5446 | ······-·PCI-DSS-Req-7.1 |
| Offset 5453, 16 lines modified | Offset 5453, 16 lines modified | ||
| 5453 | ······-·no_reboot_needed | 5453 | ······-·no_reboot_needed |
| 5454 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5454 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5455 | ······file: | 5455 | ······file: |
| 5456 | ········path:·/boot/grub2/grub.cfg | 5456 | ········path:·/boot/grub2/grub.cfg |
| 5457 | ········owner:·'0' | 5457 | ········owner:·'0' |
| 5458 | ······when: | 5458 | ······when: |
| 5459 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5460 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5459 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5460 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5461 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5461 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5462 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5462 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5463 | ······tags: | 5463 | ······tags: |
| 5464 | ······-·CJIS-5.5.2.2 | 5464 | ······-·CJIS-5.5.2.2 |
| 5465 | ······-·NIST-800-171-3.4.5 | 5465 | ······-·NIST-800-171-3.4.5 |
| 5466 | ······-·NIST-800-53-AC-6(1) | 5466 | ······-·NIST-800-53-AC-6(1) |
| 5467 | ······-·NIST-800-53-CM-6(a) | 5467 | ······-·NIST-800-53-CM-6(a) |
| Offset 5492, 16 lines modified | Offset 5492, 16 lines modified | ||
| 5492 | ······-·no_reboot_needed | 5492 | ······-·no_reboot_needed |
| 5493 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5493 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5494 | ······stat: | 5494 | ······stat: |
| 5495 | ········path:·/boot/grub2/user.cfg | 5495 | ········path:·/boot/grub2/user.cfg |
| 5496 | ······register:·file_exists | 5496 | ······register:·file_exists |
| 5497 | ······when: | 5497 | ······when: |
| 5498 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5499 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5498 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5499 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5500 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5500 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5501 | ······tags: | 5501 | ······tags: |
| 5502 | ······-·CJIS-5.5.2.2 | 5502 | ······-·CJIS-5.5.2.2 |
| 5503 | ······-·NIST-800-171-3.4.5 | 5503 | ······-·NIST-800-171-3.4.5 |
| 5504 | ······-·NIST-800-53-AC-6(1) | 5504 | ······-·NIST-800-53-AC-6(1) |
| 5505 | ······-·NIST-800-53-CM-6(a) | 5505 | ······-·NIST-800-53-CM-6(a) |
| 5506 | ······-·PCI-DSS-Req-7.1 | 5506 | ······-·PCI-DSS-Req-7.1 |
| Offset 5513, 16 lines modified | Offset 5513, 16 lines modified | ||
| 5513 | ······-·no_reboot_needed | 5513 | ······-·no_reboot_needed |
| Max diff block lines reached; 11521/16176 bytes (71.22%) of diff not shown. | |||
| Offset 21830, 16 lines modified | Offset 21830, 16 lines modified | ||
| 21830 | ······-·no_reboot_needed | 21830 | ······-·no_reboot_needed |
| 21831 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 21831 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 21832 | ······stat: | 21832 | ······stat: |
| 21833 | ········path:·/boot/grub2/grub.cfg | 21833 | ········path:·/boot/grub2/grub.cfg |
| 21834 | ······register:·file_exists | 21834 | ······register:·file_exists |
| 21835 | ······when: | 21835 | ······when: |
| 21836 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21837 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21836 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21837 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21838 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21838 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21839 | ······tags: | 21839 | ······tags: |
| 21840 | ······-·CJIS-5.5.2.2 | 21840 | ······-·CJIS-5.5.2.2 |
| 21841 | ······-·NIST-800-171-3.4.5 | 21841 | ······-·NIST-800-171-3.4.5 |
| 21842 | ······-·NIST-800-53-AC-6(1) | 21842 | ······-·NIST-800-53-AC-6(1) |
| 21843 | ······-·NIST-800-53-CM-6(a) | 21843 | ······-·NIST-800-53-CM-6(a) |
| 21844 | ······-·PCI-DSS-Req-7.1 | 21844 | ······-·PCI-DSS-Req-7.1 |
| Offset 21851, 16 lines modified | Offset 21851, 16 lines modified | ||
| 21851 | ······-·no_reboot_needed | 21851 | ······-·no_reboot_needed |
| 21852 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 21852 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 21853 | ······file: | 21853 | ······file: |
| 21854 | ········path:·/boot/grub2/grub.cfg | 21854 | ········path:·/boot/grub2/grub.cfg |
| 21855 | ········group:·'0' | 21855 | ········group:·'0' |
| 21856 | ······when: | 21856 | ······when: |
| 21857 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21858 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21857 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21858 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21859 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21859 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21860 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 21860 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 21861 | ······tags: | 21861 | ······tags: |
| 21862 | ······-·CJIS-5.5.2.2 | 21862 | ······-·CJIS-5.5.2.2 |
| 21863 | ······-·NIST-800-171-3.4.5 | 21863 | ······-·NIST-800-171-3.4.5 |
| 21864 | ······-·NIST-800-53-AC-6(1) | 21864 | ······-·NIST-800-53-AC-6(1) |
| 21865 | ······-·NIST-800-53-CM-6(a) | 21865 | ······-·NIST-800-53-CM-6(a) |
| Offset 21890, 16 lines modified | Offset 21890, 16 lines modified | ||
| 21890 | ······-·no_reboot_needed | 21890 | ······-·no_reboot_needed |
| 21891 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 21891 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 21892 | ······stat: | 21892 | ······stat: |
| 21893 | ········path:·/boot/grub2/user.cfg | 21893 | ········path:·/boot/grub2/user.cfg |
| 21894 | ······register:·file_exists | 21894 | ······register:·file_exists |
| 21895 | ······when: | 21895 | ······when: |
| 21896 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21897 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21896 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21897 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21898 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21898 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21899 | ······tags: | 21899 | ······tags: |
| 21900 | ······-·CJIS-5.5.2.2 | 21900 | ······-·CJIS-5.5.2.2 |
| 21901 | ······-·NIST-800-171-3.4.5 | 21901 | ······-·NIST-800-171-3.4.5 |
| 21902 | ······-·NIST-800-53-AC-6(1) | 21902 | ······-·NIST-800-53-AC-6(1) |
| 21903 | ······-·NIST-800-53-CM-6(a) | 21903 | ······-·NIST-800-53-CM-6(a) |
| 21904 | ······-·PCI-DSS-Req-7.1 | 21904 | ······-·PCI-DSS-Req-7.1 |
| Offset 21911, 16 lines modified | Offset 21911, 16 lines modified | ||
| 21911 | ······-·no_reboot_needed | 21911 | ······-·no_reboot_needed |
| 21912 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 21912 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 21913 | ······file: | 21913 | ······file: |
| 21914 | ········path:·/boot/grub2/user.cfg | 21914 | ········path:·/boot/grub2/user.cfg |
| 21915 | ········group:·'0' | 21915 | ········group:·'0' |
| 21916 | ······when: | 21916 | ······when: |
| 21917 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21918 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21917 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21918 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21919 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21919 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21920 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 21920 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 21921 | ······tags: | 21921 | ······tags: |
| 21922 | ······-·CJIS-5.5.2.2 | 21922 | ······-·CJIS-5.5.2.2 |
| 21923 | ······-·NIST-800-171-3.4.5 | 21923 | ······-·NIST-800-171-3.4.5 |
| 21924 | ······-·NIST-800-53-AC-6(1) | 21924 | ······-·NIST-800-53-AC-6(1) |
| 21925 | ······-·NIST-800-53-CM-6(a) | 21925 | ······-·NIST-800-53-CM-6(a) |
| Offset 21950, 16 lines modified | Offset 21950, 16 lines modified | ||
| 21950 | ······-·no_reboot_needed | 21950 | ······-·no_reboot_needed |
| 21951 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 21951 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 21952 | ······stat: | 21952 | ······stat: |
| 21953 | ········path:·/boot/grub2/grub.cfg | 21953 | ········path:·/boot/grub2/grub.cfg |
| 21954 | ······register:·file_exists | 21954 | ······register:·file_exists |
| 21955 | ······when: | 21955 | ······when: |
| 21956 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21957 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21956 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21957 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21958 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21958 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21959 | ······tags: | 21959 | ······tags: |
| 21960 | ······-·CJIS-5.5.2.2 | 21960 | ······-·CJIS-5.5.2.2 |
| 21961 | ······-·NIST-800-171-3.4.5 | 21961 | ······-·NIST-800-171-3.4.5 |
| 21962 | ······-·NIST-800-53-AC-6(1) | 21962 | ······-·NIST-800-53-AC-6(1) |
| 21963 | ······-·NIST-800-53-CM-6(a) | 21963 | ······-·NIST-800-53-CM-6(a) |
| 21964 | ······-·PCI-DSS-Req-7.1 | 21964 | ······-·PCI-DSS-Req-7.1 |
| Offset 21971, 16 lines modified | Offset 21971, 16 lines modified | ||
| 21971 | ······-·no_reboot_needed | 21971 | ······-·no_reboot_needed |
| 21972 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 21972 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 21973 | ······file: | 21973 | ······file: |
| 21974 | ········path:·/boot/grub2/grub.cfg | 21974 | ········path:·/boot/grub2/grub.cfg |
| 21975 | ········owner:·'0' | 21975 | ········owner:·'0' |
| 21976 | ······when: | 21976 | ······when: |
| 21977 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21978 | ······-·'"grub2-common"·in·ansible_facts.packages' | 21977 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 21978 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 21979 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 21979 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 21980 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 21980 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 21981 | ······tags: | 21981 | ······tags: |
| 21982 | ······-·CJIS-5.5.2.2 | 21982 | ······-·CJIS-5.5.2.2 |
| 21983 | ······-·NIST-800-171-3.4.5 | 21983 | ······-·NIST-800-171-3.4.5 |
| 21984 | ······-·NIST-800-53-AC-6(1) | 21984 | ······-·NIST-800-53-AC-6(1) |
| 21985 | ······-·NIST-800-53-CM-6(a) | 21985 | ······-·NIST-800-53-CM-6(a) |
| Offset 22010, 16 lines modified | Offset 22010, 16 lines modified | ||
| 22010 | ······-·no_reboot_needed | 22010 | ······-·no_reboot_needed |
| 22011 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 22011 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 22012 | ······stat: | 22012 | ······stat: |
| 22013 | ········path:·/boot/grub2/user.cfg | 22013 | ········path:·/boot/grub2/user.cfg |
| 22014 | ······register:·file_exists | 22014 | ······register:·file_exists |
| 22015 | ······when: | 22015 | ······when: |
| 22016 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22017 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22016 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22017 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22018 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22018 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22019 | ······tags: | 22019 | ······tags: |
| 22020 | ······-·CJIS-5.5.2.2 | 22020 | ······-·CJIS-5.5.2.2 |
| 22021 | ······-·NIST-800-171-3.4.5 | 22021 | ······-·NIST-800-171-3.4.5 |
| 22022 | ······-·NIST-800-53-AC-6(1) | 22022 | ······-·NIST-800-53-AC-6(1) |
| 22023 | ······-·NIST-800-53-CM-6(a) | 22023 | ······-·NIST-800-53-CM-6(a) |
| 22024 | ······-·PCI-DSS-Req-7.1 | 22024 | ······-·PCI-DSS-Req-7.1 |
| Offset 22031, 16 lines modified | Offset 22031, 16 lines modified | ||
| 22031 | ······-·no_reboot_needed | 22031 | ······-·no_reboot_needed |
| Max diff block lines reached; 11553/16224 bytes (71.21%) of diff not shown. | |||
| Offset 13554, 16 lines modified | Offset 13554, 16 lines modified | ||
| 13554 | ······-·no_reboot_needed | 13554 | ······-·no_reboot_needed |
| 13555 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 13555 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 13556 | ······stat: | 13556 | ······stat: |
| 13557 | ········path:·/boot/grub2/grub.cfg | 13557 | ········path:·/boot/grub2/grub.cfg |
| 13558 | ······register:·file_exists | 13558 | ······register:·file_exists |
| 13559 | ······when: | 13559 | ······when: |
| 13560 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13561 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13560 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13561 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13562 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13562 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13563 | ······tags: | 13563 | ······tags: |
| 13564 | ······-·CJIS-5.5.2.2 | 13564 | ······-·CJIS-5.5.2.2 |
| 13565 | ······-·NIST-800-171-3.4.5 | 13565 | ······-·NIST-800-171-3.4.5 |
| 13566 | ······-·NIST-800-53-AC-6(1) | 13566 | ······-·NIST-800-53-AC-6(1) |
| 13567 | ······-·NIST-800-53-CM-6(a) | 13567 | ······-·NIST-800-53-CM-6(a) |
| 13568 | ······-·PCI-DSS-Req-7.1 | 13568 | ······-·PCI-DSS-Req-7.1 |
| Offset 13575, 16 lines modified | Offset 13575, 16 lines modified | ||
| 13575 | ······-·no_reboot_needed | 13575 | ······-·no_reboot_needed |
| 13576 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 13576 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 13577 | ······file: | 13577 | ······file: |
| 13578 | ········path:·/boot/grub2/grub.cfg | 13578 | ········path:·/boot/grub2/grub.cfg |
| 13579 | ········group:·'0' | 13579 | ········group:·'0' |
| 13580 | ······when: | 13580 | ······when: |
| 13581 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13582 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13581 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13582 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13583 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13583 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13584 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13584 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13585 | ······tags: | 13585 | ······tags: |
| 13586 | ······-·CJIS-5.5.2.2 | 13586 | ······-·CJIS-5.5.2.2 |
| 13587 | ······-·NIST-800-171-3.4.5 | 13587 | ······-·NIST-800-171-3.4.5 |
| 13588 | ······-·NIST-800-53-AC-6(1) | 13588 | ······-·NIST-800-53-AC-6(1) |
| 13589 | ······-·NIST-800-53-CM-6(a) | 13589 | ······-·NIST-800-53-CM-6(a) |
| Offset 13614, 16 lines modified | Offset 13614, 16 lines modified | ||
| 13614 | ······-·no_reboot_needed | 13614 | ······-·no_reboot_needed |
| 13615 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 13615 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 13616 | ······stat: | 13616 | ······stat: |
| 13617 | ········path:·/boot/grub2/grub.cfg | 13617 | ········path:·/boot/grub2/grub.cfg |
| 13618 | ······register:·file_exists | 13618 | ······register:·file_exists |
| 13619 | ······when: | 13619 | ······when: |
| 13620 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13621 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13620 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13621 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13622 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13622 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13623 | ······tags: | 13623 | ······tags: |
| 13624 | ······-·CJIS-5.5.2.2 | 13624 | ······-·CJIS-5.5.2.2 |
| 13625 | ······-·NIST-800-171-3.4.5 | 13625 | ······-·NIST-800-171-3.4.5 |
| 13626 | ······-·NIST-800-53-AC-6(1) | 13626 | ······-·NIST-800-53-AC-6(1) |
| 13627 | ······-·NIST-800-53-CM-6(a) | 13627 | ······-·NIST-800-53-CM-6(a) |
| 13628 | ······-·PCI-DSS-Req-7.1 | 13628 | ······-·PCI-DSS-Req-7.1 |
| Offset 13635, 16 lines modified | Offset 13635, 16 lines modified | ||
| 13635 | ······-·no_reboot_needed | 13635 | ······-·no_reboot_needed |
| 13636 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 13636 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 13637 | ······file: | 13637 | ······file: |
| 13638 | ········path:·/boot/grub2/grub.cfg | 13638 | ········path:·/boot/grub2/grub.cfg |
| 13639 | ········owner:·'0' | 13639 | ········owner:·'0' |
| 13640 | ······when: | 13640 | ······when: |
| 13641 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13642 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13641 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13642 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13643 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13643 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13644 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13644 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13645 | ······tags: | 13645 | ······tags: |
| 13646 | ······-·CJIS-5.5.2.2 | 13646 | ······-·CJIS-5.5.2.2 |
| 13647 | ······-·NIST-800-171-3.4.5 | 13647 | ······-·NIST-800-171-3.4.5 |
| 13648 | ······-·NIST-800-53-AC-6(1) | 13648 | ······-·NIST-800-53-AC-6(1) |
| 13649 | ······-·NIST-800-53-CM-6(a) | 13649 | ······-·NIST-800-53-CM-6(a) |
| Offset 22210, 16 lines modified | Offset 22210, 16 lines modified | ||
| 22210 | ······-·no_reboot_needed | 22210 | ······-·no_reboot_needed |
| 22211 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22211 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22212 | ······stat: | 22212 | ······stat: |
| 22213 | ········path:·/boot/grub2/grub.cfg | 22213 | ········path:·/boot/grub2/grub.cfg |
| 22214 | ······register:·file_exists | 22214 | ······register:·file_exists |
| 22215 | ······when: | 22215 | ······when: |
| 22216 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22217 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22216 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22217 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22218 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22218 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22219 | ······tags: | 22219 | ······tags: |
| 22220 | ······-·CJIS-5.5.2.2 | 22220 | ······-·CJIS-5.5.2.2 |
| 22221 | ······-·NIST-800-171-3.4.5 | 22221 | ······-·NIST-800-171-3.4.5 |
| 22222 | ······-·NIST-800-53-AC-6(1) | 22222 | ······-·NIST-800-53-AC-6(1) |
| 22223 | ······-·NIST-800-53-CM-6(a) | 22223 | ······-·NIST-800-53-CM-6(a) |
| 22224 | ······-·PCI-DSS-Req-7.1 | 22224 | ······-·PCI-DSS-Req-7.1 |
| Offset 22231, 16 lines modified | Offset 22231, 16 lines modified | ||
| 22231 | ······-·no_reboot_needed | 22231 | ······-·no_reboot_needed |
| 22232 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 22232 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 22233 | ······file: | 22233 | ······file: |
| 22234 | ········path:·/boot/grub2/grub.cfg | 22234 | ········path:·/boot/grub2/grub.cfg |
| 22235 | ········group:·'0' | 22235 | ········group:·'0' |
| 22236 | ······when: | 22236 | ······when: |
| 22237 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22238 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22237 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22238 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22239 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22239 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22240 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22240 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22241 | ······tags: | 22241 | ······tags: |
| 22242 | ······-·CJIS-5.5.2.2 | 22242 | ······-·CJIS-5.5.2.2 |
| 22243 | ······-·NIST-800-171-3.4.5 | 22243 | ······-·NIST-800-171-3.4.5 |
| 22244 | ······-·NIST-800-53-AC-6(1) | 22244 | ······-·NIST-800-53-AC-6(1) |
| 22245 | ······-·NIST-800-53-CM-6(a) | 22245 | ······-·NIST-800-53-CM-6(a) |
| Offset 22270, 16 lines modified | Offset 22270, 16 lines modified | ||
| 22270 | ······-·no_reboot_needed | 22270 | ······-·no_reboot_needed |
| 22271 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22271 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22272 | ······stat: | 22272 | ······stat: |
| 22273 | ········path:·/boot/grub2/grub.cfg | 22273 | ········path:·/boot/grub2/grub.cfg |
| 22274 | ······register:·file_exists | 22274 | ······register:·file_exists |
| 22275 | ······when: | 22275 | ······when: |
| 22276 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22277 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22276 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22277 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22278 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22278 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22279 | ······tags: | 22279 | ······tags: |
| 22280 | ······-·CJIS-5.5.2.2 | 22280 | ······-·CJIS-5.5.2.2 |
| 22281 | ······-·NIST-800-171-3.4.5 | 22281 | ······-·NIST-800-171-3.4.5 |
| 22282 | ······-·NIST-800-53-AC-6(1) | 22282 | ······-·NIST-800-53-AC-6(1) |
| 22283 | ······-·NIST-800-53-CM-6(a) | 22283 | ······-·NIST-800-53-CM-6(a) |
| 22284 | ······-·PCI-DSS-Req-7.1 | 22284 | ······-·PCI-DSS-Req-7.1 |
| Offset 22291, 16 lines modified | Offset 22291, 16 lines modified | ||
| 22291 | ······-·no_reboot_needed | 22291 | ······-·no_reboot_needed |
| 22292 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 22292 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 22293 | ······file: | 22293 | ······file: |
| 22294 | ········path:·/boot/grub2/grub.cfg | 22294 | ········path:·/boot/grub2/grub.cfg |
| 22295 | ········owner:·'0' | 22295 | ········owner:·'0' |
| 22296 | ······when: | 22296 | ······when: |
| 22297 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22298 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22297 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22298 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22301 | ······tags: | 22301 | ······tags: |
| 22302 | ······-·CJIS-5.5.2.2 | 22302 | ······-·CJIS-5.5.2.2 |
| 22303 | ······-·NIST-800-171-3.4.5 | 22303 | ······-·NIST-800-171-3.4.5 |
| 22304 | ······-·NIST-800-53-AC-6(1) | 22304 | ······-·NIST-800-53-AC-6(1) |
| 22305 | ······-·NIST-800-53-CM-6(a) | 22305 | ······-·NIST-800-53-CM-6(a) |
| Offset 22991, 16 lines modified | Offset 22991, 16 lines modified | ||
| 22991 | ······-·no_reboot_needed | 22991 | ······-·no_reboot_needed |
| 22992 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22992 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22993 | ······stat: | 22993 | ······stat: |
| 22994 | ········path:·/boot/grub2/grub.cfg | 22994 | ········path:·/boot/grub2/grub.cfg |
| 22995 | ······register:·file_exists | 22995 | ······register:·file_exists |
| 22996 | ······when: | 22996 | ······when: |
| 22997 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22998 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22997 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22998 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22999 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22999 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23000 | ······tags: | 23000 | ······tags: |
| 23001 | ······-·CJIS-5.5.2.2 | 23001 | ······-·CJIS-5.5.2.2 |
| 23002 | ······-·NIST-800-171-3.4.5 | 23002 | ······-·NIST-800-171-3.4.5 |
| 23003 | ······-·NIST-800-53-AC-6(1) | 23003 | ······-·NIST-800-53-AC-6(1) |
| 23004 | ······-·NIST-800-53-CM-6(a) | 23004 | ······-·NIST-800-53-CM-6(a) |
| 23005 | ······-·PCI-DSS-Req-7.1 | 23005 | ······-·PCI-DSS-Req-7.1 |
| Offset 23012, 16 lines modified | Offset 23012, 16 lines modified | ||
| 23012 | ······-·no_reboot_needed | 23012 | ······-·no_reboot_needed |
| 23013 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 23013 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 23014 | ······file: | 23014 | ······file: |
| 23015 | ········path:·/boot/grub2/grub.cfg | 23015 | ········path:·/boot/grub2/grub.cfg |
| 23016 | ········group:·'0' | 23016 | ········group:·'0' |
| 23017 | ······when: | 23017 | ······when: |
| 23018 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23019 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23018 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23019 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23020 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23020 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23021 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 23021 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 23022 | ······tags: | 23022 | ······tags: |
| 23023 | ······-·CJIS-5.5.2.2 | 23023 | ······-·CJIS-5.5.2.2 |
| 23024 | ······-·NIST-800-171-3.4.5 | 23024 | ······-·NIST-800-171-3.4.5 |
| 23025 | ······-·NIST-800-53-AC-6(1) | 23025 | ······-·NIST-800-53-AC-6(1) |
| 23026 | ······-·NIST-800-53-CM-6(a) | 23026 | ······-·NIST-800-53-CM-6(a) |
| Offset 23051, 16 lines modified | Offset 23051, 16 lines modified | ||
| 23051 | ······-·no_reboot_needed | 23051 | ······-·no_reboot_needed |
| 23052 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 23052 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 23053 | ······stat: | 23053 | ······stat: |
| 23054 | ········path:·/boot/grub2/grub.cfg | 23054 | ········path:·/boot/grub2/grub.cfg |
| 23055 | ······register:·file_exists | 23055 | ······register:·file_exists |
| 23056 | ······when: | 23056 | ······when: |
| 23057 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23058 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23057 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23058 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23059 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23059 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23060 | ······tags: | 23060 | ······tags: |
| 23061 | ······-·CJIS-5.5.2.2 | 23061 | ······-·CJIS-5.5.2.2 |
| 23062 | ······-·NIST-800-171-3.4.5 | 23062 | ······-·NIST-800-171-3.4.5 |
| 23063 | ······-·NIST-800-53-AC-6(1) | 23063 | ······-·NIST-800-53-AC-6(1) |
| 23064 | ······-·NIST-800-53-CM-6(a) | 23064 | ······-·NIST-800-53-CM-6(a) |
| 23065 | ······-·PCI-DSS-Req-7.1 | 23065 | ······-·PCI-DSS-Req-7.1 |
| Offset 23072, 16 lines modified | Offset 23072, 16 lines modified | ||
| 23072 | ······-·no_reboot_needed | 23072 | ······-·no_reboot_needed |
| 23073 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 23073 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 23074 | ······file: | 23074 | ······file: |
| 23075 | ········path:·/boot/grub2/grub.cfg | 23075 | ········path:·/boot/grub2/grub.cfg |
| 23076 | ········owner:·'0' | 23076 | ········owner:·'0' |
| 23077 | ······when: | 23077 | ······when: |
| 23078 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23079 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23078 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23079 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23080 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23080 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23081 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 23081 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 23082 | ······tags: | 23082 | ······tags: |
| 23083 | ······-·CJIS-5.5.2.2 | 23083 | ······-·CJIS-5.5.2.2 |
| 23084 | ······-·NIST-800-171-3.4.5 | 23084 | ······-·NIST-800-171-3.4.5 |
| 23085 | ······-·NIST-800-53-AC-6(1) | 23085 | ······-·NIST-800-53-AC-6(1) |
| 23086 | ······-·NIST-800-53-CM-6(a) | 23086 | ······-·NIST-800-53-CM-6(a) |
| Offset 3210, 16 lines modified | Offset 3210, 16 lines modified | ||
| 3210 | ······-·no_reboot_needed | 3210 | ······-·no_reboot_needed |
| 3211 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 3211 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 3212 | ······stat: | 3212 | ······stat: |
| 3213 | ········path:·/boot/grub2/grub.cfg | 3213 | ········path:·/boot/grub2/grub.cfg |
| 3214 | ······register:·file_exists | 3214 | ······register:·file_exists |
| 3215 | ······when: | 3215 | ······when: |
| 3216 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3217 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3216 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3217 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3218 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3218 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3219 | ······tags: | 3219 | ······tags: |
| 3220 | ······-·CJIS-5.5.2.2 | 3220 | ······-·CJIS-5.5.2.2 |
| 3221 | ······-·NIST-800-171-3.4.5 | 3221 | ······-·NIST-800-171-3.4.5 |
| 3222 | ······-·NIST-800-53-AC-6(1) | 3222 | ······-·NIST-800-53-AC-6(1) |
| 3223 | ······-·NIST-800-53-CM-6(a) | 3223 | ······-·NIST-800-53-CM-6(a) |
| 3224 | ······-·PCI-DSS-Req-7.1 | 3224 | ······-·PCI-DSS-Req-7.1 |
| Offset 3231, 16 lines modified | Offset 3231, 16 lines modified | ||
| 3231 | ······-·no_reboot_needed | 3231 | ······-·no_reboot_needed |
| 3232 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 3232 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 3233 | ······file: | 3233 | ······file: |
| 3234 | ········path:·/boot/grub2/grub.cfg | 3234 | ········path:·/boot/grub2/grub.cfg |
| 3235 | ········group:·'0' | 3235 | ········group:·'0' |
| 3236 | ······when: | 3236 | ······when: |
| 3237 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3238 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3237 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3238 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3239 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3239 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3240 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3240 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3241 | ······tags: | 3241 | ······tags: |
| 3242 | ······-·CJIS-5.5.2.2 | 3242 | ······-·CJIS-5.5.2.2 |
| 3243 | ······-·NIST-800-171-3.4.5 | 3243 | ······-·NIST-800-171-3.4.5 |
| 3244 | ······-·NIST-800-53-AC-6(1) | 3244 | ······-·NIST-800-53-AC-6(1) |
| 3245 | ······-·NIST-800-53-CM-6(a) | 3245 | ······-·NIST-800-53-CM-6(a) |
| Offset 3270, 16 lines modified | Offset 3270, 16 lines modified | ||
| 3270 | ······-·no_reboot_needed | 3270 | ······-·no_reboot_needed |
| 3271 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 3271 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 3272 | ······stat: | 3272 | ······stat: |
| 3273 | ········path:·/boot/grub2/grub.cfg | 3273 | ········path:·/boot/grub2/grub.cfg |
| 3274 | ······register:·file_exists | 3274 | ······register:·file_exists |
| 3275 | ······when: | 3275 | ······when: |
| 3276 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3277 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3276 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3277 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3278 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3278 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3279 | ······tags: | 3279 | ······tags: |
| 3280 | ······-·CJIS-5.5.2.2 | 3280 | ······-·CJIS-5.5.2.2 |
| 3281 | ······-·NIST-800-171-3.4.5 | 3281 | ······-·NIST-800-171-3.4.5 |
| 3282 | ······-·NIST-800-53-AC-6(1) | 3282 | ······-·NIST-800-53-AC-6(1) |
| 3283 | ······-·NIST-800-53-CM-6(a) | 3283 | ······-·NIST-800-53-CM-6(a) |
| 3284 | ······-·PCI-DSS-Req-7.1 | 3284 | ······-·PCI-DSS-Req-7.1 |
| Offset 3291, 16 lines modified | Offset 3291, 16 lines modified | ||
| 3291 | ······-·no_reboot_needed | 3291 | ······-·no_reboot_needed |
| 3292 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 3292 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 3293 | ······file: | 3293 | ······file: |
| 3294 | ········path:·/boot/grub2/grub.cfg | 3294 | ········path:·/boot/grub2/grub.cfg |
| 3295 | ········owner:·'0' | 3295 | ········owner:·'0' |
| 3296 | ······when: | 3296 | ······when: |
| 3297 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3298 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3297 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3298 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3301 | ······tags: | 3301 | ······tags: |
| 3302 | ······-·CJIS-5.5.2.2 | 3302 | ······-·CJIS-5.5.2.2 |
| 3303 | ······-·NIST-800-171-3.4.5 | 3303 | ······-·NIST-800-171-3.4.5 |
| 3304 | ······-·NIST-800-53-AC-6(1) | 3304 | ······-·NIST-800-53-AC-6(1) |
| 3305 | ······-·NIST-800-53-CM-6(a) | 3305 | ······-·NIST-800-53-CM-6(a) |
| Offset 3328, 16 lines modified | Offset 3328, 16 lines modified | ||
| 3328 | ······-·no_reboot_needed | 3328 | ······-·no_reboot_needed |
| 3329 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 3329 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 3330 | ······stat: | 3330 | ······stat: |
| 3331 | ········path:·/boot/grub2/grub.cfg | 3331 | ········path:·/boot/grub2/grub.cfg |
| 3332 | ······register:·file_exists | 3332 | ······register:·file_exists |
| 3333 | ······when: | 3333 | ······when: |
| 3334 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3335 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3334 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3335 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3336 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3336 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3337 | ······tags: | 3337 | ······tags: |
| 3338 | ······-·NIST-800-171-3.4.5 | 3338 | ······-·NIST-800-171-3.4.5 |
| 3339 | ······-·NIST-800-53-AC-6(1) | 3339 | ······-·NIST-800-53-AC-6(1) |
| 3340 | ······-·NIST-800-53-CM-6(a) | 3340 | ······-·NIST-800-53-CM-6(a) |
| 3341 | ······-·configure_strategy | 3341 | ······-·configure_strategy |
| 3342 | ······-·file_permissions_grub2_cfg | 3342 | ······-·file_permissions_grub2_cfg |
| Offset 3347, 16 lines modified | Offset 3347, 16 lines modified | ||
| 3347 | ······-·no_reboot_needed | 3347 | ······-·no_reboot_needed |
| 3348 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 3348 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 3349 | ······file: | 3349 | ······file: |
| 3350 | ········path:·/boot/grub2/grub.cfg | 3350 | ········path:·/boot/grub2/grub.cfg |
| 3351 | ········mode:·u-xs,g-xwrs,o-xwrt | 3351 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 3352 | ······when: | 3352 | ······when: |
| 3353 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3354 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3353 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3354 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3355 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3355 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3356 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3356 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3357 | ······tags: | 3357 | ······tags: |
| 3358 | ······-·NIST-800-171-3.4.5 | 3358 | ······-·NIST-800-171-3.4.5 |
| 3359 | ······-·NIST-800-53-AC-6(1) | 3359 | ······-·NIST-800-53-AC-6(1) |
| 3360 | ······-·NIST-800-53-CM-6(a) | 3360 | ······-·NIST-800-53-CM-6(a) |
| 3361 | ······-·configure_strategy | 3361 | ······-·configure_strategy |
| Offset 37476, 16 lines modified | Offset 37476, 16 lines modified | ||
| 37476 | ········lineinfile: | 37476 | ········lineinfile: |
| 37477 | ··········path:·/etc/postfix/main.cf | 37477 | ··········path:·/etc/postfix/main.cf |
| 37478 | ··········create:·true | 37478 | ··········create:·true |
| 37479 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* | 37479 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* |
| 37480 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject | 37480 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject |
| 37481 | ··········state:·present | 37481 | ··········state:·present |
| 37482 | ······when: | 37482 | ······when: |
| 37483 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 37484 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 37483 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 37484 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 37485 | ······tags: | 37485 | ······tags: |
| 37486 | ······-·DISA-STIG-RHEL-08-040290 | 37486 | ······-·DISA-STIG-RHEL-08-040290 |
| 37487 | ······-·low_complexity | 37487 | ······-·low_complexity |
| 37488 | ······-·low_disruption | 37488 | ······-·low_disruption |
| 37489 | ······-·medium_severity | 37489 | ······-·medium_severity |
| 37490 | ······-·no_reboot_needed | 37490 | ······-·no_reboot_needed |
| 37491 | ······-·postfix_prevent_unrestricted_relay | 37491 | ······-·postfix_prevent_unrestricted_relay |
| Offset 37467, 16 lines modified | Offset 37467, 16 lines modified | ||
| 37467 | ········lineinfile: | 37467 | ········lineinfile: |
| 37468 | ··········path:·/etc/postfix/main.cf | 37468 | ··········path:·/etc/postfix/main.cf |
| 37469 | ··········create:·true | 37469 | ··········create:·true |
| 37470 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* | 37470 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* |
| 37471 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject | 37471 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject |
| 37472 | ··········state:·present | 37472 | ··········state:·present |
| 37473 | ······when: | 37473 | ······when: |
| 37474 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 37475 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 37474 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 37475 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 37476 | ······tags: | 37476 | ······tags: |
| 37477 | ······-·DISA-STIG-RHEL-08-040290 | 37477 | ······-·DISA-STIG-RHEL-08-040290 |
| 37478 | ······-·low_complexity | 37478 | ······-·low_complexity |
| 37479 | ······-·low_disruption | 37479 | ······-·low_disruption |
| 37480 | ······-·medium_severity | 37480 | ······-·medium_severity |
| 37481 | ······-·no_reboot_needed | 37481 | ······-·no_reboot_needed |
| 37482 | ······-·postfix_prevent_unrestricted_relay | 37482 | ······-·postfix_prevent_unrestricted_relay |
| Offset 5328, 16 lines modified | Offset 5328, 16 lines modified | ||
| 5328 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5328 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5329 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5329 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5330 | ··········create:·true | 5330 | ··········create:·true |
| 5331 | ··········mode:·o-rwx | 5331 | ··········mode:·o-rwx |
| 5332 | ··········state:·present | 5332 | ··········state:·present |
| 5333 | ········when:·syscalls_found·|·length·==·0 | 5333 | ········when:·syscalls_found·|·length·==·0 |
| 5334 | ······when: | 5334 | ······when: |
| 5335 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5336 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5335 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5336 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5337 | ······tags: | 5337 | ······tags: |
| 5338 | ······-·NIST-800-171-3.1.7 | 5338 | ······-·NIST-800-171-3.1.7 |
| 5339 | ······-·NIST-800-53-AC-6(9) | 5339 | ······-·NIST-800-53-AC-6(9) |
| 5340 | ······-·NIST-800-53-AU-12(c) | 5340 | ······-·NIST-800-53-AU-12(c) |
| 5341 | ······-·NIST-800-53-AU-2(d) | 5341 | ······-·NIST-800-53-AU-2(d) |
| 5342 | ······-·NIST-800-53-CM-6(a) | 5342 | ······-·NIST-800-53-CM-6(a) |
| 5343 | ······-·audit_rules_privileged_commands_sudo | 5343 | ······-·audit_rules_privileged_commands_sudo |
| Offset 5431, 16 lines modified | Offset 5431, 16 lines modified | ||
| 5431 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5431 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5432 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5432 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5433 | ··········create:·true | 5433 | ··········create:·true |
| 5434 | ··········mode:·o-rwx | 5434 | ··········mode:·o-rwx |
| 5435 | ··········state:·present | 5435 | ··········state:·present |
| 5436 | ········when:·syscalls_found·|·length·==·0 | 5436 | ········when:·syscalls_found·|·length·==·0 |
| 5437 | ······when: | 5437 | ······when: |
| 5438 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5439 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5438 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5439 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5440 | ······tags: | 5440 | ······tags: |
| 5441 | ······-·NIST-800-171-3.1.7 | 5441 | ······-·NIST-800-171-3.1.7 |
| 5442 | ······-·NIST-800-53-AC-6(9) | 5442 | ······-·NIST-800-53-AC-6(9) |
| 5443 | ······-·NIST-800-53-AU-12(c) | 5443 | ······-·NIST-800-53-AU-12(c) |
| 5444 | ······-·NIST-800-53-AU-2(d) | 5444 | ······-·NIST-800-53-AU-2(d) |
| 5445 | ······-·NIST-800-53-CM-6(a) | 5445 | ······-·NIST-800-53-CM-6(a) |
| 5446 | ······-·audit_rules_privileged_commands_sudo | 5446 | ······-·audit_rules_privileged_commands_sudo |
| Offset 5062, 16 lines modified | Offset 5062, 16 lines modified | ||
| 5062 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5062 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5063 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5063 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5064 | ··········create:·true | 5064 | ··········create:·true |
| 5065 | ··········mode:·o-rwx | 5065 | ··········mode:·o-rwx |
| 5066 | ··········state:·present | 5066 | ··········state:·present |
| 5067 | ········when:·syscalls_found·|·length·==·0 | 5067 | ········when:·syscalls_found·|·length·==·0 |
| 5068 | ······when: | 5068 | ······when: |
| 5069 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5070 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5069 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5070 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5071 | ······tags: | 5071 | ······tags: |
| 5072 | ······-·NIST-800-171-3.1.7 | 5072 | ······-·NIST-800-171-3.1.7 |
| 5073 | ······-·NIST-800-53-AC-6(9) | 5073 | ······-·NIST-800-53-AC-6(9) |
| 5074 | ······-·NIST-800-53-AU-12(c) | 5074 | ······-·NIST-800-53-AU-12(c) |
| 5075 | ······-·NIST-800-53-AU-2(d) | 5075 | ······-·NIST-800-53-AU-2(d) |
| 5076 | ······-·NIST-800-53-CM-6(a) | 5076 | ······-·NIST-800-53-CM-6(a) |
| 5077 | ······-·audit_rules_privileged_commands_sudo | 5077 | ······-·audit_rules_privileged_commands_sudo |
| Offset 5222, 16 lines modified | Offset 5222, 16 lines modified | ||
| 5222 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 5222 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 5223 | ······find: | 5223 | ······find: |
| 5224 | ········paths:·/etc/audit/rules.d/ | 5224 | ········paths:·/etc/audit/rules.d/ |
| 5225 | ········patterns:·'*.rules' | 5225 | ········patterns:·'*.rules' |
| 5226 | ······register:·find_rules_d | 5226 | ······register:·find_rules_d |
| 5227 | ······when: | 5227 | ······when: |
| 5228 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5229 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5228 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5229 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5230 | ······tags: | 5230 | ······tags: |
| 5231 | ······-·CJIS-5.4.1.1 | 5231 | ······-·CJIS-5.4.1.1 |
| 5232 | ······-·NIST-800-171-3.3.1 | 5232 | ······-·NIST-800-171-3.3.1 |
| 5233 | ······-·NIST-800-171-3.4.3 | 5233 | ······-·NIST-800-171-3.4.3 |
| 5234 | ······-·NIST-800-53-AC-6(9) | 5234 | ······-·NIST-800-53-AC-6(9) |
| 5235 | ······-·NIST-800-53-CM-6(a) | 5235 | ······-·NIST-800-53-CM-6(a) |
| 5236 | ······-·PCI-DSS-Req-10.5.2 | 5236 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5246, 16 lines modified | Offset 5246, 16 lines modified | ||
| 5246 | ······lineinfile: | 5246 | ······lineinfile: |
| 5247 | ········path:·'{{·item·}}' | 5247 | ········path:·'{{·item·}}' |
| 5248 | ········regexp:·^\s*(?:-e)\s+.*$ | 5248 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 5249 | ········state:·absent | 5249 | ········state:·absent |
| 5250 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 5250 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 5251 | ········}}' | 5251 | ········}}' |
| 5252 | ······when: | 5252 | ······when: |
| 5253 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5254 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5253 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5254 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5255 | ······tags: | 5255 | ······tags: |
| 5256 | ······-·CJIS-5.4.1.1 | 5256 | ······-·CJIS-5.4.1.1 |
| 5257 | ······-·NIST-800-171-3.3.1 | 5257 | ······-·NIST-800-171-3.3.1 |
| 5258 | ······-·NIST-800-171-3.4.3 | 5258 | ······-·NIST-800-171-3.4.3 |
| 5259 | ······-·NIST-800-53-AC-6(9) | 5259 | ······-·NIST-800-53-AC-6(9) |
| 5260 | ······-·NIST-800-53-CM-6(a) | 5260 | ······-·NIST-800-53-CM-6(a) |
| 5261 | ······-·PCI-DSS-Req-10.5.2 | 5261 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5272, 16 lines modified | Offset 5272, 16 lines modified | ||
| 5272 | ········create:·true | 5272 | ········create:·true |
| 5273 | ········line:·-e·2 | 5273 | ········line:·-e·2 |
| 5274 | ········mode:·o-rwx | 5274 | ········mode:·o-rwx |
| 5275 | ······loop: | 5275 | ······loop: |
| 5276 | ······-·/etc/audit/audit.rules | 5276 | ······-·/etc/audit/audit.rules |
| 5277 | ······-·/etc/audit/rules.d/immutable.rules | 5277 | ······-·/etc/audit/rules.d/immutable.rules |
| 5278 | ······when: | 5278 | ······when: |
| 5279 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5280 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5279 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5280 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5281 | ······tags: | 5281 | ······tags: |
| 5282 | ······-·CJIS-5.4.1.1 | 5282 | ······-·CJIS-5.4.1.1 |
| 5283 | ······-·NIST-800-171-3.3.1 | 5283 | ······-·NIST-800-171-3.3.1 |
| 5284 | ······-·NIST-800-171-3.4.3 | 5284 | ······-·NIST-800-171-3.4.3 |
| 5285 | ······-·NIST-800-53-AC-6(9) | 5285 | ······-·NIST-800-53-AC-6(9) |
| 5286 | ······-·NIST-800-53-CM-6(a) | 5286 | ······-·NIST-800-53-CM-6(a) |
| 5287 | ······-·PCI-DSS-Req-10.5.2 | 5287 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5313, 16 lines modified | Offset 5313, 16 lines modified | ||
| 5313 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5313 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5314 | ······find: | 5314 | ······find: |
| 5315 | ········paths:·/etc/audit/rules.d | 5315 | ········paths:·/etc/audit/rules.d |
| 5316 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5316 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5317 | ········patterns:·'*.rules' | 5317 | ········patterns:·'*.rules' |
| 5318 | ······register:·find_existing_watch_rules_d | 5318 | ······register:·find_existing_watch_rules_d |
| 5319 | ······when: | 5319 | ······when: |
| 5320 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5321 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5320 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5321 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5322 | ······tags: | 5322 | ······tags: |
| 5323 | ······-·CJIS-5.4.1.1 | 5323 | ······-·CJIS-5.4.1.1 |
| 5324 | ······-·NIST-800-171-3.1.8 | 5324 | ······-·NIST-800-171-3.1.8 |
| 5325 | ······-·NIST-800-53-AU-12(c) | 5325 | ······-·NIST-800-53-AU-12(c) |
| 5326 | ······-·NIST-800-53-AU-2(d) | 5326 | ······-·NIST-800-53-AU-2(d) |
| 5327 | ······-·NIST-800-53-CM-6(a) | 5327 | ······-·NIST-800-53-CM-6(a) |
| 5328 | ······-·PCI-DSS-Req-10.5.5 | 5328 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 5336, 16 lines modified | Offset 5336, 16 lines modified | ||
| 5336 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5336 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5337 | ······find: | 5337 | ······find: |
| 5338 | ········paths:·/etc/audit/rules.d | 5338 | ········paths:·/etc/audit/rules.d |
| 5339 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5339 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5340 | ········patterns:·'*.rules' | 5340 | ········patterns:·'*.rules' |
| 5341 | ······register:·find_watch_key | 5341 | ······register:·find_watch_key |
| 5342 | ······when: | 5342 | ······when: |
| 5343 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5343 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5344 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5345 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5345 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5346 | ········==·0 | 5346 | ········==·0 |
| 5347 | ······tags: | 5347 | ······tags: |
| 5348 | ······-·CJIS-5.4.1.1 | 5348 | ······-·CJIS-5.4.1.1 |
| 5349 | ······-·NIST-800-171-3.1.8 | 5349 | ······-·NIST-800-171-3.1.8 |
| 5350 | ······-·NIST-800-53-AU-12(c) | 5350 | ······-·NIST-800-53-AU-12(c) |
| 5351 | ······-·NIST-800-53-AU-2(d) | 5351 | ······-·NIST-800-53-AU-2(d) |
| Offset 5359, 16 lines modified | Offset 5359, 16 lines modified | ||
| 5359 | ······-·restrict_strategy | 5359 | ······-·restrict_strategy |
| 5360 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5360 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5361 | ······set_fact: | 5361 | ······set_fact: |
| 5362 | ········all_files: | 5362 | ········all_files: |
| 5363 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5363 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5364 | ······when: | 5364 | ······when: |
| 5365 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5365 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5366 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5367 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5367 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5368 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5368 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5369 | ······tags: | 5369 | ······tags: |
| 5370 | ······-·CJIS-5.4.1.1 | 5370 | ······-·CJIS-5.4.1.1 |
| 5371 | ······-·NIST-800-171-3.1.8 | 5371 | ······-·NIST-800-171-3.1.8 |
| 5372 | ······-·NIST-800-53-AU-12(c) | 5372 | ······-·NIST-800-53-AU-12(c) |
| 5373 | ······-·NIST-800-53-AU-2(d) | 5373 | ······-·NIST-800-53-AU-2(d) |
| Offset 5382, 16 lines modified | Offset 5382, 16 lines modified | ||
| 5382 | ······-·restrict_strategy | 5382 | ······-·restrict_strategy |
| 5383 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5383 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5384 | ······set_fact: | 5384 | ······set_fact: |
| 5385 | ········all_files: | 5385 | ········all_files: |
| 5386 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5386 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5387 | ······when: | 5387 | ······when: |
| 5388 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5389 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5388 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5389 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5390 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5390 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5391 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5391 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5392 | ······tags: | 5392 | ······tags: |
| 5393 | ······-·CJIS-5.4.1.1 | 5393 | ······-·CJIS-5.4.1.1 |
| 5394 | ······-·NIST-800-171-3.1.8 | 5394 | ······-·NIST-800-171-3.1.8 |
| 5395 | ······-·NIST-800-53-AU-12(c) | 5395 | ······-·NIST-800-53-AU-12(c) |
| 5396 | ······-·NIST-800-53-AU-2(d) | 5396 | ······-·NIST-800-53-AU-2(d) |
| Offset 5407, 16 lines modified | Offset 5407, 16 lines modified | ||
| 5407 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5407 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 159331/164016 bytes (97.14%) of diff not shown. | |||
| Offset 5057, 16 lines modified | Offset 5057, 16 lines modified | ||
| 5057 | ······-·no_reboot_needed | 5057 | ······-·no_reboot_needed |
| 5058 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5058 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5059 | ······stat: | 5059 | ······stat: |
| 5060 | ········path:·/boot/grub2/grub.cfg | 5060 | ········path:·/boot/grub2/grub.cfg |
| 5061 | ······register:·file_exists | 5061 | ······register:·file_exists |
| 5062 | ······when: | 5062 | ······when: |
| 5063 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5064 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5063 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5064 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5065 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5065 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5066 | ······tags: | 5066 | ······tags: |
| 5067 | ······-·CJIS-5.5.2.2 | 5067 | ······-·CJIS-5.5.2.2 |
| 5068 | ······-·NIST-800-171-3.4.5 | 5068 | ······-·NIST-800-171-3.4.5 |
| 5069 | ······-·NIST-800-53-AC-6(1) | 5069 | ······-·NIST-800-53-AC-6(1) |
| 5070 | ······-·NIST-800-53-CM-6(a) | 5070 | ······-·NIST-800-53-CM-6(a) |
| 5071 | ······-·PCI-DSS-Req-7.1 | 5071 | ······-·PCI-DSS-Req-7.1 |
| Offset 5078, 16 lines modified | Offset 5078, 16 lines modified | ||
| 5078 | ······-·no_reboot_needed | 5078 | ······-·no_reboot_needed |
| 5079 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5079 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5080 | ······file: | 5080 | ······file: |
| 5081 | ········path:·/boot/grub2/grub.cfg | 5081 | ········path:·/boot/grub2/grub.cfg |
| 5082 | ········group:·'0' | 5082 | ········group:·'0' |
| 5083 | ······when: | 5083 | ······when: |
| 5084 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5085 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5084 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5085 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5086 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5086 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5087 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5087 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5088 | ······tags: | 5088 | ······tags: |
| 5089 | ······-·CJIS-5.5.2.2 | 5089 | ······-·CJIS-5.5.2.2 |
| 5090 | ······-·NIST-800-171-3.4.5 | 5090 | ······-·NIST-800-171-3.4.5 |
| 5091 | ······-·NIST-800-53-AC-6(1) | 5091 | ······-·NIST-800-53-AC-6(1) |
| 5092 | ······-·NIST-800-53-CM-6(a) | 5092 | ······-·NIST-800-53-CM-6(a) |
| Offset 5117, 16 lines modified | Offset 5117, 16 lines modified | ||
| 5117 | ······-·no_reboot_needed | 5117 | ······-·no_reboot_needed |
| 5118 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5118 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5119 | ······stat: | 5119 | ······stat: |
| 5120 | ········path:·/boot/grub2/user.cfg | 5120 | ········path:·/boot/grub2/user.cfg |
| 5121 | ······register:·file_exists | 5121 | ······register:·file_exists |
| 5122 | ······when: | 5122 | ······when: |
| 5123 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5124 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5123 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5124 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5125 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5125 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5126 | ······tags: | 5126 | ······tags: |
| 5127 | ······-·CJIS-5.5.2.2 | 5127 | ······-·CJIS-5.5.2.2 |
| 5128 | ······-·NIST-800-171-3.4.5 | 5128 | ······-·NIST-800-171-3.4.5 |
| 5129 | ······-·NIST-800-53-AC-6(1) | 5129 | ······-·NIST-800-53-AC-6(1) |
| 5130 | ······-·NIST-800-53-CM-6(a) | 5130 | ······-·NIST-800-53-CM-6(a) |
| 5131 | ······-·PCI-DSS-Req-7.1 | 5131 | ······-·PCI-DSS-Req-7.1 |
| Offset 5138, 16 lines modified | Offset 5138, 16 lines modified | ||
| 5138 | ······-·no_reboot_needed | 5138 | ······-·no_reboot_needed |
| 5139 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5139 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5140 | ······file: | 5140 | ······file: |
| 5141 | ········path:·/boot/grub2/user.cfg | 5141 | ········path:·/boot/grub2/user.cfg |
| 5142 | ········group:·'0' | 5142 | ········group:·'0' |
| 5143 | ······when: | 5143 | ······when: |
| 5144 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5145 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5144 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5145 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5147 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5147 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5148 | ······tags: | 5148 | ······tags: |
| 5149 | ······-·CJIS-5.5.2.2 | 5149 | ······-·CJIS-5.5.2.2 |
| 5150 | ······-·NIST-800-171-3.4.5 | 5150 | ······-·NIST-800-171-3.4.5 |
| 5151 | ······-·NIST-800-53-AC-6(1) | 5151 | ······-·NIST-800-53-AC-6(1) |
| 5152 | ······-·NIST-800-53-CM-6(a) | 5152 | ······-·NIST-800-53-CM-6(a) |
| Offset 5177, 16 lines modified | Offset 5177, 16 lines modified | ||
| 5177 | ······-·no_reboot_needed | 5177 | ······-·no_reboot_needed |
| 5178 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5178 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5179 | ······stat: | 5179 | ······stat: |
| 5180 | ········path:·/boot/grub2/grub.cfg | 5180 | ········path:·/boot/grub2/grub.cfg |
| 5181 | ······register:·file_exists | 5181 | ······register:·file_exists |
| 5182 | ······when: | 5182 | ······when: |
| 5183 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5184 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5183 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5184 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5185 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5185 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5186 | ······tags: | 5186 | ······tags: |
| 5187 | ······-·CJIS-5.5.2.2 | 5187 | ······-·CJIS-5.5.2.2 |
| 5188 | ······-·NIST-800-171-3.4.5 | 5188 | ······-·NIST-800-171-3.4.5 |
| 5189 | ······-·NIST-800-53-AC-6(1) | 5189 | ······-·NIST-800-53-AC-6(1) |
| 5190 | ······-·NIST-800-53-CM-6(a) | 5190 | ······-·NIST-800-53-CM-6(a) |
| 5191 | ······-·PCI-DSS-Req-7.1 | 5191 | ······-·PCI-DSS-Req-7.1 |
| Offset 5198, 16 lines modified | Offset 5198, 16 lines modified | ||
| 5198 | ······-·no_reboot_needed | 5198 | ······-·no_reboot_needed |
| 5199 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5199 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5200 | ······file: | 5200 | ······file: |
| 5201 | ········path:·/boot/grub2/grub.cfg | 5201 | ········path:·/boot/grub2/grub.cfg |
| 5202 | ········owner:·'0' | 5202 | ········owner:·'0' |
| 5203 | ······when: | 5203 | ······when: |
| 5204 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5205 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5204 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5205 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5206 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5206 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5207 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5207 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5208 | ······tags: | 5208 | ······tags: |
| 5209 | ······-·CJIS-5.5.2.2 | 5209 | ······-·CJIS-5.5.2.2 |
| 5210 | ······-·NIST-800-171-3.4.5 | 5210 | ······-·NIST-800-171-3.4.5 |
| 5211 | ······-·NIST-800-53-AC-6(1) | 5211 | ······-·NIST-800-53-AC-6(1) |
| 5212 | ······-·NIST-800-53-CM-6(a) | 5212 | ······-·NIST-800-53-CM-6(a) |
| Offset 5237, 16 lines modified | Offset 5237, 16 lines modified | ||
| 5237 | ······-·no_reboot_needed | 5237 | ······-·no_reboot_needed |
| 5238 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5238 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5239 | ······stat: | 5239 | ······stat: |
| 5240 | ········path:·/boot/grub2/user.cfg | 5240 | ········path:·/boot/grub2/user.cfg |
| 5241 | ······register:·file_exists | 5241 | ······register:·file_exists |
| 5242 | ······when: | 5242 | ······when: |
| 5243 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5244 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5243 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5244 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5245 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5245 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5246 | ······tags: | 5246 | ······tags: |
| 5247 | ······-·CJIS-5.5.2.2 | 5247 | ······-·CJIS-5.5.2.2 |
| 5248 | ······-·NIST-800-171-3.4.5 | 5248 | ······-·NIST-800-171-3.4.5 |
| 5249 | ······-·NIST-800-53-AC-6(1) | 5249 | ······-·NIST-800-53-AC-6(1) |
| 5250 | ······-·NIST-800-53-CM-6(a) | 5250 | ······-·NIST-800-53-CM-6(a) |
| 5251 | ······-·PCI-DSS-Req-7.1 | 5251 | ······-·PCI-DSS-Req-7.1 |
| Offset 5258, 16 lines modified | Offset 5258, 16 lines modified | ||
| 5258 | ······-·no_reboot_needed | 5258 | ······-·no_reboot_needed |
| Max diff block lines reached; 3245/7725 bytes (42.01%) of diff not shown. | |||
| Offset 5057, 16 lines modified | Offset 5057, 16 lines modified | ||
| 5057 | ······-·no_reboot_needed | 5057 | ······-·no_reboot_needed |
| 5058 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5058 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5059 | ······stat: | 5059 | ······stat: |
| 5060 | ········path:·/boot/grub2/grub.cfg | 5060 | ········path:·/boot/grub2/grub.cfg |
| 5061 | ······register:·file_exists | 5061 | ······register:·file_exists |
| 5062 | ······when: | 5062 | ······when: |
| 5063 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5064 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5063 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5064 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5065 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5065 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5066 | ······tags: | 5066 | ······tags: |
| 5067 | ······-·CJIS-5.5.2.2 | 5067 | ······-·CJIS-5.5.2.2 |
| 5068 | ······-·NIST-800-171-3.4.5 | 5068 | ······-·NIST-800-171-3.4.5 |
| 5069 | ······-·NIST-800-53-AC-6(1) | 5069 | ······-·NIST-800-53-AC-6(1) |
| 5070 | ······-·NIST-800-53-CM-6(a) | 5070 | ······-·NIST-800-53-CM-6(a) |
| 5071 | ······-·PCI-DSS-Req-7.1 | 5071 | ······-·PCI-DSS-Req-7.1 |
| Offset 5078, 16 lines modified | Offset 5078, 16 lines modified | ||
| 5078 | ······-·no_reboot_needed | 5078 | ······-·no_reboot_needed |
| 5079 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5079 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5080 | ······file: | 5080 | ······file: |
| 5081 | ········path:·/boot/grub2/grub.cfg | 5081 | ········path:·/boot/grub2/grub.cfg |
| 5082 | ········group:·'0' | 5082 | ········group:·'0' |
| 5083 | ······when: | 5083 | ······when: |
| 5084 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5085 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5084 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5085 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5086 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5086 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5087 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5087 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5088 | ······tags: | 5088 | ······tags: |
| 5089 | ······-·CJIS-5.5.2.2 | 5089 | ······-·CJIS-5.5.2.2 |
| 5090 | ······-·NIST-800-171-3.4.5 | 5090 | ······-·NIST-800-171-3.4.5 |
| 5091 | ······-·NIST-800-53-AC-6(1) | 5091 | ······-·NIST-800-53-AC-6(1) |
| 5092 | ······-·NIST-800-53-CM-6(a) | 5092 | ······-·NIST-800-53-CM-6(a) |
| Offset 5117, 16 lines modified | Offset 5117, 16 lines modified | ||
| 5117 | ······-·no_reboot_needed | 5117 | ······-·no_reboot_needed |
| 5118 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5118 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5119 | ······stat: | 5119 | ······stat: |
| 5120 | ········path:·/boot/grub2/user.cfg | 5120 | ········path:·/boot/grub2/user.cfg |
| 5121 | ······register:·file_exists | 5121 | ······register:·file_exists |
| 5122 | ······when: | 5122 | ······when: |
| 5123 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5124 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5123 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5124 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5125 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5125 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5126 | ······tags: | 5126 | ······tags: |
| 5127 | ······-·CJIS-5.5.2.2 | 5127 | ······-·CJIS-5.5.2.2 |
| 5128 | ······-·NIST-800-171-3.4.5 | 5128 | ······-·NIST-800-171-3.4.5 |
| 5129 | ······-·NIST-800-53-AC-6(1) | 5129 | ······-·NIST-800-53-AC-6(1) |
| 5130 | ······-·NIST-800-53-CM-6(a) | 5130 | ······-·NIST-800-53-CM-6(a) |
| 5131 | ······-·PCI-DSS-Req-7.1 | 5131 | ······-·PCI-DSS-Req-7.1 |
| Offset 5138, 16 lines modified | Offset 5138, 16 lines modified | ||
| 5138 | ······-·no_reboot_needed | 5138 | ······-·no_reboot_needed |
| 5139 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5139 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5140 | ······file: | 5140 | ······file: |
| 5141 | ········path:·/boot/grub2/user.cfg | 5141 | ········path:·/boot/grub2/user.cfg |
| 5142 | ········group:·'0' | 5142 | ········group:·'0' |
| 5143 | ······when: | 5143 | ······when: |
| 5144 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5145 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5144 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5145 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5147 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5147 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5148 | ······tags: | 5148 | ······tags: |
| 5149 | ······-·CJIS-5.5.2.2 | 5149 | ······-·CJIS-5.5.2.2 |
| 5150 | ······-·NIST-800-171-3.4.5 | 5150 | ······-·NIST-800-171-3.4.5 |
| 5151 | ······-·NIST-800-53-AC-6(1) | 5151 | ······-·NIST-800-53-AC-6(1) |
| 5152 | ······-·NIST-800-53-CM-6(a) | 5152 | ······-·NIST-800-53-CM-6(a) |
| Offset 5177, 16 lines modified | Offset 5177, 16 lines modified | ||
| 5177 | ······-·no_reboot_needed | 5177 | ······-·no_reboot_needed |
| 5178 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5178 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5179 | ······stat: | 5179 | ······stat: |
| 5180 | ········path:·/boot/grub2/grub.cfg | 5180 | ········path:·/boot/grub2/grub.cfg |
| 5181 | ······register:·file_exists | 5181 | ······register:·file_exists |
| 5182 | ······when: | 5182 | ······when: |
| 5183 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5184 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5183 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5184 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5185 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5185 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5186 | ······tags: | 5186 | ······tags: |
| 5187 | ······-·CJIS-5.5.2.2 | 5187 | ······-·CJIS-5.5.2.2 |
| 5188 | ······-·NIST-800-171-3.4.5 | 5188 | ······-·NIST-800-171-3.4.5 |
| 5189 | ······-·NIST-800-53-AC-6(1) | 5189 | ······-·NIST-800-53-AC-6(1) |
| 5190 | ······-·NIST-800-53-CM-6(a) | 5190 | ······-·NIST-800-53-CM-6(a) |
| 5191 | ······-·PCI-DSS-Req-7.1 | 5191 | ······-·PCI-DSS-Req-7.1 |
| Offset 5198, 16 lines modified | Offset 5198, 16 lines modified | ||
| 5198 | ······-·no_reboot_needed | 5198 | ······-·no_reboot_needed |
| 5199 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5199 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5200 | ······file: | 5200 | ······file: |
| 5201 | ········path:·/boot/grub2/grub.cfg | 5201 | ········path:·/boot/grub2/grub.cfg |
| 5202 | ········owner:·'0' | 5202 | ········owner:·'0' |
| 5203 | ······when: | 5203 | ······when: |
| 5204 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5205 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5204 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5205 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5206 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5206 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5207 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5207 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5208 | ······tags: | 5208 | ······tags: |
| 5209 | ······-·CJIS-5.5.2.2 | 5209 | ······-·CJIS-5.5.2.2 |
| 5210 | ······-·NIST-800-171-3.4.5 | 5210 | ······-·NIST-800-171-3.4.5 |
| 5211 | ······-·NIST-800-53-AC-6(1) | 5211 | ······-·NIST-800-53-AC-6(1) |
| 5212 | ······-·NIST-800-53-CM-6(a) | 5212 | ······-·NIST-800-53-CM-6(a) |
| Offset 5237, 16 lines modified | Offset 5237, 16 lines modified | ||
| 5237 | ······-·no_reboot_needed | 5237 | ······-·no_reboot_needed |
| 5238 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5238 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5239 | ······stat: | 5239 | ······stat: |
| 5240 | ········path:·/boot/grub2/user.cfg | 5240 | ········path:·/boot/grub2/user.cfg |
| 5241 | ······register:·file_exists | 5241 | ······register:·file_exists |
| 5242 | ······when: | 5242 | ······when: |
| 5243 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5244 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5243 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5244 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5245 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5245 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5246 | ······tags: | 5246 | ······tags: |
| 5247 | ······-·CJIS-5.5.2.2 | 5247 | ······-·CJIS-5.5.2.2 |
| 5248 | ······-·NIST-800-171-3.4.5 | 5248 | ······-·NIST-800-171-3.4.5 |
| 5249 | ······-·NIST-800-53-AC-6(1) | 5249 | ······-·NIST-800-53-AC-6(1) |
| 5250 | ······-·NIST-800-53-CM-6(a) | 5250 | ······-·NIST-800-53-CM-6(a) |
| 5251 | ······-·PCI-DSS-Req-7.1 | 5251 | ······-·PCI-DSS-Req-7.1 |
| Offset 5258, 16 lines modified | Offset 5258, 16 lines modified | ||
| 5258 | ······-·no_reboot_needed | 5258 | ······-·no_reboot_needed |
| Max diff block lines reached; 3245/7725 bytes (42.01%) of diff not shown. | |||
| Offset 5222, 16 lines modified | Offset 5222, 16 lines modified | ||
| 5222 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 5222 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 5223 | ······find: | 5223 | ······find: |
| 5224 | ········paths:·/etc/audit/rules.d/ | 5224 | ········paths:·/etc/audit/rules.d/ |
| 5225 | ········patterns:·'*.rules' | 5225 | ········patterns:·'*.rules' |
| 5226 | ······register:·find_rules_d | 5226 | ······register:·find_rules_d |
| 5227 | ······when: | 5227 | ······when: |
| 5228 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5229 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5228 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5229 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5230 | ······tags: | 5230 | ······tags: |
| 5231 | ······-·CJIS-5.4.1.1 | 5231 | ······-·CJIS-5.4.1.1 |
| 5232 | ······-·NIST-800-171-3.3.1 | 5232 | ······-·NIST-800-171-3.3.1 |
| 5233 | ······-·NIST-800-171-3.4.3 | 5233 | ······-·NIST-800-171-3.4.3 |
| 5234 | ······-·NIST-800-53-AC-6(9) | 5234 | ······-·NIST-800-53-AC-6(9) |
| 5235 | ······-·NIST-800-53-CM-6(a) | 5235 | ······-·NIST-800-53-CM-6(a) |
| 5236 | ······-·PCI-DSS-Req-10.5.2 | 5236 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5246, 16 lines modified | Offset 5246, 16 lines modified | ||
| 5246 | ······lineinfile: | 5246 | ······lineinfile: |
| 5247 | ········path:·'{{·item·}}' | 5247 | ········path:·'{{·item·}}' |
| 5248 | ········regexp:·^\s*(?:-e)\s+.*$ | 5248 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 5249 | ········state:·absent | 5249 | ········state:·absent |
| 5250 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 5250 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 5251 | ········}}' | 5251 | ········}}' |
| 5252 | ······when: | 5252 | ······when: |
| 5253 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5254 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5253 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5254 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5255 | ······tags: | 5255 | ······tags: |
| 5256 | ······-·CJIS-5.4.1.1 | 5256 | ······-·CJIS-5.4.1.1 |
| 5257 | ······-·NIST-800-171-3.3.1 | 5257 | ······-·NIST-800-171-3.3.1 |
| 5258 | ······-·NIST-800-171-3.4.3 | 5258 | ······-·NIST-800-171-3.4.3 |
| 5259 | ······-·NIST-800-53-AC-6(9) | 5259 | ······-·NIST-800-53-AC-6(9) |
| 5260 | ······-·NIST-800-53-CM-6(a) | 5260 | ······-·NIST-800-53-CM-6(a) |
| 5261 | ······-·PCI-DSS-Req-10.5.2 | 5261 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5272, 16 lines modified | Offset 5272, 16 lines modified | ||
| 5272 | ········create:·true | 5272 | ········create:·true |
| 5273 | ········line:·-e·2 | 5273 | ········line:·-e·2 |
| 5274 | ········mode:·o-rwx | 5274 | ········mode:·o-rwx |
| 5275 | ······loop: | 5275 | ······loop: |
| 5276 | ······-·/etc/audit/audit.rules | 5276 | ······-·/etc/audit/audit.rules |
| 5277 | ······-·/etc/audit/rules.d/immutable.rules | 5277 | ······-·/etc/audit/rules.d/immutable.rules |
| 5278 | ······when: | 5278 | ······when: |
| 5279 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5280 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5279 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5280 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5281 | ······tags: | 5281 | ······tags: |
| 5282 | ······-·CJIS-5.4.1.1 | 5282 | ······-·CJIS-5.4.1.1 |
| 5283 | ······-·NIST-800-171-3.3.1 | 5283 | ······-·NIST-800-171-3.3.1 |
| 5284 | ······-·NIST-800-171-3.4.3 | 5284 | ······-·NIST-800-171-3.4.3 |
| 5285 | ······-·NIST-800-53-AC-6(9) | 5285 | ······-·NIST-800-53-AC-6(9) |
| 5286 | ······-·NIST-800-53-CM-6(a) | 5286 | ······-·NIST-800-53-CM-6(a) |
| 5287 | ······-·PCI-DSS-Req-10.5.2 | 5287 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5313, 16 lines modified | Offset 5313, 16 lines modified | ||
| 5313 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5313 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5314 | ······find: | 5314 | ······find: |
| 5315 | ········paths:·/etc/audit/rules.d | 5315 | ········paths:·/etc/audit/rules.d |
| 5316 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5316 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5317 | ········patterns:·'*.rules' | 5317 | ········patterns:·'*.rules' |
| 5318 | ······register:·find_existing_watch_rules_d | 5318 | ······register:·find_existing_watch_rules_d |
| 5319 | ······when: | 5319 | ······when: |
| 5320 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5321 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5320 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5321 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5322 | ······tags: | 5322 | ······tags: |
| 5323 | ······-·CJIS-5.4.1.1 | 5323 | ······-·CJIS-5.4.1.1 |
| 5324 | ······-·NIST-800-171-3.1.8 | 5324 | ······-·NIST-800-171-3.1.8 |
| 5325 | ······-·NIST-800-53-AU-12(c) | 5325 | ······-·NIST-800-53-AU-12(c) |
| 5326 | ······-·NIST-800-53-AU-2(d) | 5326 | ······-·NIST-800-53-AU-2(d) |
| 5327 | ······-·NIST-800-53-CM-6(a) | 5327 | ······-·NIST-800-53-CM-6(a) |
| 5328 | ······-·PCI-DSS-Req-10.5.5 | 5328 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 5336, 16 lines modified | Offset 5336, 16 lines modified | ||
| 5336 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5336 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5337 | ······find: | 5337 | ······find: |
| 5338 | ········paths:·/etc/audit/rules.d | 5338 | ········paths:·/etc/audit/rules.d |
| 5339 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5339 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5340 | ········patterns:·'*.rules' | 5340 | ········patterns:·'*.rules' |
| 5341 | ······register:·find_watch_key | 5341 | ······register:·find_watch_key |
| 5342 | ······when: | 5342 | ······when: |
| 5343 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5343 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5344 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5345 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5345 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5346 | ········==·0 | 5346 | ········==·0 |
| 5347 | ······tags: | 5347 | ······tags: |
| 5348 | ······-·CJIS-5.4.1.1 | 5348 | ······-·CJIS-5.4.1.1 |
| 5349 | ······-·NIST-800-171-3.1.8 | 5349 | ······-·NIST-800-171-3.1.8 |
| 5350 | ······-·NIST-800-53-AU-12(c) | 5350 | ······-·NIST-800-53-AU-12(c) |
| 5351 | ······-·NIST-800-53-AU-2(d) | 5351 | ······-·NIST-800-53-AU-2(d) |
| Offset 5359, 16 lines modified | Offset 5359, 16 lines modified | ||
| 5359 | ······-·restrict_strategy | 5359 | ······-·restrict_strategy |
| 5360 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5360 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5361 | ······set_fact: | 5361 | ······set_fact: |
| 5362 | ········all_files: | 5362 | ········all_files: |
| 5363 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5363 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5364 | ······when: | 5364 | ······when: |
| 5365 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5365 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5366 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5367 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5367 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5368 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5368 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5369 | ······tags: | 5369 | ······tags: |
| 5370 | ······-·CJIS-5.4.1.1 | 5370 | ······-·CJIS-5.4.1.1 |
| 5371 | ······-·NIST-800-171-3.1.8 | 5371 | ······-·NIST-800-171-3.1.8 |
| 5372 | ······-·NIST-800-53-AU-12(c) | 5372 | ······-·NIST-800-53-AU-12(c) |
| 5373 | ······-·NIST-800-53-AU-2(d) | 5373 | ······-·NIST-800-53-AU-2(d) |
| Offset 5382, 16 lines modified | Offset 5382, 16 lines modified | ||
| 5382 | ······-·restrict_strategy | 5382 | ······-·restrict_strategy |
| 5383 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5383 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5384 | ······set_fact: | 5384 | ······set_fact: |
| 5385 | ········all_files: | 5385 | ········all_files: |
| 5386 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5386 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5387 | ······when: | 5387 | ······when: |
| 5388 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5389 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5388 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5389 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5390 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5390 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5391 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5391 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5392 | ······tags: | 5392 | ······tags: |
| 5393 | ······-·CJIS-5.4.1.1 | 5393 | ······-·CJIS-5.4.1.1 |
| 5394 | ······-·NIST-800-171-3.1.8 | 5394 | ······-·NIST-800-171-3.1.8 |
| 5395 | ······-·NIST-800-53-AU-12(c) | 5395 | ······-·NIST-800-53-AU-12(c) |
| 5396 | ······-·NIST-800-53-AU-2(d) | 5396 | ······-·NIST-800-53-AU-2(d) |
| Offset 5407, 16 lines modified | Offset 5407, 16 lines modified | ||
| 5407 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5407 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 159331/164016 bytes (97.14%) of diff not shown. | |||
| Offset 3365, 16 lines modified | Offset 3365, 16 lines modified | ||
| 3365 | ······lineinfile: | 3365 | ······lineinfile: |
| 3366 | ········dest:·/etc/audit/auditd.conf | 3366 | ········dest:·/etc/audit/auditd.conf |
| 3367 | ········regexp:·^\s*flush\s*=\s*.*$ | 3367 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 3368 | ········line:·flush·=·{{·var_auditd_flush·}} | 3368 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 3369 | ········state:·present | 3369 | ········state:·present |
| 3370 | ········create:·true | 3370 | ········create:·true |
| 3371 | ······when: | 3371 | ······when: |
| 3372 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3373 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3372 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3373 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3374 | ······tags: | 3374 | ······tags: |
| 3375 | ······-·NIST-800-171-3.3.1 | 3375 | ······-·NIST-800-171-3.3.1 |
| 3376 | ······-·NIST-800-53-AU-11 | 3376 | ······-·NIST-800-53-AU-11 |
| 3377 | ······-·NIST-800-53-CM-6(a) | 3377 | ······-·NIST-800-53-CM-6(a) |
| 3378 | ······-·auditd_data_retention_flush | 3378 | ······-·auditd_data_retention_flush |
| 3379 | ······-·low_complexity | 3379 | ······-·low_complexity |
| 3380 | ······-·low_disruption | 3380 | ······-·low_disruption |
| Offset 3420, 16 lines modified | Offset 3420, 16 lines modified | ||
| 3420 | ········lineinfile: | 3420 | ········lineinfile: |
| 3421 | ··········path:·/etc/audit/auditd.conf | 3421 | ··········path:·/etc/audit/auditd.conf |
| 3422 | ··········create:·true | 3422 | ··········create:·true |
| 3423 | ··········regexp:·(?i)^\s*freq\s*=\s* | 3423 | ··········regexp:·(?i)^\s*freq\s*=\s* |
| 3424 | ··········line:·freq·=·50 | 3424 | ··········line:·freq·=·50 |
| 3425 | ··········state:·present | 3425 | ··········state:·present |
| 3426 | ······when: | 3426 | ······when: |
| 3427 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3428 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3427 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3428 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3429 | ······tags: | 3429 | ······tags: |
| 3430 | ······-·NIST-800-53-CM-6 | 3430 | ······-·NIST-800-53-CM-6 |
| 3431 | ······-·auditd_freq | 3431 | ······-·auditd_freq |
| 3432 | ······-·low_complexity | 3432 | ······-·low_complexity |
| 3433 | ······-·low_disruption | 3433 | ······-·low_disruption |
| 3434 | ······-·medium_severity | 3434 | ······-·medium_severity |
| 3435 | ······-·no_reboot_needed | 3435 | ······-·no_reboot_needed |
| Offset 3474, 16 lines modified | Offset 3474, 16 lines modified | ||
| 3474 | ········lineinfile: | 3474 | ········lineinfile: |
| 3475 | ··········path:·/etc/audit/auditd.conf | 3475 | ··········path:·/etc/audit/auditd.conf |
| 3476 | ··········create:·true | 3476 | ··········create:·true |
| 3477 | ··········regexp:·(?i)^\s*log_format\s*=\s* | 3477 | ··········regexp:·(?i)^\s*log_format\s*=\s* |
| 3478 | ··········line:·log_format·=·ENRICHED | 3478 | ··········line:·log_format·=·ENRICHED |
| 3479 | ··········state:·present | 3479 | ··········state:·present |
| 3480 | ······when: | 3480 | ······when: |
| 3481 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3482 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3482 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3483 | ······tags: | 3483 | ······tags: |
| 3484 | ······-·NIST-800-53-AU-3 | 3484 | ······-·NIST-800-53-AU-3 |
| 3485 | ······-·NIST-800-53-CM-6 | 3485 | ······-·NIST-800-53-CM-6 |
| 3486 | ······-·auditd_log_format | 3486 | ······-·auditd_log_format |
| 3487 | ······-·low_complexity | 3487 | ······-·low_complexity |
| 3488 | ······-·low_disruption | 3488 | ······-·low_disruption |
| 3489 | ······-·low_severity | 3489 | ······-·low_severity |
| Offset 3529, 16 lines modified | Offset 3529, 16 lines modified | ||
| 3529 | ········lineinfile: | 3529 | ········lineinfile: |
| 3530 | ··········path:·/etc/audit/auditd.conf | 3530 | ··········path:·/etc/audit/auditd.conf |
| 3531 | ··········create:·true | 3531 | ··········create:·true |
| 3532 | ··········regexp:·(?i)^\s*name_format\s*=\s* | 3532 | ··········regexp:·(?i)^\s*name_format\s*=\s* |
| 3533 | ··········line:·name_format·=·hostname | 3533 | ··········line:·name_format·=·hostname |
| 3534 | ··········state:·present | 3534 | ··········state:·present |
| 3535 | ······when: | 3535 | ······when: |
| 3536 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3537 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3536 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3537 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3538 | ······tags: | 3538 | ······tags: |
| 3539 | ······-·NIST-800-53-AU-3 | 3539 | ······-·NIST-800-53-AU-3 |
| 3540 | ······-·NIST-800-53-CM-6 | 3540 | ······-·NIST-800-53-CM-6 |
| 3541 | ······-·auditd_name_format | 3541 | ······-·auditd_name_format |
| 3542 | ······-·low_complexity | 3542 | ······-·low_complexity |
| 3543 | ······-·low_disruption | 3543 | ······-·low_disruption |
| 3544 | ······-·medium_severity | 3544 | ······-·medium_severity |
| Offset 1117, 16 lines modified | Offset 1117, 16 lines modified | ||
| 1117 | ······-·no_reboot_needed | 1117 | ······-·no_reboot_needed |
| 1118 | ······-·restrict_strategy | 1118 | ······-·restrict_strategy |
| 1119 | ····-·name:·Set·architecture·for·audit·tasks | 1119 | ····-·name:·Set·architecture·for·audit·tasks |
| 1120 | ······set_fact: | 1120 | ······set_fact: |
| 1121 | ········audit_arch:·b64 | 1121 | ········audit_arch:·b64 |
| 1122 | ······when: | 1122 | ······when: |
| 1123 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1124 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1123 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1124 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1125 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 1125 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 1126 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 1126 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 1127 | ······tags: | 1127 | ······tags: |
| 1128 | ······-·CJIS-5.4.1.1 | 1128 | ······-·CJIS-5.4.1.1 |
| 1129 | ······-·NIST-800-171-3.1.7 | 1129 | ······-·NIST-800-171-3.1.7 |
| 1130 | ······-·NIST-800-53-AC-6(9) | 1130 | ······-·NIST-800-53-AC-6(9) |
| 1131 | ······-·NIST-800-53-AU-12(c) | 1131 | ······-·NIST-800-53-AU-12(c) |
| Offset 1259, 16 lines modified | Offset 1259, 16 lines modified | ||
| 1259 | ··········path:·'{{·audit_file·}}' | 1259 | ··········path:·'{{·audit_file·}}' |
| 1260 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1260 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1261 | ··········create:·true | 1261 | ··········create:·true |
| 1262 | ··········mode:·o-rwx | 1262 | ··········mode:·o-rwx |
| 1263 | ··········state:·present | 1263 | ··········state:·present |
| 1264 | ········when:·syscalls_found·|·length·==·0 | 1264 | ········when:·syscalls_found·|·length·==·0 |
| 1265 | ······when: | 1265 | ······when: |
| 1266 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1267 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1266 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1267 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1268 | ······tags: | 1268 | ······tags: |
| 1269 | ······-·CJIS-5.4.1.1 | 1269 | ······-·CJIS-5.4.1.1 |
| 1270 | ······-·NIST-800-171-3.1.7 | 1270 | ······-·NIST-800-171-3.1.7 |
| 1271 | ······-·NIST-800-53-AC-6(9) | 1271 | ······-·NIST-800-53-AC-6(9) |
| 1272 | ······-·NIST-800-53-AU-12(c) | 1272 | ······-·NIST-800-53-AU-12(c) |
| 1273 | ······-·NIST-800-53-AU-2(d) | 1273 | ······-·NIST-800-53-AU-2(d) |
| 1274 | ······-·NIST-800-53-CM-6(a) | 1274 | ······-·NIST-800-53-CM-6(a) |
| Offset 1399, 16 lines modified | Offset 1399, 16 lines modified | ||
| 1399 | ··········path:·'{{·audit_file·}}' | 1399 | ··········path:·'{{·audit_file·}}' |
| 1400 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1400 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1401 | ··········create:·true | 1401 | ··········create:·true |
| 1402 | ··········mode:·o-rwx | 1402 | ··········mode:·o-rwx |
| 1403 | ··········state:·present | 1403 | ··········state:·present |
| 1404 | ········when:·syscalls_found·|·length·==·0 | 1404 | ········when:·syscalls_found·|·length·==·0 |
| 1405 | ······when: | 1405 | ······when: |
| 1406 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1407 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1406 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1407 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1408 | ······-·audit_arch·==·"b64" | 1408 | ······-·audit_arch·==·"b64" |
| 1409 | ······tags: | 1409 | ······tags: |
| 1410 | ······-·CJIS-5.4.1.1 | 1410 | ······-·CJIS-5.4.1.1 |
| 1411 | ······-·NIST-800-171-3.1.7 | 1411 | ······-·NIST-800-171-3.1.7 |
| 1412 | ······-·NIST-800-53-AC-6(9) | 1412 | ······-·NIST-800-53-AC-6(9) |
| 1413 | ······-·NIST-800-53-AU-12(c) | 1413 | ······-·NIST-800-53-AU-12(c) |
| 1414 | ······-·NIST-800-53-AU-2(d) | 1414 | ······-·NIST-800-53-AU-2(d) |
| Offset 1424, 16 lines modified | Offset 1424, 16 lines modified | ||
| 1424 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ | 1424 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ |
| 1425 | ······find: | 1425 | ······find: |
| 1426 | ········paths:·/etc/audit/rules.d | 1426 | ········paths:·/etc/audit/rules.d |
| 1427 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ | 1427 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ |
| 1428 | ········patterns:·'*.rules' | 1428 | ········patterns:·'*.rules' |
| 1429 | ······register:·find_existing_watch_rules_d | 1429 | ······register:·find_existing_watch_rules_d |
| 1430 | ······when: | 1430 | ······when: |
| 1431 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1432 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1431 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1432 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1433 | ······tags: | 1433 | ······tags: |
| 1434 | ······-·CJIS-5.4.1.1 | 1434 | ······-·CJIS-5.4.1.1 |
| 1435 | ······-·NIST-800-171-3.1.7 | 1435 | ······-·NIST-800-171-3.1.7 |
| 1436 | ······-·NIST-800-53-AC-6(9) | 1436 | ······-·NIST-800-53-AC-6(9) |
| 1437 | ······-·NIST-800-53-AU-12(c) | 1437 | ······-·NIST-800-53-AU-12(c) |
| 1438 | ······-·NIST-800-53-AU-2(d) | 1438 | ······-·NIST-800-53-AU-2(d) |
| 1439 | ······-·NIST-800-53-CM-6(a) | 1439 | ······-·NIST-800-53-CM-6(a) |
| Offset 1448, 16 lines modified | Offset 1448, 16 lines modified | ||
| 1448 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification | 1448 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification |
| 1449 | ······find: | 1449 | ······find: |
| 1450 | ········paths:·/etc/audit/rules.d | 1450 | ········paths:·/etc/audit/rules.d |
| 1451 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ | 1451 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ |
| 1452 | ········patterns:·'*.rules' | 1452 | ········patterns:·'*.rules' |
| 1453 | ······register:·find_watch_key | 1453 | ······register:·find_watch_key |
| 1454 | ······when: | 1454 | ······when: |
| 1455 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1456 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1455 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1456 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1457 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1457 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1458 | ········==·0 | 1458 | ········==·0 |
| 1459 | ······tags: | 1459 | ······tags: |
| 1460 | ······-·CJIS-5.4.1.1 | 1460 | ······-·CJIS-5.4.1.1 |
| 1461 | ······-·NIST-800-171-3.1.7 | 1461 | ······-·NIST-800-171-3.1.7 |
| 1462 | ······-·NIST-800-53-AC-6(9) | 1462 | ······-·NIST-800-53-AC-6(9) |
| 1463 | ······-·NIST-800-53-AU-12(c) | 1463 | ······-·NIST-800-53-AU-12(c) |
| Offset 1473, 16 lines modified | Offset 1473, 16 lines modified | ||
| 1473 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the | 1473 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the |
| 1474 | ········recipient·for·the·rule | 1474 | ········recipient·for·the·rule |
| 1475 | ······set_fact: | 1475 | ······set_fact: |
| 1476 | ········all_files: | 1476 | ········all_files: |
| 1477 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules | 1477 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules |
| 1478 | ······when: | 1478 | ······when: |
| 1479 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1480 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1479 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1480 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1481 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1481 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1482 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1482 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1483 | ······tags: | 1483 | ······tags: |
| 1484 | ······-·CJIS-5.4.1.1 | 1484 | ······-·CJIS-5.4.1.1 |
| 1485 | ······-·NIST-800-171-3.1.7 | 1485 | ······-·NIST-800-171-3.1.7 |
| 1486 | ······-·NIST-800-53-AC-6(9) | 1486 | ······-·NIST-800-53-AC-6(9) |
| 1487 | ······-·NIST-800-53-AU-12(c) | 1487 | ······-·NIST-800-53-AU-12(c) |
| Offset 1497, 16 lines modified | Offset 1497, 16 lines modified | ||
| 1497 | ······-·restrict_strategy | 1497 | ······-·restrict_strategy |
| 1498 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1498 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1499 | ······set_fact: | 1499 | ······set_fact: |
| 1500 | ········all_files: | 1500 | ········all_files: |
| 1501 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1501 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1502 | ······when: | 1502 | ······when: |
| 1503 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1504 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1503 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1504 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1505 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1505 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1506 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1506 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1507 | ······tags: | 1507 | ······tags: |
| 1508 | ······-·CJIS-5.4.1.1 | 1508 | ······-·CJIS-5.4.1.1 |
| 1509 | ······-·NIST-800-171-3.1.7 | 1509 | ······-·NIST-800-171-3.1.7 |
| 1510 | ······-·NIST-800-53-AC-6(9) | 1510 | ······-·NIST-800-53-AC-6(9) |
| 1511 | ······-·NIST-800-53-AU-12(c) | 1511 | ······-·NIST-800-53-AU-12(c) |
| Offset 1523, 16 lines modified | Offset 1523, 16 lines modified | ||
| 1523 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ | 1523 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 66026/71076 bytes (92.89%) of diff not shown. | |||
| Offset 1279, 16 lines modified | Offset 1279, 16 lines modified | ||
| 1279 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 1279 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 1280 | ······find: | 1280 | ······find: |
| 1281 | ········paths:·/etc/audit/rules.d/ | 1281 | ········paths:·/etc/audit/rules.d/ |
| 1282 | ········patterns:·'*.rules' | 1282 | ········patterns:·'*.rules' |
| 1283 | ······register:·find_rules_d | 1283 | ······register:·find_rules_d |
| 1284 | ······when: | 1284 | ······when: |
| 1285 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1286 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1285 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1286 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1287 | ······tags: | 1287 | ······tags: |
| 1288 | ······-·CJIS-5.4.1.1 | 1288 | ······-·CJIS-5.4.1.1 |
| 1289 | ······-·NIST-800-171-3.3.1 | 1289 | ······-·NIST-800-171-3.3.1 |
| 1290 | ······-·NIST-800-171-3.4.3 | 1290 | ······-·NIST-800-171-3.4.3 |
| 1291 | ······-·NIST-800-53-AC-6(9) | 1291 | ······-·NIST-800-53-AC-6(9) |
| 1292 | ······-·NIST-800-53-CM-6(a) | 1292 | ······-·NIST-800-53-CM-6(a) |
| 1293 | ······-·PCI-DSS-Req-10.5.2 | 1293 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1303, 16 lines modified | Offset 1303, 16 lines modified | ||
| 1303 | ······lineinfile: | 1303 | ······lineinfile: |
| 1304 | ········path:·'{{·item·}}' | 1304 | ········path:·'{{·item·}}' |
| 1305 | ········regexp:·^\s*(?:-e)\s+.*$ | 1305 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 1306 | ········state:·absent | 1306 | ········state:·absent |
| 1307 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 1307 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 1308 | ········}}' | 1308 | ········}}' |
| 1309 | ······when: | 1309 | ······when: |
| 1310 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1311 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1310 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1311 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1312 | ······tags: | 1312 | ······tags: |
| 1313 | ······-·CJIS-5.4.1.1 | 1313 | ······-·CJIS-5.4.1.1 |
| 1314 | ······-·NIST-800-171-3.3.1 | 1314 | ······-·NIST-800-171-3.3.1 |
| 1315 | ······-·NIST-800-171-3.4.3 | 1315 | ······-·NIST-800-171-3.4.3 |
| 1316 | ······-·NIST-800-53-AC-6(9) | 1316 | ······-·NIST-800-53-AC-6(9) |
| 1317 | ······-·NIST-800-53-CM-6(a) | 1317 | ······-·NIST-800-53-CM-6(a) |
| 1318 | ······-·PCI-DSS-Req-10.5.2 | 1318 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1329, 16 lines modified | Offset 1329, 16 lines modified | ||
| 1329 | ········create:·true | 1329 | ········create:·true |
| 1330 | ········line:·-e·2 | 1330 | ········line:·-e·2 |
| 1331 | ········mode:·o-rwx | 1331 | ········mode:·o-rwx |
| 1332 | ······loop: | 1332 | ······loop: |
| 1333 | ······-·/etc/audit/audit.rules | 1333 | ······-·/etc/audit/audit.rules |
| 1334 | ······-·/etc/audit/rules.d/immutable.rules | 1334 | ······-·/etc/audit/rules.d/immutable.rules |
| 1335 | ······when: | 1335 | ······when: |
| 1336 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1337 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1336 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1337 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1338 | ······tags: | 1338 | ······tags: |
| 1339 | ······-·CJIS-5.4.1.1 | 1339 | ······-·CJIS-5.4.1.1 |
| 1340 | ······-·NIST-800-171-3.3.1 | 1340 | ······-·NIST-800-171-3.3.1 |
| 1341 | ······-·NIST-800-171-3.4.3 | 1341 | ······-·NIST-800-171-3.4.3 |
| 1342 | ······-·NIST-800-53-AC-6(9) | 1342 | ······-·NIST-800-53-AC-6(9) |
| 1343 | ······-·NIST-800-53-CM-6(a) | 1343 | ······-·NIST-800-53-CM-6(a) |
| 1344 | ······-·PCI-DSS-Req-10.5.2 | 1344 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1370, 16 lines modified | Offset 1370, 16 lines modified | ||
| 1370 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 1370 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 1371 | ······find: | 1371 | ······find: |
| 1372 | ········paths:·/etc/audit/rules.d | 1372 | ········paths:·/etc/audit/rules.d |
| 1373 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 1373 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 1374 | ········patterns:·'*.rules' | 1374 | ········patterns:·'*.rules' |
| 1375 | ······register:·find_existing_watch_rules_d | 1375 | ······register:·find_existing_watch_rules_d |
| 1376 | ······when: | 1376 | ······when: |
| 1377 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1378 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1377 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1378 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1379 | ······tags: | 1379 | ······tags: |
| 1380 | ······-·CJIS-5.4.1.1 | 1380 | ······-·CJIS-5.4.1.1 |
| 1381 | ······-·NIST-800-171-3.1.8 | 1381 | ······-·NIST-800-171-3.1.8 |
| 1382 | ······-·NIST-800-53-AU-12(c) | 1382 | ······-·NIST-800-53-AU-12(c) |
| 1383 | ······-·NIST-800-53-AU-2(d) | 1383 | ······-·NIST-800-53-AU-2(d) |
| 1384 | ······-·NIST-800-53-CM-6(a) | 1384 | ······-·NIST-800-53-CM-6(a) |
| 1385 | ······-·PCI-DSS-Req-10.5.5 | 1385 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 1393, 16 lines modified | Offset 1393, 16 lines modified | ||
| 1393 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 1393 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 1394 | ······find: | 1394 | ······find: |
| 1395 | ········paths:·/etc/audit/rules.d | 1395 | ········paths:·/etc/audit/rules.d |
| 1396 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 1396 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 1397 | ········patterns:·'*.rules' | 1397 | ········patterns:·'*.rules' |
| 1398 | ······register:·find_watch_key | 1398 | ······register:·find_watch_key |
| 1399 | ······when: | 1399 | ······when: |
| 1400 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1401 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1400 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1401 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1402 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1402 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1403 | ········==·0 | 1403 | ········==·0 |
| 1404 | ······tags: | 1404 | ······tags: |
| 1405 | ······-·CJIS-5.4.1.1 | 1405 | ······-·CJIS-5.4.1.1 |
| 1406 | ······-·NIST-800-171-3.1.8 | 1406 | ······-·NIST-800-171-3.1.8 |
| 1407 | ······-·NIST-800-53-AU-12(c) | 1407 | ······-·NIST-800-53-AU-12(c) |
| 1408 | ······-·NIST-800-53-AU-2(d) | 1408 | ······-·NIST-800-53-AU-2(d) |
| Offset 1416, 16 lines modified | Offset 1416, 16 lines modified | ||
| 1416 | ······-·restrict_strategy | 1416 | ······-·restrict_strategy |
| 1417 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 1417 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 1418 | ······set_fact: | 1418 | ······set_fact: |
| 1419 | ········all_files: | 1419 | ········all_files: |
| 1420 | ········-·/etc/audit/rules.d/MAC-policy.rules | 1420 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 1421 | ······when: | 1421 | ······when: |
| 1422 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1423 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1422 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1423 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1424 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1424 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1425 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1425 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1426 | ······tags: | 1426 | ······tags: |
| 1427 | ······-·CJIS-5.4.1.1 | 1427 | ······-·CJIS-5.4.1.1 |
| 1428 | ······-·NIST-800-171-3.1.8 | 1428 | ······-·NIST-800-171-3.1.8 |
| 1429 | ······-·NIST-800-53-AU-12(c) | 1429 | ······-·NIST-800-53-AU-12(c) |
| 1430 | ······-·NIST-800-53-AU-2(d) | 1430 | ······-·NIST-800-53-AU-2(d) |
| Offset 1439, 16 lines modified | Offset 1439, 16 lines modified | ||
| 1439 | ······-·restrict_strategy | 1439 | ······-·restrict_strategy |
| 1440 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1440 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1441 | ······set_fact: | 1441 | ······set_fact: |
| 1442 | ········all_files: | 1442 | ········all_files: |
| 1443 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1443 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1444 | ······when: | 1444 | ······when: |
| 1445 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1446 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1445 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1446 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1447 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1447 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1448 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1448 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1449 | ······tags: | 1449 | ······tags: |
| 1450 | ······-·CJIS-5.4.1.1 | 1450 | ······-·CJIS-5.4.1.1 |
| 1451 | ······-·NIST-800-171-3.1.8 | 1451 | ······-·NIST-800-171-3.1.8 |
| 1452 | ······-·NIST-800-53-AU-12(c) | 1452 | ······-·NIST-800-53-AU-12(c) |
| 1453 | ······-·NIST-800-53-AU-2(d) | 1453 | ······-·NIST-800-53-AU-2(d) |
| Offset 1464, 16 lines modified | Offset 1464, 16 lines modified | ||
| 1464 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 1464 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 180115/184800 bytes (97.46%) of diff not shown. | |||
| Offset 4432, 16 lines modified | Offset 4432, 16 lines modified | ||
| 4432 | ······-·no_reboot_needed | 4432 | ······-·no_reboot_needed |
| 4433 | ······-·restrict_strategy | 4433 | ······-·restrict_strategy |
| 4434 | ····-·name:·Set·architecture·for·audit·tasks | 4434 | ····-·name:·Set·architecture·for·audit·tasks |
| 4435 | ······set_fact: | 4435 | ······set_fact: |
| 4436 | ········audit_arch:·b64 | 4436 | ········audit_arch:·b64 |
| 4437 | ······when: | 4437 | ······when: |
| 4438 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4439 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4438 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4439 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4440 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 4440 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 4441 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 4441 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 4442 | ······tags: | 4442 | ······tags: |
| 4443 | ······-·CJIS-5.4.1.1 | 4443 | ······-·CJIS-5.4.1.1 |
| 4444 | ······-·NIST-800-171-3.1.7 | 4444 | ······-·NIST-800-171-3.1.7 |
| 4445 | ······-·NIST-800-53-AC-6(9) | 4445 | ······-·NIST-800-53-AC-6(9) |
| 4446 | ······-·NIST-800-53-AU-12(c) | 4446 | ······-·NIST-800-53-AU-12(c) |
| Offset 4574, 16 lines modified | Offset 4574, 16 lines modified | ||
| 4574 | ··········path:·'{{·audit_file·}}' | 4574 | ··········path:·'{{·audit_file·}}' |
| 4575 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 4575 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 4576 | ··········create:·true | 4576 | ··········create:·true |
| 4577 | ··········mode:·o-rwx | 4577 | ··········mode:·o-rwx |
| 4578 | ··········state:·present | 4578 | ··········state:·present |
| 4579 | ········when:·syscalls_found·|·length·==·0 | 4579 | ········when:·syscalls_found·|·length·==·0 |
| 4580 | ······when: | 4580 | ······when: |
| 4581 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4582 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4581 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4582 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4583 | ······tags: | 4583 | ······tags: |
| 4584 | ······-·CJIS-5.4.1.1 | 4584 | ······-·CJIS-5.4.1.1 |
| 4585 | ······-·NIST-800-171-3.1.7 | 4585 | ······-·NIST-800-171-3.1.7 |
| 4586 | ······-·NIST-800-53-AC-6(9) | 4586 | ······-·NIST-800-53-AC-6(9) |
| 4587 | ······-·NIST-800-53-AU-12(c) | 4587 | ······-·NIST-800-53-AU-12(c) |
| 4588 | ······-·NIST-800-53-AU-2(d) | 4588 | ······-·NIST-800-53-AU-2(d) |
| 4589 | ······-·NIST-800-53-CM-6(a) | 4589 | ······-·NIST-800-53-CM-6(a) |
| Offset 4714, 16 lines modified | Offset 4714, 16 lines modified | ||
| 4714 | ··········path:·'{{·audit_file·}}' | 4714 | ··········path:·'{{·audit_file·}}' |
| 4715 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 4715 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 4716 | ··········create:·true | 4716 | ··········create:·true |
| 4717 | ··········mode:·o-rwx | 4717 | ··········mode:·o-rwx |
| 4718 | ··········state:·present | 4718 | ··········state:·present |
| 4719 | ········when:·syscalls_found·|·length·==·0 | 4719 | ········when:·syscalls_found·|·length·==·0 |
| 4720 | ······when: | 4720 | ······when: |
| 4721 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4722 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4721 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4722 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4723 | ······-·audit_arch·==·"b64" | 4723 | ······-·audit_arch·==·"b64" |
| 4724 | ······tags: | 4724 | ······tags: |
| 4725 | ······-·CJIS-5.4.1.1 | 4725 | ······-·CJIS-5.4.1.1 |
| 4726 | ······-·NIST-800-171-3.1.7 | 4726 | ······-·NIST-800-171-3.1.7 |
| 4727 | ······-·NIST-800-53-AC-6(9) | 4727 | ······-·NIST-800-53-AC-6(9) |
| 4728 | ······-·NIST-800-53-AU-12(c) | 4728 | ······-·NIST-800-53-AU-12(c) |
| 4729 | ······-·NIST-800-53-AU-2(d) | 4729 | ······-·NIST-800-53-AU-2(d) |
| Offset 4739, 16 lines modified | Offset 4739, 16 lines modified | ||
| 4739 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ | 4739 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ |
| 4740 | ······find: | 4740 | ······find: |
| 4741 | ········paths:·/etc/audit/rules.d | 4741 | ········paths:·/etc/audit/rules.d |
| 4742 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ | 4742 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ |
| 4743 | ········patterns:·'*.rules' | 4743 | ········patterns:·'*.rules' |
| 4744 | ······register:·find_existing_watch_rules_d | 4744 | ······register:·find_existing_watch_rules_d |
| 4745 | ······when: | 4745 | ······when: |
| 4746 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4747 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4746 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4747 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4748 | ······tags: | 4748 | ······tags: |
| 4749 | ······-·CJIS-5.4.1.1 | 4749 | ······-·CJIS-5.4.1.1 |
| 4750 | ······-·NIST-800-171-3.1.7 | 4750 | ······-·NIST-800-171-3.1.7 |
| 4751 | ······-·NIST-800-53-AC-6(9) | 4751 | ······-·NIST-800-53-AC-6(9) |
| 4752 | ······-·NIST-800-53-AU-12(c) | 4752 | ······-·NIST-800-53-AU-12(c) |
| 4753 | ······-·NIST-800-53-AU-2(d) | 4753 | ······-·NIST-800-53-AU-2(d) |
| 4754 | ······-·NIST-800-53-CM-6(a) | 4754 | ······-·NIST-800-53-CM-6(a) |
| Offset 4763, 16 lines modified | Offset 4763, 16 lines modified | ||
| 4763 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification | 4763 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification |
| 4764 | ······find: | 4764 | ······find: |
| 4765 | ········paths:·/etc/audit/rules.d | 4765 | ········paths:·/etc/audit/rules.d |
| 4766 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ | 4766 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ |
| 4767 | ········patterns:·'*.rules' | 4767 | ········patterns:·'*.rules' |
| 4768 | ······register:·find_watch_key | 4768 | ······register:·find_watch_key |
| 4769 | ······when: | 4769 | ······when: |
| 4770 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4771 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4770 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4771 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4772 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 4772 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 4773 | ········==·0 | 4773 | ········==·0 |
| 4774 | ······tags: | 4774 | ······tags: |
| 4775 | ······-·CJIS-5.4.1.1 | 4775 | ······-·CJIS-5.4.1.1 |
| 4776 | ······-·NIST-800-171-3.1.7 | 4776 | ······-·NIST-800-171-3.1.7 |
| 4777 | ······-·NIST-800-53-AC-6(9) | 4777 | ······-·NIST-800-53-AC-6(9) |
| 4778 | ······-·NIST-800-53-AU-12(c) | 4778 | ······-·NIST-800-53-AU-12(c) |
| Offset 4788, 16 lines modified | Offset 4788, 16 lines modified | ||
| 4788 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the | 4788 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the |
| 4789 | ········recipient·for·the·rule | 4789 | ········recipient·for·the·rule |
| 4790 | ······set_fact: | 4790 | ······set_fact: |
| 4791 | ········all_files: | 4791 | ········all_files: |
| 4792 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules | 4792 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules |
| 4793 | ······when: | 4793 | ······when: |
| 4794 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4795 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4794 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4795 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4796 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 4796 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 4797 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4797 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4798 | ······tags: | 4798 | ······tags: |
| 4799 | ······-·CJIS-5.4.1.1 | 4799 | ······-·CJIS-5.4.1.1 |
| 4800 | ······-·NIST-800-171-3.1.7 | 4800 | ······-·NIST-800-171-3.1.7 |
| 4801 | ······-·NIST-800-53-AC-6(9) | 4801 | ······-·NIST-800-53-AC-6(9) |
| 4802 | ······-·NIST-800-53-AU-12(c) | 4802 | ······-·NIST-800-53-AU-12(c) |
| Offset 4812, 16 lines modified | Offset 4812, 16 lines modified | ||
| 4812 | ······-·restrict_strategy | 4812 | ······-·restrict_strategy |
| 4813 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 4813 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 4814 | ······set_fact: | 4814 | ······set_fact: |
| 4815 | ········all_files: | 4815 | ········all_files: |
| 4816 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 4816 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 4817 | ······when: | 4817 | ······when: |
| 4818 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4819 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4818 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4819 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4820 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 4820 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 4821 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4821 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4822 | ······tags: | 4822 | ······tags: |
| 4823 | ······-·CJIS-5.4.1.1 | 4823 | ······-·CJIS-5.4.1.1 |
| 4824 | ······-·NIST-800-171-3.1.7 | 4824 | ······-·NIST-800-171-3.1.7 |
| 4825 | ······-·NIST-800-53-AC-6(9) | 4825 | ······-·NIST-800-53-AC-6(9) |
| 4826 | ······-·NIST-800-53-AU-12(c) | 4826 | ······-·NIST-800-53-AU-12(c) |
| Offset 4838, 16 lines modified | Offset 4838, 16 lines modified | ||
| 4838 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ | 4838 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 83486/88536 bytes (94.30%) of diff not shown. | |||
| Offset 3357, 16 lines modified | Offset 3357, 16 lines modified | ||
| 3357 | ······lineinfile: | 3357 | ······lineinfile: |
| 3358 | ········dest:·/etc/audit/auditd.conf | 3358 | ········dest:·/etc/audit/auditd.conf |
| 3359 | ········regexp:·^\s*flush\s*=\s*.*$ | 3359 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 3360 | ········line:·flush·=·{{·var_auditd_flush·}} | 3360 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 3361 | ········state:·present | 3361 | ········state:·present |
| 3362 | ········create:·true | 3362 | ········create:·true |
| 3363 | ······when: | 3363 | ······when: |
| 3364 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3365 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3364 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3365 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3366 | ······tags: | 3366 | ······tags: |
| 3367 | ······-·NIST-800-171-3.3.1 | 3367 | ······-·NIST-800-171-3.3.1 |
| 3368 | ······-·NIST-800-53-AU-11 | 3368 | ······-·NIST-800-53-AU-11 |
| 3369 | ······-·NIST-800-53-CM-6(a) | 3369 | ······-·NIST-800-53-CM-6(a) |
| 3370 | ······-·auditd_data_retention_flush | 3370 | ······-·auditd_data_retention_flush |
| 3371 | ······-·low_complexity | 3371 | ······-·low_complexity |
| 3372 | ······-·low_disruption | 3372 | ······-·low_disruption |
| Offset 3412, 16 lines modified | Offset 3412, 16 lines modified | ||
| 3412 | ········lineinfile: | 3412 | ········lineinfile: |
| 3413 | ··········path:·/etc/audit/auditd.conf | 3413 | ··········path:·/etc/audit/auditd.conf |
| 3414 | ··········create:·true | 3414 | ··········create:·true |
| 3415 | ··········regexp:·(?i)^\s*freq\s*=\s* | 3415 | ··········regexp:·(?i)^\s*freq\s*=\s* |
| 3416 | ··········line:·freq·=·50 | 3416 | ··········line:·freq·=·50 |
| 3417 | ··········state:·present | 3417 | ··········state:·present |
| 3418 | ······when: | 3418 | ······when: |
| 3419 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3420 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3419 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3420 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3421 | ······tags: | 3421 | ······tags: |
| 3422 | ······-·NIST-800-53-CM-6 | 3422 | ······-·NIST-800-53-CM-6 |
| 3423 | ······-·auditd_freq | 3423 | ······-·auditd_freq |
| 3424 | ······-·low_complexity | 3424 | ······-·low_complexity |
| 3425 | ······-·low_disruption | 3425 | ······-·low_disruption |
| 3426 | ······-·medium_severity | 3426 | ······-·medium_severity |
| 3427 | ······-·no_reboot_needed | 3427 | ······-·no_reboot_needed |
| Offset 3466, 16 lines modified | Offset 3466, 16 lines modified | ||
| 3466 | ········lineinfile: | 3466 | ········lineinfile: |
| 3467 | ··········path:·/etc/audit/auditd.conf | 3467 | ··········path:·/etc/audit/auditd.conf |
| 3468 | ··········create:·true | 3468 | ··········create:·true |
| 3469 | ··········regexp:·(?i)^\s*log_format\s*=\s* | 3469 | ··········regexp:·(?i)^\s*log_format\s*=\s* |
| 3470 | ··········line:·log_format·=·ENRICHED | 3470 | ··········line:·log_format·=·ENRICHED |
| 3471 | ··········state:·present | 3471 | ··········state:·present |
| 3472 | ······when: | 3472 | ······when: |
| 3473 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3474 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3473 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3474 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3475 | ······tags: | 3475 | ······tags: |
| 3476 | ······-·NIST-800-53-AU-3 | 3476 | ······-·NIST-800-53-AU-3 |
| 3477 | ······-·NIST-800-53-CM-6 | 3477 | ······-·NIST-800-53-CM-6 |
| 3478 | ······-·auditd_log_format | 3478 | ······-·auditd_log_format |
| 3479 | ······-·low_complexity | 3479 | ······-·low_complexity |
| 3480 | ······-·low_disruption | 3480 | ······-·low_disruption |
| 3481 | ······-·low_severity | 3481 | ······-·low_severity |
| Offset 3521, 16 lines modified | Offset 3521, 16 lines modified | ||
| 3521 | ········lineinfile: | 3521 | ········lineinfile: |
| 3522 | ··········path:·/etc/audit/auditd.conf | 3522 | ··········path:·/etc/audit/auditd.conf |
| 3523 | ··········create:·true | 3523 | ··········create:·true |
| 3524 | ··········regexp:·(?i)^\s*name_format\s*=\s* | 3524 | ··········regexp:·(?i)^\s*name_format\s*=\s* |
| 3525 | ··········line:·name_format·=·hostname | 3525 | ··········line:·name_format·=·hostname |
| 3526 | ··········state:·present | 3526 | ··········state:·present |
| 3527 | ······when: | 3527 | ······when: |
| 3528 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3529 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3528 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3529 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3530 | ······tags: | 3530 | ······tags: |
| 3531 | ······-·NIST-800-53-AU-3 | 3531 | ······-·NIST-800-53-AU-3 |
| 3532 | ······-·NIST-800-53-CM-6 | 3532 | ······-·NIST-800-53-CM-6 |
| 3533 | ······-·auditd_name_format | 3533 | ······-·auditd_name_format |
| 3534 | ······-·low_complexity | 3534 | ······-·low_complexity |
| 3535 | ······-·low_disruption | 3535 | ······-·low_disruption |
| 3536 | ······-·medium_severity | 3536 | ······-·medium_severity |
| Offset 4963, 16 lines modified | Offset 4963, 16 lines modified | ||
| 4963 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 4963 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 4964 | ······find: | 4964 | ······find: |
| 4965 | ········paths:·/etc/audit/rules.d/ | 4965 | ········paths:·/etc/audit/rules.d/ |
| 4966 | ········patterns:·'*.rules' | 4966 | ········patterns:·'*.rules' |
| 4967 | ······register:·find_rules_d | 4967 | ······register:·find_rules_d |
| 4968 | ······when: | 4968 | ······when: |
| 4969 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4970 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4969 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4970 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4971 | ······tags: | 4971 | ······tags: |
| 4972 | ······-·CJIS-5.4.1.1 | 4972 | ······-·CJIS-5.4.1.1 |
| 4973 | ······-·NIST-800-171-3.3.1 | 4973 | ······-·NIST-800-171-3.3.1 |
| 4974 | ······-·NIST-800-171-3.4.3 | 4974 | ······-·NIST-800-171-3.4.3 |
| 4975 | ······-·NIST-800-53-AC-6(9) | 4975 | ······-·NIST-800-53-AC-6(9) |
| 4976 | ······-·NIST-800-53-CM-6(a) | 4976 | ······-·NIST-800-53-CM-6(a) |
| 4977 | ······-·PCI-DSS-Req-10.5.2 | 4977 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4987, 16 lines modified | Offset 4987, 16 lines modified | ||
| 4987 | ······lineinfile: | 4987 | ······lineinfile: |
| 4988 | ········path:·'{{·item·}}' | 4988 | ········path:·'{{·item·}}' |
| 4989 | ········regexp:·^\s*(?:-e)\s+.*$ | 4989 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 4990 | ········state:·absent | 4990 | ········state:·absent |
| 4991 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 4991 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 4992 | ········}}' | 4992 | ········}}' |
| 4993 | ······when: | 4993 | ······when: |
| 4994 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4995 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4994 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4995 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4996 | ······tags: | 4996 | ······tags: |
| 4997 | ······-·CJIS-5.4.1.1 | 4997 | ······-·CJIS-5.4.1.1 |
| 4998 | ······-·NIST-800-171-3.3.1 | 4998 | ······-·NIST-800-171-3.3.1 |
| 4999 | ······-·NIST-800-171-3.4.3 | 4999 | ······-·NIST-800-171-3.4.3 |
| 5000 | ······-·NIST-800-53-AC-6(9) | 5000 | ······-·NIST-800-53-AC-6(9) |
| 5001 | ······-·NIST-800-53-CM-6(a) | 5001 | ······-·NIST-800-53-CM-6(a) |
| 5002 | ······-·PCI-DSS-Req-10.5.2 | 5002 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5013, 16 lines modified | Offset 5013, 16 lines modified | ||
| 5013 | ········create:·true | 5013 | ········create:·true |
| 5014 | ········line:·-e·2 | 5014 | ········line:·-e·2 |
| 5015 | ········mode:·o-rwx | 5015 | ········mode:·o-rwx |
| 5016 | ······loop: | 5016 | ······loop: |
| 5017 | ······-·/etc/audit/audit.rules | 5017 | ······-·/etc/audit/audit.rules |
| 5018 | ······-·/etc/audit/rules.d/immutable.rules | 5018 | ······-·/etc/audit/rules.d/immutable.rules |
| 5019 | ······when: | 5019 | ······when: |
| 5020 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5021 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5020 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5021 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5022 | ······tags: | 5022 | ······tags: |
| 5023 | ······-·CJIS-5.4.1.1 | 5023 | ······-·CJIS-5.4.1.1 |
| 5024 | ······-·NIST-800-171-3.3.1 | 5024 | ······-·NIST-800-171-3.3.1 |
| 5025 | ······-·NIST-800-171-3.4.3 | 5025 | ······-·NIST-800-171-3.4.3 |
| 5026 | ······-·NIST-800-53-AC-6(9) | 5026 | ······-·NIST-800-53-AC-6(9) |
| 5027 | ······-·NIST-800-53-CM-6(a) | 5027 | ······-·NIST-800-53-CM-6(a) |
| 5028 | ······-·PCI-DSS-Req-10.5.2 | 5028 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5054, 16 lines modified | Offset 5054, 16 lines modified | ||
| 5054 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5054 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5055 | ······find: | 5055 | ······find: |
| 5056 | ········paths:·/etc/audit/rules.d | 5056 | ········paths:·/etc/audit/rules.d |
| 5057 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5057 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5058 | ········patterns:·'*.rules' | 5058 | ········patterns:·'*.rules' |
| 5059 | ······register:·find_existing_watch_rules_d | 5059 | ······register:·find_existing_watch_rules_d |
| 5060 | ······when: | 5060 | ······when: |
| 5061 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5062 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5061 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5062 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5063 | ······tags: | 5063 | ······tags: |
| 5064 | ······-·CJIS-5.4.1.1 | 5064 | ······-·CJIS-5.4.1.1 |
| 5065 | ······-·NIST-800-171-3.1.8 | 5065 | ······-·NIST-800-171-3.1.8 |
| 5066 | ······-·NIST-800-53-AU-12(c) | 5066 | ······-·NIST-800-53-AU-12(c) |
| 5067 | ······-·NIST-800-53-AU-2(d) | 5067 | ······-·NIST-800-53-AU-2(d) |
| 5068 | ······-·NIST-800-53-CM-6(a) | 5068 | ······-·NIST-800-53-CM-6(a) |
| 5069 | ······-·PCI-DSS-Req-10.5.5 | 5069 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 5077, 16 lines modified | Offset 5077, 16 lines modified | ||
| 5077 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5077 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5078 | ······find: | 5078 | ······find: |
| 5079 | ········paths:·/etc/audit/rules.d | 5079 | ········paths:·/etc/audit/rules.d |
| 5080 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5080 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5081 | ········patterns:·'*.rules' | 5081 | ········patterns:·'*.rules' |
| 5082 | ······register:·find_watch_key | 5082 | ······register:·find_watch_key |
| 5083 | ······when: | 5083 | ······when: |
| 5084 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5085 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5084 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5085 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5086 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5086 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5087 | ········==·0 | 5087 | ········==·0 |
| 5088 | ······tags: | 5088 | ······tags: |
| 5089 | ······-·CJIS-5.4.1.1 | 5089 | ······-·CJIS-5.4.1.1 |
| 5090 | ······-·NIST-800-171-3.1.8 | 5090 | ······-·NIST-800-171-3.1.8 |
| 5091 | ······-·NIST-800-53-AU-12(c) | 5091 | ······-·NIST-800-53-AU-12(c) |
| 5092 | ······-·NIST-800-53-AU-2(d) | 5092 | ······-·NIST-800-53-AU-2(d) |
| Offset 5100, 16 lines modified | Offset 5100, 16 lines modified | ||
| 5100 | ······-·restrict_strategy | 5100 | ······-·restrict_strategy |
| 5101 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5101 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5102 | ······set_fact: | 5102 | ······set_fact: |
| 5103 | ········all_files: | 5103 | ········all_files: |
| 5104 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5104 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5105 | ······when: | 5105 | ······when: |
| 5106 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5107 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5106 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5107 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5108 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5108 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5109 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5109 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5110 | ······tags: | 5110 | ······tags: |
| 5111 | ······-·CJIS-5.4.1.1 | 5111 | ······-·CJIS-5.4.1.1 |
| 5112 | ······-·NIST-800-171-3.1.8 | 5112 | ······-·NIST-800-171-3.1.8 |
| 5113 | ······-·NIST-800-53-AU-12(c) | 5113 | ······-·NIST-800-53-AU-12(c) |
| 5114 | ······-·NIST-800-53-AU-2(d) | 5114 | ······-·NIST-800-53-AU-2(d) |
| Offset 5123, 16 lines modified | Offset 5123, 16 lines modified | ||
| 5123 | ······-·restrict_strategy | 5123 | ······-·restrict_strategy |
| 5124 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5124 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5125 | ······set_fact: | 5125 | ······set_fact: |
| 5126 | ········all_files: | 5126 | ········all_files: |
| 5127 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5127 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5128 | ······when: | 5128 | ······when: |
| 5129 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5130 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5129 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5130 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5131 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5131 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5132 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5132 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5133 | ······tags: | 5133 | ······tags: |
| 5134 | ······-·CJIS-5.4.1.1 | 5134 | ······-·CJIS-5.4.1.1 |
| 5135 | ······-·NIST-800-171-3.1.8 | 5135 | ······-·NIST-800-171-3.1.8 |
| 5136 | ······-·NIST-800-53-AU-12(c) | 5136 | ······-·NIST-800-53-AU-12(c) |
| 5137 | ······-·NIST-800-53-AU-2(d) | 5137 | ······-·NIST-800-53-AU-2(d) |
| Offset 5148, 16 lines modified | Offset 5148, 16 lines modified | ||
| 5148 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5148 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 158112/162797 bytes (97.12%) of diff not shown. | |||
| Offset 11695, 16 lines modified | Offset 11695, 16 lines modified | ||
| 11695 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 11695 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 11696 | ······find: | 11696 | ······find: |
| 11697 | ········paths:·/etc/audit/rules.d/ | 11697 | ········paths:·/etc/audit/rules.d/ |
| 11698 | ········patterns:·'*.rules' | 11698 | ········patterns:·'*.rules' |
| 11699 | ······register:·find_rules_d | 11699 | ······register:·find_rules_d |
| 11700 | ······when: | 11700 | ······when: |
| 11701 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11702 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11701 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11702 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11703 | ······tags: | 11703 | ······tags: |
| 11704 | ······-·CJIS-5.4.1.1 | 11704 | ······-·CJIS-5.4.1.1 |
| 11705 | ······-·NIST-800-171-3.3.1 | 11705 | ······-·NIST-800-171-3.3.1 |
| 11706 | ······-·NIST-800-171-3.4.3 | 11706 | ······-·NIST-800-171-3.4.3 |
| 11707 | ······-·NIST-800-53-AC-6(9) | 11707 | ······-·NIST-800-53-AC-6(9) |
| 11708 | ······-·NIST-800-53-CM-6(a) | 11708 | ······-·NIST-800-53-CM-6(a) |
| 11709 | ······-·PCI-DSS-Req-10.5.2 | 11709 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 11719, 16 lines modified | Offset 11719, 16 lines modified | ||
| 11719 | ······lineinfile: | 11719 | ······lineinfile: |
| 11720 | ········path:·'{{·item·}}' | 11720 | ········path:·'{{·item·}}' |
| 11721 | ········regexp:·^\s*(?:-e)\s+.*$ | 11721 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 11722 | ········state:·absent | 11722 | ········state:·absent |
| 11723 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 11723 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 11724 | ········}}' | 11724 | ········}}' |
| 11725 | ······when: | 11725 | ······when: |
| 11726 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11727 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11726 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11727 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11728 | ······tags: | 11728 | ······tags: |
| 11729 | ······-·CJIS-5.4.1.1 | 11729 | ······-·CJIS-5.4.1.1 |
| 11730 | ······-·NIST-800-171-3.3.1 | 11730 | ······-·NIST-800-171-3.3.1 |
| 11731 | ······-·NIST-800-171-3.4.3 | 11731 | ······-·NIST-800-171-3.4.3 |
| 11732 | ······-·NIST-800-53-AC-6(9) | 11732 | ······-·NIST-800-53-AC-6(9) |
| 11733 | ······-·NIST-800-53-CM-6(a) | 11733 | ······-·NIST-800-53-CM-6(a) |
| 11734 | ······-·PCI-DSS-Req-10.5.2 | 11734 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 11745, 16 lines modified | Offset 11745, 16 lines modified | ||
| 11745 | ········create:·true | 11745 | ········create:·true |
| 11746 | ········line:·-e·2 | 11746 | ········line:·-e·2 |
| 11747 | ········mode:·o-rwx | 11747 | ········mode:·o-rwx |
| 11748 | ······loop: | 11748 | ······loop: |
| 11749 | ······-·/etc/audit/audit.rules | 11749 | ······-·/etc/audit/audit.rules |
| 11750 | ······-·/etc/audit/rules.d/immutable.rules | 11750 | ······-·/etc/audit/rules.d/immutable.rules |
| 11751 | ······when: | 11751 | ······when: |
| 11752 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11753 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11752 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11753 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11754 | ······tags: | 11754 | ······tags: |
| 11755 | ······-·CJIS-5.4.1.1 | 11755 | ······-·CJIS-5.4.1.1 |
| 11756 | ······-·NIST-800-171-3.3.1 | 11756 | ······-·NIST-800-171-3.3.1 |
| 11757 | ······-·NIST-800-171-3.4.3 | 11757 | ······-·NIST-800-171-3.4.3 |
| 11758 | ······-·NIST-800-53-AC-6(9) | 11758 | ······-·NIST-800-53-AC-6(9) |
| 11759 | ······-·NIST-800-53-CM-6(a) | 11759 | ······-·NIST-800-53-CM-6(a) |
| 11760 | ······-·PCI-DSS-Req-10.5.2 | 11760 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 11784, 16 lines modified | Offset 11784, 16 lines modified | ||
| 11784 | ······-·reboot_required | 11784 | ······-·reboot_required |
| 11785 | ······-·restrict_strategy | 11785 | ······-·restrict_strategy |
| 11786 | ····-·name:·Set·architecture·for·audit·mount·tasks | 11786 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 11787 | ······set_fact: | 11787 | ······set_fact: |
| 11788 | ········audit_arch:·b64 | 11788 | ········audit_arch:·b64 |
| 11789 | ······when: | 11789 | ······when: |
| 11790 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11791 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11790 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11791 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11792 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 11792 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 11793 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 11793 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 11794 | ······tags: | 11794 | ······tags: |
| 11795 | ······-·CJIS-5.4.1.1 | 11795 | ······-·CJIS-5.4.1.1 |
| 11796 | ······-·NIST-800-171-3.1.7 | 11796 | ······-·NIST-800-171-3.1.7 |
| 11797 | ······-·NIST-800-53-AC-6(9) | 11797 | ······-·NIST-800-53-AC-6(9) |
| 11798 | ······-·NIST-800-53-AU-12(c) | 11798 | ······-·NIST-800-53-AU-12(c) |
| Offset 11924, 16 lines modified | Offset 11924, 16 lines modified | ||
| 11924 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 11924 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 11925 | ············-F·auid!=unset·-F·key=perm_mod | 11925 | ············-F·auid!=unset·-F·key=perm_mod |
| 11926 | ··········create:·true | 11926 | ··········create:·true |
| 11927 | ··········mode:·o-rwx | 11927 | ··········mode:·o-rwx |
| 11928 | ··········state:·present | 11928 | ··········state:·present |
| 11929 | ········when:·syscalls_found·|·length·==·0 | 11929 | ········when:·syscalls_found·|·length·==·0 |
| 11930 | ······when: | 11930 | ······when: |
| 11931 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11932 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11931 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11932 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11933 | ······tags: | 11933 | ······tags: |
| 11934 | ······-·CJIS-5.4.1.1 | 11934 | ······-·CJIS-5.4.1.1 |
| 11935 | ······-·NIST-800-171-3.1.7 | 11935 | ······-·NIST-800-171-3.1.7 |
| 11936 | ······-·NIST-800-53-AC-6(9) | 11936 | ······-·NIST-800-53-AC-6(9) |
| 11937 | ······-·NIST-800-53-AU-12(c) | 11937 | ······-·NIST-800-53-AU-12(c) |
| 11938 | ······-·NIST-800-53-AU-2(d) | 11938 | ······-·NIST-800-53-AU-2(d) |
| 11939 | ······-·NIST-800-53-CM-6(a) | 11939 | ······-·NIST-800-53-CM-6(a) |
| Offset 12062, 16 lines modified | Offset 12062, 16 lines modified | ||
| 12062 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 12062 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 12063 | ············-F·auid!=unset·-F·key=perm_mod | 12063 | ············-F·auid!=unset·-F·key=perm_mod |
| 12064 | ··········create:·true | 12064 | ··········create:·true |
| 12065 | ··········mode:·o-rwx | 12065 | ··········mode:·o-rwx |
| 12066 | ··········state:·present | 12066 | ··········state:·present |
| 12067 | ········when:·syscalls_found·|·length·==·0 | 12067 | ········when:·syscalls_found·|·length·==·0 |
| 12068 | ······when: | 12068 | ······when: |
| 12069 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12070 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12069 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12070 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12071 | ······-·audit_arch·==·"b64" | 12071 | ······-·audit_arch·==·"b64" |
| 12072 | ······tags: | 12072 | ······tags: |
| 12073 | ······-·CJIS-5.4.1.1 | 12073 | ······-·CJIS-5.4.1.1 |
| 12074 | ······-·NIST-800-171-3.1.7 | 12074 | ······-·NIST-800-171-3.1.7 |
| 12075 | ······-·NIST-800-53-AC-6(9) | 12075 | ······-·NIST-800-53-AC-6(9) |
| 12076 | ······-·NIST-800-53-AU-12(c) | 12076 | ······-·NIST-800-53-AU-12(c) |
| 12077 | ······-·NIST-800-53-AU-2(d) | 12077 | ······-·NIST-800-53-AU-2(d) |
| Offset 12099, 16 lines modified | Offset 12099, 16 lines modified | ||
| 12099 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 12099 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 12100 | ······find: | 12100 | ······find: |
| 12101 | ········paths:·/etc/audit/rules.d | 12101 | ········paths:·/etc/audit/rules.d |
| 12102 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 12102 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 12103 | ········patterns:·'*.rules' | 12103 | ········patterns:·'*.rules' |
| 12104 | ······register:·find_existing_watch_rules_d | 12104 | ······register:·find_existing_watch_rules_d |
| 12105 | ······when: | 12105 | ······when: |
| 12106 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12107 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12106 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12107 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12108 | ······tags: | 12108 | ······tags: |
| 12109 | ······-·audit_rules_sudoers | 12109 | ······-·audit_rules_sudoers |
| 12110 | ······-·low_complexity | 12110 | ······-·low_complexity |
| 12111 | ······-·low_disruption | 12111 | ······-·low_disruption |
| 12112 | ······-·medium_severity | 12112 | ······-·medium_severity |
| 12113 | ······-·no_reboot_needed | 12113 | ······-·no_reboot_needed |
| 12114 | ······-·restrict_strategy | 12114 | ······-·restrict_strategy |
| Offset 12116, 16 lines modified | Offset 12116, 16 lines modified | ||
| 12116 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 12116 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| Max diff block lines reached; 165197/169732 bytes (97.33%) of diff not shown. | |||
| Offset 11669, 16 lines modified | Offset 11669, 16 lines modified | ||
| 11669 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 11669 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 11670 | ······find: | 11670 | ······find: |
| 11671 | ········paths:·/etc/audit/rules.d/ | 11671 | ········paths:·/etc/audit/rules.d/ |
| 11672 | ········patterns:·'*.rules' | 11672 | ········patterns:·'*.rules' |
| 11673 | ······register:·find_rules_d | 11673 | ······register:·find_rules_d |
| 11674 | ······when: | 11674 | ······when: |
| 11675 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11676 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11675 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11676 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11677 | ······tags: | 11677 | ······tags: |
| 11678 | ······-·CJIS-5.4.1.1 | 11678 | ······-·CJIS-5.4.1.1 |
| 11679 | ······-·NIST-800-171-3.3.1 | 11679 | ······-·NIST-800-171-3.3.1 |
| 11680 | ······-·NIST-800-171-3.4.3 | 11680 | ······-·NIST-800-171-3.4.3 |
| 11681 | ······-·NIST-800-53-AC-6(9) | 11681 | ······-·NIST-800-53-AC-6(9) |
| 11682 | ······-·NIST-800-53-CM-6(a) | 11682 | ······-·NIST-800-53-CM-6(a) |
| 11683 | ······-·PCI-DSS-Req-10.5.2 | 11683 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 11693, 16 lines modified | Offset 11693, 16 lines modified | ||
| 11693 | ······lineinfile: | 11693 | ······lineinfile: |
| 11694 | ········path:·'{{·item·}}' | 11694 | ········path:·'{{·item·}}' |
| 11695 | ········regexp:·^\s*(?:-e)\s+.*$ | 11695 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 11696 | ········state:·absent | 11696 | ········state:·absent |
| 11697 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 11697 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 11698 | ········}}' | 11698 | ········}}' |
| 11699 | ······when: | 11699 | ······when: |
| 11700 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11701 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11700 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11701 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11702 | ······tags: | 11702 | ······tags: |
| 11703 | ······-·CJIS-5.4.1.1 | 11703 | ······-·CJIS-5.4.1.1 |
| 11704 | ······-·NIST-800-171-3.3.1 | 11704 | ······-·NIST-800-171-3.3.1 |
| 11705 | ······-·NIST-800-171-3.4.3 | 11705 | ······-·NIST-800-171-3.4.3 |
| 11706 | ······-·NIST-800-53-AC-6(9) | 11706 | ······-·NIST-800-53-AC-6(9) |
| 11707 | ······-·NIST-800-53-CM-6(a) | 11707 | ······-·NIST-800-53-CM-6(a) |
| 11708 | ······-·PCI-DSS-Req-10.5.2 | 11708 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 11719, 16 lines modified | Offset 11719, 16 lines modified | ||
| 11719 | ········create:·true | 11719 | ········create:·true |
| 11720 | ········line:·-e·2 | 11720 | ········line:·-e·2 |
| 11721 | ········mode:·o-rwx | 11721 | ········mode:·o-rwx |
| 11722 | ······loop: | 11722 | ······loop: |
| 11723 | ······-·/etc/audit/audit.rules | 11723 | ······-·/etc/audit/audit.rules |
| 11724 | ······-·/etc/audit/rules.d/immutable.rules | 11724 | ······-·/etc/audit/rules.d/immutable.rules |
| 11725 | ······when: | 11725 | ······when: |
| 11726 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11727 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11726 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11727 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11728 | ······tags: | 11728 | ······tags: |
| 11729 | ······-·CJIS-5.4.1.1 | 11729 | ······-·CJIS-5.4.1.1 |
| 11730 | ······-·NIST-800-171-3.3.1 | 11730 | ······-·NIST-800-171-3.3.1 |
| 11731 | ······-·NIST-800-171-3.4.3 | 11731 | ······-·NIST-800-171-3.4.3 |
| 11732 | ······-·NIST-800-53-AC-6(9) | 11732 | ······-·NIST-800-53-AC-6(9) |
| 11733 | ······-·NIST-800-53-CM-6(a) | 11733 | ······-·NIST-800-53-CM-6(a) |
| 11734 | ······-·PCI-DSS-Req-10.5.2 | 11734 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 11758, 16 lines modified | Offset 11758, 16 lines modified | ||
| 11758 | ······-·reboot_required | 11758 | ······-·reboot_required |
| 11759 | ······-·restrict_strategy | 11759 | ······-·restrict_strategy |
| 11760 | ····-·name:·Set·architecture·for·audit·mount·tasks | 11760 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 11761 | ······set_fact: | 11761 | ······set_fact: |
| 11762 | ········audit_arch:·b64 | 11762 | ········audit_arch:·b64 |
| 11763 | ······when: | 11763 | ······when: |
| 11764 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11765 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11764 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11765 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11766 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 11766 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 11767 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 11767 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 11768 | ······tags: | 11768 | ······tags: |
| 11769 | ······-·CJIS-5.4.1.1 | 11769 | ······-·CJIS-5.4.1.1 |
| 11770 | ······-·NIST-800-171-3.1.7 | 11770 | ······-·NIST-800-171-3.1.7 |
| 11771 | ······-·NIST-800-53-AC-6(9) | 11771 | ······-·NIST-800-53-AC-6(9) |
| 11772 | ······-·NIST-800-53-AU-12(c) | 11772 | ······-·NIST-800-53-AU-12(c) |
| Offset 11898, 16 lines modified | Offset 11898, 16 lines modified | ||
| 11898 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 11898 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 11899 | ············-F·auid!=unset·-F·key=perm_mod | 11899 | ············-F·auid!=unset·-F·key=perm_mod |
| 11900 | ··········create:·true | 11900 | ··········create:·true |
| 11901 | ··········mode:·o-rwx | 11901 | ··········mode:·o-rwx |
| 11902 | ··········state:·present | 11902 | ··········state:·present |
| 11903 | ········when:·syscalls_found·|·length·==·0 | 11903 | ········when:·syscalls_found·|·length·==·0 |
| 11904 | ······when: | 11904 | ······when: |
| 11905 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11906 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 11905 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 11906 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 11907 | ······tags: | 11907 | ······tags: |
| 11908 | ······-·CJIS-5.4.1.1 | 11908 | ······-·CJIS-5.4.1.1 |
| 11909 | ······-·NIST-800-171-3.1.7 | 11909 | ······-·NIST-800-171-3.1.7 |
| 11910 | ······-·NIST-800-53-AC-6(9) | 11910 | ······-·NIST-800-53-AC-6(9) |
| 11911 | ······-·NIST-800-53-AU-12(c) | 11911 | ······-·NIST-800-53-AU-12(c) |
| 11912 | ······-·NIST-800-53-AU-2(d) | 11912 | ······-·NIST-800-53-AU-2(d) |
| 11913 | ······-·NIST-800-53-CM-6(a) | 11913 | ······-·NIST-800-53-CM-6(a) |
| Offset 12036, 16 lines modified | Offset 12036, 16 lines modified | ||
| 12036 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 12036 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 12037 | ············-F·auid!=unset·-F·key=perm_mod | 12037 | ············-F·auid!=unset·-F·key=perm_mod |
| 12038 | ··········create:·true | 12038 | ··········create:·true |
| 12039 | ··········mode:·o-rwx | 12039 | ··········mode:·o-rwx |
| 12040 | ··········state:·present | 12040 | ··········state:·present |
| 12041 | ········when:·syscalls_found·|·length·==·0 | 12041 | ········when:·syscalls_found·|·length·==·0 |
| 12042 | ······when: | 12042 | ······when: |
| 12043 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12044 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12043 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12044 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12045 | ······-·audit_arch·==·"b64" | 12045 | ······-·audit_arch·==·"b64" |
| 12046 | ······tags: | 12046 | ······tags: |
| 12047 | ······-·CJIS-5.4.1.1 | 12047 | ······-·CJIS-5.4.1.1 |
| 12048 | ······-·NIST-800-171-3.1.7 | 12048 | ······-·NIST-800-171-3.1.7 |
| 12049 | ······-·NIST-800-53-AC-6(9) | 12049 | ······-·NIST-800-53-AC-6(9) |
| 12050 | ······-·NIST-800-53-AU-12(c) | 12050 | ······-·NIST-800-53-AU-12(c) |
| 12051 | ······-·NIST-800-53-AU-2(d) | 12051 | ······-·NIST-800-53-AU-2(d) |
| Offset 12073, 16 lines modified | Offset 12073, 16 lines modified | ||
| 12073 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 12073 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 12074 | ······find: | 12074 | ······find: |
| 12075 | ········paths:·/etc/audit/rules.d | 12075 | ········paths:·/etc/audit/rules.d |
| 12076 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 12076 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 12077 | ········patterns:·'*.rules' | 12077 | ········patterns:·'*.rules' |
| 12078 | ······register:·find_existing_watch_rules_d | 12078 | ······register:·find_existing_watch_rules_d |
| 12079 | ······when: | 12079 | ······when: |
| 12080 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12081 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12080 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12081 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12082 | ······tags: | 12082 | ······tags: |
| 12083 | ······-·audit_rules_sudoers | 12083 | ······-·audit_rules_sudoers |
| 12084 | ······-·low_complexity | 12084 | ······-·low_complexity |
| 12085 | ······-·low_disruption | 12085 | ······-·low_disruption |
| 12086 | ······-·medium_severity | 12086 | ······-·medium_severity |
| 12087 | ······-·no_reboot_needed | 12087 | ······-·no_reboot_needed |
| 12088 | ······-·restrict_strategy | 12088 | ······-·restrict_strategy |
| Offset 12090, 16 lines modified | Offset 12090, 16 lines modified | ||
| 12090 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 12090 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| Max diff block lines reached; 165197/169732 bytes (97.33%) of diff not shown. | |||
| Offset 13628, 16 lines modified | Offset 13628, 16 lines modified | ||
| 13628 | ······-·no_reboot_needed | 13628 | ······-·no_reboot_needed |
| 13629 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg | 13629 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg |
| 13630 | ······stat: | 13630 | ······stat: |
| 13631 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 13631 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 13632 | ······register:·file_exists | 13632 | ······register:·file_exists |
| 13633 | ······when: | 13633 | ······when: |
| 13634 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13635 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13634 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13635 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13636 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13636 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13637 | ······tags: | 13637 | ······tags: |
| 13638 | ······-·CJIS-5.5.2.2 | 13638 | ······-·CJIS-5.5.2.2 |
| 13639 | ······-·NIST-800-171-3.4.5 | 13639 | ······-·NIST-800-171-3.4.5 |
| 13640 | ······-·NIST-800-53-AC-6(1) | 13640 | ······-·NIST-800-53-AC-6(1) |
| 13641 | ······-·NIST-800-53-CM-6(a) | 13641 | ······-·NIST-800-53-CM-6(a) |
| 13642 | ······-·PCI-DSS-Req-7.1 | 13642 | ······-·PCI-DSS-Req-7.1 |
| Offset 13649, 16 lines modified | Offset 13649, 16 lines modified | ||
| 13649 | ······-·no_reboot_needed | 13649 | ······-·no_reboot_needed |
| 13650 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/grub.cfg | 13650 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/grub.cfg |
| 13651 | ······file: | 13651 | ······file: |
| 13652 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 13652 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 13653 | ········group:·'0' | 13653 | ········group:·'0' |
| 13654 | ······when: | 13654 | ······when: |
| 13655 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13656 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13655 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13656 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13657 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13657 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13658 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13658 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13659 | ······tags: | 13659 | ······tags: |
| 13660 | ······-·CJIS-5.5.2.2 | 13660 | ······-·CJIS-5.5.2.2 |
| 13661 | ······-·NIST-800-171-3.4.5 | 13661 | ······-·NIST-800-171-3.4.5 |
| 13662 | ······-·NIST-800-53-AC-6(1) | 13662 | ······-·NIST-800-53-AC-6(1) |
| 13663 | ······-·NIST-800-53-CM-6(a) | 13663 | ······-·NIST-800-53-CM-6(a) |
| Offset 13688, 16 lines modified | Offset 13688, 16 lines modified | ||
| 13688 | ······-·no_reboot_needed | 13688 | ······-·no_reboot_needed |
| 13689 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg | 13689 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg |
| 13690 | ······stat: | 13690 | ······stat: |
| 13691 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 13691 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 13692 | ······register:·file_exists | 13692 | ······register:·file_exists |
| 13693 | ······when: | 13693 | ······when: |
| 13694 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13695 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13694 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13695 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13696 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13696 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13697 | ······tags: | 13697 | ······tags: |
| 13698 | ······-·CJIS-5.5.2.2 | 13698 | ······-·CJIS-5.5.2.2 |
| 13699 | ······-·NIST-800-171-3.4.5 | 13699 | ······-·NIST-800-171-3.4.5 |
| 13700 | ······-·NIST-800-53-AC-6(1) | 13700 | ······-·NIST-800-53-AC-6(1) |
| 13701 | ······-·NIST-800-53-CM-6(a) | 13701 | ······-·NIST-800-53-CM-6(a) |
| 13702 | ······-·PCI-DSS-Req-7.1 | 13702 | ······-·PCI-DSS-Req-7.1 |
| Offset 13709, 16 lines modified | Offset 13709, 16 lines modified | ||
| 13709 | ······-·no_reboot_needed | 13709 | ······-·no_reboot_needed |
| 13710 | ····-·name:·Ensure·owner·0·on·/boot/efi/EFI/redhat/grub.cfg | 13710 | ····-·name:·Ensure·owner·0·on·/boot/efi/EFI/redhat/grub.cfg |
| 13711 | ······file: | 13711 | ······file: |
| 13712 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 13712 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 13713 | ········owner:·'0' | 13713 | ········owner:·'0' |
| 13714 | ······when: | 13714 | ······when: |
| 13715 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13716 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13715 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13716 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13717 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13717 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13718 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13718 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13719 | ······tags: | 13719 | ······tags: |
| 13720 | ······-·CJIS-5.5.2.2 | 13720 | ······-·CJIS-5.5.2.2 |
| 13721 | ······-·NIST-800-171-3.4.5 | 13721 | ······-·NIST-800-171-3.4.5 |
| 13722 | ······-·NIST-800-53-AC-6(1) | 13722 | ······-·NIST-800-53-AC-6(1) |
| 13723 | ······-·NIST-800-53-CM-6(a) | 13723 | ······-·NIST-800-53-CM-6(a) |
| Offset 13093, 16 lines modified | Offset 13093, 16 lines modified | ||
| 13093 | ······-·no_reboot_needed | 13093 | ······-·no_reboot_needed |
| 13094 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 13094 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 13095 | ······stat: | 13095 | ······stat: |
| 13096 | ········path:·/boot/grub2/grub.cfg | 13096 | ········path:·/boot/grub2/grub.cfg |
| 13097 | ······register:·file_exists | 13097 | ······register:·file_exists |
| 13098 | ······when: | 13098 | ······when: |
| 13099 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13100 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 13099 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 13100 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13101 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13101 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13102 | ······tags: | 13102 | ······tags: |
| 13103 | ······-·CJIS-5.5.2.2 | 13103 | ······-·CJIS-5.5.2.2 |
| 13104 | ······-·NIST-800-171-3.4.5 | 13104 | ······-·NIST-800-171-3.4.5 |
| 13105 | ······-·NIST-800-53-AC-6(1) | 13105 | ······-·NIST-800-53-AC-6(1) |
| 13106 | ······-·NIST-800-53-CM-6(a) | 13106 | ······-·NIST-800-53-CM-6(a) |
| 13107 | ······-·PCI-DSS-Req-7.1 | 13107 | ······-·PCI-DSS-Req-7.1 |
| Offset 13114, 16 lines modified | Offset 13114, 16 lines modified | ||
| 13114 | ······-·no_reboot_needed | 13114 | ······-·no_reboot_needed |
| 13115 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 13115 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 13116 | ······file: | 13116 | ······file: |
| 13117 | ········path:·/boot/grub2/grub.cfg | 13117 | ········path:·/boot/grub2/grub.cfg |
| 13118 | ········group:·'0' | 13118 | ········group:·'0' |
| 13119 | ······when: | 13119 | ······when: |
| 13120 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13121 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 13120 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 13121 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13122 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13122 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13123 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13123 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13124 | ······tags: | 13124 | ······tags: |
| 13125 | ······-·CJIS-5.5.2.2 | 13125 | ······-·CJIS-5.5.2.2 |
| 13126 | ······-·NIST-800-171-3.4.5 | 13126 | ······-·NIST-800-171-3.4.5 |
| 13127 | ······-·NIST-800-53-AC-6(1) | 13127 | ······-·NIST-800-53-AC-6(1) |
| 13128 | ······-·NIST-800-53-CM-6(a) | 13128 | ······-·NIST-800-53-CM-6(a) |
| Offset 13153, 16 lines modified | Offset 13153, 16 lines modified | ||
| 13153 | ······-·no_reboot_needed | 13153 | ······-·no_reboot_needed |
| 13154 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 13154 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 13155 | ······stat: | 13155 | ······stat: |
| 13156 | ········path:·/boot/grub2/grub.cfg | 13156 | ········path:·/boot/grub2/grub.cfg |
| 13157 | ······register:·file_exists | 13157 | ······register:·file_exists |
| 13158 | ······when: | 13158 | ······when: |
| 13159 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13160 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 13159 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 13160 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13161 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13161 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13162 | ······tags: | 13162 | ······tags: |
| 13163 | ······-·CJIS-5.5.2.2 | 13163 | ······-·CJIS-5.5.2.2 |
| 13164 | ······-·NIST-800-171-3.4.5 | 13164 | ······-·NIST-800-171-3.4.5 |
| 13165 | ······-·NIST-800-53-AC-6(1) | 13165 | ······-·NIST-800-53-AC-6(1) |
| 13166 | ······-·NIST-800-53-CM-6(a) | 13166 | ······-·NIST-800-53-CM-6(a) |
| 13167 | ······-·PCI-DSS-Req-7.1 | 13167 | ······-·PCI-DSS-Req-7.1 |
| Offset 13174, 16 lines modified | Offset 13174, 16 lines modified | ||
| 13174 | ······-·no_reboot_needed | 13174 | ······-·no_reboot_needed |
| 13175 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 13175 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 13176 | ······file: | 13176 | ······file: |
| 13177 | ········path:·/boot/grub2/grub.cfg | 13177 | ········path:·/boot/grub2/grub.cfg |
| 13178 | ········owner:·'0' | 13178 | ········owner:·'0' |
| 13179 | ······when: | 13179 | ······when: |
| 13180 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13181 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 13180 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 13181 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 13182 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13182 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13183 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13183 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13184 | ······tags: | 13184 | ······tags: |
| 13185 | ······-·CJIS-5.5.2.2 | 13185 | ······-·CJIS-5.5.2.2 |
| 13186 | ······-·NIST-800-171-3.4.5 | 13186 | ······-·NIST-800-171-3.4.5 |
| 13187 | ······-·NIST-800-53-AC-6(1) | 13187 | ······-·NIST-800-53-AC-6(1) |
| 13188 | ······-·NIST-800-53-CM-6(a) | 13188 | ······-·NIST-800-53-CM-6(a) |
| Offset 22037, 16 lines modified | Offset 22037, 16 lines modified | ||
| 22037 | ······-·no_reboot_needed | 22037 | ······-·no_reboot_needed |
| 22038 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22038 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22039 | ······stat: | 22039 | ······stat: |
| 22040 | ········path:·/boot/grub2/grub.cfg | 22040 | ········path:·/boot/grub2/grub.cfg |
| 22041 | ······register:·file_exists | 22041 | ······register:·file_exists |
| 22042 | ······when: | 22042 | ······when: |
| 22043 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22044 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22043 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22044 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22045 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22045 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22046 | ······tags: | 22046 | ······tags: |
| 22047 | ······-·CJIS-5.5.2.2 | 22047 | ······-·CJIS-5.5.2.2 |
| 22048 | ······-·NIST-800-171-3.4.5 | 22048 | ······-·NIST-800-171-3.4.5 |
| 22049 | ······-·NIST-800-53-AC-6(1) | 22049 | ······-·NIST-800-53-AC-6(1) |
| 22050 | ······-·NIST-800-53-CM-6(a) | 22050 | ······-·NIST-800-53-CM-6(a) |
| 22051 | ······-·PCI-DSS-Req-7.1 | 22051 | ······-·PCI-DSS-Req-7.1 |
| Offset 22058, 16 lines modified | Offset 22058, 16 lines modified | ||
| 22058 | ······-·no_reboot_needed | 22058 | ······-·no_reboot_needed |
| 22059 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 22059 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 22060 | ······file: | 22060 | ······file: |
| 22061 | ········path:·/boot/grub2/grub.cfg | 22061 | ········path:·/boot/grub2/grub.cfg |
| 22062 | ········group:·'0' | 22062 | ········group:·'0' |
| 22063 | ······when: | 22063 | ······when: |
| 22064 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22065 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22064 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22065 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22066 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22066 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22067 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22067 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22068 | ······tags: | 22068 | ······tags: |
| 22069 | ······-·CJIS-5.5.2.2 | 22069 | ······-·CJIS-5.5.2.2 |
| 22070 | ······-·NIST-800-171-3.4.5 | 22070 | ······-·NIST-800-171-3.4.5 |
| 22071 | ······-·NIST-800-53-AC-6(1) | 22071 | ······-·NIST-800-53-AC-6(1) |
| 22072 | ······-·NIST-800-53-CM-6(a) | 22072 | ······-·NIST-800-53-CM-6(a) |
| Offset 22097, 16 lines modified | Offset 22097, 16 lines modified | ||
| 22097 | ······-·no_reboot_needed | 22097 | ······-·no_reboot_needed |
| 22098 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22098 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22099 | ······stat: | 22099 | ······stat: |
| 22100 | ········path:·/boot/grub2/grub.cfg | 22100 | ········path:·/boot/grub2/grub.cfg |
| 22101 | ······register:·file_exists | 22101 | ······register:·file_exists |
| 22102 | ······when: | 22102 | ······when: |
| 22103 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22104 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22103 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22104 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22105 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22105 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22106 | ······tags: | 22106 | ······tags: |
| 22107 | ······-·CJIS-5.5.2.2 | 22107 | ······-·CJIS-5.5.2.2 |
| 22108 | ······-·NIST-800-171-3.4.5 | 22108 | ······-·NIST-800-171-3.4.5 |
| 22109 | ······-·NIST-800-53-AC-6(1) | 22109 | ······-·NIST-800-53-AC-6(1) |
| 22110 | ······-·NIST-800-53-CM-6(a) | 22110 | ······-·NIST-800-53-CM-6(a) |
| 22111 | ······-·PCI-DSS-Req-7.1 | 22111 | ······-·PCI-DSS-Req-7.1 |
| Offset 22118, 16 lines modified | Offset 22118, 16 lines modified | ||
| 22118 | ······-·no_reboot_needed | 22118 | ······-·no_reboot_needed |
| 22119 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 22119 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 22120 | ······file: | 22120 | ······file: |
| 22121 | ········path:·/boot/grub2/grub.cfg | 22121 | ········path:·/boot/grub2/grub.cfg |
| 22122 | ········owner:·'0' | 22122 | ········owner:·'0' |
| 22123 | ······when: | 22123 | ······when: |
| 22124 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22125 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22124 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22125 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22126 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22126 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22127 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22127 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22128 | ······tags: | 22128 | ······tags: |
| 22129 | ······-·CJIS-5.5.2.2 | 22129 | ······-·CJIS-5.5.2.2 |
| 22130 | ······-·NIST-800-171-3.4.5 | 22130 | ······-·NIST-800-171-3.4.5 |
| 22131 | ······-·NIST-800-53-AC-6(1) | 22131 | ······-·NIST-800-53-AC-6(1) |
| 22132 | ······-·NIST-800-53-CM-6(a) | 22132 | ······-·NIST-800-53-CM-6(a) |
| Offset 22155, 16 lines modified | Offset 22155, 16 lines modified | ||
| 22155 | ······-·no_reboot_needed | 22155 | ······-·no_reboot_needed |
| 22156 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22156 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22157 | ······stat: | 22157 | ······stat: |
| 22158 | ········path:·/boot/grub2/grub.cfg | 22158 | ········path:·/boot/grub2/grub.cfg |
| 22159 | ······register:·file_exists | 22159 | ······register:·file_exists |
| 22160 | ······when: | 22160 | ······when: |
| 22161 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22162 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22161 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22162 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22163 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22163 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22164 | ······tags: | 22164 | ······tags: |
| 22165 | ······-·NIST-800-171-3.4.5 | 22165 | ······-·NIST-800-171-3.4.5 |
| 22166 | ······-·NIST-800-53-AC-6(1) | 22166 | ······-·NIST-800-53-AC-6(1) |
| 22167 | ······-·NIST-800-53-CM-6(a) | 22167 | ······-·NIST-800-53-CM-6(a) |
| 22168 | ······-·configure_strategy | 22168 | ······-·configure_strategy |
| 22169 | ······-·file_permissions_grub2_cfg | 22169 | ······-·file_permissions_grub2_cfg |
| Offset 22174, 16 lines modified | Offset 22174, 16 lines modified | ||
| 22174 | ······-·no_reboot_needed | 22174 | ······-·no_reboot_needed |
| 22175 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 22175 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 22176 | ······file: | 22176 | ······file: |
| 22177 | ········path:·/boot/grub2/grub.cfg | 22177 | ········path:·/boot/grub2/grub.cfg |
| 22178 | ········mode:·u-xs,g-xwrs,o-xwrt | 22178 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 22179 | ······when: | 22179 | ······when: |
| 22180 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22181 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22180 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22181 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22182 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22182 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22183 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22183 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22184 | ······tags: | 22184 | ······tags: |
| 22185 | ······-·NIST-800-171-3.4.5 | 22185 | ······-·NIST-800-171-3.4.5 |
| 22186 | ······-·NIST-800-53-AC-6(1) | 22186 | ······-·NIST-800-53-AC-6(1) |
| 22187 | ······-·NIST-800-53-CM-6(a) | 22187 | ······-·NIST-800-53-CM-6(a) |
| 22188 | ······-·configure_strategy | 22188 | ······-·configure_strategy |
| Offset 22530, 16 lines modified | Offset 22530, 16 lines modified | ||
| 22530 | ······-·no_reboot_needed | 22530 | ······-·no_reboot_needed |
| 22531 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22531 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22532 | ······stat: | 22532 | ······stat: |
| 22533 | ········path:·/boot/grub2/grub.cfg | 22533 | ········path:·/boot/grub2/grub.cfg |
| 22534 | ······register:·file_exists | 22534 | ······register:·file_exists |
| 22535 | ······when: | 22535 | ······when: |
| 22536 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22537 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22536 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22537 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22538 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22538 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22539 | ······tags: | 22539 | ······tags: |
| 22540 | ······-·CJIS-5.5.2.2 | 22540 | ······-·CJIS-5.5.2.2 |
| 22541 | ······-·NIST-800-171-3.4.5 | 22541 | ······-·NIST-800-171-3.4.5 |
| 22542 | ······-·NIST-800-53-AC-6(1) | 22542 | ······-·NIST-800-53-AC-6(1) |
| 22543 | ······-·NIST-800-53-CM-6(a) | 22543 | ······-·NIST-800-53-CM-6(a) |
| 22544 | ······-·PCI-DSS-Req-7.1 | 22544 | ······-·PCI-DSS-Req-7.1 |
| Offset 22551, 16 lines modified | Offset 22551, 16 lines modified | ||
| 22551 | ······-·no_reboot_needed | 22551 | ······-·no_reboot_needed |
| 22552 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 22552 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 22553 | ······file: | 22553 | ······file: |
| 22554 | ········path:·/boot/grub2/grub.cfg | 22554 | ········path:·/boot/grub2/grub.cfg |
| 22555 | ········group:·'0' | 22555 | ········group:·'0' |
| 22556 | ······when: | 22556 | ······when: |
| 22557 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22558 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22557 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22558 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22559 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22559 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22560 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22560 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22561 | ······tags: | 22561 | ······tags: |
| 22562 | ······-·CJIS-5.5.2.2 | 22562 | ······-·CJIS-5.5.2.2 |
| 22563 | ······-·NIST-800-171-3.4.5 | 22563 | ······-·NIST-800-171-3.4.5 |
| 22564 | ······-·NIST-800-53-AC-6(1) | 22564 | ······-·NIST-800-53-AC-6(1) |
| 22565 | ······-·NIST-800-53-CM-6(a) | 22565 | ······-·NIST-800-53-CM-6(a) |
| Offset 22590, 16 lines modified | Offset 22590, 16 lines modified | ||
| 22590 | ······-·no_reboot_needed | 22590 | ······-·no_reboot_needed |
| 22591 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22591 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22592 | ······stat: | 22592 | ······stat: |
| 22593 | ········path:·/boot/grub2/grub.cfg | 22593 | ········path:·/boot/grub2/grub.cfg |
| 22594 | ······register:·file_exists | 22594 | ······register:·file_exists |
| 22595 | ······when: | 22595 | ······when: |
| 22596 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22597 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22596 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22597 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22598 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22598 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22599 | ······tags: | 22599 | ······tags: |
| 22600 | ······-·CJIS-5.5.2.2 | 22600 | ······-·CJIS-5.5.2.2 |
| 22601 | ······-·NIST-800-171-3.4.5 | 22601 | ······-·NIST-800-171-3.4.5 |
| 22602 | ······-·NIST-800-53-AC-6(1) | 22602 | ······-·NIST-800-53-AC-6(1) |
| 22603 | ······-·NIST-800-53-CM-6(a) | 22603 | ······-·NIST-800-53-CM-6(a) |
| 22604 | ······-·PCI-DSS-Req-7.1 | 22604 | ······-·PCI-DSS-Req-7.1 |
| Offset 22611, 16 lines modified | Offset 22611, 16 lines modified | ||
| 22611 | ······-·no_reboot_needed | 22611 | ······-·no_reboot_needed |
| 22612 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 22612 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 22613 | ······file: | 22613 | ······file: |
| 22614 | ········path:·/boot/grub2/grub.cfg | 22614 | ········path:·/boot/grub2/grub.cfg |
| 22615 | ········owner:·'0' | 22615 | ········owner:·'0' |
| 22616 | ······when: | 22616 | ······when: |
| 22617 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22618 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 22617 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 22618 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 22619 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22619 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22620 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22620 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22621 | ······tags: | 22621 | ······tags: |
| 22622 | ······-·CJIS-5.5.2.2 | 22622 | ······-·CJIS-5.5.2.2 |
| 22623 | ······-·NIST-800-171-3.4.5 | 22623 | ······-·NIST-800-171-3.4.5 |
| 22624 | ······-·NIST-800-53-AC-6(1) | 22624 | ······-·NIST-800-53-AC-6(1) |
| 22625 | ······-·NIST-800-53-CM-6(a) | 22625 | ······-·NIST-800-53-CM-6(a) |
| Offset 5219, 16 lines modified | Offset 5219, 16 lines modified | ||
| 5219 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5219 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5220 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5220 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5221 | ··········create:·true | 5221 | ··········create:·true |
| 5222 | ··········mode:·o-rwx | 5222 | ··········mode:·o-rwx |
| 5223 | ··········state:·present | 5223 | ··········state:·present |
| 5224 | ········when:·syscalls_found·|·length·==·0 | 5224 | ········when:·syscalls_found·|·length·==·0 |
| 5225 | ······when: | 5225 | ······when: |
| 5226 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5227 | ······-·'"audit"·in·ansible_facts.packages' | 5226 | ······-·'"audit"·in·ansible_facts.packages' |
| 5227 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5228 | ······tags: | 5228 | ······tags: |
| 5229 | ······-·NIST-800-171-3.1.7 | 5229 | ······-·NIST-800-171-3.1.7 |
| 5230 | ······-·NIST-800-53-AC-6(9) | 5230 | ······-·NIST-800-53-AC-6(9) |
| 5231 | ······-·NIST-800-53-AU-12(c) | 5231 | ······-·NIST-800-53-AU-12(c) |
| 5232 | ······-·NIST-800-53-AU-2(d) | 5232 | ······-·NIST-800-53-AU-2(d) |
| 5233 | ······-·NIST-800-53-CM-6(a) | 5233 | ······-·NIST-800-53-CM-6(a) |
| 5234 | ······-·audit_rules_privileged_commands_sudo | 5234 | ······-·audit_rules_privileged_commands_sudo |
| Offset 5321, 16 lines modified | Offset 5321, 16 lines modified | ||
| 5321 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5321 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5322 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5322 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5323 | ··········create:·true | 5323 | ··········create:·true |
| 5324 | ··········mode:·o-rwx | 5324 | ··········mode:·o-rwx |
| 5325 | ··········state:·present | 5325 | ··········state:·present |
| 5326 | ········when:·syscalls_found·|·length·==·0 | 5326 | ········when:·syscalls_found·|·length·==·0 |
| 5327 | ······when: | 5327 | ······when: |
| 5328 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5329 | ······-·'"audit"·in·ansible_facts.packages' | 5328 | ······-·'"audit"·in·ansible_facts.packages' |
| 5329 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5330 | ······tags: | 5330 | ······tags: |
| 5331 | ······-·NIST-800-171-3.1.7 | 5331 | ······-·NIST-800-171-3.1.7 |
| 5332 | ······-·NIST-800-53-AC-6(9) | 5332 | ······-·NIST-800-53-AC-6(9) |
| 5333 | ······-·NIST-800-53-AU-12(c) | 5333 | ······-·NIST-800-53-AU-12(c) |
| 5334 | ······-·NIST-800-53-AU-2(d) | 5334 | ······-·NIST-800-53-AU-2(d) |
| 5335 | ······-·NIST-800-53-CM-6(a) | 5335 | ······-·NIST-800-53-CM-6(a) |
| 5336 | ······-·audit_rules_privileged_commands_sudo | 5336 | ······-·audit_rules_privileged_commands_sudo |
| Offset 4953, 16 lines modified | Offset 4953, 16 lines modified | ||
| 4953 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 4953 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 4954 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 4954 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 4955 | ··········create:·true | 4955 | ··········create:·true |
| 4956 | ··········mode:·o-rwx | 4956 | ··········mode:·o-rwx |
| 4957 | ··········state:·present | 4957 | ··········state:·present |
| 4958 | ········when:·syscalls_found·|·length·==·0 | 4958 | ········when:·syscalls_found·|·length·==·0 |
| 4959 | ······when: | 4959 | ······when: |
| 4960 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4961 | ······-·'"audit"·in·ansible_facts.packages' | 4960 | ······-·'"audit"·in·ansible_facts.packages' |
| 4961 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4962 | ······tags: | 4962 | ······tags: |
| 4963 | ······-·NIST-800-171-3.1.7 | 4963 | ······-·NIST-800-171-3.1.7 |
| 4964 | ······-·NIST-800-53-AC-6(9) | 4964 | ······-·NIST-800-53-AC-6(9) |
| 4965 | ······-·NIST-800-53-AU-12(c) | 4965 | ······-·NIST-800-53-AU-12(c) |
| 4966 | ······-·NIST-800-53-AU-2(d) | 4966 | ······-·NIST-800-53-AU-2(d) |
| 4967 | ······-·NIST-800-53-CM-6(a) | 4967 | ······-·NIST-800-53-CM-6(a) |
| 4968 | ······-·audit_rules_privileged_commands_sudo | 4968 | ······-·audit_rules_privileged_commands_sudo |
| Offset 4361, 16 lines modified | Offset 4361, 16 lines modified | ||
| 4361 | ······lineinfile: | 4361 | ······lineinfile: |
| 4362 | ········dest:·/etc/audit/auditd.conf | 4362 | ········dest:·/etc/audit/auditd.conf |
| 4363 | ········regexp:·^\s*flush\s*=\s*.*$ | 4363 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 4364 | ········line:·flush·=·{{·var_auditd_flush·}} | 4364 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 4365 | ········state:·present | 4365 | ········state:·present |
| 4366 | ········create:·true | 4366 | ········create:·true |
| 4367 | ······when: | 4367 | ······when: |
| 4368 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4369 | ······-·'"audit"·in·ansible_facts.packages' | 4368 | ······-·'"audit"·in·ansible_facts.packages' |
| 4369 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4370 | ······tags: | 4370 | ······tags: |
| 4371 | ······-·NIST-800-171-3.3.1 | 4371 | ······-·NIST-800-171-3.3.1 |
| 4372 | ······-·NIST-800-53-AU-11 | 4372 | ······-·NIST-800-53-AU-11 |
| 4373 | ······-·NIST-800-53-CM-6(a) | 4373 | ······-·NIST-800-53-CM-6(a) |
| 4374 | ······-·auditd_data_retention_flush | 4374 | ······-·auditd_data_retention_flush |
| 4375 | ······-·low_complexity | 4375 | ······-·low_complexity |
| 4376 | ······-·low_disruption | 4376 | ······-·low_disruption |
| Offset 4416, 16 lines modified | Offset 4416, 16 lines modified | ||
| 4416 | ········lineinfile: | 4416 | ········lineinfile: |
| 4417 | ··········path:·/etc/audit/auditd.conf | 4417 | ··········path:·/etc/audit/auditd.conf |
| 4418 | ··········create:·true | 4418 | ··········create:·true |
| 4419 | ··········regexp:·(?i)^\s*freq\s*=\s* | 4419 | ··········regexp:·(?i)^\s*freq\s*=\s* |
| 4420 | ··········line:·freq·=·50 | 4420 | ··········line:·freq·=·50 |
| 4421 | ··········state:·present | 4421 | ··········state:·present |
| 4422 | ······when: | 4422 | ······when: |
| 4423 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4424 | ······-·'"audit"·in·ansible_facts.packages' | 4423 | ······-·'"audit"·in·ansible_facts.packages' |
| 4424 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4425 | ······tags: | 4425 | ······tags: |
| 4426 | ······-·NIST-800-53-CM-6 | 4426 | ······-·NIST-800-53-CM-6 |
| 4427 | ······-·auditd_freq | 4427 | ······-·auditd_freq |
| 4428 | ······-·low_complexity | 4428 | ······-·low_complexity |
| 4429 | ······-·low_disruption | 4429 | ······-·low_disruption |
| 4430 | ······-·medium_severity | 4430 | ······-·medium_severity |
| 4431 | ······-·no_reboot_needed | 4431 | ······-·no_reboot_needed |
| Offset 4470, 16 lines modified | Offset 4470, 16 lines modified | ||
| 4470 | ········lineinfile: | 4470 | ········lineinfile: |
| 4471 | ··········path:·/etc/audit/auditd.conf | 4471 | ··········path:·/etc/audit/auditd.conf |
| 4472 | ··········create:·true | 4472 | ··········create:·true |
| 4473 | ··········regexp:·(?i)^\s*log_format\s*=\s* | 4473 | ··········regexp:·(?i)^\s*log_format\s*=\s* |
| 4474 | ··········line:·log_format·=·ENRICHED | 4474 | ··········line:·log_format·=·ENRICHED |
| 4475 | ··········state:·present | 4475 | ··········state:·present |
| 4476 | ······when: | 4476 | ······when: |
| 4477 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4478 | ······-·'"audit"·in·ansible_facts.packages' | 4477 | ······-·'"audit"·in·ansible_facts.packages' |
| 4478 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4479 | ······tags: | 4479 | ······tags: |
| 4480 | ······-·NIST-800-53-AU-3 | 4480 | ······-·NIST-800-53-AU-3 |
| 4481 | ······-·NIST-800-53-CM-6 | 4481 | ······-·NIST-800-53-CM-6 |
| 4482 | ······-·auditd_log_format | 4482 | ······-·auditd_log_format |
| 4483 | ······-·low_complexity | 4483 | ······-·low_complexity |
| 4484 | ······-·low_disruption | 4484 | ······-·low_disruption |
| 4485 | ······-·low_severity | 4485 | ······-·low_severity |
| Offset 4525, 16 lines modified | Offset 4525, 16 lines modified | ||
| 4525 | ········lineinfile: | 4525 | ········lineinfile: |
| 4526 | ··········path:·/etc/audit/auditd.conf | 4526 | ··········path:·/etc/audit/auditd.conf |
| 4527 | ··········create:·true | 4527 | ··········create:·true |
| 4528 | ··········regexp:·(?i)^\s*name_format\s*=\s* | 4528 | ··········regexp:·(?i)^\s*name_format\s*=\s* |
| 4529 | ··········line:·name_format·=·hostname | 4529 | ··········line:·name_format·=·hostname |
| 4530 | ··········state:·present | 4530 | ··········state:·present |
| 4531 | ······when: | 4531 | ······when: |
| 4532 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4533 | ······-·'"audit"·in·ansible_facts.packages' | 4532 | ······-·'"audit"·in·ansible_facts.packages' |
| 4533 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4534 | ······tags: | 4534 | ······tags: |
| 4535 | ······-·NIST-800-53-AU-3 | 4535 | ······-·NIST-800-53-AU-3 |
| 4536 | ······-·NIST-800-53-CM-6 | 4536 | ······-·NIST-800-53-CM-6 |
| 4537 | ······-·auditd_name_format | 4537 | ······-·auditd_name_format |
| 4538 | ······-·low_complexity | 4538 | ······-·low_complexity |
| 4539 | ······-·low_disruption | 4539 | ······-·low_disruption |
| 4540 | ······-·medium_severity | 4540 | ······-·medium_severity |
| Offset 1008, 16 lines modified | Offset 1008, 16 lines modified | ||
| 1008 | ······-·no_reboot_needed | 1008 | ······-·no_reboot_needed |
| 1009 | ······-·restrict_strategy | 1009 | ······-·restrict_strategy |
| 1010 | ····-·name:·Set·architecture·for·audit·tasks | 1010 | ····-·name:·Set·architecture·for·audit·tasks |
| 1011 | ······set_fact: | 1011 | ······set_fact: |
| 1012 | ········audit_arch:·b64 | 1012 | ········audit_arch:·b64 |
| 1013 | ······when: | 1013 | ······when: |
| 1014 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1015 | ······-·'"audit"·in·ansible_facts.packages' | 1014 | ······-·'"audit"·in·ansible_facts.packages' |
| 1015 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1016 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 1016 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 1017 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 1017 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 1018 | ······tags: | 1018 | ······tags: |
| 1019 | ······-·CJIS-5.4.1.1 | 1019 | ······-·CJIS-5.4.1.1 |
| 1020 | ······-·NIST-800-171-3.1.7 | 1020 | ······-·NIST-800-171-3.1.7 |
| 1021 | ······-·NIST-800-53-AC-6(9) | 1021 | ······-·NIST-800-53-AC-6(9) |
| 1022 | ······-·NIST-800-53-AU-12(c) | 1022 | ······-·NIST-800-53-AU-12(c) |
| Offset 1150, 16 lines modified | Offset 1150, 16 lines modified | ||
| 1150 | ··········path:·'{{·audit_file·}}' | 1150 | ··········path:·'{{·audit_file·}}' |
| 1151 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1151 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1152 | ··········create:·true | 1152 | ··········create:·true |
| 1153 | ··········mode:·o-rwx | 1153 | ··········mode:·o-rwx |
| 1154 | ··········state:·present | 1154 | ··········state:·present |
| 1155 | ········when:·syscalls_found·|·length·==·0 | 1155 | ········when:·syscalls_found·|·length·==·0 |
| 1156 | ······when: | 1156 | ······when: |
| 1157 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1158 | ······-·'"audit"·in·ansible_facts.packages' | 1157 | ······-·'"audit"·in·ansible_facts.packages' |
| 1158 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1159 | ······tags: | 1159 | ······tags: |
| 1160 | ······-·CJIS-5.4.1.1 | 1160 | ······-·CJIS-5.4.1.1 |
| 1161 | ······-·NIST-800-171-3.1.7 | 1161 | ······-·NIST-800-171-3.1.7 |
| 1162 | ······-·NIST-800-53-AC-6(9) | 1162 | ······-·NIST-800-53-AC-6(9) |
| 1163 | ······-·NIST-800-53-AU-12(c) | 1163 | ······-·NIST-800-53-AU-12(c) |
| 1164 | ······-·NIST-800-53-AU-2(d) | 1164 | ······-·NIST-800-53-AU-2(d) |
| 1165 | ······-·NIST-800-53-CM-6(a) | 1165 | ······-·NIST-800-53-CM-6(a) |
| Offset 1290, 16 lines modified | Offset 1290, 16 lines modified | ||
| 1290 | ··········path:·'{{·audit_file·}}' | 1290 | ··········path:·'{{·audit_file·}}' |
| 1291 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1291 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1292 | ··········create:·true | 1292 | ··········create:·true |
| 1293 | ··········mode:·o-rwx | 1293 | ··········mode:·o-rwx |
| 1294 | ··········state:·present | 1294 | ··········state:·present |
| 1295 | ········when:·syscalls_found·|·length·==·0 | 1295 | ········when:·syscalls_found·|·length·==·0 |
| 1296 | ······when: | 1296 | ······when: |
| 1297 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1298 | ······-·'"audit"·in·ansible_facts.packages' | 1297 | ······-·'"audit"·in·ansible_facts.packages' |
| 1298 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1299 | ······-·audit_arch·==·"b64" | 1299 | ······-·audit_arch·==·"b64" |
| 1300 | ······tags: | 1300 | ······tags: |
| 1301 | ······-·CJIS-5.4.1.1 | 1301 | ······-·CJIS-5.4.1.1 |
| 1302 | ······-·NIST-800-171-3.1.7 | 1302 | ······-·NIST-800-171-3.1.7 |
| 1303 | ······-·NIST-800-53-AC-6(9) | 1303 | ······-·NIST-800-53-AC-6(9) |
| 1304 | ······-·NIST-800-53-AU-12(c) | 1304 | ······-·NIST-800-53-AU-12(c) |
| 1305 | ······-·NIST-800-53-AU-2(d) | 1305 | ······-·NIST-800-53-AU-2(d) |
| Offset 1315, 16 lines modified | Offset 1315, 16 lines modified | ||
| 1315 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ | 1315 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ |
| 1316 | ······find: | 1316 | ······find: |
| 1317 | ········paths:·/etc/audit/rules.d | 1317 | ········paths:·/etc/audit/rules.d |
| 1318 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ | 1318 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ |
| 1319 | ········patterns:·'*.rules' | 1319 | ········patterns:·'*.rules' |
| 1320 | ······register:·find_existing_watch_rules_d | 1320 | ······register:·find_existing_watch_rules_d |
| 1321 | ······when: | 1321 | ······when: |
| 1322 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1323 | ······-·'"audit"·in·ansible_facts.packages' | 1322 | ······-·'"audit"·in·ansible_facts.packages' |
| 1323 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1324 | ······tags: | 1324 | ······tags: |
| 1325 | ······-·CJIS-5.4.1.1 | 1325 | ······-·CJIS-5.4.1.1 |
| 1326 | ······-·NIST-800-171-3.1.7 | 1326 | ······-·NIST-800-171-3.1.7 |
| 1327 | ······-·NIST-800-53-AC-6(9) | 1327 | ······-·NIST-800-53-AC-6(9) |
| 1328 | ······-·NIST-800-53-AU-12(c) | 1328 | ······-·NIST-800-53-AU-12(c) |
| 1329 | ······-·NIST-800-53-AU-2(d) | 1329 | ······-·NIST-800-53-AU-2(d) |
| 1330 | ······-·NIST-800-53-CM-6(a) | 1330 | ······-·NIST-800-53-CM-6(a) |
| Offset 1339, 16 lines modified | Offset 1339, 16 lines modified | ||
| 1339 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification | 1339 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification |
| 1340 | ······find: | 1340 | ······find: |
| 1341 | ········paths:·/etc/audit/rules.d | 1341 | ········paths:·/etc/audit/rules.d |
| 1342 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ | 1342 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ |
| 1343 | ········patterns:·'*.rules' | 1343 | ········patterns:·'*.rules' |
| 1344 | ······register:·find_watch_key | 1344 | ······register:·find_watch_key |
| 1345 | ······when: | 1345 | ······when: |
| 1346 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1347 | ······-·'"audit"·in·ansible_facts.packages' | 1346 | ······-·'"audit"·in·ansible_facts.packages' |
| 1347 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1348 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1348 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1349 | ········==·0 | 1349 | ········==·0 |
| 1350 | ······tags: | 1350 | ······tags: |
| 1351 | ······-·CJIS-5.4.1.1 | 1351 | ······-·CJIS-5.4.1.1 |
| 1352 | ······-·NIST-800-171-3.1.7 | 1352 | ······-·NIST-800-171-3.1.7 |
| 1353 | ······-·NIST-800-53-AC-6(9) | 1353 | ······-·NIST-800-53-AC-6(9) |
| 1354 | ······-·NIST-800-53-AU-12(c) | 1354 | ······-·NIST-800-53-AU-12(c) |
| Offset 1364, 16 lines modified | Offset 1364, 16 lines modified | ||
| 1364 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the | 1364 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the |
| 1365 | ········recipient·for·the·rule | 1365 | ········recipient·for·the·rule |
| 1366 | ······set_fact: | 1366 | ······set_fact: |
| 1367 | ········all_files: | 1367 | ········all_files: |
| 1368 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules | 1368 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules |
| 1369 | ······when: | 1369 | ······when: |
| 1370 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1371 | ······-·'"audit"·in·ansible_facts.packages' | 1370 | ······-·'"audit"·in·ansible_facts.packages' |
| 1371 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1372 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1372 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1373 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1373 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1374 | ······tags: | 1374 | ······tags: |
| 1375 | ······-·CJIS-5.4.1.1 | 1375 | ······-·CJIS-5.4.1.1 |
| 1376 | ······-·NIST-800-171-3.1.7 | 1376 | ······-·NIST-800-171-3.1.7 |
| 1377 | ······-·NIST-800-53-AC-6(9) | 1377 | ······-·NIST-800-53-AC-6(9) |
| 1378 | ······-·NIST-800-53-AU-12(c) | 1378 | ······-·NIST-800-53-AU-12(c) |
| Offset 1388, 16 lines modified | Offset 1388, 16 lines modified | ||
| 1388 | ······-·restrict_strategy | 1388 | ······-·restrict_strategy |
| 1389 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1389 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1390 | ······set_fact: | 1390 | ······set_fact: |
| 1391 | ········all_files: | 1391 | ········all_files: |
| 1392 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1392 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1393 | ······when: | 1393 | ······when: |
| 1394 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1395 | ······-·'"audit"·in·ansible_facts.packages' | 1394 | ······-·'"audit"·in·ansible_facts.packages' |
| 1395 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1396 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1396 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1397 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1397 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1398 | ······tags: | 1398 | ······tags: |
| 1399 | ······-·CJIS-5.4.1.1 | 1399 | ······-·CJIS-5.4.1.1 |
| 1400 | ······-·NIST-800-171-3.1.7 | 1400 | ······-·NIST-800-171-3.1.7 |
| 1401 | ······-·NIST-800-53-AC-6(9) | 1401 | ······-·NIST-800-53-AC-6(9) |
| 1402 | ······-·NIST-800-53-AU-12(c) | 1402 | ······-·NIST-800-53-AU-12(c) |
| Offset 1414, 16 lines modified | Offset 1414, 16 lines modified | ||
| 1414 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ | 1414 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 70864/76264 bytes (92.92%) of diff not shown. | |||
| Offset 1170, 16 lines modified | Offset 1170, 16 lines modified | ||
| 1170 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 1170 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 1171 | ······find: | 1171 | ······find: |
| 1172 | ········paths:·/etc/audit/rules.d/ | 1172 | ········paths:·/etc/audit/rules.d/ |
| 1173 | ········patterns:·'*.rules' | 1173 | ········patterns:·'*.rules' |
| 1174 | ······register:·find_rules_d | 1174 | ······register:·find_rules_d |
| 1175 | ······when: | 1175 | ······when: |
| 1176 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1177 | ······-·'"audit"·in·ansible_facts.packages' | 1176 | ······-·'"audit"·in·ansible_facts.packages' |
| 1177 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1178 | ······tags: | 1178 | ······tags: |
| 1179 | ······-·CJIS-5.4.1.1 | 1179 | ······-·CJIS-5.4.1.1 |
| 1180 | ······-·NIST-800-171-3.3.1 | 1180 | ······-·NIST-800-171-3.3.1 |
| 1181 | ······-·NIST-800-171-3.4.3 | 1181 | ······-·NIST-800-171-3.4.3 |
| 1182 | ······-·NIST-800-53-AC-6(9) | 1182 | ······-·NIST-800-53-AC-6(9) |
| 1183 | ······-·NIST-800-53-CM-6(a) | 1183 | ······-·NIST-800-53-CM-6(a) |
| 1184 | ······-·PCI-DSS-Req-10.5.2 | 1184 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1194, 16 lines modified | Offset 1194, 16 lines modified | ||
| 1194 | ······lineinfile: | 1194 | ······lineinfile: |
| 1195 | ········path:·'{{·item·}}' | 1195 | ········path:·'{{·item·}}' |
| 1196 | ········regexp:·^\s*(?:-e)\s+.*$ | 1196 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 1197 | ········state:·absent | 1197 | ········state:·absent |
| 1198 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 1198 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 1199 | ········}}' | 1199 | ········}}' |
| 1200 | ······when: | 1200 | ······when: |
| 1201 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1202 | ······-·'"audit"·in·ansible_facts.packages' | 1201 | ······-·'"audit"·in·ansible_facts.packages' |
| 1202 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1203 | ······tags: | 1203 | ······tags: |
| 1204 | ······-·CJIS-5.4.1.1 | 1204 | ······-·CJIS-5.4.1.1 |
| 1205 | ······-·NIST-800-171-3.3.1 | 1205 | ······-·NIST-800-171-3.3.1 |
| 1206 | ······-·NIST-800-171-3.4.3 | 1206 | ······-·NIST-800-171-3.4.3 |
| 1207 | ······-·NIST-800-53-AC-6(9) | 1207 | ······-·NIST-800-53-AC-6(9) |
| 1208 | ······-·NIST-800-53-CM-6(a) | 1208 | ······-·NIST-800-53-CM-6(a) |
| 1209 | ······-·PCI-DSS-Req-10.5.2 | 1209 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1220, 16 lines modified | Offset 1220, 16 lines modified | ||
| 1220 | ········create:·true | 1220 | ········create:·true |
| 1221 | ········line:·-e·2 | 1221 | ········line:·-e·2 |
| 1222 | ········mode:·o-rwx | 1222 | ········mode:·o-rwx |
| 1223 | ······loop: | 1223 | ······loop: |
| 1224 | ······-·/etc/audit/audit.rules | 1224 | ······-·/etc/audit/audit.rules |
| 1225 | ······-·/etc/audit/rules.d/immutable.rules | 1225 | ······-·/etc/audit/rules.d/immutable.rules |
| 1226 | ······when: | 1226 | ······when: |
| 1227 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1228 | ······-·'"audit"·in·ansible_facts.packages' | 1227 | ······-·'"audit"·in·ansible_facts.packages' |
| 1228 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1229 | ······tags: | 1229 | ······tags: |
| 1230 | ······-·CJIS-5.4.1.1 | 1230 | ······-·CJIS-5.4.1.1 |
| 1231 | ······-·NIST-800-171-3.3.1 | 1231 | ······-·NIST-800-171-3.3.1 |
| 1232 | ······-·NIST-800-171-3.4.3 | 1232 | ······-·NIST-800-171-3.4.3 |
| 1233 | ······-·NIST-800-53-AC-6(9) | 1233 | ······-·NIST-800-53-AC-6(9) |
| 1234 | ······-·NIST-800-53-CM-6(a) | 1234 | ······-·NIST-800-53-CM-6(a) |
| 1235 | ······-·PCI-DSS-Req-10.5.2 | 1235 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 1261, 16 lines modified | Offset 1261, 16 lines modified | ||
| 1261 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 1261 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 1262 | ······find: | 1262 | ······find: |
| 1263 | ········paths:·/etc/audit/rules.d | 1263 | ········paths:·/etc/audit/rules.d |
| 1264 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 1264 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 1265 | ········patterns:·'*.rules' | 1265 | ········patterns:·'*.rules' |
| 1266 | ······register:·find_existing_watch_rules_d | 1266 | ······register:·find_existing_watch_rules_d |
| 1267 | ······when: | 1267 | ······when: |
| 1268 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1269 | ······-·'"audit"·in·ansible_facts.packages' | 1268 | ······-·'"audit"·in·ansible_facts.packages' |
| 1269 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1270 | ······tags: | 1270 | ······tags: |
| 1271 | ······-·CJIS-5.4.1.1 | 1271 | ······-·CJIS-5.4.1.1 |
| 1272 | ······-·NIST-800-171-3.1.8 | 1272 | ······-·NIST-800-171-3.1.8 |
| 1273 | ······-·NIST-800-53-AU-12(c) | 1273 | ······-·NIST-800-53-AU-12(c) |
| 1274 | ······-·NIST-800-53-AU-2(d) | 1274 | ······-·NIST-800-53-AU-2(d) |
| 1275 | ······-·NIST-800-53-CM-6(a) | 1275 | ······-·NIST-800-53-CM-6(a) |
| 1276 | ······-·PCI-DSS-Req-10.5.5 | 1276 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 1284, 16 lines modified | Offset 1284, 16 lines modified | ||
| 1284 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 1284 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 1285 | ······find: | 1285 | ······find: |
| 1286 | ········paths:·/etc/audit/rules.d | 1286 | ········paths:·/etc/audit/rules.d |
| 1287 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 1287 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 1288 | ········patterns:·'*.rules' | 1288 | ········patterns:·'*.rules' |
| 1289 | ······register:·find_watch_key | 1289 | ······register:·find_watch_key |
| 1290 | ······when: | 1290 | ······when: |
| 1291 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1292 | ······-·'"audit"·in·ansible_facts.packages' | 1291 | ······-·'"audit"·in·ansible_facts.packages' |
| 1292 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1293 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1293 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1294 | ········==·0 | 1294 | ········==·0 |
| 1295 | ······tags: | 1295 | ······tags: |
| 1296 | ······-·CJIS-5.4.1.1 | 1296 | ······-·CJIS-5.4.1.1 |
| 1297 | ······-·NIST-800-171-3.1.8 | 1297 | ······-·NIST-800-171-3.1.8 |
| 1298 | ······-·NIST-800-53-AU-12(c) | 1298 | ······-·NIST-800-53-AU-12(c) |
| 1299 | ······-·NIST-800-53-AU-2(d) | 1299 | ······-·NIST-800-53-AU-2(d) |
| Offset 1307, 16 lines modified | Offset 1307, 16 lines modified | ||
| 1307 | ······-·restrict_strategy | 1307 | ······-·restrict_strategy |
| 1308 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 1308 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 1309 | ······set_fact: | 1309 | ······set_fact: |
| 1310 | ········all_files: | 1310 | ········all_files: |
| 1311 | ········-·/etc/audit/rules.d/MAC-policy.rules | 1311 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 1312 | ······when: | 1312 | ······when: |
| 1313 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1314 | ······-·'"audit"·in·ansible_facts.packages' | 1313 | ······-·'"audit"·in·ansible_facts.packages' |
| 1314 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1315 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1315 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1316 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1316 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1317 | ······tags: | 1317 | ······tags: |
| 1318 | ······-·CJIS-5.4.1.1 | 1318 | ······-·CJIS-5.4.1.1 |
| 1319 | ······-·NIST-800-171-3.1.8 | 1319 | ······-·NIST-800-171-3.1.8 |
| 1320 | ······-·NIST-800-53-AU-12(c) | 1320 | ······-·NIST-800-53-AU-12(c) |
| 1321 | ······-·NIST-800-53-AU-2(d) | 1321 | ······-·NIST-800-53-AU-2(d) |
| Offset 1330, 16 lines modified | Offset 1330, 16 lines modified | ||
| 1330 | ······-·restrict_strategy | 1330 | ······-·restrict_strategy |
| 1331 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1331 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1332 | ······set_fact: | 1332 | ······set_fact: |
| 1333 | ········all_files: | 1333 | ········all_files: |
| 1334 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1334 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1335 | ······when: | 1335 | ······when: |
| 1336 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1337 | ······-·'"audit"·in·ansible_facts.packages' | 1336 | ······-·'"audit"·in·ansible_facts.packages' |
| 1337 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1338 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1338 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1339 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1339 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1340 | ······tags: | 1340 | ······tags: |
| 1341 | ······-·CJIS-5.4.1.1 | 1341 | ······-·CJIS-5.4.1.1 |
| 1342 | ······-·NIST-800-171-3.1.8 | 1342 | ······-·NIST-800-171-3.1.8 |
| 1343 | ······-·NIST-800-53-AU-12(c) | 1343 | ······-·NIST-800-53-AU-12(c) |
| 1344 | ······-·NIST-800-53-AU-2(d) | 1344 | ······-·NIST-800-53-AU-2(d) |
| Offset 1355, 16 lines modified | Offset 1355, 16 lines modified | ||
| 1355 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 1355 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 190753/195788 bytes (97.43%) of diff not shown. | |||
| Offset 4353, 16 lines modified | Offset 4353, 16 lines modified | ||
| 4353 | ······lineinfile: | 4353 | ······lineinfile: |
| 4354 | ········dest:·/etc/audit/auditd.conf | 4354 | ········dest:·/etc/audit/auditd.conf |
| 4355 | ········regexp:·^\s*flush\s*=\s*.*$ | 4355 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 4356 | ········line:·flush·=·{{·var_auditd_flush·}} | 4356 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 4357 | ········state:·present | 4357 | ········state:·present |
| 4358 | ········create:·true | 4358 | ········create:·true |
| 4359 | ······when: | 4359 | ······when: |
| 4360 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4361 | ······-·'"audit"·in·ansible_facts.packages' | 4360 | ······-·'"audit"·in·ansible_facts.packages' |
| 4361 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4362 | ······tags: | 4362 | ······tags: |
| 4363 | ······-·NIST-800-171-3.3.1 | 4363 | ······-·NIST-800-171-3.3.1 |
| 4364 | ······-·NIST-800-53-AU-11 | 4364 | ······-·NIST-800-53-AU-11 |
| 4365 | ······-·NIST-800-53-CM-6(a) | 4365 | ······-·NIST-800-53-CM-6(a) |
| 4366 | ······-·auditd_data_retention_flush | 4366 | ······-·auditd_data_retention_flush |
| 4367 | ······-·low_complexity | 4367 | ······-·low_complexity |
| 4368 | ······-·low_disruption | 4368 | ······-·low_disruption |
| Offset 4408, 16 lines modified | Offset 4408, 16 lines modified | ||
| 4408 | ········lineinfile: | 4408 | ········lineinfile: |
| 4409 | ··········path:·/etc/audit/auditd.conf | 4409 | ··········path:·/etc/audit/auditd.conf |
| 4410 | ··········create:·true | 4410 | ··········create:·true |
| 4411 | ··········regexp:·(?i)^\s*freq\s*=\s* | 4411 | ··········regexp:·(?i)^\s*freq\s*=\s* |
| 4412 | ··········line:·freq·=·50 | 4412 | ··········line:·freq·=·50 |
| 4413 | ··········state:·present | 4413 | ··········state:·present |
| 4414 | ······when: | 4414 | ······when: |
| 4415 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4416 | ······-·'"audit"·in·ansible_facts.packages' | 4415 | ······-·'"audit"·in·ansible_facts.packages' |
| 4416 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4417 | ······tags: | 4417 | ······tags: |
| 4418 | ······-·NIST-800-53-CM-6 | 4418 | ······-·NIST-800-53-CM-6 |
| 4419 | ······-·auditd_freq | 4419 | ······-·auditd_freq |
| 4420 | ······-·low_complexity | 4420 | ······-·low_complexity |
| 4421 | ······-·low_disruption | 4421 | ······-·low_disruption |
| 4422 | ······-·medium_severity | 4422 | ······-·medium_severity |
| 4423 | ······-·no_reboot_needed | 4423 | ······-·no_reboot_needed |
| Offset 4462, 16 lines modified | Offset 4462, 16 lines modified | ||
| 4462 | ········lineinfile: | 4462 | ········lineinfile: |
| 4463 | ··········path:·/etc/audit/auditd.conf | 4463 | ··········path:·/etc/audit/auditd.conf |
| 4464 | ··········create:·true | 4464 | ··········create:·true |
| 4465 | ··········regexp:·(?i)^\s*log_format\s*=\s* | 4465 | ··········regexp:·(?i)^\s*log_format\s*=\s* |
| 4466 | ··········line:·log_format·=·ENRICHED | 4466 | ··········line:·log_format·=·ENRICHED |
| 4467 | ··········state:·present | 4467 | ··········state:·present |
| 4468 | ······when: | 4468 | ······when: |
| 4469 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4470 | ······-·'"audit"·in·ansible_facts.packages' | 4469 | ······-·'"audit"·in·ansible_facts.packages' |
| 4470 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4471 | ······tags: | 4471 | ······tags: |
| 4472 | ······-·NIST-800-53-AU-3 | 4472 | ······-·NIST-800-53-AU-3 |
| 4473 | ······-·NIST-800-53-CM-6 | 4473 | ······-·NIST-800-53-CM-6 |
| 4474 | ······-·auditd_log_format | 4474 | ······-·auditd_log_format |
| 4475 | ······-·low_complexity | 4475 | ······-·low_complexity |
| 4476 | ······-·low_disruption | 4476 | ······-·low_disruption |
| 4477 | ······-·low_severity | 4477 | ······-·low_severity |
| Offset 4517, 16 lines modified | Offset 4517, 16 lines modified | ||
| 4517 | ········lineinfile: | 4517 | ········lineinfile: |
| 4518 | ··········path:·/etc/audit/auditd.conf | 4518 | ··········path:·/etc/audit/auditd.conf |
| 4519 | ··········create:·true | 4519 | ··········create:·true |
| 4520 | ··········regexp:·(?i)^\s*name_format\s*=\s* | 4520 | ··········regexp:·(?i)^\s*name_format\s*=\s* |
| 4521 | ··········line:·name_format·=·hostname | 4521 | ··········line:·name_format·=·hostname |
| 4522 | ··········state:·present | 4522 | ··········state:·present |
| 4523 | ······when: | 4523 | ······when: |
| 4524 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4525 | ······-·'"audit"·in·ansible_facts.packages' | 4524 | ······-·'"audit"·in·ansible_facts.packages' |
| 4525 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4526 | ······tags: | 4526 | ······tags: |
| 4527 | ······-·NIST-800-53-AU-3 | 4527 | ······-·NIST-800-53-AU-3 |
| 4528 | ······-·NIST-800-53-CM-6 | 4528 | ······-·NIST-800-53-CM-6 |
| 4529 | ······-·auditd_name_format | 4529 | ······-·auditd_name_format |
| 4530 | ······-·low_complexity | 4530 | ······-·low_complexity |
| 4531 | ······-·low_disruption | 4531 | ······-·low_disruption |
| 4532 | ······-·medium_severity | 4532 | ······-·medium_severity |
| Offset 4973, 16 lines modified | Offset 4973, 16 lines modified | ||
| 4973 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 4973 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 4974 | ······find: | 4974 | ······find: |
| 4975 | ········paths:·/etc/audit/rules.d/ | 4975 | ········paths:·/etc/audit/rules.d/ |
| 4976 | ········patterns:·'*.rules' | 4976 | ········patterns:·'*.rules' |
| 4977 | ······register:·find_rules_d | 4977 | ······register:·find_rules_d |
| 4978 | ······when: | 4978 | ······when: |
| 4979 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4980 | ······-·'"audit"·in·ansible_facts.packages' | 4979 | ······-·'"audit"·in·ansible_facts.packages' |
| 4980 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4981 | ······tags: | 4981 | ······tags: |
| 4982 | ······-·CJIS-5.4.1.1 | 4982 | ······-·CJIS-5.4.1.1 |
| 4983 | ······-·NIST-800-171-3.3.1 | 4983 | ······-·NIST-800-171-3.3.1 |
| 4984 | ······-·NIST-800-171-3.4.3 | 4984 | ······-·NIST-800-171-3.4.3 |
| 4985 | ······-·NIST-800-53-AC-6(9) | 4985 | ······-·NIST-800-53-AC-6(9) |
| 4986 | ······-·NIST-800-53-CM-6(a) | 4986 | ······-·NIST-800-53-CM-6(a) |
| 4987 | ······-·PCI-DSS-Req-10.5.2 | 4987 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4997, 16 lines modified | Offset 4997, 16 lines modified | ||
| 4997 | ······lineinfile: | 4997 | ······lineinfile: |
| 4998 | ········path:·'{{·item·}}' | 4998 | ········path:·'{{·item·}}' |
| 4999 | ········regexp:·^\s*(?:-e)\s+.*$ | 4999 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 5000 | ········state:·absent | 5000 | ········state:·absent |
| 5001 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 5001 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 5002 | ········}}' | 5002 | ········}}' |
| 5003 | ······when: | 5003 | ······when: |
| 5004 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5005 | ······-·'"audit"·in·ansible_facts.packages' | 5004 | ······-·'"audit"·in·ansible_facts.packages' |
| 5005 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5006 | ······tags: | 5006 | ······tags: |
| 5007 | ······-·CJIS-5.4.1.1 | 5007 | ······-·CJIS-5.4.1.1 |
| 5008 | ······-·NIST-800-171-3.3.1 | 5008 | ······-·NIST-800-171-3.3.1 |
| 5009 | ······-·NIST-800-171-3.4.3 | 5009 | ······-·NIST-800-171-3.4.3 |
| 5010 | ······-·NIST-800-53-AC-6(9) | 5010 | ······-·NIST-800-53-AC-6(9) |
| 5011 | ······-·NIST-800-53-CM-6(a) | 5011 | ······-·NIST-800-53-CM-6(a) |
| 5012 | ······-·PCI-DSS-Req-10.5.2 | 5012 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5023, 16 lines modified | Offset 5023, 16 lines modified | ||
| 5023 | ········create:·true | 5023 | ········create:·true |
| 5024 | ········line:·-e·2 | 5024 | ········line:·-e·2 |
| 5025 | ········mode:·o-rwx | 5025 | ········mode:·o-rwx |
| 5026 | ······loop: | 5026 | ······loop: |
| 5027 | ······-·/etc/audit/audit.rules | 5027 | ······-·/etc/audit/audit.rules |
| 5028 | ······-·/etc/audit/rules.d/immutable.rules | 5028 | ······-·/etc/audit/rules.d/immutable.rules |
| 5029 | ······when: | 5029 | ······when: |
| 5030 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5031 | ······-·'"audit"·in·ansible_facts.packages' | 5030 | ······-·'"audit"·in·ansible_facts.packages' |
| 5031 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5032 | ······tags: | 5032 | ······tags: |
| 5033 | ······-·CJIS-5.4.1.1 | 5033 | ······-·CJIS-5.4.1.1 |
| 5034 | ······-·NIST-800-171-3.3.1 | 5034 | ······-·NIST-800-171-3.3.1 |
| 5035 | ······-·NIST-800-171-3.4.3 | 5035 | ······-·NIST-800-171-3.4.3 |
| 5036 | ······-·NIST-800-53-AC-6(9) | 5036 | ······-·NIST-800-53-AC-6(9) |
| 5037 | ······-·NIST-800-53-CM-6(a) | 5037 | ······-·NIST-800-53-CM-6(a) |
| 5038 | ······-·PCI-DSS-Req-10.5.2 | 5038 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 5064, 16 lines modified | Offset 5064, 16 lines modified | ||
| 5064 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5064 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5065 | ······find: | 5065 | ······find: |
| 5066 | ········paths:·/etc/audit/rules.d | 5066 | ········paths:·/etc/audit/rules.d |
| 5067 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5067 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5068 | ········patterns:·'*.rules' | 5068 | ········patterns:·'*.rules' |
| 5069 | ······register:·find_existing_watch_rules_d | 5069 | ······register:·find_existing_watch_rules_d |
| 5070 | ······when: | 5070 | ······when: |
| 5071 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5072 | ······-·'"audit"·in·ansible_facts.packages' | 5071 | ······-·'"audit"·in·ansible_facts.packages' |
| 5072 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5073 | ······tags: | 5073 | ······tags: |
| 5074 | ······-·CJIS-5.4.1.1 | 5074 | ······-·CJIS-5.4.1.1 |
| 5075 | ······-·NIST-800-171-3.1.8 | 5075 | ······-·NIST-800-171-3.1.8 |
| 5076 | ······-·NIST-800-53-AU-12(c) | 5076 | ······-·NIST-800-53-AU-12(c) |
| 5077 | ······-·NIST-800-53-AU-2(d) | 5077 | ······-·NIST-800-53-AU-2(d) |
| 5078 | ······-·NIST-800-53-CM-6(a) | 5078 | ······-·NIST-800-53-CM-6(a) |
| 5079 | ······-·PCI-DSS-Req-10.5.5 | 5079 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 5087, 16 lines modified | Offset 5087, 16 lines modified | ||
| 5087 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5087 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5088 | ······find: | 5088 | ······find: |
| 5089 | ········paths:·/etc/audit/rules.d | 5089 | ········paths:·/etc/audit/rules.d |
| 5090 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5090 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5091 | ········patterns:·'*.rules' | 5091 | ········patterns:·'*.rules' |
| 5092 | ······register:·find_watch_key | 5092 | ······register:·find_watch_key |
| 5093 | ······when: | 5093 | ······when: |
| 5094 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5095 | ······-·'"audit"·in·ansible_facts.packages' | 5094 | ······-·'"audit"·in·ansible_facts.packages' |
| 5095 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5096 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5096 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5097 | ········==·0 | 5097 | ········==·0 |
| 5098 | ······tags: | 5098 | ······tags: |
| 5099 | ······-·CJIS-5.4.1.1 | 5099 | ······-·CJIS-5.4.1.1 |
| 5100 | ······-·NIST-800-171-3.1.8 | 5100 | ······-·NIST-800-171-3.1.8 |
| 5101 | ······-·NIST-800-53-AU-12(c) | 5101 | ······-·NIST-800-53-AU-12(c) |
| 5102 | ······-·NIST-800-53-AU-2(d) | 5102 | ······-·NIST-800-53-AU-2(d) |
| Offset 5110, 16 lines modified | Offset 5110, 16 lines modified | ||
| 5110 | ······-·restrict_strategy | 5110 | ······-·restrict_strategy |
| 5111 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5111 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5112 | ······set_fact: | 5112 | ······set_fact: |
| 5113 | ········all_files: | 5113 | ········all_files: |
| 5114 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5114 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5115 | ······when: | 5115 | ······when: |
| 5116 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5117 | ······-·'"audit"·in·ansible_facts.packages' | 5116 | ······-·'"audit"·in·ansible_facts.packages' |
| 5117 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5118 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5118 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5119 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5119 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5120 | ······tags: | 5120 | ······tags: |
| 5121 | ······-·CJIS-5.4.1.1 | 5121 | ······-·CJIS-5.4.1.1 |
| 5122 | ······-·NIST-800-171-3.1.8 | 5122 | ······-·NIST-800-171-3.1.8 |
| 5123 | ······-·NIST-800-53-AU-12(c) | 5123 | ······-·NIST-800-53-AU-12(c) |
| 5124 | ······-·NIST-800-53-AU-2(d) | 5124 | ······-·NIST-800-53-AU-2(d) |
| Offset 5133, 16 lines modified | Offset 5133, 16 lines modified | ||
| 5133 | ······-·restrict_strategy | 5133 | ······-·restrict_strategy |
| 5134 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5134 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5135 | ······set_fact: | 5135 | ······set_fact: |
| 5136 | ········all_files: | 5136 | ········all_files: |
| 5137 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5137 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5138 | ······when: | 5138 | ······when: |
| 5139 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5140 | ······-·'"audit"·in·ansible_facts.packages' | 5139 | ······-·'"audit"·in·ansible_facts.packages' |
| 5140 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5141 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5141 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5142 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5142 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5143 | ······tags: | 5143 | ······tags: |
| 5144 | ······-·CJIS-5.4.1.1 | 5144 | ······-·CJIS-5.4.1.1 |
| 5145 | ······-·NIST-800-171-3.1.8 | 5145 | ······-·NIST-800-171-3.1.8 |
| 5146 | ······-·NIST-800-53-AU-12(c) | 5146 | ······-·NIST-800-53-AU-12(c) |
| 5147 | ······-·NIST-800-53-AU-2(d) | 5147 | ······-·NIST-800-53-AU-2(d) |
| Offset 5158, 16 lines modified | Offset 5158, 16 lines modified | ||
| 5158 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5158 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 167208/172243 bytes (97.08%) of diff not shown. | |||
| Offset 694, 16 lines modified | Offset 694, 16 lines modified | ||
| 694 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 694 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 695 | ······find: | 695 | ······find: |
| 696 | ········paths:·/etc/audit/rules.d | 696 | ········paths:·/etc/audit/rules.d |
| 697 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 697 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 698 | ········patterns:·'*.rules' | 698 | ········patterns:·'*.rules' |
| 699 | ······register:·find_existing_watch_rules_d | 699 | ······register:·find_existing_watch_rules_d |
| 700 | ······when: | 700 | ······when: |
| 701 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 702 | ······-·'"audit"·in·ansible_facts.packages' | 701 | ······-·'"audit"·in·ansible_facts.packages' |
| 702 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 703 | ······tags: | 703 | ······tags: |
| 704 | ······-·CJIS-5.4.1.1 | 704 | ······-·CJIS-5.4.1.1 |
| 705 | ······-·NIST-800-171-3.1.8 | 705 | ······-·NIST-800-171-3.1.8 |
| 706 | ······-·NIST-800-53-AU-12(c) | 706 | ······-·NIST-800-53-AU-12(c) |
| 707 | ······-·NIST-800-53-AU-2(d) | 707 | ······-·NIST-800-53-AU-2(d) |
| 708 | ······-·NIST-800-53-CM-6(a) | 708 | ······-·NIST-800-53-CM-6(a) |
| 709 | ······-·PCI-DSS-Req-10.5.5 | 709 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 717, 16 lines modified | Offset 717, 16 lines modified | ||
| 717 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 717 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 718 | ······find: | 718 | ······find: |
| 719 | ········paths:·/etc/audit/rules.d | 719 | ········paths:·/etc/audit/rules.d |
| 720 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 720 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 721 | ········patterns:·'*.rules' | 721 | ········patterns:·'*.rules' |
| 722 | ······register:·find_watch_key | 722 | ······register:·find_watch_key |
| 723 | ······when: | 723 | ······when: |
| 724 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 725 | ······-·'"audit"·in·ansible_facts.packages' | 724 | ······-·'"audit"·in·ansible_facts.packages' |
| 725 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 726 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 726 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 727 | ········==·0 | 727 | ········==·0 |
| 728 | ······tags: | 728 | ······tags: |
| 729 | ······-·CJIS-5.4.1.1 | 729 | ······-·CJIS-5.4.1.1 |
| 730 | ······-·NIST-800-171-3.1.8 | 730 | ······-·NIST-800-171-3.1.8 |
| 731 | ······-·NIST-800-53-AU-12(c) | 731 | ······-·NIST-800-53-AU-12(c) |
| 732 | ······-·NIST-800-53-AU-2(d) | 732 | ······-·NIST-800-53-AU-2(d) |
| Offset 740, 16 lines modified | Offset 740, 16 lines modified | ||
| 740 | ······-·restrict_strategy | 740 | ······-·restrict_strategy |
| 741 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 741 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 742 | ······set_fact: | 742 | ······set_fact: |
| 743 | ········all_files: | 743 | ········all_files: |
| 744 | ········-·/etc/audit/rules.d/MAC-policy.rules | 744 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 745 | ······when: | 745 | ······when: |
| 746 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 747 | ······-·'"audit"·in·ansible_facts.packages' | 746 | ······-·'"audit"·in·ansible_facts.packages' |
| 747 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 748 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 748 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 749 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 749 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 750 | ······tags: | 750 | ······tags: |
| 751 | ······-·CJIS-5.4.1.1 | 751 | ······-·CJIS-5.4.1.1 |
| 752 | ······-·NIST-800-171-3.1.8 | 752 | ······-·NIST-800-171-3.1.8 |
| 753 | ······-·NIST-800-53-AU-12(c) | 753 | ······-·NIST-800-53-AU-12(c) |
| 754 | ······-·NIST-800-53-AU-2(d) | 754 | ······-·NIST-800-53-AU-2(d) |
| Offset 763, 16 lines modified | Offset 763, 16 lines modified | ||
| 763 | ······-·restrict_strategy | 763 | ······-·restrict_strategy |
| 764 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 764 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 765 | ······set_fact: | 765 | ······set_fact: |
| 766 | ········all_files: | 766 | ········all_files: |
| 767 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 767 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 768 | ······when: | 768 | ······when: |
| 769 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 770 | ······-·'"audit"·in·ansible_facts.packages' | 769 | ······-·'"audit"·in·ansible_facts.packages' |
| 770 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 771 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 771 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 772 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 772 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 773 | ······tags: | 773 | ······tags: |
| 774 | ······-·CJIS-5.4.1.1 | 774 | ······-·CJIS-5.4.1.1 |
| 775 | ······-·NIST-800-171-3.1.8 | 775 | ······-·NIST-800-171-3.1.8 |
| 776 | ······-·NIST-800-53-AU-12(c) | 776 | ······-·NIST-800-53-AU-12(c) |
| 777 | ······-·NIST-800-53-AU-2(d) | 777 | ······-·NIST-800-53-AU-2(d) |
| Offset 788, 16 lines modified | Offset 788, 16 lines modified | ||
| 788 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 788 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| 789 | ······lineinfile: | 789 | ······lineinfile: |
| 790 | ········path:·'{{·all_files[0]·}}' | 790 | ········path:·'{{·all_files[0]·}}' |
| 791 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 791 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 792 | ········create:·true | 792 | ········create:·true |
| 793 | ········mode:·'0640' | 793 | ········mode:·'0640' |
| 794 | ······when: | 794 | ······when: |
| 795 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 796 | ······-·'"audit"·in·ansible_facts.packages' | 795 | ······-·'"audit"·in·ansible_facts.packages' |
| 796 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 797 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 797 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 798 | ········==·0 | 798 | ········==·0 |
| 799 | ······tags: | 799 | ······tags: |
| 800 | ······-·CJIS-5.4.1.1 | 800 | ······-·CJIS-5.4.1.1 |
| 801 | ······-·NIST-800-171-3.1.8 | 801 | ······-·NIST-800-171-3.1.8 |
| 802 | ······-·NIST-800-53-AU-12(c) | 802 | ······-·NIST-800-53-AU-12(c) |
| 803 | ······-·NIST-800-53-AU-2(d) | 803 | ······-·NIST-800-53-AU-2(d) |
| Offset 813, 16 lines modified | Offset 813, 16 lines modified | ||
| 813 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules | 813 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules |
| 814 | ······find: | 814 | ······find: |
| 815 | ········paths:·/etc/audit/ | 815 | ········paths:·/etc/audit/ |
| 816 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 816 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 817 | ········patterns:·audit.rules | 817 | ········patterns:·audit.rules |
| 818 | ······register:·find_existing_watch_audit_rules | 818 | ······register:·find_existing_watch_audit_rules |
| 819 | ······when: | 819 | ······when: |
| 820 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 821 | ······-·'"audit"·in·ansible_facts.packages' | 820 | ······-·'"audit"·in·ansible_facts.packages' |
| 821 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 822 | ······tags: | 822 | ······tags: |
| 823 | ······-·CJIS-5.4.1.1 | 823 | ······-·CJIS-5.4.1.1 |
| 824 | ······-·NIST-800-171-3.1.8 | 824 | ······-·NIST-800-171-3.1.8 |
| 825 | ······-·NIST-800-53-AU-12(c) | 825 | ······-·NIST-800-53-AU-12(c) |
| 826 | ······-·NIST-800-53-AU-2(d) | 826 | ······-·NIST-800-53-AU-2(d) |
| 827 | ······-·NIST-800-53-CM-6(a) | 827 | ······-·NIST-800-53-CM-6(a) |
| 828 | ······-·PCI-DSS-Req-10.5.5 | 828 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 837, 16 lines modified | Offset 837, 16 lines modified | ||
| 837 | ······lineinfile: | 837 | ······lineinfile: |
| 838 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 838 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 839 | ········state:·present | 839 | ········state:·present |
| 840 | ········dest:·/etc/audit/audit.rules | 840 | ········dest:·/etc/audit/audit.rules |
| 841 | ········create:·true | 841 | ········create:·true |
| 842 | ········mode:·'0640' | 842 | ········mode:·'0640' |
| 843 | ······when: | 843 | ······when: |
| 844 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 845 | ······-·'"audit"·in·ansible_facts.packages' | 844 | ······-·'"audit"·in·ansible_facts.packages' |
| 845 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 846 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched | 846 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched |
| 847 | ········==·0 | 847 | ········==·0 |
| 848 | ······tags: | 848 | ······tags: |
| 849 | ······-·CJIS-5.4.1.1 | 849 | ······-·CJIS-5.4.1.1 |
| 850 | ······-·NIST-800-171-3.1.8 | 850 | ······-·NIST-800-171-3.1.8 |
| 851 | ······-·NIST-800-53-AU-12(c) | 851 | ······-·NIST-800-53-AU-12(c) |
| 852 | ······-·NIST-800-53-AU-2(d) | 852 | ······-·NIST-800-53-AU-2(d) |
| Offset 878, 16 lines modified | Offset 878, 16 lines modified | ||
| 878 | ······-·reboot_required | 878 | ······-·reboot_required |
| Max diff block lines reached; 95559/100775 bytes (94.82%) of diff not shown. | |||
| Offset 9328, 16 lines modified | Offset 9328, 16 lines modified | ||
| 9328 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 9328 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 9329 | ······find: | 9329 | ······find: |
| 9330 | ········paths:·/etc/audit/rules.d/ | 9330 | ········paths:·/etc/audit/rules.d/ |
| 9331 | ········patterns:·'*.rules' | 9331 | ········patterns:·'*.rules' |
| 9332 | ······register:·find_rules_d | 9332 | ······register:·find_rules_d |
| 9333 | ······when: | 9333 | ······when: |
| 9334 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9335 | ······-·'"audit"·in·ansible_facts.packages' | 9334 | ······-·'"audit"·in·ansible_facts.packages' |
| 9335 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9336 | ······tags: | 9336 | ······tags: |
| 9337 | ······-·CJIS-5.4.1.1 | 9337 | ······-·CJIS-5.4.1.1 |
| 9338 | ······-·NIST-800-171-3.3.1 | 9338 | ······-·NIST-800-171-3.3.1 |
| 9339 | ······-·NIST-800-171-3.4.3 | 9339 | ······-·NIST-800-171-3.4.3 |
| 9340 | ······-·NIST-800-53-AC-6(9) | 9340 | ······-·NIST-800-53-AC-6(9) |
| 9341 | ······-·NIST-800-53-CM-6(a) | 9341 | ······-·NIST-800-53-CM-6(a) |
| 9342 | ······-·PCI-DSS-Req-10.5.2 | 9342 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 9352, 16 lines modified | Offset 9352, 16 lines modified | ||
| 9352 | ······lineinfile: | 9352 | ······lineinfile: |
| 9353 | ········path:·'{{·item·}}' | 9353 | ········path:·'{{·item·}}' |
| 9354 | ········regexp:·^\s*(?:-e)\s+.*$ | 9354 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 9355 | ········state:·absent | 9355 | ········state:·absent |
| 9356 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 9356 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 9357 | ········}}' | 9357 | ········}}' |
| 9358 | ······when: | 9358 | ······when: |
| 9359 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9360 | ······-·'"audit"·in·ansible_facts.packages' | 9359 | ······-·'"audit"·in·ansible_facts.packages' |
| 9360 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9361 | ······tags: | 9361 | ······tags: |
| 9362 | ······-·CJIS-5.4.1.1 | 9362 | ······-·CJIS-5.4.1.1 |
| 9363 | ······-·NIST-800-171-3.3.1 | 9363 | ······-·NIST-800-171-3.3.1 |
| 9364 | ······-·NIST-800-171-3.4.3 | 9364 | ······-·NIST-800-171-3.4.3 |
| 9365 | ······-·NIST-800-53-AC-6(9) | 9365 | ······-·NIST-800-53-AC-6(9) |
| 9366 | ······-·NIST-800-53-CM-6(a) | 9366 | ······-·NIST-800-53-CM-6(a) |
| 9367 | ······-·PCI-DSS-Req-10.5.2 | 9367 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 9378, 16 lines modified | Offset 9378, 16 lines modified | ||
| 9378 | ········create:·true | 9378 | ········create:·true |
| 9379 | ········line:·-e·2 | 9379 | ········line:·-e·2 |
| 9380 | ········mode:·o-rwx | 9380 | ········mode:·o-rwx |
| 9381 | ······loop: | 9381 | ······loop: |
| 9382 | ······-·/etc/audit/audit.rules | 9382 | ······-·/etc/audit/audit.rules |
| 9383 | ······-·/etc/audit/rules.d/immutable.rules | 9383 | ······-·/etc/audit/rules.d/immutable.rules |
| 9384 | ······when: | 9384 | ······when: |
| 9385 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9386 | ······-·'"audit"·in·ansible_facts.packages' | 9385 | ······-·'"audit"·in·ansible_facts.packages' |
| 9386 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9387 | ······tags: | 9387 | ······tags: |
| 9388 | ······-·CJIS-5.4.1.1 | 9388 | ······-·CJIS-5.4.1.1 |
| 9389 | ······-·NIST-800-171-3.3.1 | 9389 | ······-·NIST-800-171-3.3.1 |
| 9390 | ······-·NIST-800-171-3.4.3 | 9390 | ······-·NIST-800-171-3.4.3 |
| 9391 | ······-·NIST-800-53-AC-6(9) | 9391 | ······-·NIST-800-53-AC-6(9) |
| 9392 | ······-·NIST-800-53-CM-6(a) | 9392 | ······-·NIST-800-53-CM-6(a) |
| 9393 | ······-·PCI-DSS-Req-10.5.2 | 9393 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 9417, 16 lines modified | Offset 9417, 16 lines modified | ||
| 9417 | ······-·reboot_required | 9417 | ······-·reboot_required |
| 9418 | ······-·restrict_strategy | 9418 | ······-·restrict_strategy |
| 9419 | ····-·name:·Set·architecture·for·audit·mount·tasks | 9419 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 9420 | ······set_fact: | 9420 | ······set_fact: |
| 9421 | ········audit_arch:·b64 | 9421 | ········audit_arch:·b64 |
| 9422 | ······when: | 9422 | ······when: |
| 9423 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9424 | ······-·'"audit"·in·ansible_facts.packages' | 9423 | ······-·'"audit"·in·ansible_facts.packages' |
| 9424 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9425 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 9425 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 9426 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 9426 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 9427 | ······tags: | 9427 | ······tags: |
| 9428 | ······-·CJIS-5.4.1.1 | 9428 | ······-·CJIS-5.4.1.1 |
| 9429 | ······-·NIST-800-171-3.1.7 | 9429 | ······-·NIST-800-171-3.1.7 |
| 9430 | ······-·NIST-800-53-AC-6(9) | 9430 | ······-·NIST-800-53-AC-6(9) |
| 9431 | ······-·NIST-800-53-AU-12(c) | 9431 | ······-·NIST-800-53-AU-12(c) |
| Offset 9557, 16 lines modified | Offset 9557, 16 lines modified | ||
| 9557 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9557 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9558 | ············-F·auid!=unset·-F·key=perm_mod | 9558 | ············-F·auid!=unset·-F·key=perm_mod |
| 9559 | ··········create:·true | 9559 | ··········create:·true |
| 9560 | ··········mode:·o-rwx | 9560 | ··········mode:·o-rwx |
| 9561 | ··········state:·present | 9561 | ··········state:·present |
| 9562 | ········when:·syscalls_found·|·length·==·0 | 9562 | ········when:·syscalls_found·|·length·==·0 |
| 9563 | ······when: | 9563 | ······when: |
| 9564 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9565 | ······-·'"audit"·in·ansible_facts.packages' | 9564 | ······-·'"audit"·in·ansible_facts.packages' |
| 9565 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9566 | ······tags: | 9566 | ······tags: |
| 9567 | ······-·CJIS-5.4.1.1 | 9567 | ······-·CJIS-5.4.1.1 |
| 9568 | ······-·NIST-800-171-3.1.7 | 9568 | ······-·NIST-800-171-3.1.7 |
| 9569 | ······-·NIST-800-53-AC-6(9) | 9569 | ······-·NIST-800-53-AC-6(9) |
| 9570 | ······-·NIST-800-53-AU-12(c) | 9570 | ······-·NIST-800-53-AU-12(c) |
| 9571 | ······-·NIST-800-53-AU-2(d) | 9571 | ······-·NIST-800-53-AU-2(d) |
| 9572 | ······-·NIST-800-53-CM-6(a) | 9572 | ······-·NIST-800-53-CM-6(a) |
| Offset 9695, 16 lines modified | Offset 9695, 16 lines modified | ||
| 9695 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9695 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9696 | ············-F·auid!=unset·-F·key=perm_mod | 9696 | ············-F·auid!=unset·-F·key=perm_mod |
| 9697 | ··········create:·true | 9697 | ··········create:·true |
| 9698 | ··········mode:·o-rwx | 9698 | ··········mode:·o-rwx |
| 9699 | ··········state:·present | 9699 | ··········state:·present |
| 9700 | ········when:·syscalls_found·|·length·==·0 | 9700 | ········when:·syscalls_found·|·length·==·0 |
| 9701 | ······when: | 9701 | ······when: |
| 9702 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9703 | ······-·'"audit"·in·ansible_facts.packages' | 9702 | ······-·'"audit"·in·ansible_facts.packages' |
| 9703 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9704 | ······-·audit_arch·==·"b64" | 9704 | ······-·audit_arch·==·"b64" |
| 9705 | ······tags: | 9705 | ······tags: |
| 9706 | ······-·CJIS-5.4.1.1 | 9706 | ······-·CJIS-5.4.1.1 |
| 9707 | ······-·NIST-800-171-3.1.7 | 9707 | ······-·NIST-800-171-3.1.7 |
| 9708 | ······-·NIST-800-53-AC-6(9) | 9708 | ······-·NIST-800-53-AC-6(9) |
| 9709 | ······-·NIST-800-53-AU-12(c) | 9709 | ······-·NIST-800-53-AU-12(c) |
| 9710 | ······-·NIST-800-53-AU-2(d) | 9710 | ······-·NIST-800-53-AU-2(d) |
| Offset 9732, 16 lines modified | Offset 9732, 16 lines modified | ||
| 9732 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 9732 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 9733 | ······find: | 9733 | ······find: |
| 9734 | ········paths:·/etc/audit/rules.d | 9734 | ········paths:·/etc/audit/rules.d |
| 9735 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 9735 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 9736 | ········patterns:·'*.rules' | 9736 | ········patterns:·'*.rules' |
| 9737 | ······register:·find_existing_watch_rules_d | 9737 | ······register:·find_existing_watch_rules_d |
| 9738 | ······when: | 9738 | ······when: |
| 9739 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9740 | ······-·'"audit"·in·ansible_facts.packages' | 9739 | ······-·'"audit"·in·ansible_facts.packages' |
| 9740 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9741 | ······tags: | 9741 | ······tags: |
| 9742 | ······-·audit_rules_sudoers | 9742 | ······-·audit_rules_sudoers |
| 9743 | ······-·low_complexity | 9743 | ······-·low_complexity |
| 9744 | ······-·low_disruption | 9744 | ······-·low_disruption |
| 9745 | ······-·medium_severity | 9745 | ······-·medium_severity |
| 9746 | ······-·no_reboot_needed | 9746 | ······-·no_reboot_needed |
| 9747 | ······-·restrict_strategy | 9747 | ······-·restrict_strategy |
| Offset 9749, 16 lines modified | Offset 9749, 16 lines modified | ||
| 9749 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 9749 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| Max diff block lines reached; 138602/143471 bytes (96.61%) of diff not shown. | |||
| Offset 9333, 16 lines modified | Offset 9333, 16 lines modified | ||
| 9333 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 9333 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 9334 | ······find: | 9334 | ······find: |
| 9335 | ········paths:·/etc/audit/rules.d/ | 9335 | ········paths:·/etc/audit/rules.d/ |
| 9336 | ········patterns:·'*.rules' | 9336 | ········patterns:·'*.rules' |
| 9337 | ······register:·find_rules_d | 9337 | ······register:·find_rules_d |
| 9338 | ······when: | 9338 | ······when: |
| 9339 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9340 | ······-·'"audit"·in·ansible_facts.packages' | 9339 | ······-·'"audit"·in·ansible_facts.packages' |
| 9340 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9341 | ······tags: | 9341 | ······tags: |
| 9342 | ······-·CJIS-5.4.1.1 | 9342 | ······-·CJIS-5.4.1.1 |
| 9343 | ······-·NIST-800-171-3.3.1 | 9343 | ······-·NIST-800-171-3.3.1 |
| 9344 | ······-·NIST-800-171-3.4.3 | 9344 | ······-·NIST-800-171-3.4.3 |
| 9345 | ······-·NIST-800-53-AC-6(9) | 9345 | ······-·NIST-800-53-AC-6(9) |
| 9346 | ······-·NIST-800-53-CM-6(a) | 9346 | ······-·NIST-800-53-CM-6(a) |
| 9347 | ······-·PCI-DSS-Req-10.5.2 | 9347 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 9357, 16 lines modified | Offset 9357, 16 lines modified | ||
| 9357 | ······lineinfile: | 9357 | ······lineinfile: |
| 9358 | ········path:·'{{·item·}}' | 9358 | ········path:·'{{·item·}}' |
| 9359 | ········regexp:·^\s*(?:-e)\s+.*$ | 9359 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 9360 | ········state:·absent | 9360 | ········state:·absent |
| 9361 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 9361 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 9362 | ········}}' | 9362 | ········}}' |
| 9363 | ······when: | 9363 | ······when: |
| 9364 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9365 | ······-·'"audit"·in·ansible_facts.packages' | 9364 | ······-·'"audit"·in·ansible_facts.packages' |
| 9365 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9366 | ······tags: | 9366 | ······tags: |
| 9367 | ······-·CJIS-5.4.1.1 | 9367 | ······-·CJIS-5.4.1.1 |
| 9368 | ······-·NIST-800-171-3.3.1 | 9368 | ······-·NIST-800-171-3.3.1 |
| 9369 | ······-·NIST-800-171-3.4.3 | 9369 | ······-·NIST-800-171-3.4.3 |
| 9370 | ······-·NIST-800-53-AC-6(9) | 9370 | ······-·NIST-800-53-AC-6(9) |
| 9371 | ······-·NIST-800-53-CM-6(a) | 9371 | ······-·NIST-800-53-CM-6(a) |
| 9372 | ······-·PCI-DSS-Req-10.5.2 | 9372 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 9383, 16 lines modified | Offset 9383, 16 lines modified | ||
| 9383 | ········create:·true | 9383 | ········create:·true |
| 9384 | ········line:·-e·2 | 9384 | ········line:·-e·2 |
| 9385 | ········mode:·o-rwx | 9385 | ········mode:·o-rwx |
| 9386 | ······loop: | 9386 | ······loop: |
| 9387 | ······-·/etc/audit/audit.rules | 9387 | ······-·/etc/audit/audit.rules |
| 9388 | ······-·/etc/audit/rules.d/immutable.rules | 9388 | ······-·/etc/audit/rules.d/immutable.rules |
| 9389 | ······when: | 9389 | ······when: |
| 9390 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9391 | ······-·'"audit"·in·ansible_facts.packages' | 9390 | ······-·'"audit"·in·ansible_facts.packages' |
| 9391 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9392 | ······tags: | 9392 | ······tags: |
| 9393 | ······-·CJIS-5.4.1.1 | 9393 | ······-·CJIS-5.4.1.1 |
| 9394 | ······-·NIST-800-171-3.3.1 | 9394 | ······-·NIST-800-171-3.3.1 |
| 9395 | ······-·NIST-800-171-3.4.3 | 9395 | ······-·NIST-800-171-3.4.3 |
| 9396 | ······-·NIST-800-53-AC-6(9) | 9396 | ······-·NIST-800-53-AC-6(9) |
| 9397 | ······-·NIST-800-53-CM-6(a) | 9397 | ······-·NIST-800-53-CM-6(a) |
| 9398 | ······-·PCI-DSS-Req-10.5.2 | 9398 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 9422, 16 lines modified | Offset 9422, 16 lines modified | ||
| 9422 | ······-·reboot_required | 9422 | ······-·reboot_required |
| 9423 | ······-·restrict_strategy | 9423 | ······-·restrict_strategy |
| 9424 | ····-·name:·Set·architecture·for·audit·mount·tasks | 9424 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 9425 | ······set_fact: | 9425 | ······set_fact: |
| 9426 | ········audit_arch:·b64 | 9426 | ········audit_arch:·b64 |
| 9427 | ······when: | 9427 | ······when: |
| 9428 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9429 | ······-·'"audit"·in·ansible_facts.packages' | 9428 | ······-·'"audit"·in·ansible_facts.packages' |
| 9429 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9430 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 9430 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 9431 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 9431 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 9432 | ······tags: | 9432 | ······tags: |
| 9433 | ······-·CJIS-5.4.1.1 | 9433 | ······-·CJIS-5.4.1.1 |
| 9434 | ······-·NIST-800-171-3.1.7 | 9434 | ······-·NIST-800-171-3.1.7 |
| 9435 | ······-·NIST-800-53-AC-6(9) | 9435 | ······-·NIST-800-53-AC-6(9) |
| 9436 | ······-·NIST-800-53-AU-12(c) | 9436 | ······-·NIST-800-53-AU-12(c) |
| Offset 9562, 16 lines modified | Offset 9562, 16 lines modified | ||
| 9562 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9562 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9563 | ············-F·auid!=unset·-F·key=perm_mod | 9563 | ············-F·auid!=unset·-F·key=perm_mod |
| 9564 | ··········create:·true | 9564 | ··········create:·true |
| 9565 | ··········mode:·o-rwx | 9565 | ··········mode:·o-rwx |
| 9566 | ··········state:·present | 9566 | ··········state:·present |
| 9567 | ········when:·syscalls_found·|·length·==·0 | 9567 | ········when:·syscalls_found·|·length·==·0 |
| 9568 | ······when: | 9568 | ······when: |
| 9569 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9570 | ······-·'"audit"·in·ansible_facts.packages' | 9569 | ······-·'"audit"·in·ansible_facts.packages' |
| 9570 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9571 | ······tags: | 9571 | ······tags: |
| 9572 | ······-·CJIS-5.4.1.1 | 9572 | ······-·CJIS-5.4.1.1 |
| 9573 | ······-·NIST-800-171-3.1.7 | 9573 | ······-·NIST-800-171-3.1.7 |
| 9574 | ······-·NIST-800-53-AC-6(9) | 9574 | ······-·NIST-800-53-AC-6(9) |
| 9575 | ······-·NIST-800-53-AU-12(c) | 9575 | ······-·NIST-800-53-AU-12(c) |
| 9576 | ······-·NIST-800-53-AU-2(d) | 9576 | ······-·NIST-800-53-AU-2(d) |
| 9577 | ······-·NIST-800-53-CM-6(a) | 9577 | ······-·NIST-800-53-CM-6(a) |
| Offset 9700, 16 lines modified | Offset 9700, 16 lines modified | ||
| 9700 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9700 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9701 | ············-F·auid!=unset·-F·key=perm_mod | 9701 | ············-F·auid!=unset·-F·key=perm_mod |
| 9702 | ··········create:·true | 9702 | ··········create:·true |
| 9703 | ··········mode:·o-rwx | 9703 | ··········mode:·o-rwx |
| 9704 | ··········state:·present | 9704 | ··········state:·present |
| 9705 | ········when:·syscalls_found·|·length·==·0 | 9705 | ········when:·syscalls_found·|·length·==·0 |
| 9706 | ······when: | 9706 | ······when: |
| 9707 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9708 | ······-·'"audit"·in·ansible_facts.packages' | 9707 | ······-·'"audit"·in·ansible_facts.packages' |
| 9708 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9709 | ······-·audit_arch·==·"b64" | 9709 | ······-·audit_arch·==·"b64" |
| 9710 | ······tags: | 9710 | ······tags: |
| 9711 | ······-·CJIS-5.4.1.1 | 9711 | ······-·CJIS-5.4.1.1 |
| 9712 | ······-·NIST-800-171-3.1.7 | 9712 | ······-·NIST-800-171-3.1.7 |
| 9713 | ······-·NIST-800-53-AC-6(9) | 9713 | ······-·NIST-800-53-AC-6(9) |
| 9714 | ······-·NIST-800-53-AU-12(c) | 9714 | ······-·NIST-800-53-AU-12(c) |
| 9715 | ······-·NIST-800-53-AU-2(d) | 9715 | ······-·NIST-800-53-AU-2(d) |
| Offset 9737, 16 lines modified | Offset 9737, 16 lines modified | ||
| 9737 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 9737 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 9738 | ······find: | 9738 | ······find: |
| 9739 | ········paths:·/etc/audit/rules.d | 9739 | ········paths:·/etc/audit/rules.d |
| 9740 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 9740 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 9741 | ········patterns:·'*.rules' | 9741 | ········patterns:·'*.rules' |
| 9742 | ······register:·find_existing_watch_rules_d | 9742 | ······register:·find_existing_watch_rules_d |
| 9743 | ······when: | 9743 | ······when: |
| 9744 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9745 | ······-·'"audit"·in·ansible_facts.packages' | 9744 | ······-·'"audit"·in·ansible_facts.packages' |
| 9745 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9746 | ······tags: | 9746 | ······tags: |
| 9747 | ······-·audit_rules_sudoers | 9747 | ······-·audit_rules_sudoers |
| 9748 | ······-·low_complexity | 9748 | ······-·low_complexity |
| 9749 | ······-·low_disruption | 9749 | ······-·low_disruption |
| 9750 | ······-·medium_severity | 9750 | ······-·medium_severity |
| 9751 | ······-·no_reboot_needed | 9751 | ······-·no_reboot_needed |
| 9752 | ······-·restrict_strategy | 9752 | ······-·restrict_strategy |
| Offset 9754, 16 lines modified | Offset 9754, 16 lines modified | ||
| 9754 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 9754 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| Max diff block lines reached; 138602/143471 bytes (96.61%) of diff not shown. | |||
| Offset 3817, 16 lines modified | Offset 3817, 16 lines modified | ||
| 3817 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 3817 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 3818 | ······find: | 3818 | ······find: |
| 3819 | ········paths:·/etc/audit/rules.d/ | 3819 | ········paths:·/etc/audit/rules.d/ |
| 3820 | ········patterns:·'*.rules' | 3820 | ········patterns:·'*.rules' |
| 3821 | ······register:·find_rules_d | 3821 | ······register:·find_rules_d |
| 3822 | ······when: | 3822 | ······when: |
| 3823 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3824 | ······-·'"audit"·in·ansible_facts.packages' | 3823 | ······-·'"audit"·in·ansible_facts.packages' |
| 3824 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3825 | ······tags: | 3825 | ······tags: |
| 3826 | ······-·CCE-27097-5 | 3826 | ······-·CCE-27097-5 |
| 3827 | ······-·CJIS-5.4.1.1 | 3827 | ······-·CJIS-5.4.1.1 |
| 3828 | ······-·NIST-800-171-3.3.1 | 3828 | ······-·NIST-800-171-3.3.1 |
| 3829 | ······-·NIST-800-171-3.4.3 | 3829 | ······-·NIST-800-171-3.4.3 |
| 3830 | ······-·NIST-800-53-AC-6(9) | 3830 | ······-·NIST-800-53-AC-6(9) |
| 3831 | ······-·NIST-800-53-CM-6(a) | 3831 | ······-·NIST-800-53-CM-6(a) |
| Offset 3842, 16 lines modified | Offset 3842, 16 lines modified | ||
| 3842 | ······lineinfile: | 3842 | ······lineinfile: |
| 3843 | ········path:·'{{·item·}}' | 3843 | ········path:·'{{·item·}}' |
| 3844 | ········regexp:·^\s*(?:-e)\s+.*$ | 3844 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 3845 | ········state:·absent | 3845 | ········state:·absent |
| 3846 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 3846 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 3847 | ········}}' | 3847 | ········}}' |
| 3848 | ······when: | 3848 | ······when: |
| 3849 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3850 | ······-·'"audit"·in·ansible_facts.packages' | 3849 | ······-·'"audit"·in·ansible_facts.packages' |
| 3850 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3851 | ······tags: | 3851 | ······tags: |
| 3852 | ······-·CCE-27097-5 | 3852 | ······-·CCE-27097-5 |
| 3853 | ······-·CJIS-5.4.1.1 | 3853 | ······-·CJIS-5.4.1.1 |
| 3854 | ······-·NIST-800-171-3.3.1 | 3854 | ······-·NIST-800-171-3.3.1 |
| 3855 | ······-·NIST-800-171-3.4.3 | 3855 | ······-·NIST-800-171-3.4.3 |
| 3856 | ······-·NIST-800-53-AC-6(9) | 3856 | ······-·NIST-800-53-AC-6(9) |
| 3857 | ······-·NIST-800-53-CM-6(a) | 3857 | ······-·NIST-800-53-CM-6(a) |
| Offset 3869, 16 lines modified | Offset 3869, 16 lines modified | ||
| 3869 | ········create:·true | 3869 | ········create:·true |
| 3870 | ········line:·-e·2 | 3870 | ········line:·-e·2 |
| 3871 | ········mode:·o-rwx | 3871 | ········mode:·o-rwx |
| 3872 | ······loop: | 3872 | ······loop: |
| 3873 | ······-·/etc/audit/audit.rules | 3873 | ······-·/etc/audit/audit.rules |
| 3874 | ······-·/etc/audit/rules.d/immutable.rules | 3874 | ······-·/etc/audit/rules.d/immutable.rules |
| 3875 | ······when: | 3875 | ······when: |
| 3876 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3877 | ······-·'"audit"·in·ansible_facts.packages' | 3876 | ······-·'"audit"·in·ansible_facts.packages' |
| 3877 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3878 | ······tags: | 3878 | ······tags: |
| 3879 | ······-·CCE-27097-5 | 3879 | ······-·CCE-27097-5 |
| 3880 | ······-·CJIS-5.4.1.1 | 3880 | ······-·CJIS-5.4.1.1 |
| 3881 | ······-·NIST-800-171-3.3.1 | 3881 | ······-·NIST-800-171-3.3.1 |
| 3882 | ······-·NIST-800-171-3.4.3 | 3882 | ······-·NIST-800-171-3.4.3 |
| 3883 | ······-·NIST-800-53-AC-6(9) | 3883 | ······-·NIST-800-53-AC-6(9) |
| 3884 | ······-·NIST-800-53-CM-6(a) | 3884 | ······-·NIST-800-53-CM-6(a) |
| Offset 3912, 16 lines modified | Offset 3912, 16 lines modified | ||
| 3912 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 3912 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 3913 | ······find: | 3913 | ······find: |
| 3914 | ········paths:·/etc/audit/rules.d | 3914 | ········paths:·/etc/audit/rules.d |
| 3915 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 3915 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 3916 | ········patterns:·'*.rules' | 3916 | ········patterns:·'*.rules' |
| 3917 | ······register:·find_existing_watch_rules_d | 3917 | ······register:·find_existing_watch_rules_d |
| 3918 | ······when: | 3918 | ······when: |
| 3919 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3920 | ······-·'"audit"·in·ansible_facts.packages' | 3919 | ······-·'"audit"·in·ansible_facts.packages' |
| 3920 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3921 | ······tags: | 3921 | ······tags: |
| 3922 | ······-·CCE-27168-4 | 3922 | ······-·CCE-27168-4 |
| 3923 | ······-·CJIS-5.4.1.1 | 3923 | ······-·CJIS-5.4.1.1 |
| 3924 | ······-·NIST-800-171-3.1.8 | 3924 | ······-·NIST-800-171-3.1.8 |
| 3925 | ······-·NIST-800-53-AU-12(c) | 3925 | ······-·NIST-800-53-AU-12(c) |
| 3926 | ······-·NIST-800-53-AU-2(d) | 3926 | ······-·NIST-800-53-AU-2(d) |
| 3927 | ······-·NIST-800-53-CM-6(a) | 3927 | ······-·NIST-800-53-CM-6(a) |
| Offset 3936, 16 lines modified | Offset 3936, 16 lines modified | ||
| 3936 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 3936 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 3937 | ······find: | 3937 | ······find: |
| 3938 | ········paths:·/etc/audit/rules.d | 3938 | ········paths:·/etc/audit/rules.d |
| 3939 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 3939 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 3940 | ········patterns:·'*.rules' | 3940 | ········patterns:·'*.rules' |
| 3941 | ······register:·find_watch_key | 3941 | ······register:·find_watch_key |
| 3942 | ······when: | 3942 | ······when: |
| 3943 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3944 | ······-·'"audit"·in·ansible_facts.packages' | 3943 | ······-·'"audit"·in·ansible_facts.packages' |
| 3944 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3945 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 3945 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 3946 | ········==·0 | 3946 | ········==·0 |
| 3947 | ······tags: | 3947 | ······tags: |
| 3948 | ······-·CCE-27168-4 | 3948 | ······-·CCE-27168-4 |
| 3949 | ······-·CJIS-5.4.1.1 | 3949 | ······-·CJIS-5.4.1.1 |
| 3950 | ······-·NIST-800-171-3.1.8 | 3950 | ······-·NIST-800-171-3.1.8 |
| 3951 | ······-·NIST-800-53-AU-12(c) | 3951 | ······-·NIST-800-53-AU-12(c) |
| Offset 3960, 16 lines modified | Offset 3960, 16 lines modified | ||
| 3960 | ······-·restrict_strategy | 3960 | ······-·restrict_strategy |
| 3961 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 3961 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 3962 | ······set_fact: | 3962 | ······set_fact: |
| 3963 | ········all_files: | 3963 | ········all_files: |
| 3964 | ········-·/etc/audit/rules.d/MAC-policy.rules | 3964 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 3965 | ······when: | 3965 | ······when: |
| 3966 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3967 | ······-·'"audit"·in·ansible_facts.packages' | 3966 | ······-·'"audit"·in·ansible_facts.packages' |
| 3967 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3968 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 3968 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 3969 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 3969 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 3970 | ······tags: | 3970 | ······tags: |
| 3971 | ······-·CCE-27168-4 | 3971 | ······-·CCE-27168-4 |
| 3972 | ······-·CJIS-5.4.1.1 | 3972 | ······-·CJIS-5.4.1.1 |
| 3973 | ······-·NIST-800-171-3.1.8 | 3973 | ······-·NIST-800-171-3.1.8 |
| 3974 | ······-·NIST-800-53-AU-12(c) | 3974 | ······-·NIST-800-53-AU-12(c) |
| Offset 3984, 16 lines modified | Offset 3984, 16 lines modified | ||
| 3984 | ······-·restrict_strategy | 3984 | ······-·restrict_strategy |
| 3985 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 3985 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 3986 | ······set_fact: | 3986 | ······set_fact: |
| 3987 | ········all_files: | 3987 | ········all_files: |
| 3988 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 3988 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 3989 | ······when: | 3989 | ······when: |
| 3990 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3991 | ······-·'"audit"·in·ansible_facts.packages' | 3990 | ······-·'"audit"·in·ansible_facts.packages' |
| 3991 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3992 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 3992 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 3993 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 3993 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 3994 | ······tags: | 3994 | ······tags: |
| 3995 | ······-·CCE-27168-4 | 3995 | ······-·CCE-27168-4 |
| 3996 | ······-·CJIS-5.4.1.1 | 3996 | ······-·CJIS-5.4.1.1 |
| 3997 | ······-·NIST-800-171-3.1.8 | 3997 | ······-·NIST-800-171-3.1.8 |
| 3998 | ······-·NIST-800-53-AU-12(c) | 3998 | ······-·NIST-800-53-AU-12(c) |
| Offset 4010, 16 lines modified | Offset 4010, 16 lines modified | ||
| 4010 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 4010 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 159649/164632 bytes (96.97%) of diff not shown. | |||
| Offset 5590, 16 lines modified | Offset 5590, 16 lines modified | ||
| 5590 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5590 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5591 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5591 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5592 | ··········create:·true | 5592 | ··········create:·true |
| 5593 | ··········mode:·o-rwx | 5593 | ··········mode:·o-rwx |
| 5594 | ··········state:·present | 5594 | ··········state:·present |
| 5595 | ········when:·syscalls_found·|·length·==·0 | 5595 | ········when:·syscalls_found·|·length·==·0 |
| 5596 | ······when: | 5596 | ······when: |
| 5597 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5598 | ······-·'"audit"·in·ansible_facts.packages' | 5597 | ······-·'"audit"·in·ansible_facts.packages' |
| 5598 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5599 | ······tags: | 5599 | ······tags: |
| 5600 | ······-·CCE-80401-3 | 5600 | ······-·CCE-80401-3 |
| 5601 | ······-·DISA-STIG-RHEL-07-030690 | 5601 | ······-·DISA-STIG-RHEL-07-030690 |
| 5602 | ······-·NIST-800-171-3.1.7 | 5602 | ······-·NIST-800-171-3.1.7 |
| 5603 | ······-·NIST-800-53-AC-6(9) | 5603 | ······-·NIST-800-53-AC-6(9) |
| 5604 | ······-·NIST-800-53-AU-12(c) | 5604 | ······-·NIST-800-53-AU-12(c) |
| 5605 | ······-·NIST-800-53-AU-2(d) | 5605 | ······-·NIST-800-53-AU-2(d) |
| Offset 5750, 16 lines modified | Offset 5750, 16 lines modified | ||
| 5750 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5750 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5751 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5751 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5752 | ··········create:·true | 5752 | ··········create:·true |
| 5753 | ··········mode:·o-rwx | 5753 | ··········mode:·o-rwx |
| 5754 | ··········state:·present | 5754 | ··········state:·present |
| 5755 | ········when:·syscalls_found·|·length·==·0 | 5755 | ········when:·syscalls_found·|·length·==·0 |
| 5756 | ······when: | 5756 | ······when: |
| 5757 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5758 | ······-·'"audit"·in·ansible_facts.packages' | 5757 | ······-·'"audit"·in·ansible_facts.packages' |
| 5758 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5759 | ······tags: | 5759 | ······tags: |
| 5760 | ······-·CCE-80401-3 | 5760 | ······-·CCE-80401-3 |
| 5761 | ······-·DISA-STIG-RHEL-07-030690 | 5761 | ······-·DISA-STIG-RHEL-07-030690 |
| 5762 | ······-·NIST-800-171-3.1.7 | 5762 | ······-·NIST-800-171-3.1.7 |
| 5763 | ······-·NIST-800-53-AC-6(9) | 5763 | ······-·NIST-800-53-AC-6(9) |
| 5764 | ······-·NIST-800-53-AU-12(c) | 5764 | ······-·NIST-800-53-AU-12(c) |
| 5765 | ······-·NIST-800-53-AU-2(d) | 5765 | ······-·NIST-800-53-AU-2(d) |
| Offset 5305, 16 lines modified | Offset 5305, 16 lines modified | ||
| 5305 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5305 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5306 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5306 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5307 | ··········create:·true | 5307 | ··········create:·true |
| 5308 | ··········mode:·o-rwx | 5308 | ··········mode:·o-rwx |
| 5309 | ··········state:·present | 5309 | ··········state:·present |
| 5310 | ········when:·syscalls_found·|·length·==·0 | 5310 | ········when:·syscalls_found·|·length·==·0 |
| 5311 | ······when: | 5311 | ······when: |
| 5312 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5313 | ······-·'"audit"·in·ansible_facts.packages' | 5312 | ······-·'"audit"·in·ansible_facts.packages' |
| 5313 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 5314 | ······tags: | 5314 | ······tags: |
| 5315 | ······-·CCE-80401-3 | 5315 | ······-·CCE-80401-3 |
| 5316 | ······-·DISA-STIG-RHEL-07-030690 | 5316 | ······-·DISA-STIG-RHEL-07-030690 |
| 5317 | ······-·NIST-800-171-3.1.7 | 5317 | ······-·NIST-800-171-3.1.7 |
| 5318 | ······-·NIST-800-53-AC-6(9) | 5318 | ······-·NIST-800-53-AC-6(9) |
| 5319 | ······-·NIST-800-53-AU-12(c) | 5319 | ······-·NIST-800-53-AU-12(c) |
| 5320 | ······-·NIST-800-53-AU-2(d) | 5320 | ······-·NIST-800-53-AU-2(d) |
| Offset 3189, 16 lines modified | Offset 3189, 16 lines modified | ||
| 3189 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 3189 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 3190 | ······find: | 3190 | ······find: |
| 3191 | ········paths:·/etc/audit/rules.d/ | 3191 | ········paths:·/etc/audit/rules.d/ |
| 3192 | ········patterns:·'*.rules' | 3192 | ········patterns:·'*.rules' |
| 3193 | ······register:·find_rules_d | 3193 | ······register:·find_rules_d |
| 3194 | ······when: | 3194 | ······when: |
| 3195 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3196 | ······-·'"audit"·in·ansible_facts.packages' | 3195 | ······-·'"audit"·in·ansible_facts.packages' |
| 3196 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3197 | ······tags: | 3197 | ······tags: |
| 3198 | ······-·CCE-27097-5 | 3198 | ······-·CCE-27097-5 |
| 3199 | ······-·CJIS-5.4.1.1 | 3199 | ······-·CJIS-5.4.1.1 |
| 3200 | ······-·NIST-800-171-3.3.1 | 3200 | ······-·NIST-800-171-3.3.1 |
| 3201 | ······-·NIST-800-171-3.4.3 | 3201 | ······-·NIST-800-171-3.4.3 |
| 3202 | ······-·NIST-800-53-AC-6(9) | 3202 | ······-·NIST-800-53-AC-6(9) |
| 3203 | ······-·NIST-800-53-CM-6(a) | 3203 | ······-·NIST-800-53-CM-6(a) |
| Offset 3214, 16 lines modified | Offset 3214, 16 lines modified | ||
| 3214 | ······lineinfile: | 3214 | ······lineinfile: |
| 3215 | ········path:·'{{·item·}}' | 3215 | ········path:·'{{·item·}}' |
| 3216 | ········regexp:·^\s*(?:-e)\s+.*$ | 3216 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 3217 | ········state:·absent | 3217 | ········state:·absent |
| 3218 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 3218 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 3219 | ········}}' | 3219 | ········}}' |
| 3220 | ······when: | 3220 | ······when: |
| 3221 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3222 | ······-·'"audit"·in·ansible_facts.packages' | 3221 | ······-·'"audit"·in·ansible_facts.packages' |
| 3222 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3223 | ······tags: | 3223 | ······tags: |
| 3224 | ······-·CCE-27097-5 | 3224 | ······-·CCE-27097-5 |
| 3225 | ······-·CJIS-5.4.1.1 | 3225 | ······-·CJIS-5.4.1.1 |
| 3226 | ······-·NIST-800-171-3.3.1 | 3226 | ······-·NIST-800-171-3.3.1 |
| 3227 | ······-·NIST-800-171-3.4.3 | 3227 | ······-·NIST-800-171-3.4.3 |
| 3228 | ······-·NIST-800-53-AC-6(9) | 3228 | ······-·NIST-800-53-AC-6(9) |
| 3229 | ······-·NIST-800-53-CM-6(a) | 3229 | ······-·NIST-800-53-CM-6(a) |
| Offset 3241, 16 lines modified | Offset 3241, 16 lines modified | ||
| 3241 | ········create:·true | 3241 | ········create:·true |
| 3242 | ········line:·-e·2 | 3242 | ········line:·-e·2 |
| 3243 | ········mode:·o-rwx | 3243 | ········mode:·o-rwx |
| 3244 | ······loop: | 3244 | ······loop: |
| 3245 | ······-·/etc/audit/audit.rules | 3245 | ······-·/etc/audit/audit.rules |
| 3246 | ······-·/etc/audit/rules.d/immutable.rules | 3246 | ······-·/etc/audit/rules.d/immutable.rules |
| 3247 | ······when: | 3247 | ······when: |
| 3248 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3249 | ······-·'"audit"·in·ansible_facts.packages' | 3248 | ······-·'"audit"·in·ansible_facts.packages' |
| 3249 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3250 | ······tags: | 3250 | ······tags: |
| 3251 | ······-·CCE-27097-5 | 3251 | ······-·CCE-27097-5 |
| 3252 | ······-·CJIS-5.4.1.1 | 3252 | ······-·CJIS-5.4.1.1 |
| 3253 | ······-·NIST-800-171-3.3.1 | 3253 | ······-·NIST-800-171-3.3.1 |
| 3254 | ······-·NIST-800-171-3.4.3 | 3254 | ······-·NIST-800-171-3.4.3 |
| 3255 | ······-·NIST-800-53-AC-6(9) | 3255 | ······-·NIST-800-53-AC-6(9) |
| 3256 | ······-·NIST-800-53-CM-6(a) | 3256 | ······-·NIST-800-53-CM-6(a) |
| Offset 3284, 16 lines modified | Offset 3284, 16 lines modified | ||
| 3284 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 3284 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 3285 | ······find: | 3285 | ······find: |
| 3286 | ········paths:·/etc/audit/rules.d | 3286 | ········paths:·/etc/audit/rules.d |
| 3287 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 3287 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 3288 | ········patterns:·'*.rules' | 3288 | ········patterns:·'*.rules' |
| 3289 | ······register:·find_existing_watch_rules_d | 3289 | ······register:·find_existing_watch_rules_d |
| 3290 | ······when: | 3290 | ······when: |
| 3291 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3292 | ······-·'"audit"·in·ansible_facts.packages' | 3291 | ······-·'"audit"·in·ansible_facts.packages' |
| 3292 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3293 | ······tags: | 3293 | ······tags: |
| 3294 | ······-·CCE-27168-4 | 3294 | ······-·CCE-27168-4 |
| 3295 | ······-·CJIS-5.4.1.1 | 3295 | ······-·CJIS-5.4.1.1 |
| 3296 | ······-·NIST-800-171-3.1.8 | 3296 | ······-·NIST-800-171-3.1.8 |
| 3297 | ······-·NIST-800-53-AU-12(c) | 3297 | ······-·NIST-800-53-AU-12(c) |
| 3298 | ······-·NIST-800-53-AU-2(d) | 3298 | ······-·NIST-800-53-AU-2(d) |
| 3299 | ······-·NIST-800-53-CM-6(a) | 3299 | ······-·NIST-800-53-CM-6(a) |
| Offset 3308, 16 lines modified | Offset 3308, 16 lines modified | ||
| 3308 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 3308 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 3309 | ······find: | 3309 | ······find: |
| 3310 | ········paths:·/etc/audit/rules.d | 3310 | ········paths:·/etc/audit/rules.d |
| 3311 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 3311 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 3312 | ········patterns:·'*.rules' | 3312 | ········patterns:·'*.rules' |
| 3313 | ······register:·find_watch_key | 3313 | ······register:·find_watch_key |
| 3314 | ······when: | 3314 | ······when: |
| 3315 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3316 | ······-·'"audit"·in·ansible_facts.packages' | 3315 | ······-·'"audit"·in·ansible_facts.packages' |
| 3316 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3317 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 3317 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 3318 | ········==·0 | 3318 | ········==·0 |
| 3319 | ······tags: | 3319 | ······tags: |
| 3320 | ······-·CCE-27168-4 | 3320 | ······-·CCE-27168-4 |
| 3321 | ······-·CJIS-5.4.1.1 | 3321 | ······-·CJIS-5.4.1.1 |
| 3322 | ······-·NIST-800-171-3.1.8 | 3322 | ······-·NIST-800-171-3.1.8 |
| 3323 | ······-·NIST-800-53-AU-12(c) | 3323 | ······-·NIST-800-53-AU-12(c) |
| Offset 3332, 16 lines modified | Offset 3332, 16 lines modified | ||
| 3332 | ······-·restrict_strategy | 3332 | ······-·restrict_strategy |
| 3333 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 3333 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 3334 | ······set_fact: | 3334 | ······set_fact: |
| 3335 | ········all_files: | 3335 | ········all_files: |
| 3336 | ········-·/etc/audit/rules.d/MAC-policy.rules | 3336 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 3337 | ······when: | 3337 | ······when: |
| 3338 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3339 | ······-·'"audit"·in·ansible_facts.packages' | 3338 | ······-·'"audit"·in·ansible_facts.packages' |
| 3339 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3340 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 3340 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 3341 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 3341 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 3342 | ······tags: | 3342 | ······tags: |
| 3343 | ······-·CCE-27168-4 | 3343 | ······-·CCE-27168-4 |
| 3344 | ······-·CJIS-5.4.1.1 | 3344 | ······-·CJIS-5.4.1.1 |
| 3345 | ······-·NIST-800-171-3.1.8 | 3345 | ······-·NIST-800-171-3.1.8 |
| 3346 | ······-·NIST-800-53-AU-12(c) | 3346 | ······-·NIST-800-53-AU-12(c) |
| Offset 3356, 16 lines modified | Offset 3356, 16 lines modified | ||
| 3356 | ······-·restrict_strategy | 3356 | ······-·restrict_strategy |
| 3357 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 3357 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 3358 | ······set_fact: | 3358 | ······set_fact: |
| 3359 | ········all_files: | 3359 | ········all_files: |
| 3360 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 3360 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 3361 | ······when: | 3361 | ······when: |
| 3362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3363 | ······-·'"audit"·in·ansible_facts.packages' | 3362 | ······-·'"audit"·in·ansible_facts.packages' |
| 3363 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3364 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 3364 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 3365 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 3365 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 3366 | ······tags: | 3366 | ······tags: |
| 3367 | ······-·CCE-27168-4 | 3367 | ······-·CCE-27168-4 |
| 3368 | ······-·CJIS-5.4.1.1 | 3368 | ······-·CJIS-5.4.1.1 |
| 3369 | ······-·NIST-800-171-3.1.8 | 3369 | ······-·NIST-800-171-3.1.8 |
| 3370 | ······-·NIST-800-53-AU-12(c) | 3370 | ······-·NIST-800-53-AU-12(c) |
| Offset 3382, 16 lines modified | Offset 3382, 16 lines modified | ||
| 3382 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 3382 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 185393/190376 bytes (97.38%) of diff not shown. | |||
| Offset 3252, 16 lines modified | Offset 3252, 16 lines modified | ||
| 3252 | ······-·no_reboot_needed | 3252 | ······-·no_reboot_needed |
| 3253 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg | 3253 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg |
| 3254 | ······stat: | 3254 | ······stat: |
| 3255 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3255 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3256 | ······register:·file_exists | 3256 | ······register:·file_exists |
| 3257 | ······when: | 3257 | ······when: |
| 3258 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3259 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3258 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3259 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3260 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3260 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3261 | ······tags: | 3261 | ······tags: |
| 3262 | ······-·CCE-83430-9 | 3262 | ······-·CCE-83430-9 |
| 3263 | ······-·CJIS-5.5.2.2 | 3263 | ······-·CJIS-5.5.2.2 |
| 3264 | ······-·NIST-800-171-3.4.5 | 3264 | ······-·NIST-800-171-3.4.5 |
| 3265 | ······-·NIST-800-53-AC-6(1) | 3265 | ······-·NIST-800-53-AC-6(1) |
| 3266 | ······-·NIST-800-53-CM-6(a) | 3266 | ······-·NIST-800-53-CM-6(a) |
| Offset 3274, 16 lines modified | Offset 3274, 16 lines modified | ||
| 3274 | ······-·no_reboot_needed | 3274 | ······-·no_reboot_needed |
| 3275 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/grub.cfg | 3275 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/grub.cfg |
| 3276 | ······file: | 3276 | ······file: |
| 3277 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3277 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3278 | ········group:·'0' | 3278 | ········group:·'0' |
| 3279 | ······when: | 3279 | ······when: |
| 3280 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3281 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3280 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3281 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3282 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3282 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3283 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3283 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3284 | ······tags: | 3284 | ······tags: |
| 3285 | ······-·CCE-83430-9 | 3285 | ······-·CCE-83430-9 |
| 3286 | ······-·CJIS-5.5.2.2 | 3286 | ······-·CJIS-5.5.2.2 |
| 3287 | ······-·NIST-800-171-3.4.5 | 3287 | ······-·NIST-800-171-3.4.5 |
| 3288 | ······-·NIST-800-53-AC-6(1) | 3288 | ······-·NIST-800-53-AC-6(1) |
| Offset 3315, 16 lines modified | Offset 3315, 16 lines modified | ||
| 3315 | ······-·no_reboot_needed | 3315 | ······-·no_reboot_needed |
| 3316 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg | 3316 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg |
| 3317 | ······stat: | 3317 | ······stat: |
| 3318 | ········path:·/boot/efi/EFI/redhat/user.cfg | 3318 | ········path:·/boot/efi/EFI/redhat/user.cfg |
| 3319 | ······register:·file_exists | 3319 | ······register:·file_exists |
| 3320 | ······when: | 3320 | ······when: |
| 3321 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3322 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3321 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3322 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3323 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3323 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3324 | ······tags: | 3324 | ······tags: |
| 3325 | ······-·CCE-86011-4 | 3325 | ······-·CCE-86011-4 |
| 3326 | ······-·CJIS-5.5.2.2 | 3326 | ······-·CJIS-5.5.2.2 |
| 3327 | ······-·NIST-800-171-3.4.5 | 3327 | ······-·NIST-800-171-3.4.5 |
| 3328 | ······-·NIST-800-53-AC-6(1) | 3328 | ······-·NIST-800-53-AC-6(1) |
| 3329 | ······-·NIST-800-53-CM-6(a) | 3329 | ······-·NIST-800-53-CM-6(a) |
| Offset 3337, 16 lines modified | Offset 3337, 16 lines modified | ||
| 3337 | ······-·no_reboot_needed | 3337 | ······-·no_reboot_needed |
| 3338 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/user.cfg | 3338 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/user.cfg |
| 3339 | ······file: | 3339 | ······file: |
| 3340 | ········path:·/boot/efi/EFI/redhat/user.cfg | 3340 | ········path:·/boot/efi/EFI/redhat/user.cfg |
| 3341 | ········group:·'0' | 3341 | ········group:·'0' |
| 3342 | ······when: | 3342 | ······when: |
| 3343 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3344 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3343 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3344 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3345 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3345 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3346 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3346 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3347 | ······tags: | 3347 | ······tags: |
| 3348 | ······-·CCE-86011-4 | 3348 | ······-·CCE-86011-4 |
| 3349 | ······-·CJIS-5.5.2.2 | 3349 | ······-·CJIS-5.5.2.2 |
| 3350 | ······-·NIST-800-171-3.4.5 | 3350 | ······-·NIST-800-171-3.4.5 |
| 3351 | ······-·NIST-800-53-AC-6(1) | 3351 | ······-·NIST-800-53-AC-6(1) |
| Offset 3378, 16 lines modified | Offset 3378, 16 lines modified | ||
| 3378 | ······-·no_reboot_needed | 3378 | ······-·no_reboot_needed |
| 3379 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg | 3379 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg |
| 3380 | ······stat: | 3380 | ······stat: |
| 3381 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3381 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3382 | ······register:·file_exists | 3382 | ······register:·file_exists |
| 3383 | ······when: | 3383 | ······when: |
| 3384 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3385 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3384 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3385 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3386 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3386 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3387 | ······tags: | 3387 | ······tags: |
| 3388 | ······-·CCE-83429-1 | 3388 | ······-·CCE-83429-1 |
| 3389 | ······-·CJIS-5.5.2.2 | 3389 | ······-·CJIS-5.5.2.2 |
| 3390 | ······-·NIST-800-171-3.4.5 | 3390 | ······-·NIST-800-171-3.4.5 |
| 3391 | ······-·NIST-800-53-AC-6(1) | 3391 | ······-·NIST-800-53-AC-6(1) |
| 3392 | ······-·NIST-800-53-CM-6(a) | 3392 | ······-·NIST-800-53-CM-6(a) |
| Offset 3400, 16 lines modified | Offset 3400, 16 lines modified | ||
| 3400 | ······-·no_reboot_needed | 3400 | ······-·no_reboot_needed |
| 3401 | ····-·name:·Ensure·owner·0·on·/boot/efi/EFI/redhat/grub.cfg | 3401 | ····-·name:·Ensure·owner·0·on·/boot/efi/EFI/redhat/grub.cfg |
| 3402 | ······file: | 3402 | ······file: |
| 3403 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3403 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3404 | ········owner:·'0' | 3404 | ········owner:·'0' |
| 3405 | ······when: | 3405 | ······when: |
| 3406 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3407 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3406 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3407 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3409 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3409 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3410 | ······tags: | 3410 | ······tags: |
| 3411 | ······-·CCE-83429-1 | 3411 | ······-·CCE-83429-1 |
| 3412 | ······-·CJIS-5.5.2.2 | 3412 | ······-·CJIS-5.5.2.2 |
| 3413 | ······-·NIST-800-171-3.4.5 | 3413 | ······-·NIST-800-171-3.4.5 |
| 3414 | ······-·NIST-800-53-AC-6(1) | 3414 | ······-·NIST-800-53-AC-6(1) |
| Offset 3441, 16 lines modified | Offset 3441, 16 lines modified | ||
| 3441 | ······-·no_reboot_needed | 3441 | ······-·no_reboot_needed |
| 3442 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg | 3442 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg |
| 3443 | ······stat: | 3443 | ······stat: |
| 3444 | ········path:·/boot/efi/EFI/redhat/user.cfg | 3444 | ········path:·/boot/efi/EFI/redhat/user.cfg |
| 3445 | ······register:·file_exists | 3445 | ······register:·file_exists |
| 3446 | ······when: | 3446 | ······when: |
| 3447 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3448 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3447 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3448 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3449 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3449 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3450 | ······tags: | 3450 | ······tags: |
| 3451 | ······-·CCE-86019-7 | 3451 | ······-·CCE-86019-7 |
| 3452 | ······-·CJIS-5.5.2.2 | 3452 | ······-·CJIS-5.5.2.2 |
| 3453 | ······-·NIST-800-171-3.4.5 | 3453 | ······-·NIST-800-171-3.4.5 |
| 3454 | ······-·NIST-800-53-AC-6(1) | 3454 | ······-·NIST-800-53-AC-6(1) |
| 3455 | ······-·NIST-800-53-CM-6(a) | 3455 | ······-·NIST-800-53-CM-6(a) |
| Offset 3463, 16 lines modified | Offset 3463, 16 lines modified | ||
| 3463 | ······-·no_reboot_needed | 3463 | ······-·no_reboot_needed |
| Max diff block lines reached; 3367/8052 bytes (41.82%) of diff not shown. | |||
| Offset 3252, 16 lines modified | Offset 3252, 16 lines modified | ||
| 3252 | ······-·no_reboot_needed | 3252 | ······-·no_reboot_needed |
| 3253 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg | 3253 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg |
| 3254 | ······stat: | 3254 | ······stat: |
| 3255 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3255 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3256 | ······register:·file_exists | 3256 | ······register:·file_exists |
| 3257 | ······when: | 3257 | ······when: |
| 3258 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3259 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3258 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3259 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3260 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3260 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3261 | ······tags: | 3261 | ······tags: |
| 3262 | ······-·CCE-83430-9 | 3262 | ······-·CCE-83430-9 |
| 3263 | ······-·CJIS-5.5.2.2 | 3263 | ······-·CJIS-5.5.2.2 |
| 3264 | ······-·NIST-800-171-3.4.5 | 3264 | ······-·NIST-800-171-3.4.5 |
| 3265 | ······-·NIST-800-53-AC-6(1) | 3265 | ······-·NIST-800-53-AC-6(1) |
| 3266 | ······-·NIST-800-53-CM-6(a) | 3266 | ······-·NIST-800-53-CM-6(a) |
| Offset 3274, 16 lines modified | Offset 3274, 16 lines modified | ||
| 3274 | ······-·no_reboot_needed | 3274 | ······-·no_reboot_needed |
| 3275 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/grub.cfg | 3275 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/grub.cfg |
| 3276 | ······file: | 3276 | ······file: |
| 3277 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3277 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3278 | ········group:·'0' | 3278 | ········group:·'0' |
| 3279 | ······when: | 3279 | ······when: |
| 3280 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3281 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3280 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3281 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3282 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3282 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3283 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3283 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3284 | ······tags: | 3284 | ······tags: |
| 3285 | ······-·CCE-83430-9 | 3285 | ······-·CCE-83430-9 |
| 3286 | ······-·CJIS-5.5.2.2 | 3286 | ······-·CJIS-5.5.2.2 |
| 3287 | ······-·NIST-800-171-3.4.5 | 3287 | ······-·NIST-800-171-3.4.5 |
| 3288 | ······-·NIST-800-53-AC-6(1) | 3288 | ······-·NIST-800-53-AC-6(1) |
| Offset 3315, 16 lines modified | Offset 3315, 16 lines modified | ||
| 3315 | ······-·no_reboot_needed | 3315 | ······-·no_reboot_needed |
| 3316 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg | 3316 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg |
| 3317 | ······stat: | 3317 | ······stat: |
| 3318 | ········path:·/boot/efi/EFI/redhat/user.cfg | 3318 | ········path:·/boot/efi/EFI/redhat/user.cfg |
| 3319 | ······register:·file_exists | 3319 | ······register:·file_exists |
| 3320 | ······when: | 3320 | ······when: |
| 3321 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3322 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3321 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3322 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3323 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3323 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3324 | ······tags: | 3324 | ······tags: |
| 3325 | ······-·CCE-86011-4 | 3325 | ······-·CCE-86011-4 |
| 3326 | ······-·CJIS-5.5.2.2 | 3326 | ······-·CJIS-5.5.2.2 |
| 3327 | ······-·NIST-800-171-3.4.5 | 3327 | ······-·NIST-800-171-3.4.5 |
| 3328 | ······-·NIST-800-53-AC-6(1) | 3328 | ······-·NIST-800-53-AC-6(1) |
| 3329 | ······-·NIST-800-53-CM-6(a) | 3329 | ······-·NIST-800-53-CM-6(a) |
| Offset 3337, 16 lines modified | Offset 3337, 16 lines modified | ||
| 3337 | ······-·no_reboot_needed | 3337 | ······-·no_reboot_needed |
| 3338 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/user.cfg | 3338 | ····-·name:·Ensure·group·owner·0·on·/boot/efi/EFI/redhat/user.cfg |
| 3339 | ······file: | 3339 | ······file: |
| 3340 | ········path:·/boot/efi/EFI/redhat/user.cfg | 3340 | ········path:·/boot/efi/EFI/redhat/user.cfg |
| 3341 | ········group:·'0' | 3341 | ········group:·'0' |
| 3342 | ······when: | 3342 | ······when: |
| 3343 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3344 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3343 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3344 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3345 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3345 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3346 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3346 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3347 | ······tags: | 3347 | ······tags: |
| 3348 | ······-·CCE-86011-4 | 3348 | ······-·CCE-86011-4 |
| 3349 | ······-·CJIS-5.5.2.2 | 3349 | ······-·CJIS-5.5.2.2 |
| 3350 | ······-·NIST-800-171-3.4.5 | 3350 | ······-·NIST-800-171-3.4.5 |
| 3351 | ······-·NIST-800-53-AC-6(1) | 3351 | ······-·NIST-800-53-AC-6(1) |
| Offset 3378, 16 lines modified | Offset 3378, 16 lines modified | ||
| 3378 | ······-·no_reboot_needed | 3378 | ······-·no_reboot_needed |
| 3379 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg | 3379 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/grub.cfg |
| 3380 | ······stat: | 3380 | ······stat: |
| 3381 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3381 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3382 | ······register:·file_exists | 3382 | ······register:·file_exists |
| 3383 | ······when: | 3383 | ······when: |
| 3384 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3385 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3384 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3385 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3386 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3386 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3387 | ······tags: | 3387 | ······tags: |
| 3388 | ······-·CCE-83429-1 | 3388 | ······-·CCE-83429-1 |
| 3389 | ······-·CJIS-5.5.2.2 | 3389 | ······-·CJIS-5.5.2.2 |
| 3390 | ······-·NIST-800-171-3.4.5 | 3390 | ······-·NIST-800-171-3.4.5 |
| 3391 | ······-·NIST-800-53-AC-6(1) | 3391 | ······-·NIST-800-53-AC-6(1) |
| 3392 | ······-·NIST-800-53-CM-6(a) | 3392 | ······-·NIST-800-53-CM-6(a) |
| Offset 3400, 16 lines modified | Offset 3400, 16 lines modified | ||
| 3400 | ······-·no_reboot_needed | 3400 | ······-·no_reboot_needed |
| 3401 | ····-·name:·Ensure·owner·0·on·/boot/efi/EFI/redhat/grub.cfg | 3401 | ····-·name:·Ensure·owner·0·on·/boot/efi/EFI/redhat/grub.cfg |
| 3402 | ······file: | 3402 | ······file: |
| 3403 | ········path:·/boot/efi/EFI/redhat/grub.cfg | 3403 | ········path:·/boot/efi/EFI/redhat/grub.cfg |
| 3404 | ········owner:·'0' | 3404 | ········owner:·'0' |
| 3405 | ······when: | 3405 | ······when: |
| 3406 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3407 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3406 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3407 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3409 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3409 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3410 | ······tags: | 3410 | ······tags: |
| 3411 | ······-·CCE-83429-1 | 3411 | ······-·CCE-83429-1 |
| 3412 | ······-·CJIS-5.5.2.2 | 3412 | ······-·CJIS-5.5.2.2 |
| 3413 | ······-·NIST-800-171-3.4.5 | 3413 | ······-·NIST-800-171-3.4.5 |
| 3414 | ······-·NIST-800-53-AC-6(1) | 3414 | ······-·NIST-800-53-AC-6(1) |
| Offset 3441, 16 lines modified | Offset 3441, 16 lines modified | ||
| 3441 | ······-·no_reboot_needed | 3441 | ······-·no_reboot_needed |
| 3442 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg | 3442 | ····-·name:·Test·for·existence·/boot/efi/EFI/redhat/user.cfg |
| 3443 | ······stat: | 3443 | ······stat: |
| 3444 | ········path:·/boot/efi/EFI/redhat/user.cfg | 3444 | ········path:·/boot/efi/EFI/redhat/user.cfg |
| 3445 | ······register:·file_exists | 3445 | ······register:·file_exists |
| 3446 | ······when: | 3446 | ······when: |
| 3447 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3448 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3447 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3448 | ······-·'"/boot/efi"·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3449 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3449 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3450 | ······tags: | 3450 | ······tags: |
| 3451 | ······-·CCE-86019-7 | 3451 | ······-·CCE-86019-7 |
| 3452 | ······-·CJIS-5.5.2.2 | 3452 | ······-·CJIS-5.5.2.2 |
| 3453 | ······-·NIST-800-171-3.4.5 | 3453 | ······-·NIST-800-171-3.4.5 |
| 3454 | ······-·NIST-800-53-AC-6(1) | 3454 | ······-·NIST-800-53-AC-6(1) |
| 3455 | ······-·NIST-800-53-CM-6(a) | 3455 | ······-·NIST-800-53-CM-6(a) |
| Offset 3463, 16 lines modified | Offset 3463, 16 lines modified | ||
| 3463 | ······-·no_reboot_needed | 3463 | ······-·no_reboot_needed |
| Max diff block lines reached; 3367/8052 bytes (41.82%) of diff not shown. | |||
| Offset 3189, 16 lines modified | Offset 3189, 16 lines modified | ||
| 3189 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 3189 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 3190 | ······find: | 3190 | ······find: |
| 3191 | ········paths:·/etc/audit/rules.d/ | 3191 | ········paths:·/etc/audit/rules.d/ |
| 3192 | ········patterns:·'*.rules' | 3192 | ········patterns:·'*.rules' |
| 3193 | ······register:·find_rules_d | 3193 | ······register:·find_rules_d |
| 3194 | ······when: | 3194 | ······when: |
| 3195 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3196 | ······-·'"audit"·in·ansible_facts.packages' | 3195 | ······-·'"audit"·in·ansible_facts.packages' |
| 3196 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3197 | ······tags: | 3197 | ······tags: |
| 3198 | ······-·CCE-27097-5 | 3198 | ······-·CCE-27097-5 |
| 3199 | ······-·CJIS-5.4.1.1 | 3199 | ······-·CJIS-5.4.1.1 |
| 3200 | ······-·NIST-800-171-3.3.1 | 3200 | ······-·NIST-800-171-3.3.1 |
| 3201 | ······-·NIST-800-171-3.4.3 | 3201 | ······-·NIST-800-171-3.4.3 |
| 3202 | ······-·NIST-800-53-AC-6(9) | 3202 | ······-·NIST-800-53-AC-6(9) |
| 3203 | ······-·NIST-800-53-CM-6(a) | 3203 | ······-·NIST-800-53-CM-6(a) |
| Offset 3214, 16 lines modified | Offset 3214, 16 lines modified | ||
| 3214 | ······lineinfile: | 3214 | ······lineinfile: |
| 3215 | ········path:·'{{·item·}}' | 3215 | ········path:·'{{·item·}}' |
| 3216 | ········regexp:·^\s*(?:-e)\s+.*$ | 3216 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 3217 | ········state:·absent | 3217 | ········state:·absent |
| 3218 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 3218 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 3219 | ········}}' | 3219 | ········}}' |
| 3220 | ······when: | 3220 | ······when: |
| 3221 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3222 | ······-·'"audit"·in·ansible_facts.packages' | 3221 | ······-·'"audit"·in·ansible_facts.packages' |
| 3222 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3223 | ······tags: | 3223 | ······tags: |
| 3224 | ······-·CCE-27097-5 | 3224 | ······-·CCE-27097-5 |
| 3225 | ······-·CJIS-5.4.1.1 | 3225 | ······-·CJIS-5.4.1.1 |
| 3226 | ······-·NIST-800-171-3.3.1 | 3226 | ······-·NIST-800-171-3.3.1 |
| 3227 | ······-·NIST-800-171-3.4.3 | 3227 | ······-·NIST-800-171-3.4.3 |
| 3228 | ······-·NIST-800-53-AC-6(9) | 3228 | ······-·NIST-800-53-AC-6(9) |
| 3229 | ······-·NIST-800-53-CM-6(a) | 3229 | ······-·NIST-800-53-CM-6(a) |
| Offset 3241, 16 lines modified | Offset 3241, 16 lines modified | ||
| 3241 | ········create:·true | 3241 | ········create:·true |
| 3242 | ········line:·-e·2 | 3242 | ········line:·-e·2 |
| 3243 | ········mode:·o-rwx | 3243 | ········mode:·o-rwx |
| 3244 | ······loop: | 3244 | ······loop: |
| 3245 | ······-·/etc/audit/audit.rules | 3245 | ······-·/etc/audit/audit.rules |
| 3246 | ······-·/etc/audit/rules.d/immutable.rules | 3246 | ······-·/etc/audit/rules.d/immutable.rules |
| 3247 | ······when: | 3247 | ······when: |
| 3248 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3249 | ······-·'"audit"·in·ansible_facts.packages' | 3248 | ······-·'"audit"·in·ansible_facts.packages' |
| 3249 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3250 | ······tags: | 3250 | ······tags: |
| 3251 | ······-·CCE-27097-5 | 3251 | ······-·CCE-27097-5 |
| 3252 | ······-·CJIS-5.4.1.1 | 3252 | ······-·CJIS-5.4.1.1 |
| 3253 | ······-·NIST-800-171-3.3.1 | 3253 | ······-·NIST-800-171-3.3.1 |
| 3254 | ······-·NIST-800-171-3.4.3 | 3254 | ······-·NIST-800-171-3.4.3 |
| 3255 | ······-·NIST-800-53-AC-6(9) | 3255 | ······-·NIST-800-53-AC-6(9) |
| 3256 | ······-·NIST-800-53-CM-6(a) | 3256 | ······-·NIST-800-53-CM-6(a) |
| Offset 3284, 16 lines modified | Offset 3284, 16 lines modified | ||
| 3284 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 3284 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 3285 | ······find: | 3285 | ······find: |
| 3286 | ········paths:·/etc/audit/rules.d | 3286 | ········paths:·/etc/audit/rules.d |
| 3287 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 3287 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 3288 | ········patterns:·'*.rules' | 3288 | ········patterns:·'*.rules' |
| 3289 | ······register:·find_existing_watch_rules_d | 3289 | ······register:·find_existing_watch_rules_d |
| 3290 | ······when: | 3290 | ······when: |
| 3291 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3292 | ······-·'"audit"·in·ansible_facts.packages' | 3291 | ······-·'"audit"·in·ansible_facts.packages' |
| 3292 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3293 | ······tags: | 3293 | ······tags: |
| 3294 | ······-·CCE-27168-4 | 3294 | ······-·CCE-27168-4 |
| 3295 | ······-·CJIS-5.4.1.1 | 3295 | ······-·CJIS-5.4.1.1 |
| 3296 | ······-·NIST-800-171-3.1.8 | 3296 | ······-·NIST-800-171-3.1.8 |
| 3297 | ······-·NIST-800-53-AU-12(c) | 3297 | ······-·NIST-800-53-AU-12(c) |
| 3298 | ······-·NIST-800-53-AU-2(d) | 3298 | ······-·NIST-800-53-AU-2(d) |
| 3299 | ······-·NIST-800-53-CM-6(a) | 3299 | ······-·NIST-800-53-CM-6(a) |
| Offset 3308, 16 lines modified | Offset 3308, 16 lines modified | ||
| 3308 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 3308 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 3309 | ······find: | 3309 | ······find: |
| 3310 | ········paths:·/etc/audit/rules.d | 3310 | ········paths:·/etc/audit/rules.d |
| 3311 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 3311 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 3312 | ········patterns:·'*.rules' | 3312 | ········patterns:·'*.rules' |
| 3313 | ······register:·find_watch_key | 3313 | ······register:·find_watch_key |
| 3314 | ······when: | 3314 | ······when: |
| 3315 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3316 | ······-·'"audit"·in·ansible_facts.packages' | 3315 | ······-·'"audit"·in·ansible_facts.packages' |
| 3316 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3317 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 3317 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 3318 | ········==·0 | 3318 | ········==·0 |
| 3319 | ······tags: | 3319 | ······tags: |
| 3320 | ······-·CCE-27168-4 | 3320 | ······-·CCE-27168-4 |
| 3321 | ······-·CJIS-5.4.1.1 | 3321 | ······-·CJIS-5.4.1.1 |
| 3322 | ······-·NIST-800-171-3.1.8 | 3322 | ······-·NIST-800-171-3.1.8 |
| 3323 | ······-·NIST-800-53-AU-12(c) | 3323 | ······-·NIST-800-53-AU-12(c) |
| Offset 3332, 16 lines modified | Offset 3332, 16 lines modified | ||
| 3332 | ······-·restrict_strategy | 3332 | ······-·restrict_strategy |
| 3333 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 3333 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 3334 | ······set_fact: | 3334 | ······set_fact: |
| 3335 | ········all_files: | 3335 | ········all_files: |
| 3336 | ········-·/etc/audit/rules.d/MAC-policy.rules | 3336 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 3337 | ······when: | 3337 | ······when: |
| 3338 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3339 | ······-·'"audit"·in·ansible_facts.packages' | 3338 | ······-·'"audit"·in·ansible_facts.packages' |
| 3339 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3340 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 3340 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 3341 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 3341 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 3342 | ······tags: | 3342 | ······tags: |
| 3343 | ······-·CCE-27168-4 | 3343 | ······-·CCE-27168-4 |
| 3344 | ······-·CJIS-5.4.1.1 | 3344 | ······-·CJIS-5.4.1.1 |
| 3345 | ······-·NIST-800-171-3.1.8 | 3345 | ······-·NIST-800-171-3.1.8 |
| 3346 | ······-·NIST-800-53-AU-12(c) | 3346 | ······-·NIST-800-53-AU-12(c) |
| Offset 3356, 16 lines modified | Offset 3356, 16 lines modified | ||
| 3356 | ······-·restrict_strategy | 3356 | ······-·restrict_strategy |
| 3357 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 3357 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 3358 | ······set_fact: | 3358 | ······set_fact: |
| 3359 | ········all_files: | 3359 | ········all_files: |
| 3360 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 3360 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 3361 | ······when: | 3361 | ······when: |
| 3362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3363 | ······-·'"audit"·in·ansible_facts.packages' | 3362 | ······-·'"audit"·in·ansible_facts.packages' |
| 3363 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 3364 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 3364 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 3365 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 3365 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 3366 | ······tags: | 3366 | ······tags: |
| 3367 | ······-·CCE-27168-4 | 3367 | ······-·CCE-27168-4 |
| 3368 | ······-·CJIS-5.4.1.1 | 3368 | ······-·CJIS-5.4.1.1 |
| 3369 | ······-·NIST-800-171-3.1.8 | 3369 | ······-·NIST-800-171-3.1.8 |
| 3370 | ······-·NIST-800-53-AU-12(c) | 3370 | ······-·NIST-800-53-AU-12(c) |
| Offset 3382, 16 lines modified | Offset 3382, 16 lines modified | ||
| 3382 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 3382 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 185393/190376 bytes (97.38%) of diff not shown. | |||
| Offset 2750, 16 lines modified | Offset 2750, 16 lines modified | ||
| 2750 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 2750 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 2751 | ······find: | 2751 | ······find: |
| 2752 | ········paths:·/etc/audit/rules.d/ | 2752 | ········paths:·/etc/audit/rules.d/ |
| 2753 | ········patterns:·'*.rules' | 2753 | ········patterns:·'*.rules' |
| 2754 | ······register:·find_rules_d | 2754 | ······register:·find_rules_d |
| 2755 | ······when: | 2755 | ······when: |
| 2756 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2757 | ······-·'"audit"·in·ansible_facts.packages' | 2756 | ······-·'"audit"·in·ansible_facts.packages' |
| 2757 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2758 | ······tags: | 2758 | ······tags: |
| 2759 | ······-·CCE-27097-5 | 2759 | ······-·CCE-27097-5 |
| 2760 | ······-·CJIS-5.4.1.1 | 2760 | ······-·CJIS-5.4.1.1 |
| 2761 | ······-·NIST-800-171-3.3.1 | 2761 | ······-·NIST-800-171-3.3.1 |
| 2762 | ······-·NIST-800-171-3.4.3 | 2762 | ······-·NIST-800-171-3.4.3 |
| 2763 | ······-·NIST-800-53-AC-6(9) | 2763 | ······-·NIST-800-53-AC-6(9) |
| 2764 | ······-·NIST-800-53-CM-6(a) | 2764 | ······-·NIST-800-53-CM-6(a) |
| Offset 2775, 16 lines modified | Offset 2775, 16 lines modified | ||
| 2775 | ······lineinfile: | 2775 | ······lineinfile: |
| 2776 | ········path:·'{{·item·}}' | 2776 | ········path:·'{{·item·}}' |
| 2777 | ········regexp:·^\s*(?:-e)\s+.*$ | 2777 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 2778 | ········state:·absent | 2778 | ········state:·absent |
| 2779 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 2779 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 2780 | ········}}' | 2780 | ········}}' |
| 2781 | ······when: | 2781 | ······when: |
| 2782 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2783 | ······-·'"audit"·in·ansible_facts.packages' | 2782 | ······-·'"audit"·in·ansible_facts.packages' |
| 2783 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2784 | ······tags: | 2784 | ······tags: |
| 2785 | ······-·CCE-27097-5 | 2785 | ······-·CCE-27097-5 |
| 2786 | ······-·CJIS-5.4.1.1 | 2786 | ······-·CJIS-5.4.1.1 |
| 2787 | ······-·NIST-800-171-3.3.1 | 2787 | ······-·NIST-800-171-3.3.1 |
| 2788 | ······-·NIST-800-171-3.4.3 | 2788 | ······-·NIST-800-171-3.4.3 |
| 2789 | ······-·NIST-800-53-AC-6(9) | 2789 | ······-·NIST-800-53-AC-6(9) |
| 2790 | ······-·NIST-800-53-CM-6(a) | 2790 | ······-·NIST-800-53-CM-6(a) |
| Offset 2802, 16 lines modified | Offset 2802, 16 lines modified | ||
| 2802 | ········create:·true | 2802 | ········create:·true |
| 2803 | ········line:·-e·2 | 2803 | ········line:·-e·2 |
| 2804 | ········mode:·o-rwx | 2804 | ········mode:·o-rwx |
| 2805 | ······loop: | 2805 | ······loop: |
| 2806 | ······-·/etc/audit/audit.rules | 2806 | ······-·/etc/audit/audit.rules |
| 2807 | ······-·/etc/audit/rules.d/immutable.rules | 2807 | ······-·/etc/audit/rules.d/immutable.rules |
| 2808 | ······when: | 2808 | ······when: |
| 2809 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2810 | ······-·'"audit"·in·ansible_facts.packages' | 2809 | ······-·'"audit"·in·ansible_facts.packages' |
| 2810 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2811 | ······tags: | 2811 | ······tags: |
| 2812 | ······-·CCE-27097-5 | 2812 | ······-·CCE-27097-5 |
| 2813 | ······-·CJIS-5.4.1.1 | 2813 | ······-·CJIS-5.4.1.1 |
| 2814 | ······-·NIST-800-171-3.3.1 | 2814 | ······-·NIST-800-171-3.3.1 |
| 2815 | ······-·NIST-800-171-3.4.3 | 2815 | ······-·NIST-800-171-3.4.3 |
| 2816 | ······-·NIST-800-53-AC-6(9) | 2816 | ······-·NIST-800-53-AC-6(9) |
| 2817 | ······-·NIST-800-53-CM-6(a) | 2817 | ······-·NIST-800-53-CM-6(a) |
| Offset 2845, 16 lines modified | Offset 2845, 16 lines modified | ||
| 2845 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 2845 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 2846 | ······find: | 2846 | ······find: |
| 2847 | ········paths:·/etc/audit/rules.d | 2847 | ········paths:·/etc/audit/rules.d |
| 2848 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 2848 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 2849 | ········patterns:·'*.rules' | 2849 | ········patterns:·'*.rules' |
| 2850 | ······register:·find_existing_watch_rules_d | 2850 | ······register:·find_existing_watch_rules_d |
| 2851 | ······when: | 2851 | ······when: |
| 2852 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2853 | ······-·'"audit"·in·ansible_facts.packages' | 2852 | ······-·'"audit"·in·ansible_facts.packages' |
| 2853 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2854 | ······tags: | 2854 | ······tags: |
| 2855 | ······-·CCE-27168-4 | 2855 | ······-·CCE-27168-4 |
| 2856 | ······-·CJIS-5.4.1.1 | 2856 | ······-·CJIS-5.4.1.1 |
| 2857 | ······-·NIST-800-171-3.1.8 | 2857 | ······-·NIST-800-171-3.1.8 |
| 2858 | ······-·NIST-800-53-AU-12(c) | 2858 | ······-·NIST-800-53-AU-12(c) |
| 2859 | ······-·NIST-800-53-AU-2(d) | 2859 | ······-·NIST-800-53-AU-2(d) |
| 2860 | ······-·NIST-800-53-CM-6(a) | 2860 | ······-·NIST-800-53-CM-6(a) |
| Offset 2869, 16 lines modified | Offset 2869, 16 lines modified | ||
| 2869 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 2869 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 2870 | ······find: | 2870 | ······find: |
| 2871 | ········paths:·/etc/audit/rules.d | 2871 | ········paths:·/etc/audit/rules.d |
| 2872 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 2872 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 2873 | ········patterns:·'*.rules' | 2873 | ········patterns:·'*.rules' |
| 2874 | ······register:·find_watch_key | 2874 | ······register:·find_watch_key |
| 2875 | ······when: | 2875 | ······when: |
| 2876 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2877 | ······-·'"audit"·in·ansible_facts.packages' | 2876 | ······-·'"audit"·in·ansible_facts.packages' |
| 2877 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2878 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 2878 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 2879 | ········==·0 | 2879 | ········==·0 |
| 2880 | ······tags: | 2880 | ······tags: |
| 2881 | ······-·CCE-27168-4 | 2881 | ······-·CCE-27168-4 |
| 2882 | ······-·CJIS-5.4.1.1 | 2882 | ······-·CJIS-5.4.1.1 |
| 2883 | ······-·NIST-800-171-3.1.8 | 2883 | ······-·NIST-800-171-3.1.8 |
| 2884 | ······-·NIST-800-53-AU-12(c) | 2884 | ······-·NIST-800-53-AU-12(c) |
| Offset 2893, 16 lines modified | Offset 2893, 16 lines modified | ||
| 2893 | ······-·restrict_strategy | 2893 | ······-·restrict_strategy |
| 2894 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 2894 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 2895 | ······set_fact: | 2895 | ······set_fact: |
| 2896 | ········all_files: | 2896 | ········all_files: |
| 2897 | ········-·/etc/audit/rules.d/MAC-policy.rules | 2897 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 2898 | ······when: | 2898 | ······when: |
| 2899 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2900 | ······-·'"audit"·in·ansible_facts.packages' | 2899 | ······-·'"audit"·in·ansible_facts.packages' |
| 2900 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2901 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 2901 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 2902 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 2902 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 2903 | ······tags: | 2903 | ······tags: |
| 2904 | ······-·CCE-27168-4 | 2904 | ······-·CCE-27168-4 |
| 2905 | ······-·CJIS-5.4.1.1 | 2905 | ······-·CJIS-5.4.1.1 |
| 2906 | ······-·NIST-800-171-3.1.8 | 2906 | ······-·NIST-800-171-3.1.8 |
| 2907 | ······-·NIST-800-53-AU-12(c) | 2907 | ······-·NIST-800-53-AU-12(c) |
| Offset 2917, 16 lines modified | Offset 2917, 16 lines modified | ||
| 2917 | ······-·restrict_strategy | 2917 | ······-·restrict_strategy |
| 2918 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 2918 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 2919 | ······set_fact: | 2919 | ······set_fact: |
| 2920 | ········all_files: | 2920 | ········all_files: |
| 2921 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 2921 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 2922 | ······when: | 2922 | ······when: |
| 2923 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2924 | ······-·'"audit"·in·ansible_facts.packages' | 2923 | ······-·'"audit"·in·ansible_facts.packages' |
| 2924 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 2925 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 2925 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 2926 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 2926 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 2927 | ······tags: | 2927 | ······tags: |
| 2928 | ······-·CCE-27168-4 | 2928 | ······-·CCE-27168-4 |
| 2929 | ······-·CJIS-5.4.1.1 | 2929 | ······-·CJIS-5.4.1.1 |
| 2930 | ······-·NIST-800-171-3.1.8 | 2930 | ······-·NIST-800-171-3.1.8 |
| 2931 | ······-·NIST-800-53-AU-12(c) | 2931 | ······-·NIST-800-53-AU-12(c) |
| Offset 2943, 16 lines modified | Offset 2943, 16 lines modified | ||
| 2943 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 2943 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 102717/107700 bytes (95.37%) of diff not shown. | |||
| Offset 4681, 16 lines modified | Offset 4681, 16 lines modified | ||
| 4681 | ······lineinfile: | 4681 | ······lineinfile: |
| 4682 | ········dest:·/etc/audit/auditd.conf | 4682 | ········dest:·/etc/audit/auditd.conf |
| 4683 | ········regexp:·^\s*flush\s*=\s*.*$ | 4683 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 4684 | ········line:·flush·=·{{·var_auditd_flush·}} | 4684 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 4685 | ········state:·present | 4685 | ········state:·present |
| 4686 | ········create:·true | 4686 | ········create:·true |
| 4687 | ······when: | 4687 | ······when: |
| 4688 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4689 | ······-·'"audit"·in·ansible_facts.packages' | 4688 | ······-·'"audit"·in·ansible_facts.packages' |
| 4689 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4690 | ······tags: | 4690 | ······tags: |
| 4691 | ······-·CCE-27331-8 | 4691 | ······-·CCE-27331-8 |
| 4692 | ······-·NIST-800-171-3.3.1 | 4692 | ······-·NIST-800-171-3.3.1 |
| 4693 | ······-·NIST-800-53-AU-11 | 4693 | ······-·NIST-800-53-AU-11 |
| 4694 | ······-·NIST-800-53-CM-6(a) | 4694 | ······-·NIST-800-53-CM-6(a) |
| 4695 | ······-·auditd_data_retention_flush | 4695 | ······-·auditd_data_retention_flush |
| 4696 | ······-·low_complexity | 4696 | ······-·low_complexity |
| Offset 1095, 16 lines modified | Offset 1095, 16 lines modified | ||
| 1095 | ······-·no_reboot_needed | 1095 | ······-·no_reboot_needed |
| 1096 | ······-·restrict_strategy | 1096 | ······-·restrict_strategy |
| 1097 | ····-·name:·Set·architecture·for·audit·tasks | 1097 | ····-·name:·Set·architecture·for·audit·tasks |
| 1098 | ······set_fact: | 1098 | ······set_fact: |
| 1099 | ········audit_arch:·b64 | 1099 | ········audit_arch:·b64 |
| 1100 | ······when: | 1100 | ······when: |
| 1101 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1102 | ······-·'"audit"·in·ansible_facts.packages' | 1101 | ······-·'"audit"·in·ansible_facts.packages' |
| 1102 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1103 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 1103 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 1104 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 1104 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 1105 | ······tags: | 1105 | ······tags: |
| 1106 | ······-·CCE-27076-9 | 1106 | ······-·CCE-27076-9 |
| 1107 | ······-·CJIS-5.4.1.1 | 1107 | ······-·CJIS-5.4.1.1 |
| 1108 | ······-·NIST-800-171-3.1.7 | 1108 | ······-·NIST-800-171-3.1.7 |
| 1109 | ······-·NIST-800-53-AC-6(9) | 1109 | ······-·NIST-800-53-AC-6(9) |
| Offset 1238, 16 lines modified | Offset 1238, 16 lines modified | ||
| 1238 | ··········path:·'{{·audit_file·}}' | 1238 | ··········path:·'{{·audit_file·}}' |
| 1239 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1239 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1240 | ··········create:·true | 1240 | ··········create:·true |
| 1241 | ··········mode:·o-rwx | 1241 | ··········mode:·o-rwx |
| 1242 | ··········state:·present | 1242 | ··········state:·present |
| 1243 | ········when:·syscalls_found·|·length·==·0 | 1243 | ········when:·syscalls_found·|·length·==·0 |
| 1244 | ······when: | 1244 | ······when: |
| 1245 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1246 | ······-·'"audit"·in·ansible_facts.packages' | 1245 | ······-·'"audit"·in·ansible_facts.packages' |
| 1246 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1247 | ······tags: | 1247 | ······tags: |
| 1248 | ······-·CCE-27076-9 | 1248 | ······-·CCE-27076-9 |
| 1249 | ······-·CJIS-5.4.1.1 | 1249 | ······-·CJIS-5.4.1.1 |
| 1250 | ······-·NIST-800-171-3.1.7 | 1250 | ······-·NIST-800-171-3.1.7 |
| 1251 | ······-·NIST-800-53-AC-6(9) | 1251 | ······-·NIST-800-53-AC-6(9) |
| 1252 | ······-·NIST-800-53-AU-12(c) | 1252 | ······-·NIST-800-53-AU-12(c) |
| 1253 | ······-·NIST-800-53-AU-2(d) | 1253 | ······-·NIST-800-53-AU-2(d) |
| Offset 1379, 16 lines modified | Offset 1379, 16 lines modified | ||
| 1379 | ··········path:·'{{·audit_file·}}' | 1379 | ··········path:·'{{·audit_file·}}' |
| 1380 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1380 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1381 | ··········create:·true | 1381 | ··········create:·true |
| 1382 | ··········mode:·o-rwx | 1382 | ··········mode:·o-rwx |
| 1383 | ··········state:·present | 1383 | ··········state:·present |
| 1384 | ········when:·syscalls_found·|·length·==·0 | 1384 | ········when:·syscalls_found·|·length·==·0 |
| 1385 | ······when: | 1385 | ······when: |
| 1386 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1387 | ······-·'"audit"·in·ansible_facts.packages' | 1386 | ······-·'"audit"·in·ansible_facts.packages' |
| 1387 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1388 | ······-·audit_arch·==·"b64" | 1388 | ······-·audit_arch·==·"b64" |
| 1389 | ······tags: | 1389 | ······tags: |
| 1390 | ······-·CCE-27076-9 | 1390 | ······-·CCE-27076-9 |
| 1391 | ······-·CJIS-5.4.1.1 | 1391 | ······-·CJIS-5.4.1.1 |
| 1392 | ······-·NIST-800-171-3.1.7 | 1392 | ······-·NIST-800-171-3.1.7 |
| 1393 | ······-·NIST-800-53-AC-6(9) | 1393 | ······-·NIST-800-53-AC-6(9) |
| 1394 | ······-·NIST-800-53-AU-12(c) | 1394 | ······-·NIST-800-53-AU-12(c) |
| Offset 1405, 16 lines modified | Offset 1405, 16 lines modified | ||
| 1405 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ | 1405 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ |
| 1406 | ······find: | 1406 | ······find: |
| 1407 | ········paths:·/etc/audit/rules.d | 1407 | ········paths:·/etc/audit/rules.d |
| 1408 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ | 1408 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ |
| 1409 | ········patterns:·'*.rules' | 1409 | ········patterns:·'*.rules' |
| 1410 | ······register:·find_existing_watch_rules_d | 1410 | ······register:·find_existing_watch_rules_d |
| 1411 | ······when: | 1411 | ······when: |
| 1412 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1413 | ······-·'"audit"·in·ansible_facts.packages' | 1412 | ······-·'"audit"·in·ansible_facts.packages' |
| 1413 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1414 | ······tags: | 1414 | ······tags: |
| 1415 | ······-·CCE-27076-9 | 1415 | ······-·CCE-27076-9 |
| 1416 | ······-·CJIS-5.4.1.1 | 1416 | ······-·CJIS-5.4.1.1 |
| 1417 | ······-·NIST-800-171-3.1.7 | 1417 | ······-·NIST-800-171-3.1.7 |
| 1418 | ······-·NIST-800-53-AC-6(9) | 1418 | ······-·NIST-800-53-AC-6(9) |
| 1419 | ······-·NIST-800-53-AU-12(c) | 1419 | ······-·NIST-800-53-AU-12(c) |
| 1420 | ······-·NIST-800-53-AU-2(d) | 1420 | ······-·NIST-800-53-AU-2(d) |
| Offset 1430, 16 lines modified | Offset 1430, 16 lines modified | ||
| 1430 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification | 1430 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification |
| 1431 | ······find: | 1431 | ······find: |
| 1432 | ········paths:·/etc/audit/rules.d | 1432 | ········paths:·/etc/audit/rules.d |
| 1433 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ | 1433 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ |
| 1434 | ········patterns:·'*.rules' | 1434 | ········patterns:·'*.rules' |
| 1435 | ······register:·find_watch_key | 1435 | ······register:·find_watch_key |
| 1436 | ······when: | 1436 | ······when: |
| 1437 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1438 | ······-·'"audit"·in·ansible_facts.packages' | 1437 | ······-·'"audit"·in·ansible_facts.packages' |
| 1438 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1439 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1439 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1440 | ········==·0 | 1440 | ········==·0 |
| 1441 | ······tags: | 1441 | ······tags: |
| 1442 | ······-·CCE-27076-9 | 1442 | ······-·CCE-27076-9 |
| 1443 | ······-·CJIS-5.4.1.1 | 1443 | ······-·CJIS-5.4.1.1 |
| 1444 | ······-·NIST-800-171-3.1.7 | 1444 | ······-·NIST-800-171-3.1.7 |
| 1445 | ······-·NIST-800-53-AC-6(9) | 1445 | ······-·NIST-800-53-AC-6(9) |
| Offset 1456, 16 lines modified | Offset 1456, 16 lines modified | ||
| 1456 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the | 1456 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the |
| 1457 | ········recipient·for·the·rule | 1457 | ········recipient·for·the·rule |
| 1458 | ······set_fact: | 1458 | ······set_fact: |
| 1459 | ········all_files: | 1459 | ········all_files: |
| 1460 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules | 1460 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules |
| 1461 | ······when: | 1461 | ······when: |
| 1462 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1463 | ······-·'"audit"·in·ansible_facts.packages' | 1462 | ······-·'"audit"·in·ansible_facts.packages' |
| 1463 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1464 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1464 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1465 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1465 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1466 | ······tags: | 1466 | ······tags: |
| 1467 | ······-·CCE-27076-9 | 1467 | ······-·CCE-27076-9 |
| 1468 | ······-·CJIS-5.4.1.1 | 1468 | ······-·CJIS-5.4.1.1 |
| 1469 | ······-·NIST-800-171-3.1.7 | 1469 | ······-·NIST-800-171-3.1.7 |
| 1470 | ······-·NIST-800-53-AC-6(9) | 1470 | ······-·NIST-800-53-AC-6(9) |
| Offset 1481, 16 lines modified | Offset 1481, 16 lines modified | ||
| 1481 | ······-·restrict_strategy | 1481 | ······-·restrict_strategy |
| 1482 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1482 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1483 | ······set_fact: | 1483 | ······set_fact: |
| 1484 | ········all_files: | 1484 | ········all_files: |
| 1485 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1485 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1486 | ······when: | 1486 | ······when: |
| 1487 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1488 | ······-·'"audit"·in·ansible_facts.packages' | 1487 | ······-·'"audit"·in·ansible_facts.packages' |
| 1488 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1489 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1489 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1490 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1490 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1491 | ······tags: | 1491 | ······tags: |
| 1492 | ······-·CCE-27076-9 | 1492 | ······-·CCE-27076-9 |
| 1493 | ······-·CJIS-5.4.1.1 | 1493 | ······-·CJIS-5.4.1.1 |
| 1494 | ······-·NIST-800-171-3.1.7 | 1494 | ······-·NIST-800-171-3.1.7 |
| 1495 | ······-·NIST-800-53-AC-6(9) | 1495 | ······-·NIST-800-53-AC-6(9) |
| Offset 1508, 16 lines modified | Offset 1508, 16 lines modified | ||
| 1508 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ | 1508 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 70259/75599 bytes (92.94%) of diff not shown. | |||
| Offset 1356, 16 lines modified | Offset 1356, 16 lines modified | ||
| 1356 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 1356 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 1357 | ······find: | 1357 | ······find: |
| 1358 | ········paths:·/etc/audit/rules.d/ | 1358 | ········paths:·/etc/audit/rules.d/ |
| 1359 | ········patterns:·'*.rules' | 1359 | ········patterns:·'*.rules' |
| 1360 | ······register:·find_rules_d | 1360 | ······register:·find_rules_d |
| 1361 | ······when: | 1361 | ······when: |
| 1362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1363 | ······-·'"audit"·in·ansible_facts.packages' | 1362 | ······-·'"audit"·in·ansible_facts.packages' |
| 1363 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1364 | ······tags: | 1364 | ······tags: |
| 1365 | ······-·CCE-27097-5 | 1365 | ······-·CCE-27097-5 |
| 1366 | ······-·CJIS-5.4.1.1 | 1366 | ······-·CJIS-5.4.1.1 |
| 1367 | ······-·NIST-800-171-3.3.1 | 1367 | ······-·NIST-800-171-3.3.1 |
| 1368 | ······-·NIST-800-171-3.4.3 | 1368 | ······-·NIST-800-171-3.4.3 |
| 1369 | ······-·NIST-800-53-AC-6(9) | 1369 | ······-·NIST-800-53-AC-6(9) |
| 1370 | ······-·NIST-800-53-CM-6(a) | 1370 | ······-·NIST-800-53-CM-6(a) |
| Offset 1381, 16 lines modified | Offset 1381, 16 lines modified | ||
| 1381 | ······lineinfile: | 1381 | ······lineinfile: |
| 1382 | ········path:·'{{·item·}}' | 1382 | ········path:·'{{·item·}}' |
| 1383 | ········regexp:·^\s*(?:-e)\s+.*$ | 1383 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 1384 | ········state:·absent | 1384 | ········state:·absent |
| 1385 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 1385 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 1386 | ········}}' | 1386 | ········}}' |
| 1387 | ······when: | 1387 | ······when: |
| 1388 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1389 | ······-·'"audit"·in·ansible_facts.packages' | 1388 | ······-·'"audit"·in·ansible_facts.packages' |
| 1389 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1390 | ······tags: | 1390 | ······tags: |
| 1391 | ······-·CCE-27097-5 | 1391 | ······-·CCE-27097-5 |
| 1392 | ······-·CJIS-5.4.1.1 | 1392 | ······-·CJIS-5.4.1.1 |
| 1393 | ······-·NIST-800-171-3.3.1 | 1393 | ······-·NIST-800-171-3.3.1 |
| 1394 | ······-·NIST-800-171-3.4.3 | 1394 | ······-·NIST-800-171-3.4.3 |
| 1395 | ······-·NIST-800-53-AC-6(9) | 1395 | ······-·NIST-800-53-AC-6(9) |
| 1396 | ······-·NIST-800-53-CM-6(a) | 1396 | ······-·NIST-800-53-CM-6(a) |
| Offset 1408, 16 lines modified | Offset 1408, 16 lines modified | ||
| 1408 | ········create:·true | 1408 | ········create:·true |
| 1409 | ········line:·-e·2 | 1409 | ········line:·-e·2 |
| 1410 | ········mode:·o-rwx | 1410 | ········mode:·o-rwx |
| 1411 | ······loop: | 1411 | ······loop: |
| 1412 | ······-·/etc/audit/audit.rules | 1412 | ······-·/etc/audit/audit.rules |
| 1413 | ······-·/etc/audit/rules.d/immutable.rules | 1413 | ······-·/etc/audit/rules.d/immutable.rules |
| 1414 | ······when: | 1414 | ······when: |
| 1415 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1416 | ······-·'"audit"·in·ansible_facts.packages' | 1415 | ······-·'"audit"·in·ansible_facts.packages' |
| 1416 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1417 | ······tags: | 1417 | ······tags: |
| 1418 | ······-·CCE-27097-5 | 1418 | ······-·CCE-27097-5 |
| 1419 | ······-·CJIS-5.4.1.1 | 1419 | ······-·CJIS-5.4.1.1 |
| 1420 | ······-·NIST-800-171-3.3.1 | 1420 | ······-·NIST-800-171-3.3.1 |
| 1421 | ······-·NIST-800-171-3.4.3 | 1421 | ······-·NIST-800-171-3.4.3 |
| 1422 | ······-·NIST-800-53-AC-6(9) | 1422 | ······-·NIST-800-53-AC-6(9) |
| 1423 | ······-·NIST-800-53-CM-6(a) | 1423 | ······-·NIST-800-53-CM-6(a) |
| Offset 1451, 16 lines modified | Offset 1451, 16 lines modified | ||
| 1451 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 1451 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 1452 | ······find: | 1452 | ······find: |
| 1453 | ········paths:·/etc/audit/rules.d | 1453 | ········paths:·/etc/audit/rules.d |
| 1454 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 1454 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 1455 | ········patterns:·'*.rules' | 1455 | ········patterns:·'*.rules' |
| 1456 | ······register:·find_existing_watch_rules_d | 1456 | ······register:·find_existing_watch_rules_d |
| 1457 | ······when: | 1457 | ······when: |
| 1458 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1459 | ······-·'"audit"·in·ansible_facts.packages' | 1458 | ······-·'"audit"·in·ansible_facts.packages' |
| 1459 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1460 | ······tags: | 1460 | ······tags: |
| 1461 | ······-·CCE-27168-4 | 1461 | ······-·CCE-27168-4 |
| 1462 | ······-·CJIS-5.4.1.1 | 1462 | ······-·CJIS-5.4.1.1 |
| 1463 | ······-·NIST-800-171-3.1.8 | 1463 | ······-·NIST-800-171-3.1.8 |
| 1464 | ······-·NIST-800-53-AU-12(c) | 1464 | ······-·NIST-800-53-AU-12(c) |
| 1465 | ······-·NIST-800-53-AU-2(d) | 1465 | ······-·NIST-800-53-AU-2(d) |
| 1466 | ······-·NIST-800-53-CM-6(a) | 1466 | ······-·NIST-800-53-CM-6(a) |
| Offset 1475, 16 lines modified | Offset 1475, 16 lines modified | ||
| 1475 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 1475 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 1476 | ······find: | 1476 | ······find: |
| 1477 | ········paths:·/etc/audit/rules.d | 1477 | ········paths:·/etc/audit/rules.d |
| 1478 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 1478 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 1479 | ········patterns:·'*.rules' | 1479 | ········patterns:·'*.rules' |
| 1480 | ······register:·find_watch_key | 1480 | ······register:·find_watch_key |
| 1481 | ······when: | 1481 | ······when: |
| 1482 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1483 | ······-·'"audit"·in·ansible_facts.packages' | 1482 | ······-·'"audit"·in·ansible_facts.packages' |
| 1483 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1484 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1484 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1485 | ········==·0 | 1485 | ········==·0 |
| 1486 | ······tags: | 1486 | ······tags: |
| 1487 | ······-·CCE-27168-4 | 1487 | ······-·CCE-27168-4 |
| 1488 | ······-·CJIS-5.4.1.1 | 1488 | ······-·CJIS-5.4.1.1 |
| 1489 | ······-·NIST-800-171-3.1.8 | 1489 | ······-·NIST-800-171-3.1.8 |
| 1490 | ······-·NIST-800-53-AU-12(c) | 1490 | ······-·NIST-800-53-AU-12(c) |
| Offset 1499, 16 lines modified | Offset 1499, 16 lines modified | ||
| 1499 | ······-·restrict_strategy | 1499 | ······-·restrict_strategy |
| 1500 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 1500 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 1501 | ······set_fact: | 1501 | ······set_fact: |
| 1502 | ········all_files: | 1502 | ········all_files: |
| 1503 | ········-·/etc/audit/rules.d/MAC-policy.rules | 1503 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 1504 | ······when: | 1504 | ······when: |
| 1505 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1506 | ······-·'"audit"·in·ansible_facts.packages' | 1505 | ······-·'"audit"·in·ansible_facts.packages' |
| 1506 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1507 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1507 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1508 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1508 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1509 | ······tags: | 1509 | ······tags: |
| 1510 | ······-·CCE-27168-4 | 1510 | ······-·CCE-27168-4 |
| 1511 | ······-·CJIS-5.4.1.1 | 1511 | ······-·CJIS-5.4.1.1 |
| 1512 | ······-·NIST-800-171-3.1.8 | 1512 | ······-·NIST-800-171-3.1.8 |
| 1513 | ······-·NIST-800-53-AU-12(c) | 1513 | ······-·NIST-800-53-AU-12(c) |
| Offset 1523, 16 lines modified | Offset 1523, 16 lines modified | ||
| 1523 | ······-·restrict_strategy | 1523 | ······-·restrict_strategy |
| 1524 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1524 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1525 | ······set_fact: | 1525 | ······set_fact: |
| 1526 | ········all_files: | 1526 | ········all_files: |
| 1527 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1527 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1528 | ······when: | 1528 | ······when: |
| 1529 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1530 | ······-·'"audit"·in·ansible_facts.packages' | 1529 | ······-·'"audit"·in·ansible_facts.packages' |
| 1530 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 1531 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1531 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1532 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1532 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1533 | ······tags: | 1533 | ······tags: |
| 1534 | ······-·CCE-27168-4 | 1534 | ······-·CCE-27168-4 |
| 1535 | ······-·CJIS-5.4.1.1 | 1535 | ······-·CJIS-5.4.1.1 |
| 1536 | ······-·NIST-800-171-3.1.8 | 1536 | ······-·NIST-800-171-3.1.8 |
| 1537 | ······-·NIST-800-53-AU-12(c) | 1537 | ······-·NIST-800-53-AU-12(c) |
| Offset 1549, 16 lines modified | Offset 1549, 16 lines modified | ||
| 1549 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 1549 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 189208/194191 bytes (97.43%) of diff not shown. | |||
| Offset 10096, 16 lines modified | Offset 10096, 16 lines modified | ||
| 10096 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 10096 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 10097 | ······find: | 10097 | ······find: |
| 10098 | ········paths:·/etc/audit/rules.d/ | 10098 | ········paths:·/etc/audit/rules.d/ |
| 10099 | ········patterns:·'*.rules' | 10099 | ········patterns:·'*.rules' |
| 10100 | ······register:·find_rules_d | 10100 | ······register:·find_rules_d |
| 10101 | ······when: | 10101 | ······when: |
| 10102 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10103 | ······-·'"audit"·in·ansible_facts.packages' | 10102 | ······-·'"audit"·in·ansible_facts.packages' |
| 10103 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10104 | ······tags: | 10104 | ······tags: |
| 10105 | ······-·CCE-27097-5 | 10105 | ······-·CCE-27097-5 |
| 10106 | ······-·CJIS-5.4.1.1 | 10106 | ······-·CJIS-5.4.1.1 |
| 10107 | ······-·NIST-800-171-3.3.1 | 10107 | ······-·NIST-800-171-3.3.1 |
| 10108 | ······-·NIST-800-171-3.4.3 | 10108 | ······-·NIST-800-171-3.4.3 |
| 10109 | ······-·NIST-800-53-AC-6(9) | 10109 | ······-·NIST-800-53-AC-6(9) |
| 10110 | ······-·NIST-800-53-CM-6(a) | 10110 | ······-·NIST-800-53-CM-6(a) |
| Offset 10121, 16 lines modified | Offset 10121, 16 lines modified | ||
| 10121 | ······lineinfile: | 10121 | ······lineinfile: |
| 10122 | ········path:·'{{·item·}}' | 10122 | ········path:·'{{·item·}}' |
| 10123 | ········regexp:·^\s*(?:-e)\s+.*$ | 10123 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 10124 | ········state:·absent | 10124 | ········state:·absent |
| 10125 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 10125 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 10126 | ········}}' | 10126 | ········}}' |
| 10127 | ······when: | 10127 | ······when: |
| 10128 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10129 | ······-·'"audit"·in·ansible_facts.packages' | 10128 | ······-·'"audit"·in·ansible_facts.packages' |
| 10129 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10130 | ······tags: | 10130 | ······tags: |
| 10131 | ······-·CCE-27097-5 | 10131 | ······-·CCE-27097-5 |
| 10132 | ······-·CJIS-5.4.1.1 | 10132 | ······-·CJIS-5.4.1.1 |
| 10133 | ······-·NIST-800-171-3.3.1 | 10133 | ······-·NIST-800-171-3.3.1 |
| 10134 | ······-·NIST-800-171-3.4.3 | 10134 | ······-·NIST-800-171-3.4.3 |
| 10135 | ······-·NIST-800-53-AC-6(9) | 10135 | ······-·NIST-800-53-AC-6(9) |
| 10136 | ······-·NIST-800-53-CM-6(a) | 10136 | ······-·NIST-800-53-CM-6(a) |
| Offset 10148, 16 lines modified | Offset 10148, 16 lines modified | ||
| 10148 | ········create:·true | 10148 | ········create:·true |
| 10149 | ········line:·-e·2 | 10149 | ········line:·-e·2 |
| 10150 | ········mode:·o-rwx | 10150 | ········mode:·o-rwx |
| 10151 | ······loop: | 10151 | ······loop: |
| 10152 | ······-·/etc/audit/audit.rules | 10152 | ······-·/etc/audit/audit.rules |
| 10153 | ······-·/etc/audit/rules.d/immutable.rules | 10153 | ······-·/etc/audit/rules.d/immutable.rules |
| 10154 | ······when: | 10154 | ······when: |
| 10155 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10156 | ······-·'"audit"·in·ansible_facts.packages' | 10155 | ······-·'"audit"·in·ansible_facts.packages' |
| 10156 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10157 | ······tags: | 10157 | ······tags: |
| 10158 | ······-·CCE-27097-5 | 10158 | ······-·CCE-27097-5 |
| 10159 | ······-·CJIS-5.4.1.1 | 10159 | ······-·CJIS-5.4.1.1 |
| 10160 | ······-·NIST-800-171-3.3.1 | 10160 | ······-·NIST-800-171-3.3.1 |
| 10161 | ······-·NIST-800-171-3.4.3 | 10161 | ······-·NIST-800-171-3.4.3 |
| 10162 | ······-·NIST-800-53-AC-6(9) | 10162 | ······-·NIST-800-53-AC-6(9) |
| 10163 | ······-·NIST-800-53-CM-6(a) | 10163 | ······-·NIST-800-53-CM-6(a) |
| Offset 10191, 16 lines modified | Offset 10191, 16 lines modified | ||
| 10191 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 10191 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 10192 | ······find: | 10192 | ······find: |
| 10193 | ········paths:·/etc/audit/rules.d | 10193 | ········paths:·/etc/audit/rules.d |
| 10194 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 10194 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 10195 | ········patterns:·'*.rules' | 10195 | ········patterns:·'*.rules' |
| 10196 | ······register:·find_existing_watch_rules_d | 10196 | ······register:·find_existing_watch_rules_d |
| 10197 | ······when: | 10197 | ······when: |
| 10198 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10199 | ······-·'"audit"·in·ansible_facts.packages' | 10198 | ······-·'"audit"·in·ansible_facts.packages' |
| 10199 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10200 | ······tags: | 10200 | ······tags: |
| 10201 | ······-·CCE-27168-4 | 10201 | ······-·CCE-27168-4 |
| 10202 | ······-·CJIS-5.4.1.1 | 10202 | ······-·CJIS-5.4.1.1 |
| 10203 | ······-·NIST-800-171-3.1.8 | 10203 | ······-·NIST-800-171-3.1.8 |
| 10204 | ······-·NIST-800-53-AU-12(c) | 10204 | ······-·NIST-800-53-AU-12(c) |
| 10205 | ······-·NIST-800-53-AU-2(d) | 10205 | ······-·NIST-800-53-AU-2(d) |
| 10206 | ······-·NIST-800-53-CM-6(a) | 10206 | ······-·NIST-800-53-CM-6(a) |
| Offset 10215, 16 lines modified | Offset 10215, 16 lines modified | ||
| 10215 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 10215 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 10216 | ······find: | 10216 | ······find: |
| 10217 | ········paths:·/etc/audit/rules.d | 10217 | ········paths:·/etc/audit/rules.d |
| 10218 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 10218 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 10219 | ········patterns:·'*.rules' | 10219 | ········patterns:·'*.rules' |
| 10220 | ······register:·find_watch_key | 10220 | ······register:·find_watch_key |
| 10221 | ······when: | 10221 | ······when: |
| 10222 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10223 | ······-·'"audit"·in·ansible_facts.packages' | 10222 | ······-·'"audit"·in·ansible_facts.packages' |
| 10223 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10224 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 10224 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 10225 | ········==·0 | 10225 | ········==·0 |
| 10226 | ······tags: | 10226 | ······tags: |
| 10227 | ······-·CCE-27168-4 | 10227 | ······-·CCE-27168-4 |
| 10228 | ······-·CJIS-5.4.1.1 | 10228 | ······-·CJIS-5.4.1.1 |
| 10229 | ······-·NIST-800-171-3.1.8 | 10229 | ······-·NIST-800-171-3.1.8 |
| 10230 | ······-·NIST-800-53-AU-12(c) | 10230 | ······-·NIST-800-53-AU-12(c) |
| Offset 10239, 16 lines modified | Offset 10239, 16 lines modified | ||
| 10239 | ······-·restrict_strategy | 10239 | ······-·restrict_strategy |
| 10240 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 10240 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 10241 | ······set_fact: | 10241 | ······set_fact: |
| 10242 | ········all_files: | 10242 | ········all_files: |
| 10243 | ········-·/etc/audit/rules.d/MAC-policy.rules | 10243 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 10244 | ······when: | 10244 | ······when: |
| 10245 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10246 | ······-·'"audit"·in·ansible_facts.packages' | 10245 | ······-·'"audit"·in·ansible_facts.packages' |
| 10246 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10247 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 10247 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 10248 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 10248 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 10249 | ······tags: | 10249 | ······tags: |
| 10250 | ······-·CCE-27168-4 | 10250 | ······-·CCE-27168-4 |
| 10251 | ······-·CJIS-5.4.1.1 | 10251 | ······-·CJIS-5.4.1.1 |
| 10252 | ······-·NIST-800-171-3.1.8 | 10252 | ······-·NIST-800-171-3.1.8 |
| 10253 | ······-·NIST-800-53-AU-12(c) | 10253 | ······-·NIST-800-53-AU-12(c) |
| Offset 10263, 16 lines modified | Offset 10263, 16 lines modified | ||
| 10263 | ······-·restrict_strategy | 10263 | ······-·restrict_strategy |
| 10264 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 10264 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 10265 | ······set_fact: | 10265 | ······set_fact: |
| 10266 | ········all_files: | 10266 | ········all_files: |
| 10267 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 10267 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 10268 | ······when: | 10268 | ······when: |
| 10269 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10270 | ······-·'"audit"·in·ansible_facts.packages' | 10269 | ······-·'"audit"·in·ansible_facts.packages' |
| 10270 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 10271 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 10271 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 10272 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 10272 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 10273 | ······tags: | 10273 | ······tags: |
| 10274 | ······-·CCE-27168-4 | 10274 | ······-·CCE-27168-4 |
| 10275 | ······-·CJIS-5.4.1.1 | 10275 | ······-·CJIS-5.4.1.1 |
| 10276 | ······-·NIST-800-171-3.1.8 | 10276 | ······-·NIST-800-171-3.1.8 |
| 10277 | ······-·NIST-800-53-AU-12(c) | 10277 | ······-·NIST-800-53-AU-12(c) |
| Offset 10289, 16 lines modified | Offset 10289, 16 lines modified | ||
| 10289 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 10289 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 196810/201809 bytes (97.52%) of diff not shown. | |||
| Offset 4674, 16 lines modified | Offset 4674, 16 lines modified | ||
| 4674 | ······lineinfile: | 4674 | ······lineinfile: |
| 4675 | ········dest:·/etc/audit/auditd.conf | 4675 | ········dest:·/etc/audit/auditd.conf |
| 4676 | ········regexp:·^\s*flush\s*=\s*.*$ | 4676 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 4677 | ········line:·flush·=·{{·var_auditd_flush·}} | 4677 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 4678 | ········state:·present | 4678 | ········state:·present |
| 4679 | ········create:·true | 4679 | ········create:·true |
| 4680 | ······when: | 4680 | ······when: |
| 4681 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4682 | ······-·'"audit"·in·ansible_facts.packages' | 4681 | ······-·'"audit"·in·ansible_facts.packages' |
| 4682 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4683 | ······tags: | 4683 | ······tags: |
| 4684 | ······-·CCE-27331-8 | 4684 | ······-·CCE-27331-8 |
| 4685 | ······-·NIST-800-171-3.3.1 | 4685 | ······-·NIST-800-171-3.3.1 |
| 4686 | ······-·NIST-800-53-AU-11 | 4686 | ······-·NIST-800-53-AU-11 |
| 4687 | ······-·NIST-800-53-CM-6(a) | 4687 | ······-·NIST-800-53-CM-6(a) |
| 4688 | ······-·auditd_data_retention_flush | 4688 | ······-·auditd_data_retention_flush |
| 4689 | ······-·low_complexity | 4689 | ······-·low_complexity |
| Offset 4601, 16 lines modified | Offset 4601, 16 lines modified | ||
| 4601 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 4601 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 4602 | ······find: | 4602 | ······find: |
| 4603 | ········paths:·/etc/audit/rules.d/ | 4603 | ········paths:·/etc/audit/rules.d/ |
| 4604 | ········patterns:·'*.rules' | 4604 | ········patterns:·'*.rules' |
| 4605 | ······register:·find_rules_d | 4605 | ······register:·find_rules_d |
| 4606 | ······when: | 4606 | ······when: |
| 4607 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4608 | ······-·'"audit"·in·ansible_facts.packages' | 4607 | ······-·'"audit"·in·ansible_facts.packages' |
| 4608 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4609 | ······tags: | 4609 | ······tags: |
| 4610 | ······-·CCE-27097-5 | 4610 | ······-·CCE-27097-5 |
| 4611 | ······-·CJIS-5.4.1.1 | 4611 | ······-·CJIS-5.4.1.1 |
| 4612 | ······-·NIST-800-171-3.3.1 | 4612 | ······-·NIST-800-171-3.3.1 |
| 4613 | ······-·NIST-800-171-3.4.3 | 4613 | ······-·NIST-800-171-3.4.3 |
| 4614 | ······-·NIST-800-53-AC-6(9) | 4614 | ······-·NIST-800-53-AC-6(9) |
| 4615 | ······-·NIST-800-53-CM-6(a) | 4615 | ······-·NIST-800-53-CM-6(a) |
| Offset 4626, 16 lines modified | Offset 4626, 16 lines modified | ||
| 4626 | ······lineinfile: | 4626 | ······lineinfile: |
| 4627 | ········path:·'{{·item·}}' | 4627 | ········path:·'{{·item·}}' |
| 4628 | ········regexp:·^\s*(?:-e)\s+.*$ | 4628 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 4629 | ········state:·absent | 4629 | ········state:·absent |
| 4630 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 4630 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 4631 | ········}}' | 4631 | ········}}' |
| 4632 | ······when: | 4632 | ······when: |
| 4633 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4634 | ······-·'"audit"·in·ansible_facts.packages' | 4633 | ······-·'"audit"·in·ansible_facts.packages' |
| 4634 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4635 | ······tags: | 4635 | ······tags: |
| 4636 | ······-·CCE-27097-5 | 4636 | ······-·CCE-27097-5 |
| 4637 | ······-·CJIS-5.4.1.1 | 4637 | ······-·CJIS-5.4.1.1 |
| 4638 | ······-·NIST-800-171-3.3.1 | 4638 | ······-·NIST-800-171-3.3.1 |
| 4639 | ······-·NIST-800-171-3.4.3 | 4639 | ······-·NIST-800-171-3.4.3 |
| 4640 | ······-·NIST-800-53-AC-6(9) | 4640 | ······-·NIST-800-53-AC-6(9) |
| 4641 | ······-·NIST-800-53-CM-6(a) | 4641 | ······-·NIST-800-53-CM-6(a) |
| Offset 4653, 16 lines modified | Offset 4653, 16 lines modified | ||
| 4653 | ········create:·true | 4653 | ········create:·true |
| 4654 | ········line:·-e·2 | 4654 | ········line:·-e·2 |
| 4655 | ········mode:·o-rwx | 4655 | ········mode:·o-rwx |
| 4656 | ······loop: | 4656 | ······loop: |
| 4657 | ······-·/etc/audit/audit.rules | 4657 | ······-·/etc/audit/audit.rules |
| 4658 | ······-·/etc/audit/rules.d/immutable.rules | 4658 | ······-·/etc/audit/rules.d/immutable.rules |
| 4659 | ······when: | 4659 | ······when: |
| 4660 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4661 | ······-·'"audit"·in·ansible_facts.packages' | 4660 | ······-·'"audit"·in·ansible_facts.packages' |
| 4661 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4662 | ······tags: | 4662 | ······tags: |
| 4663 | ······-·CCE-27097-5 | 4663 | ······-·CCE-27097-5 |
| 4664 | ······-·CJIS-5.4.1.1 | 4664 | ······-·CJIS-5.4.1.1 |
| 4665 | ······-·NIST-800-171-3.3.1 | 4665 | ······-·NIST-800-171-3.3.1 |
| 4666 | ······-·NIST-800-171-3.4.3 | 4666 | ······-·NIST-800-171-3.4.3 |
| 4667 | ······-·NIST-800-53-AC-6(9) | 4667 | ······-·NIST-800-53-AC-6(9) |
| 4668 | ······-·NIST-800-53-CM-6(a) | 4668 | ······-·NIST-800-53-CM-6(a) |
| Offset 4696, 16 lines modified | Offset 4696, 16 lines modified | ||
| 4696 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 4696 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 4697 | ······find: | 4697 | ······find: |
| 4698 | ········paths:·/etc/audit/rules.d | 4698 | ········paths:·/etc/audit/rules.d |
| 4699 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 4699 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 4700 | ········patterns:·'*.rules' | 4700 | ········patterns:·'*.rules' |
| 4701 | ······register:·find_existing_watch_rules_d | 4701 | ······register:·find_existing_watch_rules_d |
| 4702 | ······when: | 4702 | ······when: |
| 4703 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4704 | ······-·'"audit"·in·ansible_facts.packages' | 4703 | ······-·'"audit"·in·ansible_facts.packages' |
| 4704 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4705 | ······tags: | 4705 | ······tags: |
| 4706 | ······-·CCE-27168-4 | 4706 | ······-·CCE-27168-4 |
| 4707 | ······-·CJIS-5.4.1.1 | 4707 | ······-·CJIS-5.4.1.1 |
| 4708 | ······-·NIST-800-171-3.1.8 | 4708 | ······-·NIST-800-171-3.1.8 |
| 4709 | ······-·NIST-800-53-AU-12(c) | 4709 | ······-·NIST-800-53-AU-12(c) |
| 4710 | ······-·NIST-800-53-AU-2(d) | 4710 | ······-·NIST-800-53-AU-2(d) |
| 4711 | ······-·NIST-800-53-CM-6(a) | 4711 | ······-·NIST-800-53-CM-6(a) |
| Offset 4720, 16 lines modified | Offset 4720, 16 lines modified | ||
| 4720 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 4720 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 4721 | ······find: | 4721 | ······find: |
| 4722 | ········paths:·/etc/audit/rules.d | 4722 | ········paths:·/etc/audit/rules.d |
| 4723 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 4723 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 4724 | ········patterns:·'*.rules' | 4724 | ········patterns:·'*.rules' |
| 4725 | ······register:·find_watch_key | 4725 | ······register:·find_watch_key |
| 4726 | ······when: | 4726 | ······when: |
| 4727 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4728 | ······-·'"audit"·in·ansible_facts.packages' | 4727 | ······-·'"audit"·in·ansible_facts.packages' |
| 4728 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4729 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 4729 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 4730 | ········==·0 | 4730 | ········==·0 |
| 4731 | ······tags: | 4731 | ······tags: |
| 4732 | ······-·CCE-27168-4 | 4732 | ······-·CCE-27168-4 |
| 4733 | ······-·CJIS-5.4.1.1 | 4733 | ······-·CJIS-5.4.1.1 |
| 4734 | ······-·NIST-800-171-3.1.8 | 4734 | ······-·NIST-800-171-3.1.8 |
| 4735 | ······-·NIST-800-53-AU-12(c) | 4735 | ······-·NIST-800-53-AU-12(c) |
| Offset 4744, 16 lines modified | Offset 4744, 16 lines modified | ||
| 4744 | ······-·restrict_strategy | 4744 | ······-·restrict_strategy |
| 4745 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 4745 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 4746 | ······set_fact: | 4746 | ······set_fact: |
| 4747 | ········all_files: | 4747 | ········all_files: |
| 4748 | ········-·/etc/audit/rules.d/MAC-policy.rules | 4748 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 4749 | ······when: | 4749 | ······when: |
| 4750 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4751 | ······-·'"audit"·in·ansible_facts.packages' | 4750 | ······-·'"audit"·in·ansible_facts.packages' |
| 4751 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4752 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 4752 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 4753 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4753 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4754 | ······tags: | 4754 | ······tags: |
| 4755 | ······-·CCE-27168-4 | 4755 | ······-·CCE-27168-4 |
| 4756 | ······-·CJIS-5.4.1.1 | 4756 | ······-·CJIS-5.4.1.1 |
| 4757 | ······-·NIST-800-171-3.1.8 | 4757 | ······-·NIST-800-171-3.1.8 |
| 4758 | ······-·NIST-800-53-AU-12(c) | 4758 | ······-·NIST-800-53-AU-12(c) |
| Offset 4768, 16 lines modified | Offset 4768, 16 lines modified | ||
| 4768 | ······-·restrict_strategy | 4768 | ······-·restrict_strategy |
| 4769 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 4769 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 4770 | ······set_fact: | 4770 | ······set_fact: |
| 4771 | ········all_files: | 4771 | ········all_files: |
| 4772 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 4772 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 4773 | ······when: | 4773 | ······when: |
| 4774 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4775 | ······-·'"audit"·in·ansible_facts.packages' | 4774 | ······-·'"audit"·in·ansible_facts.packages' |
| 4775 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4776 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 4776 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 4777 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4777 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4778 | ······tags: | 4778 | ······tags: |
| 4779 | ······-·CCE-27168-4 | 4779 | ······-·CCE-27168-4 |
| 4780 | ······-·CJIS-5.4.1.1 | 4780 | ······-·CJIS-5.4.1.1 |
| 4781 | ······-·NIST-800-171-3.1.8 | 4781 | ······-·NIST-800-171-3.1.8 |
| 4782 | ······-·NIST-800-53-AU-12(c) | 4782 | ······-·NIST-800-53-AU-12(c) |
| Offset 4794, 16 lines modified | Offset 4794, 16 lines modified | ||
| 4794 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 4794 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 102749/107732 bytes (95.37%) of diff not shown. | |||
| Offset 8342, 16 lines modified | Offset 8342, 16 lines modified | ||
| 8342 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 8342 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 8343 | ······find: | 8343 | ······find: |
| 8344 | ········paths:·/etc/audit/rules.d/ | 8344 | ········paths:·/etc/audit/rules.d/ |
| 8345 | ········patterns:·'*.rules' | 8345 | ········patterns:·'*.rules' |
| 8346 | ······register:·find_rules_d | 8346 | ······register:·find_rules_d |
| 8347 | ······when: | 8347 | ······when: |
| 8348 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8349 | ······-·'"audit"·in·ansible_facts.packages' | 8348 | ······-·'"audit"·in·ansible_facts.packages' |
| 8349 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8350 | ······tags: | 8350 | ······tags: |
| 8351 | ······-·CCE-27097-5 | 8351 | ······-·CCE-27097-5 |
| 8352 | ······-·CJIS-5.4.1.1 | 8352 | ······-·CJIS-5.4.1.1 |
| 8353 | ······-·NIST-800-171-3.3.1 | 8353 | ······-·NIST-800-171-3.3.1 |
| 8354 | ······-·NIST-800-171-3.4.3 | 8354 | ······-·NIST-800-171-3.4.3 |
| 8355 | ······-·NIST-800-53-AC-6(9) | 8355 | ······-·NIST-800-53-AC-6(9) |
| 8356 | ······-·NIST-800-53-CM-6(a) | 8356 | ······-·NIST-800-53-CM-6(a) |
| Offset 8367, 16 lines modified | Offset 8367, 16 lines modified | ||
| 8367 | ······lineinfile: | 8367 | ······lineinfile: |
| 8368 | ········path:·'{{·item·}}' | 8368 | ········path:·'{{·item·}}' |
| 8369 | ········regexp:·^\s*(?:-e)\s+.*$ | 8369 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 8370 | ········state:·absent | 8370 | ········state:·absent |
| 8371 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 8371 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 8372 | ········}}' | 8372 | ········}}' |
| 8373 | ······when: | 8373 | ······when: |
| 8374 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8375 | ······-·'"audit"·in·ansible_facts.packages' | 8374 | ······-·'"audit"·in·ansible_facts.packages' |
| 8375 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8376 | ······tags: | 8376 | ······tags: |
| 8377 | ······-·CCE-27097-5 | 8377 | ······-·CCE-27097-5 |
| 8378 | ······-·CJIS-5.4.1.1 | 8378 | ······-·CJIS-5.4.1.1 |
| 8379 | ······-·NIST-800-171-3.3.1 | 8379 | ······-·NIST-800-171-3.3.1 |
| 8380 | ······-·NIST-800-171-3.4.3 | 8380 | ······-·NIST-800-171-3.4.3 |
| 8381 | ······-·NIST-800-53-AC-6(9) | 8381 | ······-·NIST-800-53-AC-6(9) |
| 8382 | ······-·NIST-800-53-CM-6(a) | 8382 | ······-·NIST-800-53-CM-6(a) |
| Offset 8394, 16 lines modified | Offset 8394, 16 lines modified | ||
| 8394 | ········create:·true | 8394 | ········create:·true |
| 8395 | ········line:·-e·2 | 8395 | ········line:·-e·2 |
| 8396 | ········mode:·o-rwx | 8396 | ········mode:·o-rwx |
| 8397 | ······loop: | 8397 | ······loop: |
| 8398 | ······-·/etc/audit/audit.rules | 8398 | ······-·/etc/audit/audit.rules |
| 8399 | ······-·/etc/audit/rules.d/immutable.rules | 8399 | ······-·/etc/audit/rules.d/immutable.rules |
| 8400 | ······when: | 8400 | ······when: |
| 8401 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8402 | ······-·'"audit"·in·ansible_facts.packages' | 8401 | ······-·'"audit"·in·ansible_facts.packages' |
| 8402 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8403 | ······tags: | 8403 | ······tags: |
| 8404 | ······-·CCE-27097-5 | 8404 | ······-·CCE-27097-5 |
| 8405 | ······-·CJIS-5.4.1.1 | 8405 | ······-·CJIS-5.4.1.1 |
| 8406 | ······-·NIST-800-171-3.3.1 | 8406 | ······-·NIST-800-171-3.3.1 |
| 8407 | ······-·NIST-800-171-3.4.3 | 8407 | ······-·NIST-800-171-3.4.3 |
| 8408 | ······-·NIST-800-53-AC-6(9) | 8408 | ······-·NIST-800-53-AC-6(9) |
| 8409 | ······-·NIST-800-53-CM-6(a) | 8409 | ······-·NIST-800-53-CM-6(a) |
| Offset 8437, 16 lines modified | Offset 8437, 16 lines modified | ||
| 8437 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 8437 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 8438 | ······find: | 8438 | ······find: |
| 8439 | ········paths:·/etc/audit/rules.d | 8439 | ········paths:·/etc/audit/rules.d |
| 8440 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 8440 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 8441 | ········patterns:·'*.rules' | 8441 | ········patterns:·'*.rules' |
| 8442 | ······register:·find_existing_watch_rules_d | 8442 | ······register:·find_existing_watch_rules_d |
| 8443 | ······when: | 8443 | ······when: |
| 8444 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8445 | ······-·'"audit"·in·ansible_facts.packages' | 8444 | ······-·'"audit"·in·ansible_facts.packages' |
| 8445 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8446 | ······tags: | 8446 | ······tags: |
| 8447 | ······-·CCE-27168-4 | 8447 | ······-·CCE-27168-4 |
| 8448 | ······-·CJIS-5.4.1.1 | 8448 | ······-·CJIS-5.4.1.1 |
| 8449 | ······-·NIST-800-171-3.1.8 | 8449 | ······-·NIST-800-171-3.1.8 |
| 8450 | ······-·NIST-800-53-AU-12(c) | 8450 | ······-·NIST-800-53-AU-12(c) |
| 8451 | ······-·NIST-800-53-AU-2(d) | 8451 | ······-·NIST-800-53-AU-2(d) |
| 8452 | ······-·NIST-800-53-CM-6(a) | 8452 | ······-·NIST-800-53-CM-6(a) |
| Offset 8461, 16 lines modified | Offset 8461, 16 lines modified | ||
| 8461 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 8461 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 8462 | ······find: | 8462 | ······find: |
| 8463 | ········paths:·/etc/audit/rules.d | 8463 | ········paths:·/etc/audit/rules.d |
| 8464 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 8464 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 8465 | ········patterns:·'*.rules' | 8465 | ········patterns:·'*.rules' |
| 8466 | ······register:·find_watch_key | 8466 | ······register:·find_watch_key |
| 8467 | ······when: | 8467 | ······when: |
| 8468 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8469 | ······-·'"audit"·in·ansible_facts.packages' | 8468 | ······-·'"audit"·in·ansible_facts.packages' |
| 8469 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8470 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 8470 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 8471 | ········==·0 | 8471 | ········==·0 |
| 8472 | ······tags: | 8472 | ······tags: |
| 8473 | ······-·CCE-27168-4 | 8473 | ······-·CCE-27168-4 |
| 8474 | ······-·CJIS-5.4.1.1 | 8474 | ······-·CJIS-5.4.1.1 |
| 8475 | ······-·NIST-800-171-3.1.8 | 8475 | ······-·NIST-800-171-3.1.8 |
| 8476 | ······-·NIST-800-53-AU-12(c) | 8476 | ······-·NIST-800-53-AU-12(c) |
| Offset 8485, 16 lines modified | Offset 8485, 16 lines modified | ||
| 8485 | ······-·restrict_strategy | 8485 | ······-·restrict_strategy |
| 8486 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 8486 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 8487 | ······set_fact: | 8487 | ······set_fact: |
| 8488 | ········all_files: | 8488 | ········all_files: |
| 8489 | ········-·/etc/audit/rules.d/MAC-policy.rules | 8489 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 8490 | ······when: | 8490 | ······when: |
| 8491 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8492 | ······-·'"audit"·in·ansible_facts.packages' | 8491 | ······-·'"audit"·in·ansible_facts.packages' |
| 8492 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8493 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 8493 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 8494 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 8494 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 8495 | ······tags: | 8495 | ······tags: |
| 8496 | ······-·CCE-27168-4 | 8496 | ······-·CCE-27168-4 |
| 8497 | ······-·CJIS-5.4.1.1 | 8497 | ······-·CJIS-5.4.1.1 |
| 8498 | ······-·NIST-800-171-3.1.8 | 8498 | ······-·NIST-800-171-3.1.8 |
| 8499 | ······-·NIST-800-53-AU-12(c) | 8499 | ······-·NIST-800-53-AU-12(c) |
| Offset 8509, 16 lines modified | Offset 8509, 16 lines modified | ||
| 8509 | ······-·restrict_strategy | 8509 | ······-·restrict_strategy |
| 8510 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 8510 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 8511 | ······set_fact: | 8511 | ······set_fact: |
| 8512 | ········all_files: | 8512 | ········all_files: |
| 8513 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 8513 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 8514 | ······when: | 8514 | ······when: |
| 8515 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8516 | ······-·'"audit"·in·ansible_facts.packages' | 8515 | ······-·'"audit"·in·ansible_facts.packages' |
| 8516 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 8517 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 8517 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 8518 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 8518 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 8519 | ······tags: | 8519 | ······tags: |
| 8520 | ······-·CCE-27168-4 | 8520 | ······-·CCE-27168-4 |
| 8521 | ······-·CJIS-5.4.1.1 | 8521 | ······-·CJIS-5.4.1.1 |
| 8522 | ······-·NIST-800-171-3.1.8 | 8522 | ······-·NIST-800-171-3.1.8 |
| 8523 | ······-·NIST-800-53-AU-12(c) | 8523 | ······-·NIST-800-53-AU-12(c) |
| Offset 8535, 16 lines modified | Offset 8535, 16 lines modified | ||
| 8535 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 8535 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 203021/208004 bytes (97.60%) of diff not shown. | |||
| Offset 6052, 16 lines modified | Offset 6052, 16 lines modified | ||
| 6052 | ······-·reboot_required | 6052 | ······-·reboot_required |
| 6053 | ······-·restrict_strategy | 6053 | ······-·restrict_strategy |
| 6054 | ····-·name:·Set·architecture·for·audit·mount·tasks | 6054 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 6055 | ······set_fact: | 6055 | ······set_fact: |
| 6056 | ········audit_arch:·b64 | 6056 | ········audit_arch:·b64 |
| 6057 | ······when: | 6057 | ······when: |
| 6058 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6059 | ······-·'"audit"·in·ansible_facts.packages' | 6058 | ······-·'"audit"·in·ansible_facts.packages' |
| 6059 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6060 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 6060 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 6061 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 6061 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 6062 | ······tags: | 6062 | ······tags: |
| 6063 | ······-·CCE-27447-2 | 6063 | ······-·CCE-27447-2 |
| 6064 | ······-·CJIS-5.4.1.1 | 6064 | ······-·CJIS-5.4.1.1 |
| 6065 | ······-·DISA-STIG-RHEL-07-030740 | 6065 | ······-·DISA-STIG-RHEL-07-030740 |
| 6066 | ······-·NIST-800-171-3.1.7 | 6066 | ······-·NIST-800-171-3.1.7 |
| Offset 6194, 16 lines modified | Offset 6194, 16 lines modified | ||
| 6194 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 6194 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 6195 | ············-F·auid!=unset·-F·key=perm_mod | 6195 | ············-F·auid!=unset·-F·key=perm_mod |
| 6196 | ··········create:·true | 6196 | ··········create:·true |
| 6197 | ··········mode:·o-rwx | 6197 | ··········mode:·o-rwx |
| 6198 | ··········state:·present | 6198 | ··········state:·present |
| 6199 | ········when:·syscalls_found·|·length·==·0 | 6199 | ········when:·syscalls_found·|·length·==·0 |
| 6200 | ······when: | 6200 | ······when: |
| 6201 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6202 | ······-·'"audit"·in·ansible_facts.packages' | 6201 | ······-·'"audit"·in·ansible_facts.packages' |
| 6202 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6203 | ······tags: | 6203 | ······tags: |
| 6204 | ······-·CCE-27447-2 | 6204 | ······-·CCE-27447-2 |
| 6205 | ······-·CJIS-5.4.1.1 | 6205 | ······-·CJIS-5.4.1.1 |
| 6206 | ······-·DISA-STIG-RHEL-07-030740 | 6206 | ······-·DISA-STIG-RHEL-07-030740 |
| 6207 | ······-·NIST-800-171-3.1.7 | 6207 | ······-·NIST-800-171-3.1.7 |
| 6208 | ······-·NIST-800-53-AC-6(9) | 6208 | ······-·NIST-800-53-AC-6(9) |
| 6209 | ······-·NIST-800-53-AU-12(c) | 6209 | ······-·NIST-800-53-AU-12(c) |
| Offset 6334, 16 lines modified | Offset 6334, 16 lines modified | ||
| 6334 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 6334 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 6335 | ············-F·auid!=unset·-F·key=perm_mod | 6335 | ············-F·auid!=unset·-F·key=perm_mod |
| 6336 | ··········create:·true | 6336 | ··········create:·true |
| 6337 | ··········mode:·o-rwx | 6337 | ··········mode:·o-rwx |
| 6338 | ··········state:·present | 6338 | ··········state:·present |
| 6339 | ········when:·syscalls_found·|·length·==·0 | 6339 | ········when:·syscalls_found·|·length·==·0 |
| 6340 | ······when: | 6340 | ······when: |
| 6341 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6342 | ······-·'"audit"·in·ansible_facts.packages' | 6341 | ······-·'"audit"·in·ansible_facts.packages' |
| 6342 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6343 | ······-·audit_arch·==·"b64" | 6343 | ······-·audit_arch·==·"b64" |
| 6344 | ······tags: | 6344 | ······tags: |
| 6345 | ······-·CCE-27447-2 | 6345 | ······-·CCE-27447-2 |
| 6346 | ······-·CJIS-5.4.1.1 | 6346 | ······-·CJIS-5.4.1.1 |
| 6347 | ······-·DISA-STIG-RHEL-07-030740 | 6347 | ······-·DISA-STIG-RHEL-07-030740 |
| 6348 | ······-·NIST-800-171-3.1.7 | 6348 | ······-·NIST-800-171-3.1.7 |
| 6349 | ······-·NIST-800-53-AC-6(9) | 6349 | ······-·NIST-800-53-AC-6(9) |
| Offset 6384, 16 lines modified | Offset 6384, 16 lines modified | ||
| 6384 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 6384 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 6385 | ······find: | 6385 | ······find: |
| 6386 | ········paths:·/etc/audit/rules.d | 6386 | ········paths:·/etc/audit/rules.d |
| 6387 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 6387 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 6388 | ········patterns:·'*.rules' | 6388 | ········patterns:·'*.rules' |
| 6389 | ······register:·find_existing_watch_rules_d | 6389 | ······register:·find_existing_watch_rules_d |
| 6390 | ······when: | 6390 | ······when: |
| 6391 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6392 | ······-·'"audit"·in·ansible_facts.packages' | 6391 | ······-·'"audit"·in·ansible_facts.packages' |
| 6392 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6393 | ······tags: | 6393 | ······tags: |
| 6394 | ······-·CCE-27461-3 | 6394 | ······-·CCE-27461-3 |
| 6395 | ······-·CJIS-5.4.1.1 | 6395 | ······-·CJIS-5.4.1.1 |
| 6396 | ······-·DISA-STIG-RHEL-07-030700 | 6396 | ······-·DISA-STIG-RHEL-07-030700 |
| 6397 | ······-·NIST-800-171-3.1.7 | 6397 | ······-·NIST-800-171-3.1.7 |
| 6398 | ······-·NIST-800-53-AC-2(7)(b) | 6398 | ······-·NIST-800-53-AC-2(7)(b) |
| 6399 | ······-·NIST-800-53-AC-6(9) | 6399 | ······-·NIST-800-53-AC-6(9) |
| Offset 6412, 16 lines modified | Offset 6412, 16 lines modified | ||
| 6412 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 6412 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| 6413 | ······find: | 6413 | ······find: |
| 6414 | ········paths:·/etc/audit/rules.d | 6414 | ········paths:·/etc/audit/rules.d |
| 6415 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ | 6415 | ········contains:·^.*(?:-F·key=|-k\s+)actions$ |
| 6416 | ········patterns:·'*.rules' | 6416 | ········patterns:·'*.rules' |
| 6417 | ······register:·find_watch_key | 6417 | ······register:·find_watch_key |
| 6418 | ······when: | 6418 | ······when: |
| 6419 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6420 | ······-·'"audit"·in·ansible_facts.packages' | 6419 | ······-·'"audit"·in·ansible_facts.packages' |
| 6420 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6421 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 6421 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 6422 | ········==·0 | 6422 | ········==·0 |
| 6423 | ······tags: | 6423 | ······tags: |
| 6424 | ······-·CCE-27461-3 | 6424 | ······-·CCE-27461-3 |
| 6425 | ······-·CJIS-5.4.1.1 | 6425 | ······-·CJIS-5.4.1.1 |
| 6426 | ······-·DISA-STIG-RHEL-07-030700 | 6426 | ······-·DISA-STIG-RHEL-07-030700 |
| 6427 | ······-·NIST-800-171-3.1.7 | 6427 | ······-·NIST-800-171-3.1.7 |
| Offset 6440, 16 lines modified | Offset 6440, 16 lines modified | ||
| 6440 | ······-·restrict_strategy | 6440 | ······-·restrict_strategy |
| 6441 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule | 6441 | ····-·name:·Use·/etc/audit/rules.d/actions.rules·as·the·recipient·for·the·rule |
| 6442 | ······set_fact: | 6442 | ······set_fact: |
| 6443 | ········all_files: | 6443 | ········all_files: |
| 6444 | ········-·/etc/audit/rules.d/actions.rules | 6444 | ········-·/etc/audit/rules.d/actions.rules |
| 6445 | ······when: | 6445 | ······when: |
| 6446 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6447 | ······-·'"audit"·in·ansible_facts.packages' | 6446 | ······-·'"audit"·in·ansible_facts.packages' |
| 6447 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6448 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 6448 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 6449 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 6449 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 6450 | ······tags: | 6450 | ······tags: |
| 6451 | ······-·CCE-27461-3 | 6451 | ······-·CCE-27461-3 |
| 6452 | ······-·CJIS-5.4.1.1 | 6452 | ······-·CJIS-5.4.1.1 |
| 6453 | ······-·DISA-STIG-RHEL-07-030700 | 6453 | ······-·DISA-STIG-RHEL-07-030700 |
| 6454 | ······-·NIST-800-171-3.1.7 | 6454 | ······-·NIST-800-171-3.1.7 |
| Offset 6468, 16 lines modified | Offset 6468, 16 lines modified | ||
| 6468 | ······-·restrict_strategy | 6468 | ······-·restrict_strategy |
| 6469 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 6469 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 6470 | ······set_fact: | 6470 | ······set_fact: |
| 6471 | ········all_files: | 6471 | ········all_files: |
| 6472 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 6472 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 6473 | ······when: | 6473 | ······when: |
| 6474 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6475 | ······-·'"audit"·in·ansible_facts.packages' | 6474 | ······-·'"audit"·in·ansible_facts.packages' |
| 6475 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 6476 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 6476 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 6477 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 6477 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 6478 | ······tags: | 6478 | ······tags: |
| 6479 | ······-·CCE-27461-3 | 6479 | ······-·CCE-27461-3 |
| 6480 | ······-·CJIS-5.4.1.1 | 6480 | ······-·CJIS-5.4.1.1 |
| 6481 | ······-·DISA-STIG-RHEL-07-030700 | 6481 | ······-·DISA-STIG-RHEL-07-030700 |
| 6482 | ······-·NIST-800-171-3.1.7 | 6482 | ······-·NIST-800-171-3.1.7 |
| Offset 6498, 16 lines modified | Offset 6498, 16 lines modified | ||
| 6498 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ | 6498 | ····-·name:·Add·watch·rule·for·/etc/sudoers·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 135626/140859 bytes (96.28%) of diff not shown. | |||
| Offset 668, 16 lines modified | Offset 668, 16 lines modified | ||
| 668 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 668 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 669 | ······find: | 669 | ······find: |
| 670 | ········paths:·/etc/audit/rules.d | 670 | ········paths:·/etc/audit/rules.d |
| 671 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 671 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 672 | ········patterns:·'*.rules' | 672 | ········patterns:·'*.rules' |
| 673 | ······register:·find_existing_watch_rules_d | 673 | ······register:·find_existing_watch_rules_d |
| 674 | ······when: | 674 | ······when: |
| 675 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 676 | ······-·'"audit"·in·ansible_facts.packages' | 675 | ······-·'"audit"·in·ansible_facts.packages' |
| 676 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 677 | ······tags: | 677 | ······tags: |
| 678 | ······-·CCE-27168-4 | 678 | ······-·CCE-27168-4 |
| 679 | ······-·CJIS-5.4.1.1 | 679 | ······-·CJIS-5.4.1.1 |
| 680 | ······-·NIST-800-171-3.1.8 | 680 | ······-·NIST-800-171-3.1.8 |
| 681 | ······-·NIST-800-53-AU-12(c) | 681 | ······-·NIST-800-53-AU-12(c) |
| 682 | ······-·NIST-800-53-AU-2(d) | 682 | ······-·NIST-800-53-AU-2(d) |
| 683 | ······-·NIST-800-53-CM-6(a) | 683 | ······-·NIST-800-53-CM-6(a) |
| Offset 692, 16 lines modified | Offset 692, 16 lines modified | ||
| 692 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 692 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 693 | ······find: | 693 | ······find: |
| 694 | ········paths:·/etc/audit/rules.d | 694 | ········paths:·/etc/audit/rules.d |
| 695 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 695 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 696 | ········patterns:·'*.rules' | 696 | ········patterns:·'*.rules' |
| 697 | ······register:·find_watch_key | 697 | ······register:·find_watch_key |
| 698 | ······when: | 698 | ······when: |
| 699 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 700 | ······-·'"audit"·in·ansible_facts.packages' | 699 | ······-·'"audit"·in·ansible_facts.packages' |
| 700 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 701 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 701 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 702 | ········==·0 | 702 | ········==·0 |
| 703 | ······tags: | 703 | ······tags: |
| 704 | ······-·CCE-27168-4 | 704 | ······-·CCE-27168-4 |
| 705 | ······-·CJIS-5.4.1.1 | 705 | ······-·CJIS-5.4.1.1 |
| 706 | ······-·NIST-800-171-3.1.8 | 706 | ······-·NIST-800-171-3.1.8 |
| 707 | ······-·NIST-800-53-AU-12(c) | 707 | ······-·NIST-800-53-AU-12(c) |
| Offset 716, 16 lines modified | Offset 716, 16 lines modified | ||
| 716 | ······-·restrict_strategy | 716 | ······-·restrict_strategy |
| 717 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 717 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 718 | ······set_fact: | 718 | ······set_fact: |
| 719 | ········all_files: | 719 | ········all_files: |
| 720 | ········-·/etc/audit/rules.d/MAC-policy.rules | 720 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 721 | ······when: | 721 | ······when: |
| 722 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 723 | ······-·'"audit"·in·ansible_facts.packages' | 722 | ······-·'"audit"·in·ansible_facts.packages' |
| 723 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 724 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 724 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 725 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 725 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 726 | ······tags: | 726 | ······tags: |
| 727 | ······-·CCE-27168-4 | 727 | ······-·CCE-27168-4 |
| 728 | ······-·CJIS-5.4.1.1 | 728 | ······-·CJIS-5.4.1.1 |
| 729 | ······-·NIST-800-171-3.1.8 | 729 | ······-·NIST-800-171-3.1.8 |
| 730 | ······-·NIST-800-53-AU-12(c) | 730 | ······-·NIST-800-53-AU-12(c) |
| Offset 740, 16 lines modified | Offset 740, 16 lines modified | ||
| 740 | ······-·restrict_strategy | 740 | ······-·restrict_strategy |
| 741 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 741 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 742 | ······set_fact: | 742 | ······set_fact: |
| 743 | ········all_files: | 743 | ········all_files: |
| 744 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 744 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 745 | ······when: | 745 | ······when: |
| 746 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 747 | ······-·'"audit"·in·ansible_facts.packages' | 746 | ······-·'"audit"·in·ansible_facts.packages' |
| 747 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 748 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 748 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 749 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 749 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 750 | ······tags: | 750 | ······tags: |
| 751 | ······-·CCE-27168-4 | 751 | ······-·CCE-27168-4 |
| 752 | ······-·CJIS-5.4.1.1 | 752 | ······-·CJIS-5.4.1.1 |
| 753 | ······-·NIST-800-171-3.1.8 | 753 | ······-·NIST-800-171-3.1.8 |
| 754 | ······-·NIST-800-53-AU-12(c) | 754 | ······-·NIST-800-53-AU-12(c) |
| Offset 766, 16 lines modified | Offset 766, 16 lines modified | ||
| 766 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 766 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| 767 | ······lineinfile: | 767 | ······lineinfile: |
| 768 | ········path:·'{{·all_files[0]·}}' | 768 | ········path:·'{{·all_files[0]·}}' |
| 769 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 769 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 770 | ········create:·true | 770 | ········create:·true |
| 771 | ········mode:·'0640' | 771 | ········mode:·'0640' |
| 772 | ······when: | 772 | ······when: |
| 773 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 774 | ······-·'"audit"·in·ansible_facts.packages' | 773 | ······-·'"audit"·in·ansible_facts.packages' |
| 774 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 775 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 775 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 776 | ········==·0 | 776 | ········==·0 |
| 777 | ······tags: | 777 | ······tags: |
| 778 | ······-·CCE-27168-4 | 778 | ······-·CCE-27168-4 |
| 779 | ······-·CJIS-5.4.1.1 | 779 | ······-·CJIS-5.4.1.1 |
| 780 | ······-·NIST-800-171-3.1.8 | 780 | ······-·NIST-800-171-3.1.8 |
| 781 | ······-·NIST-800-53-AU-12(c) | 781 | ······-·NIST-800-53-AU-12(c) |
| Offset 792, 16 lines modified | Offset 792, 16 lines modified | ||
| 792 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules | 792 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules |
| 793 | ······find: | 793 | ······find: |
| 794 | ········paths:·/etc/audit/ | 794 | ········paths:·/etc/audit/ |
| 795 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 795 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 796 | ········patterns:·audit.rules | 796 | ········patterns:·audit.rules |
| 797 | ······register:·find_existing_watch_audit_rules | 797 | ······register:·find_existing_watch_audit_rules |
| 798 | ······when: | 798 | ······when: |
| 799 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 800 | ······-·'"audit"·in·ansible_facts.packages' | 799 | ······-·'"audit"·in·ansible_facts.packages' |
| 800 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 801 | ······tags: | 801 | ······tags: |
| 802 | ······-·CCE-27168-4 | 802 | ······-·CCE-27168-4 |
| 803 | ······-·CJIS-5.4.1.1 | 803 | ······-·CJIS-5.4.1.1 |
| 804 | ······-·NIST-800-171-3.1.8 | 804 | ······-·NIST-800-171-3.1.8 |
| 805 | ······-·NIST-800-53-AU-12(c) | 805 | ······-·NIST-800-53-AU-12(c) |
| 806 | ······-·NIST-800-53-AU-2(d) | 806 | ······-·NIST-800-53-AU-2(d) |
| 807 | ······-·NIST-800-53-CM-6(a) | 807 | ······-·NIST-800-53-CM-6(a) |
| Offset 817, 16 lines modified | Offset 817, 16 lines modified | ||
| 817 | ······lineinfile: | 817 | ······lineinfile: |
| 818 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 818 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 819 | ········state:·present | 819 | ········state:·present |
| 820 | ········dest:·/etc/audit/audit.rules | 820 | ········dest:·/etc/audit/audit.rules |
| 821 | ········create:·true | 821 | ········create:·true |
| 822 | ········mode:·'0640' | 822 | ········mode:·'0640' |
| 823 | ······when: | 823 | ······when: |
| 824 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 825 | ······-·'"audit"·in·ansible_facts.packages' | 824 | ······-·'"audit"·in·ansible_facts.packages' |
| 825 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 826 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched | 826 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched |
| 827 | ········==·0 | 827 | ········==·0 |
| 828 | ······tags: | 828 | ······tags: |
| 829 | ······-·CCE-27168-4 | 829 | ······-·CCE-27168-4 |
| 830 | ······-·CJIS-5.4.1.1 | 830 | ······-·CJIS-5.4.1.1 |
| 831 | ······-·NIST-800-171-3.1.8 | 831 | ······-·NIST-800-171-3.1.8 |
| 832 | ······-·NIST-800-53-AU-12(c) | 832 | ······-·NIST-800-53-AU-12(c) |
| Offset 861, 16 lines modified | Offset 861, 16 lines modified | ||
| 861 | ······-·reboot_required | 861 | ······-·reboot_required |
| Max diff block lines reached; 80706/85868 bytes (93.99%) of diff not shown. | |||
| Offset 9553, 16 lines modified | Offset 9553, 16 lines modified | ||
| 9553 | ······-·reboot_required | 9553 | ······-·reboot_required |
| 9554 | ······-·restrict_strategy | 9554 | ······-·restrict_strategy |
| 9555 | ····-·name:·Set·architecture·for·audit·mount·tasks | 9555 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 9556 | ······set_fact: | 9556 | ······set_fact: |
| 9557 | ········audit_arch:·b64 | 9557 | ········audit_arch:·b64 |
| 9558 | ······when: | 9558 | ······when: |
| 9559 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9560 | ······-·'"audit"·in·ansible_facts.packages' | 9559 | ······-·'"audit"·in·ansible_facts.packages' |
| 9560 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9561 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 9561 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 9562 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 9562 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 9563 | ······tags: | 9563 | ······tags: |
| 9564 | ······-·CCE-27447-2 | 9564 | ······-·CCE-27447-2 |
| 9565 | ······-·CJIS-5.4.1.1 | 9565 | ······-·CJIS-5.4.1.1 |
| 9566 | ······-·DISA-STIG-RHEL-07-030740 | 9566 | ······-·DISA-STIG-RHEL-07-030740 |
| 9567 | ······-·NIST-800-171-3.1.7 | 9567 | ······-·NIST-800-171-3.1.7 |
| Offset 9695, 16 lines modified | Offset 9695, 16 lines modified | ||
| 9695 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9695 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9696 | ············-F·auid!=unset·-F·key=perm_mod | 9696 | ············-F·auid!=unset·-F·key=perm_mod |
| 9697 | ··········create:·true | 9697 | ··········create:·true |
| 9698 | ··········mode:·o-rwx | 9698 | ··········mode:·o-rwx |
| 9699 | ··········state:·present | 9699 | ··········state:·present |
| 9700 | ········when:·syscalls_found·|·length·==·0 | 9700 | ········when:·syscalls_found·|·length·==·0 |
| 9701 | ······when: | 9701 | ······when: |
| 9702 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9703 | ······-·'"audit"·in·ansible_facts.packages' | 9702 | ······-·'"audit"·in·ansible_facts.packages' |
| 9703 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9704 | ······tags: | 9704 | ······tags: |
| 9705 | ······-·CCE-27447-2 | 9705 | ······-·CCE-27447-2 |
| 9706 | ······-·CJIS-5.4.1.1 | 9706 | ······-·CJIS-5.4.1.1 |
| 9707 | ······-·DISA-STIG-RHEL-07-030740 | 9707 | ······-·DISA-STIG-RHEL-07-030740 |
| 9708 | ······-·NIST-800-171-3.1.7 | 9708 | ······-·NIST-800-171-3.1.7 |
| 9709 | ······-·NIST-800-53-AC-6(9) | 9709 | ······-·NIST-800-53-AC-6(9) |
| 9710 | ······-·NIST-800-53-AU-12(c) | 9710 | ······-·NIST-800-53-AU-12(c) |
| Offset 9835, 16 lines modified | Offset 9835, 16 lines modified | ||
| 9835 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9835 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9836 | ············-F·auid!=unset·-F·key=perm_mod | 9836 | ············-F·auid!=unset·-F·key=perm_mod |
| 9837 | ··········create:·true | 9837 | ··········create:·true |
| 9838 | ··········mode:·o-rwx | 9838 | ··········mode:·o-rwx |
| 9839 | ··········state:·present | 9839 | ··········state:·present |
| 9840 | ········when:·syscalls_found·|·length·==·0 | 9840 | ········when:·syscalls_found·|·length·==·0 |
| 9841 | ······when: | 9841 | ······when: |
| 9842 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9843 | ······-·'"audit"·in·ansible_facts.packages' | 9842 | ······-·'"audit"·in·ansible_facts.packages' |
| 9843 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9844 | ······-·audit_arch·==·"b64" | 9844 | ······-·audit_arch·==·"b64" |
| 9845 | ······tags: | 9845 | ······tags: |
| 9846 | ······-·CCE-27447-2 | 9846 | ······-·CCE-27447-2 |
| 9847 | ······-·CJIS-5.4.1.1 | 9847 | ······-·CJIS-5.4.1.1 |
| 9848 | ······-·DISA-STIG-RHEL-07-030740 | 9848 | ······-·DISA-STIG-RHEL-07-030740 |
| 9849 | ······-·NIST-800-171-3.1.7 | 9849 | ······-·NIST-800-171-3.1.7 |
| 9850 | ······-·NIST-800-53-AC-6(9) | 9850 | ······-·NIST-800-53-AC-6(9) |
| Offset 9878, 16 lines modified | Offset 9878, 16 lines modified | ||
| 9878 | ······-·medium_severity | 9878 | ······-·medium_severity |
| 9879 | ······-·no_reboot_needed | 9879 | ······-·no_reboot_needed |
| 9880 | ······-·restrict_strategy | 9880 | ······-·restrict_strategy |
| 9881 | ····-·name:·Service·facts | 9881 | ····-·name:·Service·facts |
| 9882 | ······service_facts:·null | 9882 | ······service_facts:·null |
| 9883 | ······when: | 9883 | ······when: |
| 9884 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9885 | ······-·'"audit"·in·ansible_facts.packages' | 9884 | ······-·'"audit"·in·ansible_facts.packages' |
| 9885 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9886 | ······tags: | 9886 | ······tags: |
| 9887 | ······-·CCE-83555-3 | 9887 | ······-·CCE-83555-3 |
| 9888 | ······-·DISA-STIG-RHEL-07-030360 | 9888 | ······-·DISA-STIG-RHEL-07-030360 |
| 9889 | ······-·NIST-800-53-AC-6(9) | 9889 | ······-·NIST-800-53-AC-6(9) |
| 9890 | ······-·NIST-800-53-AU-12(3) | 9890 | ······-·NIST-800-53-AU-12(3) |
| 9891 | ······-·NIST-800-53-AU-7(a) | 9891 | ······-·NIST-800-53-AU-7(a) |
| 9892 | ······-·NIST-800-53-AU-7(b) | 9892 | ······-·NIST-800-53-AU-7(b) |
| Offset 9900, 16 lines modified | Offset 9900, 16 lines modified | ||
| 9900 | ······-·no_reboot_needed | 9900 | ······-·no_reboot_needed |
| 9901 | ······-·restrict_strategy | 9901 | ······-·restrict_strategy |
| 9902 | ····-·name:·Check·the·rules·script·being·used | 9902 | ····-·name:·Check·the·rules·script·being·used |
| 9903 | ······command:·grep·'^ExecStartPost'·/usr/lib/systemd/system/auditd.service | 9903 | ······command:·grep·'^ExecStartPost'·/usr/lib/systemd/system/auditd.service |
| 9904 | ······register:·check_rules_scripts_result | 9904 | ······register:·check_rules_scripts_result |
| 9905 | ······when: | 9905 | ······when: |
| 9906 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9907 | ······-·'"audit"·in·ansible_facts.packages' | 9906 | ······-·'"audit"·in·ansible_facts.packages' |
| 9907 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9908 | ······tags: | 9908 | ······tags: |
| 9909 | ······-·CCE-83555-3 | 9909 | ······-·CCE-83555-3 |
| 9910 | ······-·DISA-STIG-RHEL-07-030360 | 9910 | ······-·DISA-STIG-RHEL-07-030360 |
| 9911 | ······-·NIST-800-53-AC-6(9) | 9911 | ······-·NIST-800-53-AC-6(9) |
| 9912 | ······-·NIST-800-53-AU-12(3) | 9912 | ······-·NIST-800-53-AU-12(3) |
| 9913 | ······-·NIST-800-53-AU-7(a) | 9913 | ······-·NIST-800-53-AU-7(a) |
| 9914 | ······-·NIST-800-53-AU-7(b) | 9914 | ······-·NIST-800-53-AU-7(b) |
| Offset 9926, 16 lines modified | Offset 9926, 16 lines modified | ||
| 9926 | ······set_fact: | 9926 | ······set_fact: |
| 9927 | ········suid_audit_rules: | 9927 | ········suid_audit_rules: |
| 9928 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid | 9928 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid |
| 9929 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid | 9929 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid |
| 9930 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid | 9930 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid |
| 9931 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid | 9931 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid |
| 9932 | ······when: | 9932 | ······when: |
| 9933 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9934 | ······-·'"audit"·in·ansible_facts.packages' | 9933 | ······-·'"audit"·in·ansible_facts.packages' |
| 9934 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9935 | ······tags: | 9935 | ······tags: |
| 9936 | ······-·CCE-83555-3 | 9936 | ······-·CCE-83555-3 |
| 9937 | ······-·DISA-STIG-RHEL-07-030360 | 9937 | ······-·DISA-STIG-RHEL-07-030360 |
| 9938 | ······-·NIST-800-53-AC-6(9) | 9938 | ······-·NIST-800-53-AC-6(9) |
| 9939 | ······-·NIST-800-53-AU-12(3) | 9939 | ······-·NIST-800-53-AU-12(3) |
| 9940 | ······-·NIST-800-53-AU-7(a) | 9940 | ······-·NIST-800-53-AU-7(a) |
| 9941 | ······-·NIST-800-53-AU-7(b) | 9941 | ······-·NIST-800-53-AU-7(b) |
| Offset 9950, 16 lines modified | Offset 9950, 16 lines modified | ||
| 9950 | ····-·name:·Update·/etc/audit/rules.d/privileged.rules·to·audit·privileged·functions | 9950 | ····-·name:·Update·/etc/audit/rules.d/privileged.rules·to·audit·privileged·functions |
| 9951 | ······lineinfile: | 9951 | ······lineinfile: |
| 9952 | ········path:·/etc/audit/rules.d/privileged.rules | 9952 | ········path:·/etc/audit/rules.d/privileged.rules |
| 9953 | ········line:·'{{··item··}}' | 9953 | ········line:·'{{··item··}}' |
| 9954 | ········create:·true | 9954 | ········create:·true |
| 9955 | ······when: | 9955 | ······when: |
| 9956 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9957 | ······-·'"audit"·in·ansible_facts.packages' | 9956 | ······-·'"audit"·in·ansible_facts.packages' |
| 9957 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9958 | ······-·'"auditd.service"·in·ansible_facts.services' | 9958 | ······-·'"auditd.service"·in·ansible_facts.services' |
| 9959 | ······-·'"augenrules"·in·check_rules_scripts_result.stdout' | 9959 | ······-·'"augenrules"·in·check_rules_scripts_result.stdout' |
| 9960 | ······register:·augenrules_audit_rules_privilege_function_update_result | 9960 | ······register:·augenrules_audit_rules_privilege_function_update_result |
| 9961 | ······with_items:·'{{·suid_audit_rules·}}' | 9961 | ······with_items:·'{{·suid_audit_rules·}}' |
| 9962 | ······tags: | 9962 | ······tags: |
| 9963 | ······-·CCE-83555-3 | 9963 | ······-·CCE-83555-3 |
| 9964 | ······-·DISA-STIG-RHEL-07-030360 | 9964 | ······-·DISA-STIG-RHEL-07-030360 |
| Offset 9978, 16 lines modified | Offset 9978, 16 lines modified | ||
| Max diff block lines reached; 141490/146602 bytes (96.51%) of diff not shown. | |||
| Offset 9558, 16 lines modified | Offset 9558, 16 lines modified | ||
| 9558 | ······-·reboot_required | 9558 | ······-·reboot_required |
| 9559 | ······-·restrict_strategy | 9559 | ······-·restrict_strategy |
| 9560 | ····-·name:·Set·architecture·for·audit·mount·tasks | 9560 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 9561 | ······set_fact: | 9561 | ······set_fact: |
| 9562 | ········audit_arch:·b64 | 9562 | ········audit_arch:·b64 |
| 9563 | ······when: | 9563 | ······when: |
| 9564 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9565 | ······-·'"audit"·in·ansible_facts.packages' | 9564 | ······-·'"audit"·in·ansible_facts.packages' |
| 9565 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9566 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 9566 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 9567 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 9567 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 9568 | ······tags: | 9568 | ······tags: |
| 9569 | ······-·CCE-27447-2 | 9569 | ······-·CCE-27447-2 |
| 9570 | ······-·CJIS-5.4.1.1 | 9570 | ······-·CJIS-5.4.1.1 |
| 9571 | ······-·DISA-STIG-RHEL-07-030740 | 9571 | ······-·DISA-STIG-RHEL-07-030740 |
| 9572 | ······-·NIST-800-171-3.1.7 | 9572 | ······-·NIST-800-171-3.1.7 |
| Offset 9700, 16 lines modified | Offset 9700, 16 lines modified | ||
| 9700 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9700 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9701 | ············-F·auid!=unset·-F·key=perm_mod | 9701 | ············-F·auid!=unset·-F·key=perm_mod |
| 9702 | ··········create:·true | 9702 | ··········create:·true |
| 9703 | ··········mode:·o-rwx | 9703 | ··········mode:·o-rwx |
| 9704 | ··········state:·present | 9704 | ··········state:·present |
| 9705 | ········when:·syscalls_found·|·length·==·0 | 9705 | ········when:·syscalls_found·|·length·==·0 |
| 9706 | ······when: | 9706 | ······when: |
| 9707 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9708 | ······-·'"audit"·in·ansible_facts.packages' | 9707 | ······-·'"audit"·in·ansible_facts.packages' |
| 9708 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9709 | ······tags: | 9709 | ······tags: |
| 9710 | ······-·CCE-27447-2 | 9710 | ······-·CCE-27447-2 |
| 9711 | ······-·CJIS-5.4.1.1 | 9711 | ······-·CJIS-5.4.1.1 |
| 9712 | ······-·DISA-STIG-RHEL-07-030740 | 9712 | ······-·DISA-STIG-RHEL-07-030740 |
| 9713 | ······-·NIST-800-171-3.1.7 | 9713 | ······-·NIST-800-171-3.1.7 |
| 9714 | ······-·NIST-800-53-AC-6(9) | 9714 | ······-·NIST-800-53-AC-6(9) |
| 9715 | ······-·NIST-800-53-AU-12(c) | 9715 | ······-·NIST-800-53-AU-12(c) |
| Offset 9840, 16 lines modified | Offset 9840, 16 lines modified | ||
| 9840 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 9840 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 9841 | ············-F·auid!=unset·-F·key=perm_mod | 9841 | ············-F·auid!=unset·-F·key=perm_mod |
| 9842 | ··········create:·true | 9842 | ··········create:·true |
| 9843 | ··········mode:·o-rwx | 9843 | ··········mode:·o-rwx |
| 9844 | ··········state:·present | 9844 | ··········state:·present |
| 9845 | ········when:·syscalls_found·|·length·==·0 | 9845 | ········when:·syscalls_found·|·length·==·0 |
| 9846 | ······when: | 9846 | ······when: |
| 9847 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9848 | ······-·'"audit"·in·ansible_facts.packages' | 9847 | ······-·'"audit"·in·ansible_facts.packages' |
| 9848 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9849 | ······-·audit_arch·==·"b64" | 9849 | ······-·audit_arch·==·"b64" |
| 9850 | ······tags: | 9850 | ······tags: |
| 9851 | ······-·CCE-27447-2 | 9851 | ······-·CCE-27447-2 |
| 9852 | ······-·CJIS-5.4.1.1 | 9852 | ······-·CJIS-5.4.1.1 |
| 9853 | ······-·DISA-STIG-RHEL-07-030740 | 9853 | ······-·DISA-STIG-RHEL-07-030740 |
| 9854 | ······-·NIST-800-171-3.1.7 | 9854 | ······-·NIST-800-171-3.1.7 |
| 9855 | ······-·NIST-800-53-AC-6(9) | 9855 | ······-·NIST-800-53-AC-6(9) |
| Offset 9883, 16 lines modified | Offset 9883, 16 lines modified | ||
| 9883 | ······-·medium_severity | 9883 | ······-·medium_severity |
| 9884 | ······-·no_reboot_needed | 9884 | ······-·no_reboot_needed |
| 9885 | ······-·restrict_strategy | 9885 | ······-·restrict_strategy |
| 9886 | ····-·name:·Service·facts | 9886 | ····-·name:·Service·facts |
| 9887 | ······service_facts:·null | 9887 | ······service_facts:·null |
| 9888 | ······when: | 9888 | ······when: |
| 9889 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9890 | ······-·'"audit"·in·ansible_facts.packages' | 9889 | ······-·'"audit"·in·ansible_facts.packages' |
| 9890 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9891 | ······tags: | 9891 | ······tags: |
| 9892 | ······-·CCE-83555-3 | 9892 | ······-·CCE-83555-3 |
| 9893 | ······-·DISA-STIG-RHEL-07-030360 | 9893 | ······-·DISA-STIG-RHEL-07-030360 |
| 9894 | ······-·NIST-800-53-AC-6(9) | 9894 | ······-·NIST-800-53-AC-6(9) |
| 9895 | ······-·NIST-800-53-AU-12(3) | 9895 | ······-·NIST-800-53-AU-12(3) |
| 9896 | ······-·NIST-800-53-AU-7(a) | 9896 | ······-·NIST-800-53-AU-7(a) |
| 9897 | ······-·NIST-800-53-AU-7(b) | 9897 | ······-·NIST-800-53-AU-7(b) |
| Offset 9905, 16 lines modified | Offset 9905, 16 lines modified | ||
| 9905 | ······-·no_reboot_needed | 9905 | ······-·no_reboot_needed |
| 9906 | ······-·restrict_strategy | 9906 | ······-·restrict_strategy |
| 9907 | ····-·name:·Check·the·rules·script·being·used | 9907 | ····-·name:·Check·the·rules·script·being·used |
| 9908 | ······command:·grep·'^ExecStartPost'·/usr/lib/systemd/system/auditd.service | 9908 | ······command:·grep·'^ExecStartPost'·/usr/lib/systemd/system/auditd.service |
| 9909 | ······register:·check_rules_scripts_result | 9909 | ······register:·check_rules_scripts_result |
| 9910 | ······when: | 9910 | ······when: |
| 9911 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9912 | ······-·'"audit"·in·ansible_facts.packages' | 9911 | ······-·'"audit"·in·ansible_facts.packages' |
| 9912 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9913 | ······tags: | 9913 | ······tags: |
| 9914 | ······-·CCE-83555-3 | 9914 | ······-·CCE-83555-3 |
| 9915 | ······-·DISA-STIG-RHEL-07-030360 | 9915 | ······-·DISA-STIG-RHEL-07-030360 |
| 9916 | ······-·NIST-800-53-AC-6(9) | 9916 | ······-·NIST-800-53-AC-6(9) |
| 9917 | ······-·NIST-800-53-AU-12(3) | 9917 | ······-·NIST-800-53-AU-12(3) |
| 9918 | ······-·NIST-800-53-AU-7(a) | 9918 | ······-·NIST-800-53-AU-7(a) |
| 9919 | ······-·NIST-800-53-AU-7(b) | 9919 | ······-·NIST-800-53-AU-7(b) |
| Offset 9931, 16 lines modified | Offset 9931, 16 lines modified | ||
| 9931 | ······set_fact: | 9931 | ······set_fact: |
| 9932 | ········suid_audit_rules: | 9932 | ········suid_audit_rules: |
| 9933 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid | 9933 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid |
| 9934 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid | 9934 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·gid!=egid·-F·egid=0·-k·setgid |
| 9935 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid | 9935 | ········-·-a·always,exit·-F·arch=b32·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid |
| 9936 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid | 9936 | ········-·-a·always,exit·-F·arch=b64·-S·execve·-C·uid!=euid·-F·euid=0·-k·setuid |
| 9937 | ······when: | 9937 | ······when: |
| 9938 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9939 | ······-·'"audit"·in·ansible_facts.packages' | 9938 | ······-·'"audit"·in·ansible_facts.packages' |
| 9939 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9940 | ······tags: | 9940 | ······tags: |
| 9941 | ······-·CCE-83555-3 | 9941 | ······-·CCE-83555-3 |
| 9942 | ······-·DISA-STIG-RHEL-07-030360 | 9942 | ······-·DISA-STIG-RHEL-07-030360 |
| 9943 | ······-·NIST-800-53-AC-6(9) | 9943 | ······-·NIST-800-53-AC-6(9) |
| 9944 | ······-·NIST-800-53-AU-12(3) | 9944 | ······-·NIST-800-53-AU-12(3) |
| 9945 | ······-·NIST-800-53-AU-7(a) | 9945 | ······-·NIST-800-53-AU-7(a) |
| 9946 | ······-·NIST-800-53-AU-7(b) | 9946 | ······-·NIST-800-53-AU-7(b) |
| Offset 9955, 16 lines modified | Offset 9955, 16 lines modified | ||
| 9955 | ····-·name:·Update·/etc/audit/rules.d/privileged.rules·to·audit·privileged·functions | 9955 | ····-·name:·Update·/etc/audit/rules.d/privileged.rules·to·audit·privileged·functions |
| 9956 | ······lineinfile: | 9956 | ······lineinfile: |
| 9957 | ········path:·/etc/audit/rules.d/privileged.rules | 9957 | ········path:·/etc/audit/rules.d/privileged.rules |
| 9958 | ········line:·'{{··item··}}' | 9958 | ········line:·'{{··item··}}' |
| 9959 | ········create:·true | 9959 | ········create:·true |
| 9960 | ······when: | 9960 | ······when: |
| 9961 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9962 | ······-·'"audit"·in·ansible_facts.packages' | 9961 | ······-·'"audit"·in·ansible_facts.packages' |
| 9962 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 9963 | ······-·'"auditd.service"·in·ansible_facts.services' | 9963 | ······-·'"auditd.service"·in·ansible_facts.services' |
| 9964 | ······-·'"augenrules"·in·check_rules_scripts_result.stdout' | 9964 | ······-·'"augenrules"·in·check_rules_scripts_result.stdout' |
| 9965 | ······register:·augenrules_audit_rules_privilege_function_update_result | 9965 | ······register:·augenrules_audit_rules_privilege_function_update_result |
| 9966 | ······with_items:·'{{·suid_audit_rules·}}' | 9966 | ······with_items:·'{{·suid_audit_rules·}}' |
| 9967 | ······tags: | 9967 | ······tags: |
| 9968 | ······-·CCE-83555-3 | 9968 | ······-·CCE-83555-3 |
| 9969 | ······-·DISA-STIG-RHEL-07-030360 | 9969 | ······-·DISA-STIG-RHEL-07-030360 |
| Offset 9983, 16 lines modified | Offset 9983, 16 lines modified | ||
| Max diff block lines reached; 141490/146602 bytes (96.51%) of diff not shown. | |||
| Offset 22273, 16 lines modified | Offset 22273, 16 lines modified | ||
| 22273 | ······-·no_reboot_needed | 22273 | ······-·no_reboot_needed |
| 22274 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22274 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22275 | ······stat: | 22275 | ······stat: |
| 22276 | ········path:·/boot/grub2/grub.cfg | 22276 | ········path:·/boot/grub2/grub.cfg |
| 22277 | ······register:·file_exists | 22277 | ······register:·file_exists |
| 22278 | ······when: | 22278 | ······when: |
| 22279 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22280 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22279 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22280 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22281 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22281 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22282 | ······tags: | 22282 | ······tags: |
| 22283 | ······-·CCE-80800-6 | 22283 | ······-·CCE-80800-6 |
| 22284 | ······-·CJIS-5.5.2.2 | 22284 | ······-·CJIS-5.5.2.2 |
| 22285 | ······-·NIST-800-171-3.4.5 | 22285 | ······-·NIST-800-171-3.4.5 |
| 22286 | ······-·NIST-800-53-AC-6(1) | 22286 | ······-·NIST-800-53-AC-6(1) |
| 22287 | ······-·NIST-800-53-CM-6(a) | 22287 | ······-·NIST-800-53-CM-6(a) |
| Offset 22295, 16 lines modified | Offset 22295, 16 lines modified | ||
| 22295 | ······-·no_reboot_needed | 22295 | ······-·no_reboot_needed |
| 22296 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 22296 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 22297 | ······file: | 22297 | ······file: |
| 22298 | ········path:·/boot/grub2/grub.cfg | 22298 | ········path:·/boot/grub2/grub.cfg |
| 22299 | ········group:·'0' | 22299 | ········group:·'0' |
| 22300 | ······when: | 22300 | ······when: |
| 22301 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22302 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22301 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22302 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22303 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22303 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22304 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22304 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22305 | ······tags: | 22305 | ······tags: |
| 22306 | ······-·CCE-80800-6 | 22306 | ······-·CCE-80800-6 |
| 22307 | ······-·CJIS-5.5.2.2 | 22307 | ······-·CJIS-5.5.2.2 |
| 22308 | ······-·NIST-800-171-3.4.5 | 22308 | ······-·NIST-800-171-3.4.5 |
| 22309 | ······-·NIST-800-53-AC-6(1) | 22309 | ······-·NIST-800-53-AC-6(1) |
| Offset 22336, 16 lines modified | Offset 22336, 16 lines modified | ||
| 22336 | ······-·no_reboot_needed | 22336 | ······-·no_reboot_needed |
| 22337 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 22337 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 22338 | ······stat: | 22338 | ······stat: |
| 22339 | ········path:·/boot/grub2/user.cfg | 22339 | ········path:·/boot/grub2/user.cfg |
| 22340 | ······register:·file_exists | 22340 | ······register:·file_exists |
| 22341 | ······when: | 22341 | ······when: |
| 22342 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22343 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22342 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22343 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22345 | ······tags: | 22345 | ······tags: |
| 22346 | ······-·CCE-86009-8 | 22346 | ······-·CCE-86009-8 |
| 22347 | ······-·CJIS-5.5.2.2 | 22347 | ······-·CJIS-5.5.2.2 |
| 22348 | ······-·NIST-800-171-3.4.5 | 22348 | ······-·NIST-800-171-3.4.5 |
| 22349 | ······-·NIST-800-53-AC-6(1) | 22349 | ······-·NIST-800-53-AC-6(1) |
| 22350 | ······-·NIST-800-53-CM-6(a) | 22350 | ······-·NIST-800-53-CM-6(a) |
| Offset 22358, 16 lines modified | Offset 22358, 16 lines modified | ||
| 22358 | ······-·no_reboot_needed | 22358 | ······-·no_reboot_needed |
| 22359 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 22359 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 22360 | ······file: | 22360 | ······file: |
| 22361 | ········path:·/boot/grub2/user.cfg | 22361 | ········path:·/boot/grub2/user.cfg |
| 22362 | ········group:·'0' | 22362 | ········group:·'0' |
| 22363 | ······when: | 22363 | ······when: |
| 22364 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22365 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22364 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22365 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22367 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22367 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22368 | ······tags: | 22368 | ······tags: |
| 22369 | ······-·CCE-86009-8 | 22369 | ······-·CCE-86009-8 |
| 22370 | ······-·CJIS-5.5.2.2 | 22370 | ······-·CJIS-5.5.2.2 |
| 22371 | ······-·NIST-800-171-3.4.5 | 22371 | ······-·NIST-800-171-3.4.5 |
| 22372 | ······-·NIST-800-53-AC-6(1) | 22372 | ······-·NIST-800-53-AC-6(1) |
| Offset 22399, 16 lines modified | Offset 22399, 16 lines modified | ||
| 22399 | ······-·no_reboot_needed | 22399 | ······-·no_reboot_needed |
| 22400 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22400 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22401 | ······stat: | 22401 | ······stat: |
| 22402 | ········path:·/boot/grub2/grub.cfg | 22402 | ········path:·/boot/grub2/grub.cfg |
| 22403 | ······register:·file_exists | 22403 | ······register:·file_exists |
| 22404 | ······when: | 22404 | ······when: |
| 22405 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22406 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22405 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22406 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22407 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22407 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22408 | ······tags: | 22408 | ······tags: |
| 22409 | ······-·CCE-80805-5 | 22409 | ······-·CCE-80805-5 |
| 22410 | ······-·CJIS-5.5.2.2 | 22410 | ······-·CJIS-5.5.2.2 |
| 22411 | ······-·NIST-800-171-3.4.5 | 22411 | ······-·NIST-800-171-3.4.5 |
| 22412 | ······-·NIST-800-53-AC-6(1) | 22412 | ······-·NIST-800-53-AC-6(1) |
| 22413 | ······-·NIST-800-53-CM-6(a) | 22413 | ······-·NIST-800-53-CM-6(a) |
| Offset 22421, 16 lines modified | Offset 22421, 16 lines modified | ||
| 22421 | ······-·no_reboot_needed | 22421 | ······-·no_reboot_needed |
| 22422 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 22422 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 22423 | ······file: | 22423 | ······file: |
| 22424 | ········path:·/boot/grub2/grub.cfg | 22424 | ········path:·/boot/grub2/grub.cfg |
| 22425 | ········owner:·'0' | 22425 | ········owner:·'0' |
| 22426 | ······when: | 22426 | ······when: |
| 22427 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22428 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22427 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22428 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22429 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22429 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22430 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22430 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22431 | ······tags: | 22431 | ······tags: |
| 22432 | ······-·CCE-80805-5 | 22432 | ······-·CCE-80805-5 |
| 22433 | ······-·CJIS-5.5.2.2 | 22433 | ······-·CJIS-5.5.2.2 |
| 22434 | ······-·NIST-800-171-3.4.5 | 22434 | ······-·NIST-800-171-3.4.5 |
| 22435 | ······-·NIST-800-53-AC-6(1) | 22435 | ······-·NIST-800-53-AC-6(1) |
| Offset 22462, 16 lines modified | Offset 22462, 16 lines modified | ||
| 22462 | ······-·no_reboot_needed | 22462 | ······-·no_reboot_needed |
| 22463 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 22463 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 22464 | ······stat: | 22464 | ······stat: |
| 22465 | ········path:·/boot/grub2/user.cfg | 22465 | ········path:·/boot/grub2/user.cfg |
| 22466 | ······register:·file_exists | 22466 | ······register:·file_exists |
| 22467 | ······when: | 22467 | ······when: |
| 22468 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22469 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22468 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22469 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22470 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22470 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22471 | ······tags: | 22471 | ······tags: |
| 22472 | ······-·CCE-86015-5 | 22472 | ······-·CCE-86015-5 |
| 22473 | ······-·CJIS-5.5.2.2 | 22473 | ······-·CJIS-5.5.2.2 |
| 22474 | ······-·NIST-800-171-3.4.5 | 22474 | ······-·NIST-800-171-3.4.5 |
| 22475 | ······-·NIST-800-53-AC-6(1) | 22475 | ······-·NIST-800-53-AC-6(1) |
| 22476 | ······-·NIST-800-53-CM-6(a) | 22476 | ······-·NIST-800-53-CM-6(a) |
| Offset 22484, 16 lines modified | Offset 22484, 16 lines modified | ||
| 22484 | ······-·no_reboot_needed | 22484 | ······-·no_reboot_needed |
| Max diff block lines reached; 11403/16034 bytes (71.12%) of diff not shown. | |||
| Offset 5473, 16 lines modified | Offset 5473, 16 lines modified | ||
| 5473 | ······-·no_reboot_needed | 5473 | ······-·no_reboot_needed |
| 5474 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5474 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5475 | ······stat: | 5475 | ······stat: |
| 5476 | ········path:·/boot/grub2/grub.cfg | 5476 | ········path:·/boot/grub2/grub.cfg |
| 5477 | ······register:·file_exists | 5477 | ······register:·file_exists |
| 5478 | ······when: | 5478 | ······when: |
| 5479 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5480 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5479 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5480 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5482 | ······tags: | 5482 | ······tags: |
| 5483 | ······-·CCE-80800-6 | 5483 | ······-·CCE-80800-6 |
| 5484 | ······-·CJIS-5.5.2.2 | 5484 | ······-·CJIS-5.5.2.2 |
| 5485 | ······-·NIST-800-171-3.4.5 | 5485 | ······-·NIST-800-171-3.4.5 |
| 5486 | ······-·NIST-800-53-AC-6(1) | 5486 | ······-·NIST-800-53-AC-6(1) |
| 5487 | ······-·NIST-800-53-CM-6(a) | 5487 | ······-·NIST-800-53-CM-6(a) |
| Offset 5495, 16 lines modified | Offset 5495, 16 lines modified | ||
| 5495 | ······-·no_reboot_needed | 5495 | ······-·no_reboot_needed |
| 5496 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5496 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5497 | ······file: | 5497 | ······file: |
| 5498 | ········path:·/boot/grub2/grub.cfg | 5498 | ········path:·/boot/grub2/grub.cfg |
| 5499 | ········group:·'0' | 5499 | ········group:·'0' |
| 5500 | ······when: | 5500 | ······when: |
| 5501 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5502 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5501 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5502 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5503 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5503 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5504 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5504 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5505 | ······tags: | 5505 | ······tags: |
| 5506 | ······-·CCE-80800-6 | 5506 | ······-·CCE-80800-6 |
| 5507 | ······-·CJIS-5.5.2.2 | 5507 | ······-·CJIS-5.5.2.2 |
| 5508 | ······-·NIST-800-171-3.4.5 | 5508 | ······-·NIST-800-171-3.4.5 |
| 5509 | ······-·NIST-800-53-AC-6(1) | 5509 | ······-·NIST-800-53-AC-6(1) |
| Offset 5536, 16 lines modified | Offset 5536, 16 lines modified | ||
| 5536 | ······-·no_reboot_needed | 5536 | ······-·no_reboot_needed |
| 5537 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5537 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5538 | ······stat: | 5538 | ······stat: |
| 5539 | ········path:·/boot/grub2/user.cfg | 5539 | ········path:·/boot/grub2/user.cfg |
| 5540 | ······register:·file_exists | 5540 | ······register:·file_exists |
| 5541 | ······when: | 5541 | ······when: |
| 5542 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5543 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5542 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5543 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5544 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5544 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5545 | ······tags: | 5545 | ······tags: |
| 5546 | ······-·CCE-86009-8 | 5546 | ······-·CCE-86009-8 |
| 5547 | ······-·CJIS-5.5.2.2 | 5547 | ······-·CJIS-5.5.2.2 |
| 5548 | ······-·NIST-800-171-3.4.5 | 5548 | ······-·NIST-800-171-3.4.5 |
| 5549 | ······-·NIST-800-53-AC-6(1) | 5549 | ······-·NIST-800-53-AC-6(1) |
| 5550 | ······-·NIST-800-53-CM-6(a) | 5550 | ······-·NIST-800-53-CM-6(a) |
| Offset 5558, 16 lines modified | Offset 5558, 16 lines modified | ||
| 5558 | ······-·no_reboot_needed | 5558 | ······-·no_reboot_needed |
| 5559 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5559 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5560 | ······file: | 5560 | ······file: |
| 5561 | ········path:·/boot/grub2/user.cfg | 5561 | ········path:·/boot/grub2/user.cfg |
| 5562 | ········group:·'0' | 5562 | ········group:·'0' |
| 5563 | ······when: | 5563 | ······when: |
| 5564 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5565 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5564 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5565 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5566 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5566 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5567 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5567 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5568 | ······tags: | 5568 | ······tags: |
| 5569 | ······-·CCE-86009-8 | 5569 | ······-·CCE-86009-8 |
| 5570 | ······-·CJIS-5.5.2.2 | 5570 | ······-·CJIS-5.5.2.2 |
| 5571 | ······-·NIST-800-171-3.4.5 | 5571 | ······-·NIST-800-171-3.4.5 |
| 5572 | ······-·NIST-800-53-AC-6(1) | 5572 | ······-·NIST-800-53-AC-6(1) |
| Offset 5599, 16 lines modified | Offset 5599, 16 lines modified | ||
| 5599 | ······-·no_reboot_needed | 5599 | ······-·no_reboot_needed |
| 5600 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5600 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5601 | ······stat: | 5601 | ······stat: |
| 5602 | ········path:·/boot/grub2/grub.cfg | 5602 | ········path:·/boot/grub2/grub.cfg |
| 5603 | ······register:·file_exists | 5603 | ······register:·file_exists |
| 5604 | ······when: | 5604 | ······when: |
| 5605 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5606 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5605 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5606 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5607 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5607 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5608 | ······tags: | 5608 | ······tags: |
| 5609 | ······-·CCE-80805-5 | 5609 | ······-·CCE-80805-5 |
| 5610 | ······-·CJIS-5.5.2.2 | 5610 | ······-·CJIS-5.5.2.2 |
| 5611 | ······-·NIST-800-171-3.4.5 | 5611 | ······-·NIST-800-171-3.4.5 |
| 5612 | ······-·NIST-800-53-AC-6(1) | 5612 | ······-·NIST-800-53-AC-6(1) |
| 5613 | ······-·NIST-800-53-CM-6(a) | 5613 | ······-·NIST-800-53-CM-6(a) |
| Offset 5621, 16 lines modified | Offset 5621, 16 lines modified | ||
| 5621 | ······-·no_reboot_needed | 5621 | ······-·no_reboot_needed |
| 5622 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5622 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5623 | ······file: | 5623 | ······file: |
| 5624 | ········path:·/boot/grub2/grub.cfg | 5624 | ········path:·/boot/grub2/grub.cfg |
| 5625 | ········owner:·'0' | 5625 | ········owner:·'0' |
| 5626 | ······when: | 5626 | ······when: |
| 5627 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5628 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5627 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5628 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5629 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5629 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5630 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5630 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5631 | ······tags: | 5631 | ······tags: |
| 5632 | ······-·CCE-80805-5 | 5632 | ······-·CCE-80805-5 |
| 5633 | ······-·CJIS-5.5.2.2 | 5633 | ······-·CJIS-5.5.2.2 |
| 5634 | ······-·NIST-800-171-3.4.5 | 5634 | ······-·NIST-800-171-3.4.5 |
| 5635 | ······-·NIST-800-53-AC-6(1) | 5635 | ······-·NIST-800-53-AC-6(1) |
| Offset 5662, 16 lines modified | Offset 5662, 16 lines modified | ||
| 5662 | ······-·no_reboot_needed | 5662 | ······-·no_reboot_needed |
| 5663 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5663 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5664 | ······stat: | 5664 | ······stat: |
| 5665 | ········path:·/boot/grub2/user.cfg | 5665 | ········path:·/boot/grub2/user.cfg |
| 5666 | ······register:·file_exists | 5666 | ······register:·file_exists |
| 5667 | ······when: | 5667 | ······when: |
| 5668 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5669 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5668 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5669 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5670 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5670 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5671 | ······tags: | 5671 | ······tags: |
| 5672 | ······-·CCE-86015-5 | 5672 | ······-·CCE-86015-5 |
| 5673 | ······-·CJIS-5.5.2.2 | 5673 | ······-·CJIS-5.5.2.2 |
| 5674 | ······-·NIST-800-171-3.4.5 | 5674 | ······-·NIST-800-171-3.4.5 |
| 5675 | ······-·NIST-800-53-AC-6(1) | 5675 | ······-·NIST-800-53-AC-6(1) |
| 5676 | ······-·NIST-800-53-CM-6(a) | 5676 | ······-·NIST-800-53-CM-6(a) |
| Offset 5684, 16 lines modified | Offset 5684, 16 lines modified | ||
| 5684 | ······-·no_reboot_needed | 5684 | ······-·no_reboot_needed |
| Max diff block lines reached; 11371/15986 bytes (71.13%) of diff not shown. | |||
| Offset 5473, 16 lines modified | Offset 5473, 16 lines modified | ||
| 5473 | ······-·no_reboot_needed | 5473 | ······-·no_reboot_needed |
| 5474 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5474 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5475 | ······stat: | 5475 | ······stat: |
| 5476 | ········path:·/boot/grub2/grub.cfg | 5476 | ········path:·/boot/grub2/grub.cfg |
| 5477 | ······register:·file_exists | 5477 | ······register:·file_exists |
| 5478 | ······when: | 5478 | ······when: |
| 5479 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5480 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5479 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5480 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5482 | ······tags: | 5482 | ······tags: |
| 5483 | ······-·CCE-80800-6 | 5483 | ······-·CCE-80800-6 |
| 5484 | ······-·CJIS-5.5.2.2 | 5484 | ······-·CJIS-5.5.2.2 |
| 5485 | ······-·NIST-800-171-3.4.5 | 5485 | ······-·NIST-800-171-3.4.5 |
| 5486 | ······-·NIST-800-53-AC-6(1) | 5486 | ······-·NIST-800-53-AC-6(1) |
| 5487 | ······-·NIST-800-53-CM-6(a) | 5487 | ······-·NIST-800-53-CM-6(a) |
| Offset 5495, 16 lines modified | Offset 5495, 16 lines modified | ||
| 5495 | ······-·no_reboot_needed | 5495 | ······-·no_reboot_needed |
| 5496 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5496 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5497 | ······file: | 5497 | ······file: |
| 5498 | ········path:·/boot/grub2/grub.cfg | 5498 | ········path:·/boot/grub2/grub.cfg |
| 5499 | ········group:·'0' | 5499 | ········group:·'0' |
| 5500 | ······when: | 5500 | ······when: |
| 5501 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5502 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5501 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5502 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5503 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5503 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5504 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5504 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5505 | ······tags: | 5505 | ······tags: |
| 5506 | ······-·CCE-80800-6 | 5506 | ······-·CCE-80800-6 |
| 5507 | ······-·CJIS-5.5.2.2 | 5507 | ······-·CJIS-5.5.2.2 |
| 5508 | ······-·NIST-800-171-3.4.5 | 5508 | ······-·NIST-800-171-3.4.5 |
| 5509 | ······-·NIST-800-53-AC-6(1) | 5509 | ······-·NIST-800-53-AC-6(1) |
| Offset 5536, 16 lines modified | Offset 5536, 16 lines modified | ||
| 5536 | ······-·no_reboot_needed | 5536 | ······-·no_reboot_needed |
| 5537 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5537 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5538 | ······stat: | 5538 | ······stat: |
| 5539 | ········path:·/boot/grub2/user.cfg | 5539 | ········path:·/boot/grub2/user.cfg |
| 5540 | ······register:·file_exists | 5540 | ······register:·file_exists |
| 5541 | ······when: | 5541 | ······when: |
| 5542 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5543 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5542 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5543 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5544 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5544 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5545 | ······tags: | 5545 | ······tags: |
| 5546 | ······-·CCE-86009-8 | 5546 | ······-·CCE-86009-8 |
| 5547 | ······-·CJIS-5.5.2.2 | 5547 | ······-·CJIS-5.5.2.2 |
| 5548 | ······-·NIST-800-171-3.4.5 | 5548 | ······-·NIST-800-171-3.4.5 |
| 5549 | ······-·NIST-800-53-AC-6(1) | 5549 | ······-·NIST-800-53-AC-6(1) |
| 5550 | ······-·NIST-800-53-CM-6(a) | 5550 | ······-·NIST-800-53-CM-6(a) |
| Offset 5558, 16 lines modified | Offset 5558, 16 lines modified | ||
| 5558 | ······-·no_reboot_needed | 5558 | ······-·no_reboot_needed |
| 5559 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5559 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5560 | ······file: | 5560 | ······file: |
| 5561 | ········path:·/boot/grub2/user.cfg | 5561 | ········path:·/boot/grub2/user.cfg |
| 5562 | ········group:·'0' | 5562 | ········group:·'0' |
| 5563 | ······when: | 5563 | ······when: |
| 5564 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5565 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5564 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5565 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5566 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5566 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5567 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5567 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5568 | ······tags: | 5568 | ······tags: |
| 5569 | ······-·CCE-86009-8 | 5569 | ······-·CCE-86009-8 |
| 5570 | ······-·CJIS-5.5.2.2 | 5570 | ······-·CJIS-5.5.2.2 |
| 5571 | ······-·NIST-800-171-3.4.5 | 5571 | ······-·NIST-800-171-3.4.5 |
| 5572 | ······-·NIST-800-53-AC-6(1) | 5572 | ······-·NIST-800-53-AC-6(1) |
| Offset 5599, 16 lines modified | Offset 5599, 16 lines modified | ||
| 5599 | ······-·no_reboot_needed | 5599 | ······-·no_reboot_needed |
| 5600 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5600 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5601 | ······stat: | 5601 | ······stat: |
| 5602 | ········path:·/boot/grub2/grub.cfg | 5602 | ········path:·/boot/grub2/grub.cfg |
| 5603 | ······register:·file_exists | 5603 | ······register:·file_exists |
| 5604 | ······when: | 5604 | ······when: |
| 5605 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5606 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5605 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5606 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5607 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5607 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5608 | ······tags: | 5608 | ······tags: |
| 5609 | ······-·CCE-80805-5 | 5609 | ······-·CCE-80805-5 |
| 5610 | ······-·CJIS-5.5.2.2 | 5610 | ······-·CJIS-5.5.2.2 |
| 5611 | ······-·NIST-800-171-3.4.5 | 5611 | ······-·NIST-800-171-3.4.5 |
| 5612 | ······-·NIST-800-53-AC-6(1) | 5612 | ······-·NIST-800-53-AC-6(1) |
| 5613 | ······-·NIST-800-53-CM-6(a) | 5613 | ······-·NIST-800-53-CM-6(a) |
| Offset 5621, 16 lines modified | Offset 5621, 16 lines modified | ||
| 5621 | ······-·no_reboot_needed | 5621 | ······-·no_reboot_needed |
| 5622 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5622 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5623 | ······file: | 5623 | ······file: |
| 5624 | ········path:·/boot/grub2/grub.cfg | 5624 | ········path:·/boot/grub2/grub.cfg |
| 5625 | ········owner:·'0' | 5625 | ········owner:·'0' |
| 5626 | ······when: | 5626 | ······when: |
| 5627 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5628 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5627 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5628 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5629 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5629 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5630 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5630 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5631 | ······tags: | 5631 | ······tags: |
| 5632 | ······-·CCE-80805-5 | 5632 | ······-·CCE-80805-5 |
| 5633 | ······-·CJIS-5.5.2.2 | 5633 | ······-·CJIS-5.5.2.2 |
| 5634 | ······-·NIST-800-171-3.4.5 | 5634 | ······-·NIST-800-171-3.4.5 |
| 5635 | ······-·NIST-800-53-AC-6(1) | 5635 | ······-·NIST-800-53-AC-6(1) |
| Offset 5662, 16 lines modified | Offset 5662, 16 lines modified | ||
| 5662 | ······-·no_reboot_needed | 5662 | ······-·no_reboot_needed |
| 5663 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5663 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5664 | ······stat: | 5664 | ······stat: |
| 5665 | ········path:·/boot/grub2/user.cfg | 5665 | ········path:·/boot/grub2/user.cfg |
| 5666 | ······register:·file_exists | 5666 | ······register:·file_exists |
| 5667 | ······when: | 5667 | ······when: |
| 5668 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5669 | ······-·'"grub2-common"·in·ansible_facts.packages' | 5668 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 5669 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 5670 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5670 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5671 | ······tags: | 5671 | ······tags: |
| 5672 | ······-·CCE-86015-5 | 5672 | ······-·CCE-86015-5 |
| 5673 | ······-·CJIS-5.5.2.2 | 5673 | ······-·CJIS-5.5.2.2 |
| 5674 | ······-·NIST-800-171-3.4.5 | 5674 | ······-·NIST-800-171-3.4.5 |
| 5675 | ······-·NIST-800-53-AC-6(1) | 5675 | ······-·NIST-800-53-AC-6(1) |
| 5676 | ······-·NIST-800-53-CM-6(a) | 5676 | ······-·NIST-800-53-CM-6(a) |
| Offset 5684, 16 lines modified | Offset 5684, 16 lines modified | ||
| 5684 | ······-·no_reboot_needed | 5684 | ······-·no_reboot_needed |
| Max diff block lines reached; 11371/15986 bytes (71.13%) of diff not shown. | |||
| Offset 22273, 16 lines modified | Offset 22273, 16 lines modified | ||
| 22273 | ······-·no_reboot_needed | 22273 | ······-·no_reboot_needed |
| 22274 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22274 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22275 | ······stat: | 22275 | ······stat: |
| 22276 | ········path:·/boot/grub2/grub.cfg | 22276 | ········path:·/boot/grub2/grub.cfg |
| 22277 | ······register:·file_exists | 22277 | ······register:·file_exists |
| 22278 | ······when: | 22278 | ······when: |
| 22279 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22280 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22279 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22280 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22281 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22281 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22282 | ······tags: | 22282 | ······tags: |
| 22283 | ······-·CCE-80800-6 | 22283 | ······-·CCE-80800-6 |
| 22284 | ······-·CJIS-5.5.2.2 | 22284 | ······-·CJIS-5.5.2.2 |
| 22285 | ······-·NIST-800-171-3.4.5 | 22285 | ······-·NIST-800-171-3.4.5 |
| 22286 | ······-·NIST-800-53-AC-6(1) | 22286 | ······-·NIST-800-53-AC-6(1) |
| 22287 | ······-·NIST-800-53-CM-6(a) | 22287 | ······-·NIST-800-53-CM-6(a) |
| Offset 22295, 16 lines modified | Offset 22295, 16 lines modified | ||
| 22295 | ······-·no_reboot_needed | 22295 | ······-·no_reboot_needed |
| 22296 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 22296 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 22297 | ······file: | 22297 | ······file: |
| 22298 | ········path:·/boot/grub2/grub.cfg | 22298 | ········path:·/boot/grub2/grub.cfg |
| 22299 | ········group:·'0' | 22299 | ········group:·'0' |
| 22300 | ······when: | 22300 | ······when: |
| 22301 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22302 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22301 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22302 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22303 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22303 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22304 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22304 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22305 | ······tags: | 22305 | ······tags: |
| 22306 | ······-·CCE-80800-6 | 22306 | ······-·CCE-80800-6 |
| 22307 | ······-·CJIS-5.5.2.2 | 22307 | ······-·CJIS-5.5.2.2 |
| 22308 | ······-·NIST-800-171-3.4.5 | 22308 | ······-·NIST-800-171-3.4.5 |
| 22309 | ······-·NIST-800-53-AC-6(1) | 22309 | ······-·NIST-800-53-AC-6(1) |
| Offset 22336, 16 lines modified | Offset 22336, 16 lines modified | ||
| 22336 | ······-·no_reboot_needed | 22336 | ······-·no_reboot_needed |
| 22337 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 22337 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 22338 | ······stat: | 22338 | ······stat: |
| 22339 | ········path:·/boot/grub2/user.cfg | 22339 | ········path:·/boot/grub2/user.cfg |
| 22340 | ······register:·file_exists | 22340 | ······register:·file_exists |
| 22341 | ······when: | 22341 | ······when: |
| 22342 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22343 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22342 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22343 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22344 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22345 | ······tags: | 22345 | ······tags: |
| 22346 | ······-·CCE-86009-8 | 22346 | ······-·CCE-86009-8 |
| 22347 | ······-·CJIS-5.5.2.2 | 22347 | ······-·CJIS-5.5.2.2 |
| 22348 | ······-·NIST-800-171-3.4.5 | 22348 | ······-·NIST-800-171-3.4.5 |
| 22349 | ······-·NIST-800-53-AC-6(1) | 22349 | ······-·NIST-800-53-AC-6(1) |
| 22350 | ······-·NIST-800-53-CM-6(a) | 22350 | ······-·NIST-800-53-CM-6(a) |
| Offset 22358, 16 lines modified | Offset 22358, 16 lines modified | ||
| 22358 | ······-·no_reboot_needed | 22358 | ······-·no_reboot_needed |
| 22359 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 22359 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 22360 | ······file: | 22360 | ······file: |
| 22361 | ········path:·/boot/grub2/user.cfg | 22361 | ········path:·/boot/grub2/user.cfg |
| 22362 | ········group:·'0' | 22362 | ········group:·'0' |
| 22363 | ······when: | 22363 | ······when: |
| 22364 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22365 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22364 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22365 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22367 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22367 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22368 | ······tags: | 22368 | ······tags: |
| 22369 | ······-·CCE-86009-8 | 22369 | ······-·CCE-86009-8 |
| 22370 | ······-·CJIS-5.5.2.2 | 22370 | ······-·CJIS-5.5.2.2 |
| 22371 | ······-·NIST-800-171-3.4.5 | 22371 | ······-·NIST-800-171-3.4.5 |
| 22372 | ······-·NIST-800-53-AC-6(1) | 22372 | ······-·NIST-800-53-AC-6(1) |
| Offset 22399, 16 lines modified | Offset 22399, 16 lines modified | ||
| 22399 | ······-·no_reboot_needed | 22399 | ······-·no_reboot_needed |
| 22400 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22400 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22401 | ······stat: | 22401 | ······stat: |
| 22402 | ········path:·/boot/grub2/grub.cfg | 22402 | ········path:·/boot/grub2/grub.cfg |
| 22403 | ······register:·file_exists | 22403 | ······register:·file_exists |
| 22404 | ······when: | 22404 | ······when: |
| 22405 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22406 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22405 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22406 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22407 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22407 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22408 | ······tags: | 22408 | ······tags: |
| 22409 | ······-·CCE-80805-5 | 22409 | ······-·CCE-80805-5 |
| 22410 | ······-·CJIS-5.5.2.2 | 22410 | ······-·CJIS-5.5.2.2 |
| 22411 | ······-·NIST-800-171-3.4.5 | 22411 | ······-·NIST-800-171-3.4.5 |
| 22412 | ······-·NIST-800-53-AC-6(1) | 22412 | ······-·NIST-800-53-AC-6(1) |
| 22413 | ······-·NIST-800-53-CM-6(a) | 22413 | ······-·NIST-800-53-CM-6(a) |
| Offset 22421, 16 lines modified | Offset 22421, 16 lines modified | ||
| 22421 | ······-·no_reboot_needed | 22421 | ······-·no_reboot_needed |
| 22422 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 22422 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 22423 | ······file: | 22423 | ······file: |
| 22424 | ········path:·/boot/grub2/grub.cfg | 22424 | ········path:·/boot/grub2/grub.cfg |
| 22425 | ········owner:·'0' | 22425 | ········owner:·'0' |
| 22426 | ······when: | 22426 | ······when: |
| 22427 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22428 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22427 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22428 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22429 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22429 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22430 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22430 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22431 | ······tags: | 22431 | ······tags: |
| 22432 | ······-·CCE-80805-5 | 22432 | ······-·CCE-80805-5 |
| 22433 | ······-·CJIS-5.5.2.2 | 22433 | ······-·CJIS-5.5.2.2 |
| 22434 | ······-·NIST-800-171-3.4.5 | 22434 | ······-·NIST-800-171-3.4.5 |
| 22435 | ······-·NIST-800-53-AC-6(1) | 22435 | ······-·NIST-800-53-AC-6(1) |
| Offset 22462, 16 lines modified | Offset 22462, 16 lines modified | ||
| 22462 | ······-·no_reboot_needed | 22462 | ······-·no_reboot_needed |
| 22463 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 22463 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 22464 | ······stat: | 22464 | ······stat: |
| 22465 | ········path:·/boot/grub2/user.cfg | 22465 | ········path:·/boot/grub2/user.cfg |
| 22466 | ······register:·file_exists | 22466 | ······register:·file_exists |
| 22467 | ······when: | 22467 | ······when: |
| 22468 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22469 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22468 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22469 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22470 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22470 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22471 | ······tags: | 22471 | ······tags: |
| 22472 | ······-·CCE-86015-5 | 22472 | ······-·CCE-86015-5 |
| 22473 | ······-·CJIS-5.5.2.2 | 22473 | ······-·CJIS-5.5.2.2 |
| 22474 | ······-·NIST-800-171-3.4.5 | 22474 | ······-·NIST-800-171-3.4.5 |
| 22475 | ······-·NIST-800-53-AC-6(1) | 22475 | ······-·NIST-800-53-AC-6(1) |
| 22476 | ······-·NIST-800-53-CM-6(a) | 22476 | ······-·NIST-800-53-CM-6(a) |
| Offset 22484, 16 lines modified | Offset 22484, 16 lines modified | ||
| 22484 | ······-·no_reboot_needed | 22484 | ······-·no_reboot_needed |
| Max diff block lines reached; 11403/16034 bytes (71.12%) of diff not shown. | |||
| Offset 13831, 16 lines modified | Offset 13831, 16 lines modified | ||
| 13831 | ······-·no_reboot_needed | 13831 | ······-·no_reboot_needed |
| 13832 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 13832 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 13833 | ······stat: | 13833 | ······stat: |
| 13834 | ········path:·/boot/grub2/grub.cfg | 13834 | ········path:·/boot/grub2/grub.cfg |
| 13835 | ······register:·file_exists | 13835 | ······register:·file_exists |
| 13836 | ······when: | 13836 | ······when: |
| 13837 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13838 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13837 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13838 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13839 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13839 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13840 | ······tags: | 13840 | ······tags: |
| 13841 | ······-·CCE-80800-6 | 13841 | ······-·CCE-80800-6 |
| 13842 | ······-·CJIS-5.5.2.2 | 13842 | ······-·CJIS-5.5.2.2 |
| 13843 | ······-·NIST-800-171-3.4.5 | 13843 | ······-·NIST-800-171-3.4.5 |
| 13844 | ······-·NIST-800-53-AC-6(1) | 13844 | ······-·NIST-800-53-AC-6(1) |
| 13845 | ······-·NIST-800-53-CM-6(a) | 13845 | ······-·NIST-800-53-CM-6(a) |
| Offset 13853, 16 lines modified | Offset 13853, 16 lines modified | ||
| 13853 | ······-·no_reboot_needed | 13853 | ······-·no_reboot_needed |
| 13854 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 13854 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 13855 | ······file: | 13855 | ······file: |
| 13856 | ········path:·/boot/grub2/grub.cfg | 13856 | ········path:·/boot/grub2/grub.cfg |
| 13857 | ········group:·'0' | 13857 | ········group:·'0' |
| 13858 | ······when: | 13858 | ······when: |
| 13859 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13860 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13859 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13860 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13861 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13861 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13862 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13862 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13863 | ······tags: | 13863 | ······tags: |
| 13864 | ······-·CCE-80800-6 | 13864 | ······-·CCE-80800-6 |
| 13865 | ······-·CJIS-5.5.2.2 | 13865 | ······-·CJIS-5.5.2.2 |
| 13866 | ······-·NIST-800-171-3.4.5 | 13866 | ······-·NIST-800-171-3.4.5 |
| 13867 | ······-·NIST-800-53-AC-6(1) | 13867 | ······-·NIST-800-53-AC-6(1) |
| Offset 13894, 16 lines modified | Offset 13894, 16 lines modified | ||
| 13894 | ······-·no_reboot_needed | 13894 | ······-·no_reboot_needed |
| 13895 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 13895 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 13896 | ······stat: | 13896 | ······stat: |
| 13897 | ········path:·/boot/grub2/grub.cfg | 13897 | ········path:·/boot/grub2/grub.cfg |
| 13898 | ······register:·file_exists | 13898 | ······register:·file_exists |
| 13899 | ······when: | 13899 | ······when: |
| 13900 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13901 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13900 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13901 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13902 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13902 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13903 | ······tags: | 13903 | ······tags: |
| 13904 | ······-·CCE-80805-5 | 13904 | ······-·CCE-80805-5 |
| 13905 | ······-·CJIS-5.5.2.2 | 13905 | ······-·CJIS-5.5.2.2 |
| 13906 | ······-·NIST-800-171-3.4.5 | 13906 | ······-·NIST-800-171-3.4.5 |
| 13907 | ······-·NIST-800-53-AC-6(1) | 13907 | ······-·NIST-800-53-AC-6(1) |
| 13908 | ······-·NIST-800-53-CM-6(a) | 13908 | ······-·NIST-800-53-CM-6(a) |
| Offset 13916, 16 lines modified | Offset 13916, 16 lines modified | ||
| 13916 | ······-·no_reboot_needed | 13916 | ······-·no_reboot_needed |
| 13917 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 13917 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 13918 | ······file: | 13918 | ······file: |
| 13919 | ········path:·/boot/grub2/grub.cfg | 13919 | ········path:·/boot/grub2/grub.cfg |
| 13920 | ········owner:·'0' | 13920 | ········owner:·'0' |
| 13921 | ······when: | 13921 | ······when: |
| 13922 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13923 | ······-·'"grub2-common"·in·ansible_facts.packages' | 13922 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 13923 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 13924 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 13924 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 13925 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 13925 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 13926 | ······tags: | 13926 | ······tags: |
| 13927 | ······-·CCE-80805-5 | 13927 | ······-·CCE-80805-5 |
| 13928 | ······-·CJIS-5.5.2.2 | 13928 | ······-·CJIS-5.5.2.2 |
| 13929 | ······-·NIST-800-171-3.4.5 | 13929 | ······-·NIST-800-171-3.4.5 |
| 13930 | ······-·NIST-800-53-AC-6(1) | 13930 | ······-·NIST-800-53-AC-6(1) |
| Offset 22603, 16 lines modified | Offset 22603, 16 lines modified | ||
| 22603 | ······-·no_reboot_needed | 22603 | ······-·no_reboot_needed |
| 22604 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22604 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22605 | ······stat: | 22605 | ······stat: |
| 22606 | ········path:·/boot/grub2/grub.cfg | 22606 | ········path:·/boot/grub2/grub.cfg |
| 22607 | ······register:·file_exists | 22607 | ······register:·file_exists |
| 22608 | ······when: | 22608 | ······when: |
| 22609 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22610 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22609 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22610 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22611 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22611 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22612 | ······tags: | 22612 | ······tags: |
| 22613 | ······-·CCE-80800-6 | 22613 | ······-·CCE-80800-6 |
| 22614 | ······-·CJIS-5.5.2.2 | 22614 | ······-·CJIS-5.5.2.2 |
| 22615 | ······-·NIST-800-171-3.4.5 | 22615 | ······-·NIST-800-171-3.4.5 |
| 22616 | ······-·NIST-800-53-AC-6(1) | 22616 | ······-·NIST-800-53-AC-6(1) |
| 22617 | ······-·NIST-800-53-CM-6(a) | 22617 | ······-·NIST-800-53-CM-6(a) |
| Offset 22625, 16 lines modified | Offset 22625, 16 lines modified | ||
| 22625 | ······-·no_reboot_needed | 22625 | ······-·no_reboot_needed |
| 22626 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 22626 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 22627 | ······file: | 22627 | ······file: |
| 22628 | ········path:·/boot/grub2/grub.cfg | 22628 | ········path:·/boot/grub2/grub.cfg |
| 22629 | ········group:·'0' | 22629 | ········group:·'0' |
| 22630 | ······when: | 22630 | ······when: |
| 22631 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22632 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22631 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22632 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22633 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22633 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22634 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22634 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22635 | ······tags: | 22635 | ······tags: |
| 22636 | ······-·CCE-80800-6 | 22636 | ······-·CCE-80800-6 |
| 22637 | ······-·CJIS-5.5.2.2 | 22637 | ······-·CJIS-5.5.2.2 |
| 22638 | ······-·NIST-800-171-3.4.5 | 22638 | ······-·NIST-800-171-3.4.5 |
| 22639 | ······-·NIST-800-53-AC-6(1) | 22639 | ······-·NIST-800-53-AC-6(1) |
| Offset 22666, 16 lines modified | Offset 22666, 16 lines modified | ||
| 22666 | ······-·no_reboot_needed | 22666 | ······-·no_reboot_needed |
| 22667 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 22667 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 22668 | ······stat: | 22668 | ······stat: |
| 22669 | ········path:·/boot/grub2/grub.cfg | 22669 | ········path:·/boot/grub2/grub.cfg |
| 22670 | ······register:·file_exists | 22670 | ······register:·file_exists |
| 22671 | ······when: | 22671 | ······when: |
| 22672 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22673 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22672 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22673 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22674 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22674 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22675 | ······tags: | 22675 | ······tags: |
| 22676 | ······-·CCE-80805-5 | 22676 | ······-·CCE-80805-5 |
| 22677 | ······-·CJIS-5.5.2.2 | 22677 | ······-·CJIS-5.5.2.2 |
| 22678 | ······-·NIST-800-171-3.4.5 | 22678 | ······-·NIST-800-171-3.4.5 |
| 22679 | ······-·NIST-800-53-AC-6(1) | 22679 | ······-·NIST-800-53-AC-6(1) |
| 22680 | ······-·NIST-800-53-CM-6(a) | 22680 | ······-·NIST-800-53-CM-6(a) |
| Offset 22688, 16 lines modified | Offset 22688, 16 lines modified | ||
| 22688 | ······-·no_reboot_needed | 22688 | ······-·no_reboot_needed |
| 22689 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 22689 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 22690 | ······file: | 22690 | ······file: |
| 22691 | ········path:·/boot/grub2/grub.cfg | 22691 | ········path:·/boot/grub2/grub.cfg |
| 22692 | ········owner:·'0' | 22692 | ········owner:·'0' |
| 22693 | ······when: | 22693 | ······when: |
| 22694 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22695 | ······-·'"grub2-common"·in·ansible_facts.packages' | 22694 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 22695 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 22696 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 22696 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 22697 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 22697 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 22698 | ······tags: | 22698 | ······tags: |
| 22699 | ······-·CCE-80805-5 | 22699 | ······-·CCE-80805-5 |
| 22700 | ······-·CJIS-5.5.2.2 | 22700 | ······-·CJIS-5.5.2.2 |
| 22701 | ······-·NIST-800-171-3.4.5 | 22701 | ······-·NIST-800-171-3.4.5 |
| 22702 | ······-·NIST-800-53-AC-6(1) | 22702 | ······-·NIST-800-53-AC-6(1) |
| Offset 23406, 16 lines modified | Offset 23406, 16 lines modified | ||
| 23406 | ······-·no_reboot_needed | 23406 | ······-·no_reboot_needed |
| 23407 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 23407 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 23408 | ······stat: | 23408 | ······stat: |
| 23409 | ········path:·/boot/grub2/grub.cfg | 23409 | ········path:·/boot/grub2/grub.cfg |
| 23410 | ······register:·file_exists | 23410 | ······register:·file_exists |
| 23411 | ······when: | 23411 | ······when: |
| 23412 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23413 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23412 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23413 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23414 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23414 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23415 | ······tags: | 23415 | ······tags: |
| 23416 | ······-·CCE-80800-6 | 23416 | ······-·CCE-80800-6 |
| 23417 | ······-·CJIS-5.5.2.2 | 23417 | ······-·CJIS-5.5.2.2 |
| 23418 | ······-·NIST-800-171-3.4.5 | 23418 | ······-·NIST-800-171-3.4.5 |
| 23419 | ······-·NIST-800-53-AC-6(1) | 23419 | ······-·NIST-800-53-AC-6(1) |
| 23420 | ······-·NIST-800-53-CM-6(a) | 23420 | ······-·NIST-800-53-CM-6(a) |
| Offset 23428, 16 lines modified | Offset 23428, 16 lines modified | ||
| 23428 | ······-·no_reboot_needed | 23428 | ······-·no_reboot_needed |
| 23429 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 23429 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 23430 | ······file: | 23430 | ······file: |
| 23431 | ········path:·/boot/grub2/grub.cfg | 23431 | ········path:·/boot/grub2/grub.cfg |
| 23432 | ········group:·'0' | 23432 | ········group:·'0' |
| 23433 | ······when: | 23433 | ······when: |
| 23434 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23435 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23434 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23435 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23436 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23436 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23437 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 23437 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 23438 | ······tags: | 23438 | ······tags: |
| 23439 | ······-·CCE-80800-6 | 23439 | ······-·CCE-80800-6 |
| 23440 | ······-·CJIS-5.5.2.2 | 23440 | ······-·CJIS-5.5.2.2 |
| 23441 | ······-·NIST-800-171-3.4.5 | 23441 | ······-·NIST-800-171-3.4.5 |
| 23442 | ······-·NIST-800-53-AC-6(1) | 23442 | ······-·NIST-800-53-AC-6(1) |
| Offset 23469, 16 lines modified | Offset 23469, 16 lines modified | ||
| 23469 | ······-·no_reboot_needed | 23469 | ······-·no_reboot_needed |
| 23470 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 23470 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 23471 | ······stat: | 23471 | ······stat: |
| 23472 | ········path:·/boot/grub2/grub.cfg | 23472 | ········path:·/boot/grub2/grub.cfg |
| 23473 | ······register:·file_exists | 23473 | ······register:·file_exists |
| 23474 | ······when: | 23474 | ······when: |
| 23475 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23476 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23475 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23476 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23477 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23477 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23478 | ······tags: | 23478 | ······tags: |
| 23479 | ······-·CCE-80805-5 | 23479 | ······-·CCE-80805-5 |
| 23480 | ······-·CJIS-5.5.2.2 | 23480 | ······-·CJIS-5.5.2.2 |
| 23481 | ······-·NIST-800-171-3.4.5 | 23481 | ······-·NIST-800-171-3.4.5 |
| 23482 | ······-·NIST-800-53-AC-6(1) | 23482 | ······-·NIST-800-53-AC-6(1) |
| 23483 | ······-·NIST-800-53-CM-6(a) | 23483 | ······-·NIST-800-53-CM-6(a) |
| Offset 23491, 16 lines modified | Offset 23491, 16 lines modified | ||
| 23491 | ······-·no_reboot_needed | 23491 | ······-·no_reboot_needed |
| 23492 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 23492 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 23493 | ······file: | 23493 | ······file: |
| 23494 | ········path:·/boot/grub2/grub.cfg | 23494 | ········path:·/boot/grub2/grub.cfg |
| 23495 | ········owner:·'0' | 23495 | ········owner:·'0' |
| 23496 | ······when: | 23496 | ······when: |
| 23497 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23498 | ······-·'"grub2-common"·in·ansible_facts.packages' | 23497 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 23498 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 23499 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 23499 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 23500 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 23500 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 23501 | ······tags: | 23501 | ······tags: |
| 23502 | ······-·CCE-80805-5 | 23502 | ······-·CCE-80805-5 |
| 23503 | ······-·CJIS-5.5.2.2 | 23503 | ······-·CJIS-5.5.2.2 |
| 23504 | ······-·NIST-800-171-3.4.5 | 23504 | ······-·NIST-800-171-3.4.5 |
| 23505 | ······-·NIST-800-53-AC-6(1) | 23505 | ······-·NIST-800-53-AC-6(1) |
| Offset 3276, 16 lines modified | Offset 3276, 16 lines modified | ||
| 3276 | ······-·no_reboot_needed | 3276 | ······-·no_reboot_needed |
| 3277 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 3277 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 3278 | ······stat: | 3278 | ······stat: |
| 3279 | ········path:·/boot/grub2/grub.cfg | 3279 | ········path:·/boot/grub2/grub.cfg |
| 3280 | ······register:·file_exists | 3280 | ······register:·file_exists |
| 3281 | ······when: | 3281 | ······when: |
| 3282 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3283 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3282 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3283 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3284 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3284 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3285 | ······tags: | 3285 | ······tags: |
| 3286 | ······-·CCE-80800-6 | 3286 | ······-·CCE-80800-6 |
| 3287 | ······-·CJIS-5.5.2.2 | 3287 | ······-·CJIS-5.5.2.2 |
| 3288 | ······-·NIST-800-171-3.4.5 | 3288 | ······-·NIST-800-171-3.4.5 |
| 3289 | ······-·NIST-800-53-AC-6(1) | 3289 | ······-·NIST-800-53-AC-6(1) |
| 3290 | ······-·NIST-800-53-CM-6(a) | 3290 | ······-·NIST-800-53-CM-6(a) |
| Offset 3298, 16 lines modified | Offset 3298, 16 lines modified | ||
| 3298 | ······-·no_reboot_needed | 3298 | ······-·no_reboot_needed |
| 3299 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 3299 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 3300 | ······file: | 3300 | ······file: |
| 3301 | ········path:·/boot/grub2/grub.cfg | 3301 | ········path:·/boot/grub2/grub.cfg |
| 3302 | ········group:·'0' | 3302 | ········group:·'0' |
| 3303 | ······when: | 3303 | ······when: |
| 3304 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3305 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3304 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3305 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3306 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3306 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3307 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3307 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3308 | ······tags: | 3308 | ······tags: |
| 3309 | ······-·CCE-80800-6 | 3309 | ······-·CCE-80800-6 |
| 3310 | ······-·CJIS-5.5.2.2 | 3310 | ······-·CJIS-5.5.2.2 |
| 3311 | ······-·NIST-800-171-3.4.5 | 3311 | ······-·NIST-800-171-3.4.5 |
| 3312 | ······-·NIST-800-53-AC-6(1) | 3312 | ······-·NIST-800-53-AC-6(1) |
| Offset 3339, 16 lines modified | Offset 3339, 16 lines modified | ||
| 3339 | ······-·no_reboot_needed | 3339 | ······-·no_reboot_needed |
| 3340 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 3340 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 3341 | ······stat: | 3341 | ······stat: |
| 3342 | ········path:·/boot/grub2/grub.cfg | 3342 | ········path:·/boot/grub2/grub.cfg |
| 3343 | ······register:·file_exists | 3343 | ······register:·file_exists |
| 3344 | ······when: | 3344 | ······when: |
| 3345 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3346 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3345 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3346 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3347 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3347 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3348 | ······tags: | 3348 | ······tags: |
| 3349 | ······-·CCE-80805-5 | 3349 | ······-·CCE-80805-5 |
| 3350 | ······-·CJIS-5.5.2.2 | 3350 | ······-·CJIS-5.5.2.2 |
| 3351 | ······-·NIST-800-171-3.4.5 | 3351 | ······-·NIST-800-171-3.4.5 |
| 3352 | ······-·NIST-800-53-AC-6(1) | 3352 | ······-·NIST-800-53-AC-6(1) |
| 3353 | ······-·NIST-800-53-CM-6(a) | 3353 | ······-·NIST-800-53-CM-6(a) |
| Offset 3361, 16 lines modified | Offset 3361, 16 lines modified | ||
| 3361 | ······-·no_reboot_needed | 3361 | ······-·no_reboot_needed |
| 3362 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 3362 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 3363 | ······file: | 3363 | ······file: |
| 3364 | ········path:·/boot/grub2/grub.cfg | 3364 | ········path:·/boot/grub2/grub.cfg |
| 3365 | ········owner:·'0' | 3365 | ········owner:·'0' |
| 3366 | ······when: | 3366 | ······when: |
| 3367 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3368 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3367 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3368 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3369 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3369 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3370 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3370 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3371 | ······tags: | 3371 | ······tags: |
| 3372 | ······-·CCE-80805-5 | 3372 | ······-·CCE-80805-5 |
| 3373 | ······-·CJIS-5.5.2.2 | 3373 | ······-·CJIS-5.5.2.2 |
| 3374 | ······-·NIST-800-171-3.4.5 | 3374 | ······-·NIST-800-171-3.4.5 |
| 3375 | ······-·NIST-800-53-AC-6(1) | 3375 | ······-·NIST-800-53-AC-6(1) |
| Offset 3400, 16 lines modified | Offset 3400, 16 lines modified | ||
| 3400 | ······-·no_reboot_needed | 3400 | ······-·no_reboot_needed |
| 3401 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 3401 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 3402 | ······stat: | 3402 | ······stat: |
| 3403 | ········path:·/boot/grub2/grub.cfg | 3403 | ········path:·/boot/grub2/grub.cfg |
| 3404 | ······register:·file_exists | 3404 | ······register:·file_exists |
| 3405 | ······when: | 3405 | ······when: |
| 3406 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3407 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3406 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3407 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3409 | ······tags: | 3409 | ······tags: |
| 3410 | ······-·CCE-80814-7 | 3410 | ······-·CCE-80814-7 |
| 3411 | ······-·NIST-800-171-3.4.5 | 3411 | ······-·NIST-800-171-3.4.5 |
| 3412 | ······-·NIST-800-53-AC-6(1) | 3412 | ······-·NIST-800-53-AC-6(1) |
| 3413 | ······-·NIST-800-53-CM-6(a) | 3413 | ······-·NIST-800-53-CM-6(a) |
| 3414 | ······-·configure_strategy | 3414 | ······-·configure_strategy |
| Offset 3420, 16 lines modified | Offset 3420, 16 lines modified | ||
| 3420 | ······-·no_reboot_needed | 3420 | ······-·no_reboot_needed |
| 3421 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg | 3421 | ····-·name:·Ensure·permission·u-xs,g-xwrs,o-xwrt·on·/boot/grub2/grub.cfg |
| 3422 | ······file: | 3422 | ······file: |
| 3423 | ········path:·/boot/grub2/grub.cfg | 3423 | ········path:·/boot/grub2/grub.cfg |
| 3424 | ········mode:·u-xs,g-xwrs,o-xwrt | 3424 | ········mode:·u-xs,g-xwrs,o-xwrt |
| 3425 | ······when: | 3425 | ······when: |
| 3426 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3427 | ······-·'"grub2-common"·in·ansible_facts.packages' | 3426 | ······-·'"grub2-common"·in·ansible_facts.packages' |
| 3427 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | ||
| 3428 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3428 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3429 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 3429 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 3430 | ······tags: | 3430 | ······tags: |
| 3431 | ······-·CCE-80814-7 | 3431 | ······-·CCE-80814-7 |
| 3432 | ······-·NIST-800-171-3.4.5 | 3432 | ······-·NIST-800-171-3.4.5 |
| 3433 | ······-·NIST-800-53-AC-6(1) | 3433 | ······-·NIST-800-53-AC-6(1) |
| 3434 | ······-·NIST-800-53-CM-6(a) | 3434 | ······-·NIST-800-53-CM-6(a) |
| Offset 38420, 16 lines modified | Offset 38420, 16 lines modified | ||
| 38420 | ········lineinfile: | 38420 | ········lineinfile: |
| 38421 | ··········path:·/etc/postfix/main.cf | 38421 | ··········path:·/etc/postfix/main.cf |
| 38422 | ··········create:·true | 38422 | ··········create:·true |
| 38423 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* | 38423 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* |
| 38424 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject | 38424 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject |
| 38425 | ··········state:·present | 38425 | ··········state:·present |
| 38426 | ······when: | 38426 | ······when: |
| 38427 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 38428 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 38427 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 38428 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 38429 | ······tags: | 38429 | ······tags: |
| 38430 | ······-·CCE-84054-6 | 38430 | ······-·CCE-84054-6 |
| 38431 | ······-·DISA-STIG-RHEL-08-040290 | 38431 | ······-·DISA-STIG-RHEL-08-040290 |
| 38432 | ······-·low_complexity | 38432 | ······-·low_complexity |
| 38433 | ······-·low_disruption | 38433 | ······-·low_disruption |
| 38434 | ······-·medium_severity | 38434 | ······-·medium_severity |
| 38435 | ······-·no_reboot_needed | 38435 | ······-·no_reboot_needed |
| Offset 38410, 16 lines modified | Offset 38410, 16 lines modified | ||
| 38410 | ········lineinfile: | 38410 | ········lineinfile: |
| 38411 | ··········path:·/etc/postfix/main.cf | 38411 | ··········path:·/etc/postfix/main.cf |
| 38412 | ··········create:·true | 38412 | ··········create:·true |
| 38413 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* | 38413 | ··········regexp:·^[·\t]*smtpd_client_restrictions\s*=\s* |
| 38414 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject | 38414 | ··········line:·smtpd_client_restrictions·=·permit_mynetworks,reject |
| 38415 | ··········state:·present | 38415 | ··········state:·present |
| 38416 | ······when: | 38416 | ······when: |
| 38417 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 38418 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 38417 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 38418 | ······-·'"postfix"·in·ansible_facts.packages' | ||
| 38419 | ······tags: | 38419 | ······tags: |
| 38420 | ······-·CCE-84054-6 | 38420 | ······-·CCE-84054-6 |
| 38421 | ······-·DISA-STIG-RHEL-08-040290 | 38421 | ······-·DISA-STIG-RHEL-08-040290 |
| 38422 | ······-·low_complexity | 38422 | ······-·low_complexity |
| 38423 | ······-·low_disruption | 38423 | ······-·low_disruption |
| 38424 | ······-·medium_severity | 38424 | ······-·medium_severity |
| 38425 | ······-·no_reboot_needed | 38425 | ······-·no_reboot_needed |
| Offset 5432, 16 lines modified | Offset 5432, 16 lines modified | ||
| 5432 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5432 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5433 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5433 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5434 | ··········create:·true | 5434 | ··········create:·true |
| 5435 | ··········mode:·o-rwx | 5435 | ··········mode:·o-rwx |
| 5436 | ··········state:·present | 5436 | ··········state:·present |
| 5437 | ········when:·syscalls_found·|·length·==·0 | 5437 | ········when:·syscalls_found·|·length·==·0 |
| 5438 | ······when: | 5438 | ······when: |
| 5439 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5440 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5439 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5440 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5441 | ······tags: | 5441 | ······tags: |
| 5442 | ······-·CCE-83780-7 | 5442 | ······-·CCE-83780-7 |
| 5443 | ······-·NIST-800-171-3.1.7 | 5443 | ······-·NIST-800-171-3.1.7 |
| 5444 | ······-·NIST-800-53-AC-6(9) | 5444 | ······-·NIST-800-53-AC-6(9) |
| 5445 | ······-·NIST-800-53-AU-12(c) | 5445 | ······-·NIST-800-53-AU-12(c) |
| 5446 | ······-·NIST-800-53-AU-2(d) | 5446 | ······-·NIST-800-53-AU-2(d) |
| 5447 | ······-·NIST-800-53-CM-6(a) | 5447 | ······-·NIST-800-53-CM-6(a) |
| Offset 5540, 16 lines modified | Offset 5540, 16 lines modified | ||
| 5540 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5540 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5541 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5541 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5542 | ··········create:·true | 5542 | ··········create:·true |
| 5543 | ··········mode:·o-rwx | 5543 | ··········mode:·o-rwx |
| 5544 | ··········state:·present | 5544 | ··········state:·present |
| 5545 | ········when:·syscalls_found·|·length·==·0 | 5545 | ········when:·syscalls_found·|·length·==·0 |
| 5546 | ······when: | 5546 | ······when: |
| 5547 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5548 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5547 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5548 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5549 | ······tags: | 5549 | ······tags: |
| 5550 | ······-·CCE-83780-7 | 5550 | ······-·CCE-83780-7 |
| 5551 | ······-·NIST-800-171-3.1.7 | 5551 | ······-·NIST-800-171-3.1.7 |
| 5552 | ······-·NIST-800-53-AC-6(9) | 5552 | ······-·NIST-800-53-AC-6(9) |
| 5553 | ······-·NIST-800-53-AU-12(c) | 5553 | ······-·NIST-800-53-AU-12(c) |
| 5554 | ······-·NIST-800-53-AU-2(d) | 5554 | ······-·NIST-800-53-AU-2(d) |
| 5555 | ······-·NIST-800-53-CM-6(a) | 5555 | ······-·NIST-800-53-CM-6(a) |
| Offset 5153, 16 lines modified | Offset 5153, 16 lines modified | ||
| 5153 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x | 5153 | ··········line:·-a·always,exit{{·syscalls·|·join(',')·}}·-F·path=/usr/bin/sudo·-F·perm=x |
| 5154 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged | 5154 | ············-F·auid>=1000·-F·auid!=unset·-F·key=privileged |
| 5155 | ··········create:·true | 5155 | ··········create:·true |
| 5156 | ··········mode:·o-rwx | 5156 | ··········mode:·o-rwx |
| 5157 | ··········state:·present | 5157 | ··········state:·present |
| 5158 | ········when:·syscalls_found·|·length·==·0 | 5158 | ········when:·syscalls_found·|·length·==·0 |
| 5159 | ······when: | 5159 | ······when: |
| 5160 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5161 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5160 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5161 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5162 | ······tags: | 5162 | ······tags: |
| 5163 | ······-·CCE-83780-7 | 5163 | ······-·CCE-83780-7 |
| 5164 | ······-·NIST-800-171-3.1.7 | 5164 | ······-·NIST-800-171-3.1.7 |
| 5165 | ······-·NIST-800-53-AC-6(9) | 5165 | ······-·NIST-800-53-AC-6(9) |
| 5166 | ······-·NIST-800-53-AU-12(c) | 5166 | ······-·NIST-800-53-AU-12(c) |
| 5167 | ······-·NIST-800-53-AU-2(d) | 5167 | ······-·NIST-800-53-AU-2(d) |
| 5168 | ······-·NIST-800-53-CM-6(a) | 5168 | ······-·NIST-800-53-CM-6(a) |
| Offset 5378, 16 lines modified | Offset 5378, 16 lines modified | ||
| 5378 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 5378 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 5379 | ······find: | 5379 | ······find: |
| 5380 | ········paths:·/etc/audit/rules.d/ | 5380 | ········paths:·/etc/audit/rules.d/ |
| 5381 | ········patterns:·'*.rules' | 5381 | ········patterns:·'*.rules' |
| 5382 | ······register:·find_rules_d | 5382 | ······register:·find_rules_d |
| 5383 | ······when: | 5383 | ······when: |
| 5384 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5385 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5384 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5385 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5386 | ······tags: | 5386 | ······tags: |
| 5387 | ······-·CCE-83716-1 | 5387 | ······-·CCE-83716-1 |
| 5388 | ······-·CJIS-5.4.1.1 | 5388 | ······-·CJIS-5.4.1.1 |
| 5389 | ······-·NIST-800-171-3.3.1 | 5389 | ······-·NIST-800-171-3.3.1 |
| 5390 | ······-·NIST-800-171-3.4.3 | 5390 | ······-·NIST-800-171-3.4.3 |
| 5391 | ······-·NIST-800-53-AC-6(9) | 5391 | ······-·NIST-800-53-AC-6(9) |
| 5392 | ······-·NIST-800-53-CM-6(a) | 5392 | ······-·NIST-800-53-CM-6(a) |
| Offset 5403, 16 lines modified | Offset 5403, 16 lines modified | ||
| 5403 | ······lineinfile: | 5403 | ······lineinfile: |
| 5404 | ········path:·'{{·item·}}' | 5404 | ········path:·'{{·item·}}' |
| 5405 | ········regexp:·^\s*(?:-e)\s+.*$ | 5405 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 5406 | ········state:·absent | 5406 | ········state:·absent |
| 5407 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 5407 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 5408 | ········}}' | 5408 | ········}}' |
| 5409 | ······when: | 5409 | ······when: |
| 5410 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5411 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5410 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5411 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5412 | ······tags: | 5412 | ······tags: |
| 5413 | ······-·CCE-83716-1 | 5413 | ······-·CCE-83716-1 |
| 5414 | ······-·CJIS-5.4.1.1 | 5414 | ······-·CJIS-5.4.1.1 |
| 5415 | ······-·NIST-800-171-3.3.1 | 5415 | ······-·NIST-800-171-3.3.1 |
| 5416 | ······-·NIST-800-171-3.4.3 | 5416 | ······-·NIST-800-171-3.4.3 |
| 5417 | ······-·NIST-800-53-AC-6(9) | 5417 | ······-·NIST-800-53-AC-6(9) |
| 5418 | ······-·NIST-800-53-CM-6(a) | 5418 | ······-·NIST-800-53-CM-6(a) |
| Offset 5430, 16 lines modified | Offset 5430, 16 lines modified | ||
| 5430 | ········create:·true | 5430 | ········create:·true |
| 5431 | ········line:·-e·2 | 5431 | ········line:·-e·2 |
| 5432 | ········mode:·o-rwx | 5432 | ········mode:·o-rwx |
| 5433 | ······loop: | 5433 | ······loop: |
| 5434 | ······-·/etc/audit/audit.rules | 5434 | ······-·/etc/audit/audit.rules |
| 5435 | ······-·/etc/audit/rules.d/immutable.rules | 5435 | ······-·/etc/audit/rules.d/immutable.rules |
| 5436 | ······when: | 5436 | ······when: |
| 5437 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5438 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5437 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5438 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5439 | ······tags: | 5439 | ······tags: |
| 5440 | ······-·CCE-83716-1 | 5440 | ······-·CCE-83716-1 |
| 5441 | ······-·CJIS-5.4.1.1 | 5441 | ······-·CJIS-5.4.1.1 |
| 5442 | ······-·NIST-800-171-3.3.1 | 5442 | ······-·NIST-800-171-3.3.1 |
| 5443 | ······-·NIST-800-171-3.4.3 | 5443 | ······-·NIST-800-171-3.4.3 |
| 5444 | ······-·NIST-800-53-AC-6(9) | 5444 | ······-·NIST-800-53-AC-6(9) |
| 5445 | ······-·NIST-800-53-CM-6(a) | 5445 | ······-·NIST-800-53-CM-6(a) |
| Offset 5473, 16 lines modified | Offset 5473, 16 lines modified | ||
| 5473 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5473 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5474 | ······find: | 5474 | ······find: |
| 5475 | ········paths:·/etc/audit/rules.d | 5475 | ········paths:·/etc/audit/rules.d |
| 5476 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5476 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5477 | ········patterns:·'*.rules' | 5477 | ········patterns:·'*.rules' |
| 5478 | ······register:·find_existing_watch_rules_d | 5478 | ······register:·find_existing_watch_rules_d |
| 5479 | ······when: | 5479 | ······when: |
| 5480 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5480 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5481 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5482 | ······tags: | 5482 | ······tags: |
| 5483 | ······-·CCE-83721-1 | 5483 | ······-·CCE-83721-1 |
| 5484 | ······-·CJIS-5.4.1.1 | 5484 | ······-·CJIS-5.4.1.1 |
| 5485 | ······-·NIST-800-171-3.1.8 | 5485 | ······-·NIST-800-171-3.1.8 |
| 5486 | ······-·NIST-800-53-AU-12(c) | 5486 | ······-·NIST-800-53-AU-12(c) |
| 5487 | ······-·NIST-800-53-AU-2(d) | 5487 | ······-·NIST-800-53-AU-2(d) |
| 5488 | ······-·NIST-800-53-CM-6(a) | 5488 | ······-·NIST-800-53-CM-6(a) |
| Offset 5497, 16 lines modified | Offset 5497, 16 lines modified | ||
| 5497 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5497 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5498 | ······find: | 5498 | ······find: |
| 5499 | ········paths:·/etc/audit/rules.d | 5499 | ········paths:·/etc/audit/rules.d |
| 5500 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5500 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5501 | ········patterns:·'*.rules' | 5501 | ········patterns:·'*.rules' |
| 5502 | ······register:·find_watch_key | 5502 | ······register:·find_watch_key |
| 5503 | ······when: | 5503 | ······when: |
| 5504 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5505 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5504 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5505 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5506 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5506 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5507 | ········==·0 | 5507 | ········==·0 |
| 5508 | ······tags: | 5508 | ······tags: |
| 5509 | ······-·CCE-83721-1 | 5509 | ······-·CCE-83721-1 |
| 5510 | ······-·CJIS-5.4.1.1 | 5510 | ······-·CJIS-5.4.1.1 |
| 5511 | ······-·NIST-800-171-3.1.8 | 5511 | ······-·NIST-800-171-3.1.8 |
| 5512 | ······-·NIST-800-53-AU-12(c) | 5512 | ······-·NIST-800-53-AU-12(c) |
| Offset 5521, 16 lines modified | Offset 5521, 16 lines modified | ||
| 5521 | ······-·restrict_strategy | 5521 | ······-·restrict_strategy |
| 5522 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5522 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5523 | ······set_fact: | 5523 | ······set_fact: |
| 5524 | ········all_files: | 5524 | ········all_files: |
| 5525 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5525 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5526 | ······when: | 5526 | ······when: |
| 5527 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5528 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5527 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5528 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5529 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5529 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5530 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5530 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5531 | ······tags: | 5531 | ······tags: |
| 5532 | ······-·CCE-83721-1 | 5532 | ······-·CCE-83721-1 |
| 5533 | ······-·CJIS-5.4.1.1 | 5533 | ······-·CJIS-5.4.1.1 |
| 5534 | ······-·NIST-800-171-3.1.8 | 5534 | ······-·NIST-800-171-3.1.8 |
| 5535 | ······-·NIST-800-53-AU-12(c) | 5535 | ······-·NIST-800-53-AU-12(c) |
| Offset 5545, 16 lines modified | Offset 5545, 16 lines modified | ||
| 5545 | ······-·restrict_strategy | 5545 | ······-·restrict_strategy |
| 5546 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5546 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5547 | ······set_fact: | 5547 | ······set_fact: |
| 5548 | ········all_files: | 5548 | ········all_files: |
| 5549 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5549 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5550 | ······when: | 5550 | ······when: |
| 5551 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5552 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5551 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5552 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5553 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5553 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5554 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5554 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5555 | ······tags: | 5555 | ······tags: |
| 5556 | ······-·CCE-83721-1 | 5556 | ······-·CCE-83721-1 |
| 5557 | ······-·CJIS-5.4.1.1 | 5557 | ······-·CJIS-5.4.1.1 |
| 5558 | ······-·NIST-800-171-3.1.8 | 5558 | ······-·NIST-800-171-3.1.8 |
| 5559 | ······-·NIST-800-53-AU-12(c) | 5559 | ······-·NIST-800-53-AU-12(c) |
| Offset 5571, 16 lines modified | Offset 5571, 16 lines modified | ||
| 5571 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5571 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 157412/162045 bytes (97.14%) of diff not shown. | |||
| Offset 5206, 16 lines modified | Offset 5206, 16 lines modified | ||
| 5206 | ······-·no_reboot_needed | 5206 | ······-·no_reboot_needed |
| 5207 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5207 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5208 | ······stat: | 5208 | ······stat: |
| 5209 | ········path:·/boot/grub2/grub.cfg | 5209 | ········path:·/boot/grub2/grub.cfg |
| 5210 | ······register:·file_exists | 5210 | ······register:·file_exists |
| 5211 | ······when: | 5211 | ······when: |
| 5212 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5213 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5212 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5213 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5214 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5214 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5215 | ······tags: | 5215 | ······tags: |
| 5216 | ······-·CCE-83848-2 | 5216 | ······-·CCE-83848-2 |
| 5217 | ······-·CJIS-5.5.2.2 | 5217 | ······-·CJIS-5.5.2.2 |
| 5218 | ······-·NIST-800-171-3.4.5 | 5218 | ······-·NIST-800-171-3.4.5 |
| 5219 | ······-·NIST-800-53-AC-6(1) | 5219 | ······-·NIST-800-53-AC-6(1) |
| 5220 | ······-·NIST-800-53-CM-6(a) | 5220 | ······-·NIST-800-53-CM-6(a) |
| Offset 5228, 16 lines modified | Offset 5228, 16 lines modified | ||
| 5228 | ······-·no_reboot_needed | 5228 | ······-·no_reboot_needed |
| 5229 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5229 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5230 | ······file: | 5230 | ······file: |
| 5231 | ········path:·/boot/grub2/grub.cfg | 5231 | ········path:·/boot/grub2/grub.cfg |
| 5232 | ········group:·'0' | 5232 | ········group:·'0' |
| 5233 | ······when: | 5233 | ······when: |
| 5234 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5235 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5234 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5235 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5236 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5236 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5237 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5237 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5238 | ······tags: | 5238 | ······tags: |
| 5239 | ······-·CCE-83848-2 | 5239 | ······-·CCE-83848-2 |
| 5240 | ······-·CJIS-5.5.2.2 | 5240 | ······-·CJIS-5.5.2.2 |
| 5241 | ······-·NIST-800-171-3.4.5 | 5241 | ······-·NIST-800-171-3.4.5 |
| 5242 | ······-·NIST-800-53-AC-6(1) | 5242 | ······-·NIST-800-53-AC-6(1) |
| Offset 5269, 16 lines modified | Offset 5269, 16 lines modified | ||
| 5269 | ······-·no_reboot_needed | 5269 | ······-·no_reboot_needed |
| 5270 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5270 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5271 | ······stat: | 5271 | ······stat: |
| 5272 | ········path:·/boot/grub2/user.cfg | 5272 | ········path:·/boot/grub2/user.cfg |
| 5273 | ······register:·file_exists | 5273 | ······register:·file_exists |
| 5274 | ······when: | 5274 | ······when: |
| 5275 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5276 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5275 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5276 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5277 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5277 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5278 | ······tags: | 5278 | ······tags: |
| 5279 | ······-·CCE-86010-6 | 5279 | ······-·CCE-86010-6 |
| 5280 | ······-·CJIS-5.5.2.2 | 5280 | ······-·CJIS-5.5.2.2 |
| 5281 | ······-·NIST-800-171-3.4.5 | 5281 | ······-·NIST-800-171-3.4.5 |
| 5282 | ······-·NIST-800-53-AC-6(1) | 5282 | ······-·NIST-800-53-AC-6(1) |
| 5283 | ······-·NIST-800-53-CM-6(a) | 5283 | ······-·NIST-800-53-CM-6(a) |
| Offset 5291, 16 lines modified | Offset 5291, 16 lines modified | ||
| 5291 | ······-·no_reboot_needed | 5291 | ······-·no_reboot_needed |
| 5292 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5292 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5293 | ······file: | 5293 | ······file: |
| 5294 | ········path:·/boot/grub2/user.cfg | 5294 | ········path:·/boot/grub2/user.cfg |
| 5295 | ········group:·'0' | 5295 | ········group:·'0' |
| 5296 | ······when: | 5296 | ······when: |
| 5297 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5298 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5297 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5298 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5301 | ······tags: | 5301 | ······tags: |
| 5302 | ······-·CCE-86010-6 | 5302 | ······-·CCE-86010-6 |
| 5303 | ······-·CJIS-5.5.2.2 | 5303 | ······-·CJIS-5.5.2.2 |
| 5304 | ······-·NIST-800-171-3.4.5 | 5304 | ······-·NIST-800-171-3.4.5 |
| 5305 | ······-·NIST-800-53-AC-6(1) | 5305 | ······-·NIST-800-53-AC-6(1) |
| Offset 5332, 16 lines modified | Offset 5332, 16 lines modified | ||
| 5332 | ······-·no_reboot_needed | 5332 | ······-·no_reboot_needed |
| 5333 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5333 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5334 | ······stat: | 5334 | ······stat: |
| 5335 | ········path:·/boot/grub2/grub.cfg | 5335 | ········path:·/boot/grub2/grub.cfg |
| 5336 | ······register:·file_exists | 5336 | ······register:·file_exists |
| 5337 | ······when: | 5337 | ······when: |
| 5338 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5339 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5338 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5339 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5340 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5340 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5341 | ······tags: | 5341 | ······tags: |
| 5342 | ······-·CCE-83845-8 | 5342 | ······-·CCE-83845-8 |
| 5343 | ······-·CJIS-5.5.2.2 | 5343 | ······-·CJIS-5.5.2.2 |
| 5344 | ······-·NIST-800-171-3.4.5 | 5344 | ······-·NIST-800-171-3.4.5 |
| 5345 | ······-·NIST-800-53-AC-6(1) | 5345 | ······-·NIST-800-53-AC-6(1) |
| 5346 | ······-·NIST-800-53-CM-6(a) | 5346 | ······-·NIST-800-53-CM-6(a) |
| Offset 5354, 16 lines modified | Offset 5354, 16 lines modified | ||
| 5354 | ······-·no_reboot_needed | 5354 | ······-·no_reboot_needed |
| 5355 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5355 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5356 | ······file: | 5356 | ······file: |
| 5357 | ········path:·/boot/grub2/grub.cfg | 5357 | ········path:·/boot/grub2/grub.cfg |
| 5358 | ········owner:·'0' | 5358 | ········owner:·'0' |
| 5359 | ······when: | 5359 | ······when: |
| 5360 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5361 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5360 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5361 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5363 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5363 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5364 | ······tags: | 5364 | ······tags: |
| 5365 | ······-·CCE-83845-8 | 5365 | ······-·CCE-83845-8 |
| 5366 | ······-·CJIS-5.5.2.2 | 5366 | ······-·CJIS-5.5.2.2 |
| 5367 | ······-·NIST-800-171-3.4.5 | 5367 | ······-·NIST-800-171-3.4.5 |
| 5368 | ······-·NIST-800-53-AC-6(1) | 5368 | ······-·NIST-800-53-AC-6(1) |
| Offset 5395, 16 lines modified | Offset 5395, 16 lines modified | ||
| 5395 | ······-·no_reboot_needed | 5395 | ······-·no_reboot_needed |
| 5396 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5396 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5397 | ······stat: | 5397 | ······stat: |
| 5398 | ········path:·/boot/grub2/user.cfg | 5398 | ········path:·/boot/grub2/user.cfg |
| 5399 | ······register:·file_exists | 5399 | ······register:·file_exists |
| 5400 | ······when: | 5400 | ······when: |
| 5401 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5402 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5401 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5402 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5403 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5403 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5404 | ······tags: | 5404 | ······tags: |
| 5405 | ······-·CCE-86016-3 | 5405 | ······-·CCE-86016-3 |
| 5406 | ······-·CJIS-5.5.2.2 | 5406 | ······-·CJIS-5.5.2.2 |
| 5407 | ······-·NIST-800-171-3.4.5 | 5407 | ······-·NIST-800-171-3.4.5 |
| 5408 | ······-·NIST-800-53-AC-6(1) | 5408 | ······-·NIST-800-53-AC-6(1) |
| 5409 | ······-·NIST-800-53-CM-6(a) | 5409 | ······-·NIST-800-53-CM-6(a) |
| Offset 5417, 16 lines modified | Offset 5417, 16 lines modified | ||
| 5417 | ······-·no_reboot_needed | 5417 | ······-·no_reboot_needed |
| Max diff block lines reached; 3194/7634 bytes (41.84%) of diff not shown. | |||
| Offset 5206, 16 lines modified | Offset 5206, 16 lines modified | ||
| 5206 | ······-·no_reboot_needed | 5206 | ······-·no_reboot_needed |
| 5207 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5207 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5208 | ······stat: | 5208 | ······stat: |
| 5209 | ········path:·/boot/grub2/grub.cfg | 5209 | ········path:·/boot/grub2/grub.cfg |
| 5210 | ······register:·file_exists | 5210 | ······register:·file_exists |
| 5211 | ······when: | 5211 | ······when: |
| 5212 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5213 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5212 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5213 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5214 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5214 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5215 | ······tags: | 5215 | ······tags: |
| 5216 | ······-·CCE-83848-2 | 5216 | ······-·CCE-83848-2 |
| 5217 | ······-·CJIS-5.5.2.2 | 5217 | ······-·CJIS-5.5.2.2 |
| 5218 | ······-·NIST-800-171-3.4.5 | 5218 | ······-·NIST-800-171-3.4.5 |
| 5219 | ······-·NIST-800-53-AC-6(1) | 5219 | ······-·NIST-800-53-AC-6(1) |
| 5220 | ······-·NIST-800-53-CM-6(a) | 5220 | ······-·NIST-800-53-CM-6(a) |
| Offset 5228, 16 lines modified | Offset 5228, 16 lines modified | ||
| 5228 | ······-·no_reboot_needed | 5228 | ······-·no_reboot_needed |
| 5229 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg | 5229 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/grub.cfg |
| 5230 | ······file: | 5230 | ······file: |
| 5231 | ········path:·/boot/grub2/grub.cfg | 5231 | ········path:·/boot/grub2/grub.cfg |
| 5232 | ········group:·'0' | 5232 | ········group:·'0' |
| 5233 | ······when: | 5233 | ······when: |
| 5234 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5235 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5234 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5235 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5236 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5236 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5237 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5237 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5238 | ······tags: | 5238 | ······tags: |
| 5239 | ······-·CCE-83848-2 | 5239 | ······-·CCE-83848-2 |
| 5240 | ······-·CJIS-5.5.2.2 | 5240 | ······-·CJIS-5.5.2.2 |
| 5241 | ······-·NIST-800-171-3.4.5 | 5241 | ······-·NIST-800-171-3.4.5 |
| 5242 | ······-·NIST-800-53-AC-6(1) | 5242 | ······-·NIST-800-53-AC-6(1) |
| Offset 5269, 16 lines modified | Offset 5269, 16 lines modified | ||
| 5269 | ······-·no_reboot_needed | 5269 | ······-·no_reboot_needed |
| 5270 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5270 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5271 | ······stat: | 5271 | ······stat: |
| 5272 | ········path:·/boot/grub2/user.cfg | 5272 | ········path:·/boot/grub2/user.cfg |
| 5273 | ······register:·file_exists | 5273 | ······register:·file_exists |
| 5274 | ······when: | 5274 | ······when: |
| 5275 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5276 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5275 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5276 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5277 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5277 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5278 | ······tags: | 5278 | ······tags: |
| 5279 | ······-·CCE-86010-6 | 5279 | ······-·CCE-86010-6 |
| 5280 | ······-·CJIS-5.5.2.2 | 5280 | ······-·CJIS-5.5.2.2 |
| 5281 | ······-·NIST-800-171-3.4.5 | 5281 | ······-·NIST-800-171-3.4.5 |
| 5282 | ······-·NIST-800-53-AC-6(1) | 5282 | ······-·NIST-800-53-AC-6(1) |
| 5283 | ······-·NIST-800-53-CM-6(a) | 5283 | ······-·NIST-800-53-CM-6(a) |
| Offset 5291, 16 lines modified | Offset 5291, 16 lines modified | ||
| 5291 | ······-·no_reboot_needed | 5291 | ······-·no_reboot_needed |
| 5292 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg | 5292 | ····-·name:·Ensure·group·owner·0·on·/boot/grub2/user.cfg |
| 5293 | ······file: | 5293 | ······file: |
| 5294 | ········path:·/boot/grub2/user.cfg | 5294 | ········path:·/boot/grub2/user.cfg |
| 5295 | ········group:·'0' | 5295 | ········group:·'0' |
| 5296 | ······when: | 5296 | ······when: |
| 5297 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5298 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5297 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5298 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5299 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5300 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5301 | ······tags: | 5301 | ······tags: |
| 5302 | ······-·CCE-86010-6 | 5302 | ······-·CCE-86010-6 |
| 5303 | ······-·CJIS-5.5.2.2 | 5303 | ······-·CJIS-5.5.2.2 |
| 5304 | ······-·NIST-800-171-3.4.5 | 5304 | ······-·NIST-800-171-3.4.5 |
| 5305 | ······-·NIST-800-53-AC-6(1) | 5305 | ······-·NIST-800-53-AC-6(1) |
| Offset 5332, 16 lines modified | Offset 5332, 16 lines modified | ||
| 5332 | ······-·no_reboot_needed | 5332 | ······-·no_reboot_needed |
| 5333 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg | 5333 | ····-·name:·Test·for·existence·/boot/grub2/grub.cfg |
| 5334 | ······stat: | 5334 | ······stat: |
| 5335 | ········path:·/boot/grub2/grub.cfg | 5335 | ········path:·/boot/grub2/grub.cfg |
| 5336 | ······register:·file_exists | 5336 | ······register:·file_exists |
| 5337 | ······when: | 5337 | ······when: |
| 5338 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5339 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5338 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5339 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5340 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5340 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5341 | ······tags: | 5341 | ······tags: |
| 5342 | ······-·CCE-83845-8 | 5342 | ······-·CCE-83845-8 |
| 5343 | ······-·CJIS-5.5.2.2 | 5343 | ······-·CJIS-5.5.2.2 |
| 5344 | ······-·NIST-800-171-3.4.5 | 5344 | ······-·NIST-800-171-3.4.5 |
| 5345 | ······-·NIST-800-53-AC-6(1) | 5345 | ······-·NIST-800-53-AC-6(1) |
| 5346 | ······-·NIST-800-53-CM-6(a) | 5346 | ······-·NIST-800-53-CM-6(a) |
| Offset 5354, 16 lines modified | Offset 5354, 16 lines modified | ||
| 5354 | ······-·no_reboot_needed | 5354 | ······-·no_reboot_needed |
| 5355 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg | 5355 | ····-·name:·Ensure·owner·0·on·/boot/grub2/grub.cfg |
| 5356 | ······file: | 5356 | ······file: |
| 5357 | ········path:·/boot/grub2/grub.cfg | 5357 | ········path:·/boot/grub2/grub.cfg |
| 5358 | ········owner:·'0' | 5358 | ········owner:·'0' |
| 5359 | ······when: | 5359 | ······when: |
| 5360 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5361 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5360 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5361 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5362 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5363 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists | 5363 | ······-·file_exists.stat·is·defined·and·file_exists.stat.exists |
| 5364 | ······tags: | 5364 | ······tags: |
| 5365 | ······-·CCE-83845-8 | 5365 | ······-·CCE-83845-8 |
| 5366 | ······-·CJIS-5.5.2.2 | 5366 | ······-·CJIS-5.5.2.2 |
| 5367 | ······-·NIST-800-171-3.4.5 | 5367 | ······-·NIST-800-171-3.4.5 |
| 5368 | ······-·NIST-800-53-AC-6(1) | 5368 | ······-·NIST-800-53-AC-6(1) |
| Offset 5395, 16 lines modified | Offset 5395, 16 lines modified | ||
| 5395 | ······-·no_reboot_needed | 5395 | ······-·no_reboot_needed |
| 5396 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg | 5396 | ····-·name:·Test·for·existence·/boot/grub2/user.cfg |
| 5397 | ······stat: | 5397 | ······stat: |
| 5398 | ········path:·/boot/grub2/user.cfg | 5398 | ········path:·/boot/grub2/user.cfg |
| 5399 | ······register:·file_exists | 5399 | ······register:·file_exists |
| 5400 | ······when: | 5400 | ······when: |
| 5401 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5402 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' | 5401 | ······-·'"/boot/efi"·not·in·ansible_mounts·|·map(attribute="mount")·|·list' |
| 5402 | ······-·'"grub2-common"·in·ansible_facts.packages' | ||
| 5403 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5403 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5404 | ······tags: | 5404 | ······tags: |
| 5405 | ······-·CCE-86016-3 | 5405 | ······-·CCE-86016-3 |
| 5406 | ······-·CJIS-5.5.2.2 | 5406 | ······-·CJIS-5.5.2.2 |
| 5407 | ······-·NIST-800-171-3.4.5 | 5407 | ······-·NIST-800-171-3.4.5 |
| 5408 | ······-·NIST-800-53-AC-6(1) | 5408 | ······-·NIST-800-53-AC-6(1) |
| 5409 | ······-·NIST-800-53-CM-6(a) | 5409 | ······-·NIST-800-53-CM-6(a) |
| Offset 5417, 16 lines modified | Offset 5417, 16 lines modified | ||
| 5417 | ······-·no_reboot_needed | 5417 | ······-·no_reboot_needed |
| Max diff block lines reached; 3194/7634 bytes (41.84%) of diff not shown. | |||
| Offset 5378, 16 lines modified | Offset 5378, 16 lines modified | ||
| 5378 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 5378 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 5379 | ······find: | 5379 | ······find: |
| 5380 | ········paths:·/etc/audit/rules.d/ | 5380 | ········paths:·/etc/audit/rules.d/ |
| 5381 | ········patterns:·'*.rules' | 5381 | ········patterns:·'*.rules' |
| 5382 | ······register:·find_rules_d | 5382 | ······register:·find_rules_d |
| 5383 | ······when: | 5383 | ······when: |
| 5384 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5385 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5384 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5385 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5386 | ······tags: | 5386 | ······tags: |
| 5387 | ······-·CCE-83716-1 | 5387 | ······-·CCE-83716-1 |
| 5388 | ······-·CJIS-5.4.1.1 | 5388 | ······-·CJIS-5.4.1.1 |
| 5389 | ······-·NIST-800-171-3.3.1 | 5389 | ······-·NIST-800-171-3.3.1 |
| 5390 | ······-·NIST-800-171-3.4.3 | 5390 | ······-·NIST-800-171-3.4.3 |
| 5391 | ······-·NIST-800-53-AC-6(9) | 5391 | ······-·NIST-800-53-AC-6(9) |
| 5392 | ······-·NIST-800-53-CM-6(a) | 5392 | ······-·NIST-800-53-CM-6(a) |
| Offset 5403, 16 lines modified | Offset 5403, 16 lines modified | ||
| 5403 | ······lineinfile: | 5403 | ······lineinfile: |
| 5404 | ········path:·'{{·item·}}' | 5404 | ········path:·'{{·item·}}' |
| 5405 | ········regexp:·^\s*(?:-e)\s+.*$ | 5405 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 5406 | ········state:·absent | 5406 | ········state:·absent |
| 5407 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 5407 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 5408 | ········}}' | 5408 | ········}}' |
| 5409 | ······when: | 5409 | ······when: |
| 5410 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5411 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5410 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5411 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5412 | ······tags: | 5412 | ······tags: |
| 5413 | ······-·CCE-83716-1 | 5413 | ······-·CCE-83716-1 |
| 5414 | ······-·CJIS-5.4.1.1 | 5414 | ······-·CJIS-5.4.1.1 |
| 5415 | ······-·NIST-800-171-3.3.1 | 5415 | ······-·NIST-800-171-3.3.1 |
| 5416 | ······-·NIST-800-171-3.4.3 | 5416 | ······-·NIST-800-171-3.4.3 |
| 5417 | ······-·NIST-800-53-AC-6(9) | 5417 | ······-·NIST-800-53-AC-6(9) |
| 5418 | ······-·NIST-800-53-CM-6(a) | 5418 | ······-·NIST-800-53-CM-6(a) |
| Offset 5430, 16 lines modified | Offset 5430, 16 lines modified | ||
| 5430 | ········create:·true | 5430 | ········create:·true |
| 5431 | ········line:·-e·2 | 5431 | ········line:·-e·2 |
| 5432 | ········mode:·o-rwx | 5432 | ········mode:·o-rwx |
| 5433 | ······loop: | 5433 | ······loop: |
| 5434 | ······-·/etc/audit/audit.rules | 5434 | ······-·/etc/audit/audit.rules |
| 5435 | ······-·/etc/audit/rules.d/immutable.rules | 5435 | ······-·/etc/audit/rules.d/immutable.rules |
| 5436 | ······when: | 5436 | ······when: |
| 5437 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5438 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5437 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5438 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5439 | ······tags: | 5439 | ······tags: |
| 5440 | ······-·CCE-83716-1 | 5440 | ······-·CCE-83716-1 |
| 5441 | ······-·CJIS-5.4.1.1 | 5441 | ······-·CJIS-5.4.1.1 |
| 5442 | ······-·NIST-800-171-3.3.1 | 5442 | ······-·NIST-800-171-3.3.1 |
| 5443 | ······-·NIST-800-171-3.4.3 | 5443 | ······-·NIST-800-171-3.4.3 |
| 5444 | ······-·NIST-800-53-AC-6(9) | 5444 | ······-·NIST-800-53-AC-6(9) |
| 5445 | ······-·NIST-800-53-CM-6(a) | 5445 | ······-·NIST-800-53-CM-6(a) |
| Offset 5473, 16 lines modified | Offset 5473, 16 lines modified | ||
| 5473 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5473 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5474 | ······find: | 5474 | ······find: |
| 5475 | ········paths:·/etc/audit/rules.d | 5475 | ········paths:·/etc/audit/rules.d |
| 5476 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5476 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5477 | ········patterns:·'*.rules' | 5477 | ········patterns:·'*.rules' |
| 5478 | ······register:·find_existing_watch_rules_d | 5478 | ······register:·find_existing_watch_rules_d |
| 5479 | ······when: | 5479 | ······when: |
| 5480 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5480 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5481 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5482 | ······tags: | 5482 | ······tags: |
| 5483 | ······-·CCE-83721-1 | 5483 | ······-·CCE-83721-1 |
| 5484 | ······-·CJIS-5.4.1.1 | 5484 | ······-·CJIS-5.4.1.1 |
| 5485 | ······-·NIST-800-171-3.1.8 | 5485 | ······-·NIST-800-171-3.1.8 |
| 5486 | ······-·NIST-800-53-AU-12(c) | 5486 | ······-·NIST-800-53-AU-12(c) |
| 5487 | ······-·NIST-800-53-AU-2(d) | 5487 | ······-·NIST-800-53-AU-2(d) |
| 5488 | ······-·NIST-800-53-CM-6(a) | 5488 | ······-·NIST-800-53-CM-6(a) |
| Offset 5497, 16 lines modified | Offset 5497, 16 lines modified | ||
| 5497 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5497 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5498 | ······find: | 5498 | ······find: |
| 5499 | ········paths:·/etc/audit/rules.d | 5499 | ········paths:·/etc/audit/rules.d |
| 5500 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5500 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5501 | ········patterns:·'*.rules' | 5501 | ········patterns:·'*.rules' |
| 5502 | ······register:·find_watch_key | 5502 | ······register:·find_watch_key |
| 5503 | ······when: | 5503 | ······when: |
| 5504 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5505 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5504 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5505 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5506 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5506 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5507 | ········==·0 | 5507 | ········==·0 |
| 5508 | ······tags: | 5508 | ······tags: |
| 5509 | ······-·CCE-83721-1 | 5509 | ······-·CCE-83721-1 |
| 5510 | ······-·CJIS-5.4.1.1 | 5510 | ······-·CJIS-5.4.1.1 |
| 5511 | ······-·NIST-800-171-3.1.8 | 5511 | ······-·NIST-800-171-3.1.8 |
| 5512 | ······-·NIST-800-53-AU-12(c) | 5512 | ······-·NIST-800-53-AU-12(c) |
| Offset 5521, 16 lines modified | Offset 5521, 16 lines modified | ||
| 5521 | ······-·restrict_strategy | 5521 | ······-·restrict_strategy |
| 5522 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5522 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5523 | ······set_fact: | 5523 | ······set_fact: |
| 5524 | ········all_files: | 5524 | ········all_files: |
| 5525 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5525 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5526 | ······when: | 5526 | ······when: |
| 5527 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5528 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5527 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5528 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5529 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5529 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5530 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5530 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5531 | ······tags: | 5531 | ······tags: |
| 5532 | ······-·CCE-83721-1 | 5532 | ······-·CCE-83721-1 |
| 5533 | ······-·CJIS-5.4.1.1 | 5533 | ······-·CJIS-5.4.1.1 |
| 5534 | ······-·NIST-800-171-3.1.8 | 5534 | ······-·NIST-800-171-3.1.8 |
| 5535 | ······-·NIST-800-53-AU-12(c) | 5535 | ······-·NIST-800-53-AU-12(c) |
| Offset 5545, 16 lines modified | Offset 5545, 16 lines modified | ||
| 5545 | ······-·restrict_strategy | 5545 | ······-·restrict_strategy |
| 5546 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5546 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5547 | ······set_fact: | 5547 | ······set_fact: |
| 5548 | ········all_files: | 5548 | ········all_files: |
| 5549 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5549 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5550 | ······when: | 5550 | ······when: |
| 5551 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5552 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5551 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5552 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5553 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5553 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5554 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5554 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5555 | ······tags: | 5555 | ······tags: |
| 5556 | ······-·CCE-83721-1 | 5556 | ······-·CCE-83721-1 |
| 5557 | ······-·CJIS-5.4.1.1 | 5557 | ······-·CJIS-5.4.1.1 |
| 5558 | ······-·NIST-800-171-3.1.8 | 5558 | ······-·NIST-800-171-3.1.8 |
| 5559 | ······-·NIST-800-53-AU-12(c) | 5559 | ······-·NIST-800-53-AU-12(c) |
| Offset 5571, 16 lines modified | Offset 5571, 16 lines modified | ||
| 5571 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5571 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 157412/162045 bytes (97.14%) of diff not shown. | |||
| Offset 3450, 16 lines modified | Offset 3450, 16 lines modified | ||
| 3450 | ······lineinfile: | 3450 | ······lineinfile: |
| 3451 | ········dest:·/etc/audit/auditd.conf | 3451 | ········dest:·/etc/audit/auditd.conf |
| 3452 | ········regexp:·^\s*flush\s*=\s*.*$ | 3452 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 3453 | ········line:·flush·=·{{·var_auditd_flush·}} | 3453 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 3454 | ········state:·present | 3454 | ········state:·present |
| 3455 | ········create:·true | 3455 | ········create:·true |
| 3456 | ······when: | 3456 | ······when: |
| 3457 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3458 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3457 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3458 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3459 | ······tags: | 3459 | ······tags: |
| 3460 | ······-·CCE-83685-8 | 3460 | ······-·CCE-83685-8 |
| 3461 | ······-·NIST-800-171-3.3.1 | 3461 | ······-·NIST-800-171-3.3.1 |
| 3462 | ······-·NIST-800-53-AU-11 | 3462 | ······-·NIST-800-53-AU-11 |
| 3463 | ······-·NIST-800-53-CM-6(a) | 3463 | ······-·NIST-800-53-CM-6(a) |
| 3464 | ······-·auditd_data_retention_flush | 3464 | ······-·auditd_data_retention_flush |
| 3465 | ······-·low_complexity | 3465 | ······-·low_complexity |
| Offset 3507, 16 lines modified | Offset 3507, 16 lines modified | ||
| 3507 | ········lineinfile: | 3507 | ········lineinfile: |
| 3508 | ··········path:·/etc/audit/auditd.conf | 3508 | ··········path:·/etc/audit/auditd.conf |
| 3509 | ··········create:·true | 3509 | ··········create:·true |
| 3510 | ··········regexp:·(?i)^\s*freq\s*=\s* | 3510 | ··········regexp:·(?i)^\s*freq\s*=\s* |
| 3511 | ··········line:·freq·=·50 | 3511 | ··········line:·freq·=·50 |
| 3512 | ··········state:·present | 3512 | ··········state:·present |
| 3513 | ······when: | 3513 | ······when: |
| 3514 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3515 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3514 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3515 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3516 | ······tags: | 3516 | ······tags: |
| 3517 | ······-·CCE-83704-7 | 3517 | ······-·CCE-83704-7 |
| 3518 | ······-·NIST-800-53-CM-6 | 3518 | ······-·NIST-800-53-CM-6 |
| 3519 | ······-·auditd_freq | 3519 | ······-·auditd_freq |
| 3520 | ······-·low_complexity | 3520 | ······-·low_complexity |
| 3521 | ······-·low_disruption | 3521 | ······-·low_disruption |
| 3522 | ······-·medium_severity | 3522 | ······-·medium_severity |
| Offset 3563, 16 lines modified | Offset 3563, 16 lines modified | ||
| 3563 | ········lineinfile: | 3563 | ········lineinfile: |
| 3564 | ··········path:·/etc/audit/auditd.conf | 3564 | ··········path:·/etc/audit/auditd.conf |
| 3565 | ··········create:·true | 3565 | ··········create:·true |
| 3566 | ··········regexp:·(?i)^\s*log_format\s*=\s* | 3566 | ··········regexp:·(?i)^\s*log_format\s*=\s* |
| 3567 | ··········line:·log_format·=·ENRICHED | 3567 | ··········line:·log_format·=·ENRICHED |
| 3568 | ··········state:·present | 3568 | ··········state:·present |
| 3569 | ······when: | 3569 | ······when: |
| 3570 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3571 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3570 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3571 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3572 | ······tags: | 3572 | ······tags: |
| 3573 | ······-·CCE-83696-5 | 3573 | ······-·CCE-83696-5 |
| 3574 | ······-·NIST-800-53-AU-3 | 3574 | ······-·NIST-800-53-AU-3 |
| 3575 | ······-·NIST-800-53-CM-6 | 3575 | ······-·NIST-800-53-CM-6 |
| 3576 | ······-·auditd_log_format | 3576 | ······-·auditd_log_format |
| 3577 | ······-·low_complexity | 3577 | ······-·low_complexity |
| 3578 | ······-·low_disruption | 3578 | ······-·low_disruption |
| Offset 3620, 16 lines modified | Offset 3620, 16 lines modified | ||
| 3620 | ········lineinfile: | 3620 | ········lineinfile: |
| 3621 | ··········path:·/etc/audit/auditd.conf | 3621 | ··········path:·/etc/audit/auditd.conf |
| 3622 | ··········create:·true | 3622 | ··········create:·true |
| 3623 | ··········regexp:·(?i)^\s*name_format\s*=\s* | 3623 | ··········regexp:·(?i)^\s*name_format\s*=\s* |
| 3624 | ··········line:·name_format·=·hostname | 3624 | ··········line:·name_format·=·hostname |
| 3625 | ··········state:·present | 3625 | ··········state:·present |
| 3626 | ······when: | 3626 | ······when: |
| 3627 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3628 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3627 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3628 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3629 | ······tags: | 3629 | ······tags: |
| 3630 | ······-·CCE-83686-6 | 3630 | ······-·CCE-83686-6 |
| 3631 | ······-·NIST-800-53-AU-3 | 3631 | ······-·NIST-800-53-AU-3 |
| 3632 | ······-·NIST-800-53-CM-6 | 3632 | ······-·NIST-800-53-CM-6 |
| 3633 | ······-·auditd_name_format | 3633 | ······-·auditd_name_format |
| 3634 | ······-·low_complexity | 3634 | ······-·low_complexity |
| 3635 | ······-·low_disruption | 3635 | ······-·low_disruption |
| Offset 1163, 16 lines modified | Offset 1163, 16 lines modified | ||
| 1163 | ······-·no_reboot_needed | 1163 | ······-·no_reboot_needed |
| 1164 | ······-·restrict_strategy | 1164 | ······-·restrict_strategy |
| 1165 | ····-·name:·Set·architecture·for·audit·tasks | 1165 | ····-·name:·Set·architecture·for·audit·tasks |
| 1166 | ······set_fact: | 1166 | ······set_fact: |
| 1167 | ········audit_arch:·b64 | 1167 | ········audit_arch:·b64 |
| 1168 | ······when: | 1168 | ······when: |
| 1169 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1170 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1169 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1170 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1171 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 1171 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 1172 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 1172 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 1173 | ······tags: | 1173 | ······tags: |
| 1174 | ······-·CCE-83706-2 | 1174 | ······-·CCE-83706-2 |
| 1175 | ······-·CJIS-5.4.1.1 | 1175 | ······-·CJIS-5.4.1.1 |
| 1176 | ······-·NIST-800-171-3.1.7 | 1176 | ······-·NIST-800-171-3.1.7 |
| 1177 | ······-·NIST-800-53-AC-6(9) | 1177 | ······-·NIST-800-53-AC-6(9) |
| Offset 1306, 16 lines modified | Offset 1306, 16 lines modified | ||
| 1306 | ··········path:·'{{·audit_file·}}' | 1306 | ··········path:·'{{·audit_file·}}' |
| 1307 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1307 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1308 | ··········create:·true | 1308 | ··········create:·true |
| 1309 | ··········mode:·o-rwx | 1309 | ··········mode:·o-rwx |
| 1310 | ··········state:·present | 1310 | ··········state:·present |
| 1311 | ········when:·syscalls_found·|·length·==·0 | 1311 | ········when:·syscalls_found·|·length·==·0 |
| 1312 | ······when: | 1312 | ······when: |
| 1313 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1314 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1313 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1314 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1315 | ······tags: | 1315 | ······tags: |
| 1316 | ······-·CCE-83706-2 | 1316 | ······-·CCE-83706-2 |
| 1317 | ······-·CJIS-5.4.1.1 | 1317 | ······-·CJIS-5.4.1.1 |
| 1318 | ······-·NIST-800-171-3.1.7 | 1318 | ······-·NIST-800-171-3.1.7 |
| 1319 | ······-·NIST-800-53-AC-6(9) | 1319 | ······-·NIST-800-53-AC-6(9) |
| 1320 | ······-·NIST-800-53-AU-12(c) | 1320 | ······-·NIST-800-53-AU-12(c) |
| 1321 | ······-·NIST-800-53-AU-2(d) | 1321 | ······-·NIST-800-53-AU-2(d) |
| Offset 1447, 16 lines modified | Offset 1447, 16 lines modified | ||
| 1447 | ··········path:·'{{·audit_file·}}' | 1447 | ··········path:·'{{·audit_file·}}' |
| 1448 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 1448 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 1449 | ··········create:·true | 1449 | ··········create:·true |
| 1450 | ··········mode:·o-rwx | 1450 | ··········mode:·o-rwx |
| 1451 | ··········state:·present | 1451 | ··········state:·present |
| 1452 | ········when:·syscalls_found·|·length·==·0 | 1452 | ········when:·syscalls_found·|·length·==·0 |
| 1453 | ······when: | 1453 | ······when: |
| 1454 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1455 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1454 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1455 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1456 | ······-·audit_arch·==·"b64" | 1456 | ······-·audit_arch·==·"b64" |
| 1457 | ······tags: | 1457 | ······tags: |
| 1458 | ······-·CCE-83706-2 | 1458 | ······-·CCE-83706-2 |
| 1459 | ······-·CJIS-5.4.1.1 | 1459 | ······-·CJIS-5.4.1.1 |
| 1460 | ······-·NIST-800-171-3.1.7 | 1460 | ······-·NIST-800-171-3.1.7 |
| 1461 | ······-·NIST-800-53-AC-6(9) | 1461 | ······-·NIST-800-53-AC-6(9) |
| 1462 | ······-·NIST-800-53-AU-12(c) | 1462 | ······-·NIST-800-53-AU-12(c) |
| Offset 1473, 16 lines modified | Offset 1473, 16 lines modified | ||
| 1473 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ | 1473 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ |
| 1474 | ······find: | 1474 | ······find: |
| 1475 | ········paths:·/etc/audit/rules.d | 1475 | ········paths:·/etc/audit/rules.d |
| 1476 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ | 1476 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ |
| 1477 | ········patterns:·'*.rules' | 1477 | ········patterns:·'*.rules' |
| 1478 | ······register:·find_existing_watch_rules_d | 1478 | ······register:·find_existing_watch_rules_d |
| 1479 | ······when: | 1479 | ······when: |
| 1480 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1481 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1480 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1481 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1482 | ······tags: | 1482 | ······tags: |
| 1483 | ······-·CCE-83706-2 | 1483 | ······-·CCE-83706-2 |
| 1484 | ······-·CJIS-5.4.1.1 | 1484 | ······-·CJIS-5.4.1.1 |
| 1485 | ······-·NIST-800-171-3.1.7 | 1485 | ······-·NIST-800-171-3.1.7 |
| 1486 | ······-·NIST-800-53-AC-6(9) | 1486 | ······-·NIST-800-53-AC-6(9) |
| 1487 | ······-·NIST-800-53-AU-12(c) | 1487 | ······-·NIST-800-53-AU-12(c) |
| 1488 | ······-·NIST-800-53-AU-2(d) | 1488 | ······-·NIST-800-53-AU-2(d) |
| Offset 1498, 16 lines modified | Offset 1498, 16 lines modified | ||
| 1498 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification | 1498 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification |
| 1499 | ······find: | 1499 | ······find: |
| 1500 | ········paths:·/etc/audit/rules.d | 1500 | ········paths:·/etc/audit/rules.d |
| 1501 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ | 1501 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ |
| 1502 | ········patterns:·'*.rules' | 1502 | ········patterns:·'*.rules' |
| 1503 | ······register:·find_watch_key | 1503 | ······register:·find_watch_key |
| 1504 | ······when: | 1504 | ······when: |
| 1505 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1506 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1505 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1506 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1507 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1507 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1508 | ········==·0 | 1508 | ········==·0 |
| 1509 | ······tags: | 1509 | ······tags: |
| 1510 | ······-·CCE-83706-2 | 1510 | ······-·CCE-83706-2 |
| 1511 | ······-·CJIS-5.4.1.1 | 1511 | ······-·CJIS-5.4.1.1 |
| 1512 | ······-·NIST-800-171-3.1.7 | 1512 | ······-·NIST-800-171-3.1.7 |
| 1513 | ······-·NIST-800-53-AC-6(9) | 1513 | ······-·NIST-800-53-AC-6(9) |
| Offset 1524, 16 lines modified | Offset 1524, 16 lines modified | ||
| 1524 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the | 1524 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the |
| 1525 | ········recipient·for·the·rule | 1525 | ········recipient·for·the·rule |
| 1526 | ······set_fact: | 1526 | ······set_fact: |
| 1527 | ········all_files: | 1527 | ········all_files: |
| 1528 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules | 1528 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules |
| 1529 | ······when: | 1529 | ······when: |
| 1530 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1531 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1530 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1531 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1532 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1532 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1533 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1533 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1534 | ······tags: | 1534 | ······tags: |
| 1535 | ······-·CCE-83706-2 | 1535 | ······-·CCE-83706-2 |
| 1536 | ······-·CJIS-5.4.1.1 | 1536 | ······-·CJIS-5.4.1.1 |
| 1537 | ······-·NIST-800-171-3.1.7 | 1537 | ······-·NIST-800-171-3.1.7 |
| 1538 | ······-·NIST-800-53-AC-6(9) | 1538 | ······-·NIST-800-53-AC-6(9) |
| Offset 1549, 16 lines modified | Offset 1549, 16 lines modified | ||
| 1549 | ······-·restrict_strategy | 1549 | ······-·restrict_strategy |
| 1550 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1550 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1551 | ······set_fact: | 1551 | ······set_fact: |
| 1552 | ········all_files: | 1552 | ········all_files: |
| 1553 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1553 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1554 | ······when: | 1554 | ······when: |
| 1555 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1556 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1555 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1556 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1557 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1557 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1558 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1558 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1559 | ······tags: | 1559 | ······tags: |
| 1560 | ······-·CCE-83706-2 | 1560 | ······-·CCE-83706-2 |
| 1561 | ······-·CJIS-5.4.1.1 | 1561 | ······-·CJIS-5.4.1.1 |
| 1562 | ······-·NIST-800-171-3.1.7 | 1562 | ······-·NIST-800-171-3.1.7 |
| 1563 | ······-·NIST-800-53-AC-6(9) | 1563 | ······-·NIST-800-53-AC-6(9) |
| Offset 1576, 16 lines modified | Offset 1576, 16 lines modified | ||
| 1576 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ | 1576 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 65234/70224 bytes (92.89%) of diff not shown. | |||
| Offset 1334, 16 lines modified | Offset 1334, 16 lines modified | ||
| 1334 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 1334 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 1335 | ······find: | 1335 | ······find: |
| 1336 | ········paths:·/etc/audit/rules.d/ | 1336 | ········paths:·/etc/audit/rules.d/ |
| 1337 | ········patterns:·'*.rules' | 1337 | ········patterns:·'*.rules' |
| 1338 | ······register:·find_rules_d | 1338 | ······register:·find_rules_d |
| 1339 | ······when: | 1339 | ······when: |
| 1340 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1341 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1340 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1341 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1342 | ······tags: | 1342 | ······tags: |
| 1343 | ······-·CCE-83716-1 | 1343 | ······-·CCE-83716-1 |
| 1344 | ······-·CJIS-5.4.1.1 | 1344 | ······-·CJIS-5.4.1.1 |
| 1345 | ······-·NIST-800-171-3.3.1 | 1345 | ······-·NIST-800-171-3.3.1 |
| 1346 | ······-·NIST-800-171-3.4.3 | 1346 | ······-·NIST-800-171-3.4.3 |
| 1347 | ······-·NIST-800-53-AC-6(9) | 1347 | ······-·NIST-800-53-AC-6(9) |
| 1348 | ······-·NIST-800-53-CM-6(a) | 1348 | ······-·NIST-800-53-CM-6(a) |
| Offset 1359, 16 lines modified | Offset 1359, 16 lines modified | ||
| 1359 | ······lineinfile: | 1359 | ······lineinfile: |
| 1360 | ········path:·'{{·item·}}' | 1360 | ········path:·'{{·item·}}' |
| 1361 | ········regexp:·^\s*(?:-e)\s+.*$ | 1361 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 1362 | ········state:·absent | 1362 | ········state:·absent |
| 1363 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 1363 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 1364 | ········}}' | 1364 | ········}}' |
| 1365 | ······when: | 1365 | ······when: |
| 1366 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1367 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1366 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1367 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1368 | ······tags: | 1368 | ······tags: |
| 1369 | ······-·CCE-83716-1 | 1369 | ······-·CCE-83716-1 |
| 1370 | ······-·CJIS-5.4.1.1 | 1370 | ······-·CJIS-5.4.1.1 |
| 1371 | ······-·NIST-800-171-3.3.1 | 1371 | ······-·NIST-800-171-3.3.1 |
| 1372 | ······-·NIST-800-171-3.4.3 | 1372 | ······-·NIST-800-171-3.4.3 |
| 1373 | ······-·NIST-800-53-AC-6(9) | 1373 | ······-·NIST-800-53-AC-6(9) |
| 1374 | ······-·NIST-800-53-CM-6(a) | 1374 | ······-·NIST-800-53-CM-6(a) |
| Offset 1386, 16 lines modified | Offset 1386, 16 lines modified | ||
| 1386 | ········create:·true | 1386 | ········create:·true |
| 1387 | ········line:·-e·2 | 1387 | ········line:·-e·2 |
| 1388 | ········mode:·o-rwx | 1388 | ········mode:·o-rwx |
| 1389 | ······loop: | 1389 | ······loop: |
| 1390 | ······-·/etc/audit/audit.rules | 1390 | ······-·/etc/audit/audit.rules |
| 1391 | ······-·/etc/audit/rules.d/immutable.rules | 1391 | ······-·/etc/audit/rules.d/immutable.rules |
| 1392 | ······when: | 1392 | ······when: |
| 1393 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1394 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1393 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1394 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1395 | ······tags: | 1395 | ······tags: |
| 1396 | ······-·CCE-83716-1 | 1396 | ······-·CCE-83716-1 |
| 1397 | ······-·CJIS-5.4.1.1 | 1397 | ······-·CJIS-5.4.1.1 |
| 1398 | ······-·NIST-800-171-3.3.1 | 1398 | ······-·NIST-800-171-3.3.1 |
| 1399 | ······-·NIST-800-171-3.4.3 | 1399 | ······-·NIST-800-171-3.4.3 |
| 1400 | ······-·NIST-800-53-AC-6(9) | 1400 | ······-·NIST-800-53-AC-6(9) |
| 1401 | ······-·NIST-800-53-CM-6(a) | 1401 | ······-·NIST-800-53-CM-6(a) |
| Offset 1429, 16 lines modified | Offset 1429, 16 lines modified | ||
| 1429 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 1429 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 1430 | ······find: | 1430 | ······find: |
| 1431 | ········paths:·/etc/audit/rules.d | 1431 | ········paths:·/etc/audit/rules.d |
| 1432 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 1432 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 1433 | ········patterns:·'*.rules' | 1433 | ········patterns:·'*.rules' |
| 1434 | ······register:·find_existing_watch_rules_d | 1434 | ······register:·find_existing_watch_rules_d |
| 1435 | ······when: | 1435 | ······when: |
| 1436 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1437 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1436 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1437 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1438 | ······tags: | 1438 | ······tags: |
| 1439 | ······-·CCE-83721-1 | 1439 | ······-·CCE-83721-1 |
| 1440 | ······-·CJIS-5.4.1.1 | 1440 | ······-·CJIS-5.4.1.1 |
| 1441 | ······-·NIST-800-171-3.1.8 | 1441 | ······-·NIST-800-171-3.1.8 |
| 1442 | ······-·NIST-800-53-AU-12(c) | 1442 | ······-·NIST-800-53-AU-12(c) |
| 1443 | ······-·NIST-800-53-AU-2(d) | 1443 | ······-·NIST-800-53-AU-2(d) |
| 1444 | ······-·NIST-800-53-CM-6(a) | 1444 | ······-·NIST-800-53-CM-6(a) |
| Offset 1453, 16 lines modified | Offset 1453, 16 lines modified | ||
| 1453 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 1453 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 1454 | ······find: | 1454 | ······find: |
| 1455 | ········paths:·/etc/audit/rules.d | 1455 | ········paths:·/etc/audit/rules.d |
| 1456 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 1456 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 1457 | ········patterns:·'*.rules' | 1457 | ········patterns:·'*.rules' |
| 1458 | ······register:·find_watch_key | 1458 | ······register:·find_watch_key |
| 1459 | ······when: | 1459 | ······when: |
| 1460 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1461 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1460 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1461 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1462 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 1462 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 1463 | ········==·0 | 1463 | ········==·0 |
| 1464 | ······tags: | 1464 | ······tags: |
| 1465 | ······-·CCE-83721-1 | 1465 | ······-·CCE-83721-1 |
| 1466 | ······-·CJIS-5.4.1.1 | 1466 | ······-·CJIS-5.4.1.1 |
| 1467 | ······-·NIST-800-171-3.1.8 | 1467 | ······-·NIST-800-171-3.1.8 |
| 1468 | ······-·NIST-800-53-AU-12(c) | 1468 | ······-·NIST-800-53-AU-12(c) |
| Offset 1477, 16 lines modified | Offset 1477, 16 lines modified | ||
| 1477 | ······-·restrict_strategy | 1477 | ······-·restrict_strategy |
| 1478 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 1478 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 1479 | ······set_fact: | 1479 | ······set_fact: |
| 1480 | ········all_files: | 1480 | ········all_files: |
| 1481 | ········-·/etc/audit/rules.d/MAC-policy.rules | 1481 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 1482 | ······when: | 1482 | ······when: |
| 1483 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1484 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1483 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1484 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1485 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 1485 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 1486 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1486 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1487 | ······tags: | 1487 | ······tags: |
| 1488 | ······-·CCE-83721-1 | 1488 | ······-·CCE-83721-1 |
| 1489 | ······-·CJIS-5.4.1.1 | 1489 | ······-·CJIS-5.4.1.1 |
| 1490 | ······-·NIST-800-171-3.1.8 | 1490 | ······-·NIST-800-171-3.1.8 |
| 1491 | ······-·NIST-800-53-AU-12(c) | 1491 | ······-·NIST-800-53-AU-12(c) |
| Offset 1501, 16 lines modified | Offset 1501, 16 lines modified | ||
| 1501 | ······-·restrict_strategy | 1501 | ······-·restrict_strategy |
| 1502 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 1502 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 1503 | ······set_fact: | 1503 | ······set_fact: |
| 1504 | ········all_files: | 1504 | ········all_files: |
| 1505 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 1505 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 1506 | ······when: | 1506 | ······when: |
| 1507 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1508 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 1507 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 1508 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 1509 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 1509 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 1510 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 1510 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 1511 | ······tags: | 1511 | ······tags: |
| 1512 | ······-·CCE-83721-1 | 1512 | ······-·CCE-83721-1 |
| 1513 | ······-·CJIS-5.4.1.1 | 1513 | ······-·CJIS-5.4.1.1 |
| 1514 | ······-·NIST-800-171-3.1.8 | 1514 | ······-·NIST-800-171-3.1.8 |
| 1515 | ······-·NIST-800-53-AU-12(c) | 1515 | ······-·NIST-800-53-AU-12(c) |
| Offset 1527, 16 lines modified | Offset 1527, 16 lines modified | ||
| 1527 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 1527 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 177648/182281 bytes (97.46%) of diff not shown. | |||
| Offset 4527, 16 lines modified | Offset 4527, 16 lines modified | ||
| 4527 | ······-·no_reboot_needed | 4527 | ······-·no_reboot_needed |
| 4528 | ······-·restrict_strategy | 4528 | ······-·restrict_strategy |
| 4529 | ····-·name:·Set·architecture·for·audit·tasks | 4529 | ····-·name:·Set·architecture·for·audit·tasks |
| 4530 | ······set_fact: | 4530 | ······set_fact: |
| 4531 | ········audit_arch:·b64 | 4531 | ········audit_arch:·b64 |
| 4532 | ······when: | 4532 | ······when: |
| 4533 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4534 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4533 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4534 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4535 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 4535 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 4536 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 4536 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 4537 | ······tags: | 4537 | ······tags: |
| 4538 | ······-·CCE-83706-2 | 4538 | ······-·CCE-83706-2 |
| 4539 | ······-·CJIS-5.4.1.1 | 4539 | ······-·CJIS-5.4.1.1 |
| 4540 | ······-·NIST-800-171-3.1.7 | 4540 | ······-·NIST-800-171-3.1.7 |
| 4541 | ······-·NIST-800-53-AC-6(9) | 4541 | ······-·NIST-800-53-AC-6(9) |
| Offset 4670, 16 lines modified | Offset 4670, 16 lines modified | ||
| 4670 | ··········path:·'{{·audit_file·}}' | 4670 | ··········path:·'{{·audit_file·}}' |
| 4671 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 4671 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 4672 | ··········create:·true | 4672 | ··········create:·true |
| 4673 | ··········mode:·o-rwx | 4673 | ··········mode:·o-rwx |
| 4674 | ··········state:·present | 4674 | ··········state:·present |
| 4675 | ········when:·syscalls_found·|·length·==·0 | 4675 | ········when:·syscalls_found·|·length·==·0 |
| 4676 | ······when: | 4676 | ······when: |
| 4677 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4678 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4677 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4678 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4679 | ······tags: | 4679 | ······tags: |
| 4680 | ······-·CCE-83706-2 | 4680 | ······-·CCE-83706-2 |
| 4681 | ······-·CJIS-5.4.1.1 | 4681 | ······-·CJIS-5.4.1.1 |
| 4682 | ······-·NIST-800-171-3.1.7 | 4682 | ······-·NIST-800-171-3.1.7 |
| 4683 | ······-·NIST-800-53-AC-6(9) | 4683 | ······-·NIST-800-53-AC-6(9) |
| 4684 | ······-·NIST-800-53-AU-12(c) | 4684 | ······-·NIST-800-53-AU-12(c) |
| 4685 | ······-·NIST-800-53-AU-2(d) | 4685 | ······-·NIST-800-53-AU-2(d) |
| Offset 4811, 16 lines modified | Offset 4811, 16 lines modified | ||
| 4811 | ··········path:·'{{·audit_file·}}' | 4811 | ··········path:·'{{·audit_file·}}' |
| 4812 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification | 4812 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·key=audit_rules_networkconfig_modification |
| 4813 | ··········create:·true | 4813 | ··········create:·true |
| 4814 | ··········mode:·o-rwx | 4814 | ··········mode:·o-rwx |
| 4815 | ··········state:·present | 4815 | ··········state:·present |
| 4816 | ········when:·syscalls_found·|·length·==·0 | 4816 | ········when:·syscalls_found·|·length·==·0 |
| 4817 | ······when: | 4817 | ······when: |
| 4818 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4819 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4818 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4819 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4820 | ······-·audit_arch·==·"b64" | 4820 | ······-·audit_arch·==·"b64" |
| 4821 | ······tags: | 4821 | ······tags: |
| 4822 | ······-·CCE-83706-2 | 4822 | ······-·CCE-83706-2 |
| 4823 | ······-·CJIS-5.4.1.1 | 4823 | ······-·CJIS-5.4.1.1 |
| 4824 | ······-·NIST-800-171-3.1.7 | 4824 | ······-·NIST-800-171-3.1.7 |
| 4825 | ······-·NIST-800-53-AC-6(9) | 4825 | ······-·NIST-800-53-AC-6(9) |
| 4826 | ······-·NIST-800-53-AU-12(c) | 4826 | ······-·NIST-800-53-AU-12(c) |
| Offset 4837, 16 lines modified | Offset 4837, 16 lines modified | ||
| 4837 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ | 4837 | ····-·name:·Check·if·watch·rule·for·/etc/issue·already·exists·in·/etc/audit/rules.d/ |
| 4838 | ······find: | 4838 | ······find: |
| 4839 | ········paths:·/etc/audit/rules.d | 4839 | ········paths:·/etc/audit/rules.d |
| 4840 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ | 4840 | ········contains:·^\s*-w\s+/etc/issue\s+-p\s+wa(\s|$)+ |
| 4841 | ········patterns:·'*.rules' | 4841 | ········patterns:·'*.rules' |
| 4842 | ······register:·find_existing_watch_rules_d | 4842 | ······register:·find_existing_watch_rules_d |
| 4843 | ······when: | 4843 | ······when: |
| 4844 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4845 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4844 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4845 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4846 | ······tags: | 4846 | ······tags: |
| 4847 | ······-·CCE-83706-2 | 4847 | ······-·CCE-83706-2 |
| 4848 | ······-·CJIS-5.4.1.1 | 4848 | ······-·CJIS-5.4.1.1 |
| 4849 | ······-·NIST-800-171-3.1.7 | 4849 | ······-·NIST-800-171-3.1.7 |
| 4850 | ······-·NIST-800-53-AC-6(9) | 4850 | ······-·NIST-800-53-AC-6(9) |
| 4851 | ······-·NIST-800-53-AU-12(c) | 4851 | ······-·NIST-800-53-AU-12(c) |
| 4852 | ······-·NIST-800-53-AU-2(d) | 4852 | ······-·NIST-800-53-AU-2(d) |
| Offset 4862, 16 lines modified | Offset 4862, 16 lines modified | ||
| 4862 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification | 4862 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·audit_rules_networkconfig_modification |
| 4863 | ······find: | 4863 | ······find: |
| 4864 | ········paths:·/etc/audit/rules.d | 4864 | ········paths:·/etc/audit/rules.d |
| 4865 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ | 4865 | ········contains:·^.*(?:-F·key=|-k\s+)audit_rules_networkconfig_modification$ |
| 4866 | ········patterns:·'*.rules' | 4866 | ········patterns:·'*.rules' |
| 4867 | ······register:·find_watch_key | 4867 | ······register:·find_watch_key |
| 4868 | ······when: | 4868 | ······when: |
| 4869 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4870 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4869 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4870 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4871 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 4871 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 4872 | ········==·0 | 4872 | ········==·0 |
| 4873 | ······tags: | 4873 | ······tags: |
| 4874 | ······-·CCE-83706-2 | 4874 | ······-·CCE-83706-2 |
| 4875 | ······-·CJIS-5.4.1.1 | 4875 | ······-·CJIS-5.4.1.1 |
| 4876 | ······-·NIST-800-171-3.1.7 | 4876 | ······-·NIST-800-171-3.1.7 |
| 4877 | ······-·NIST-800-53-AC-6(9) | 4877 | ······-·NIST-800-53-AC-6(9) |
| Offset 4888, 16 lines modified | Offset 4888, 16 lines modified | ||
| 4888 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the | 4888 | ····-·name:·Use·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules·as·the |
| 4889 | ········recipient·for·the·rule | 4889 | ········recipient·for·the·rule |
| 4890 | ······set_fact: | 4890 | ······set_fact: |
| 4891 | ········all_files: | 4891 | ········all_files: |
| 4892 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules | 4892 | ········-·/etc/audit/rules.d/audit_rules_networkconfig_modification.rules |
| 4893 | ······when: | 4893 | ······when: |
| 4894 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4895 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4894 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4895 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4896 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 4896 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 4897 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4897 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4898 | ······tags: | 4898 | ······tags: |
| 4899 | ······-·CCE-83706-2 | 4899 | ······-·CCE-83706-2 |
| 4900 | ······-·CJIS-5.4.1.1 | 4900 | ······-·CJIS-5.4.1.1 |
| 4901 | ······-·NIST-800-171-3.1.7 | 4901 | ······-·NIST-800-171-3.1.7 |
| 4902 | ······-·NIST-800-53-AC-6(9) | 4902 | ······-·NIST-800-53-AC-6(9) |
| Offset 4913, 16 lines modified | Offset 4913, 16 lines modified | ||
| 4913 | ······-·restrict_strategy | 4913 | ······-·restrict_strategy |
| 4914 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 4914 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 4915 | ······set_fact: | 4915 | ······set_fact: |
| 4916 | ········all_files: | 4916 | ········all_files: |
| 4917 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 4917 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 4918 | ······when: | 4918 | ······when: |
| 4919 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4920 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 4919 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 4920 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 4921 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 4921 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 4922 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4922 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4923 | ······tags: | 4923 | ······tags: |
| 4924 | ······-·CCE-83706-2 | 4924 | ······-·CCE-83706-2 |
| 4925 | ······-·CJIS-5.4.1.1 | 4925 | ······-·CJIS-5.4.1.1 |
| 4926 | ······-·NIST-800-171-3.1.7 | 4926 | ······-·NIST-800-171-3.1.7 |
| 4927 | ······-·NIST-800-53-AC-6(9) | 4927 | ······-·NIST-800-53-AC-6(9) |
| Offset 4940, 16 lines modified | Offset 4940, 16 lines modified | ||
| 4940 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ | 4940 | ····-·name:·Add·watch·rule·for·/etc/issue·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 82495/87485 bytes (94.30%) of diff not shown. | |||
| Offset 3442, 16 lines modified | Offset 3442, 16 lines modified | ||
| 3442 | ······lineinfile: | 3442 | ······lineinfile: |
| 3443 | ········dest:·/etc/audit/auditd.conf | 3443 | ········dest:·/etc/audit/auditd.conf |
| 3444 | ········regexp:·^\s*flush\s*=\s*.*$ | 3444 | ········regexp:·^\s*flush\s*=\s*.*$ |
| 3445 | ········line:·flush·=·{{·var_auditd_flush·}} | 3445 | ········line:·flush·=·{{·var_auditd_flush·}} |
| 3446 | ········state:·present | 3446 | ········state:·present |
| 3447 | ········create:·true | 3447 | ········create:·true |
| 3448 | ······when: | 3448 | ······when: |
| 3449 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3450 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3449 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3450 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3451 | ······tags: | 3451 | ······tags: |
| 3452 | ······-·CCE-83685-8 | 3452 | ······-·CCE-83685-8 |
| 3453 | ······-·NIST-800-171-3.3.1 | 3453 | ······-·NIST-800-171-3.3.1 |
| 3454 | ······-·NIST-800-53-AU-11 | 3454 | ······-·NIST-800-53-AU-11 |
| 3455 | ······-·NIST-800-53-CM-6(a) | 3455 | ······-·NIST-800-53-CM-6(a) |
| 3456 | ······-·auditd_data_retention_flush | 3456 | ······-·auditd_data_retention_flush |
| 3457 | ······-·low_complexity | 3457 | ······-·low_complexity |
| Offset 3499, 16 lines modified | Offset 3499, 16 lines modified | ||
| 3499 | ········lineinfile: | 3499 | ········lineinfile: |
| 3500 | ··········path:·/etc/audit/auditd.conf | 3500 | ··········path:·/etc/audit/auditd.conf |
| 3501 | ··········create:·true | 3501 | ··········create:·true |
| 3502 | ··········regexp:·(?i)^\s*freq\s*=\s* | 3502 | ··········regexp:·(?i)^\s*freq\s*=\s* |
| 3503 | ··········line:·freq·=·50 | 3503 | ··········line:·freq·=·50 |
| 3504 | ··········state:·present | 3504 | ··········state:·present |
| 3505 | ······when: | 3505 | ······when: |
| 3506 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3507 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3506 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3507 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3508 | ······tags: | 3508 | ······tags: |
| 3509 | ······-·CCE-83704-7 | 3509 | ······-·CCE-83704-7 |
| 3510 | ······-·NIST-800-53-CM-6 | 3510 | ······-·NIST-800-53-CM-6 |
| 3511 | ······-·auditd_freq | 3511 | ······-·auditd_freq |
| 3512 | ······-·low_complexity | 3512 | ······-·low_complexity |
| 3513 | ······-·low_disruption | 3513 | ······-·low_disruption |
| 3514 | ······-·medium_severity | 3514 | ······-·medium_severity |
| Offset 3555, 16 lines modified | Offset 3555, 16 lines modified | ||
| 3555 | ········lineinfile: | 3555 | ········lineinfile: |
| 3556 | ··········path:·/etc/audit/auditd.conf | 3556 | ··········path:·/etc/audit/auditd.conf |
| 3557 | ··········create:·true | 3557 | ··········create:·true |
| 3558 | ··········regexp:·(?i)^\s*log_format\s*=\s* | 3558 | ··········regexp:·(?i)^\s*log_format\s*=\s* |
| 3559 | ··········line:·log_format·=·ENRICHED | 3559 | ··········line:·log_format·=·ENRICHED |
| 3560 | ··········state:·present | 3560 | ··········state:·present |
| 3561 | ······when: | 3561 | ······when: |
| 3562 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3563 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3562 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3563 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3564 | ······tags: | 3564 | ······tags: |
| 3565 | ······-·CCE-83696-5 | 3565 | ······-·CCE-83696-5 |
| 3566 | ······-·NIST-800-53-AU-3 | 3566 | ······-·NIST-800-53-AU-3 |
| 3567 | ······-·NIST-800-53-CM-6 | 3567 | ······-·NIST-800-53-CM-6 |
| 3568 | ······-·auditd_log_format | 3568 | ······-·auditd_log_format |
| 3569 | ······-·low_complexity | 3569 | ······-·low_complexity |
| 3570 | ······-·low_disruption | 3570 | ······-·low_disruption |
| Offset 3612, 16 lines modified | Offset 3612, 16 lines modified | ||
| 3612 | ········lineinfile: | 3612 | ········lineinfile: |
| 3613 | ··········path:·/etc/audit/auditd.conf | 3613 | ··········path:·/etc/audit/auditd.conf |
| 3614 | ··········create:·true | 3614 | ··········create:·true |
| 3615 | ··········regexp:·(?i)^\s*name_format\s*=\s* | 3615 | ··········regexp:·(?i)^\s*name_format\s*=\s* |
| 3616 | ··········line:·name_format·=·hostname | 3616 | ··········line:·name_format·=·hostname |
| 3617 | ··········state:·present | 3617 | ··········state:·present |
| 3618 | ······when: | 3618 | ······when: |
| 3619 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3620 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 3619 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 3620 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 3621 | ······tags: | 3621 | ······tags: |
| 3622 | ······-·CCE-83686-6 | 3622 | ······-·CCE-83686-6 |
| 3623 | ······-·NIST-800-53-AU-3 | 3623 | ······-·NIST-800-53-AU-3 |
| 3624 | ······-·NIST-800-53-CM-6 | 3624 | ······-·NIST-800-53-CM-6 |
| 3625 | ······-·auditd_name_format | 3625 | ······-·auditd_name_format |
| 3626 | ······-·low_complexity | 3626 | ······-·low_complexity |
| 3627 | ······-·low_disruption | 3627 | ······-·low_disruption |
| Offset 5087, 16 lines modified | Offset 5087, 16 lines modified | ||
| 5087 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 5087 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 5088 | ······find: | 5088 | ······find: |
| 5089 | ········paths:·/etc/audit/rules.d/ | 5089 | ········paths:·/etc/audit/rules.d/ |
| 5090 | ········patterns:·'*.rules' | 5090 | ········patterns:·'*.rules' |
| 5091 | ······register:·find_rules_d | 5091 | ······register:·find_rules_d |
| 5092 | ······when: | 5092 | ······when: |
| 5093 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5094 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5093 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5094 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5095 | ······tags: | 5095 | ······tags: |
| 5096 | ······-·CCE-83716-1 | 5096 | ······-·CCE-83716-1 |
| 5097 | ······-·CJIS-5.4.1.1 | 5097 | ······-·CJIS-5.4.1.1 |
| 5098 | ······-·NIST-800-171-3.3.1 | 5098 | ······-·NIST-800-171-3.3.1 |
| 5099 | ······-·NIST-800-171-3.4.3 | 5099 | ······-·NIST-800-171-3.4.3 |
| 5100 | ······-·NIST-800-53-AC-6(9) | 5100 | ······-·NIST-800-53-AC-6(9) |
| 5101 | ······-·NIST-800-53-CM-6(a) | 5101 | ······-·NIST-800-53-CM-6(a) |
| Offset 5112, 16 lines modified | Offset 5112, 16 lines modified | ||
| 5112 | ······lineinfile: | 5112 | ······lineinfile: |
| 5113 | ········path:·'{{·item·}}' | 5113 | ········path:·'{{·item·}}' |
| 5114 | ········regexp:·^\s*(?:-e)\s+.*$ | 5114 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 5115 | ········state:·absent | 5115 | ········state:·absent |
| 5116 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 5116 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 5117 | ········}}' | 5117 | ········}}' |
| 5118 | ······when: | 5118 | ······when: |
| 5119 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5120 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5119 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5120 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5121 | ······tags: | 5121 | ······tags: |
| 5122 | ······-·CCE-83716-1 | 5122 | ······-·CCE-83716-1 |
| 5123 | ······-·CJIS-5.4.1.1 | 5123 | ······-·CJIS-5.4.1.1 |
| 5124 | ······-·NIST-800-171-3.3.1 | 5124 | ······-·NIST-800-171-3.3.1 |
| 5125 | ······-·NIST-800-171-3.4.3 | 5125 | ······-·NIST-800-171-3.4.3 |
| 5126 | ······-·NIST-800-53-AC-6(9) | 5126 | ······-·NIST-800-53-AC-6(9) |
| 5127 | ······-·NIST-800-53-CM-6(a) | 5127 | ······-·NIST-800-53-CM-6(a) |
| Offset 5139, 16 lines modified | Offset 5139, 16 lines modified | ||
| 5139 | ········create:·true | 5139 | ········create:·true |
| 5140 | ········line:·-e·2 | 5140 | ········line:·-e·2 |
| 5141 | ········mode:·o-rwx | 5141 | ········mode:·o-rwx |
| 5142 | ······loop: | 5142 | ······loop: |
| 5143 | ······-·/etc/audit/audit.rules | 5143 | ······-·/etc/audit/audit.rules |
| 5144 | ······-·/etc/audit/rules.d/immutable.rules | 5144 | ······-·/etc/audit/rules.d/immutable.rules |
| 5145 | ······when: | 5145 | ······when: |
| 5146 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5147 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5146 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5147 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5148 | ······tags: | 5148 | ······tags: |
| 5149 | ······-·CCE-83716-1 | 5149 | ······-·CCE-83716-1 |
| 5150 | ······-·CJIS-5.4.1.1 | 5150 | ······-·CJIS-5.4.1.1 |
| 5151 | ······-·NIST-800-171-3.3.1 | 5151 | ······-·NIST-800-171-3.3.1 |
| 5152 | ······-·NIST-800-171-3.4.3 | 5152 | ······-·NIST-800-171-3.4.3 |
| 5153 | ······-·NIST-800-53-AC-6(9) | 5153 | ······-·NIST-800-53-AC-6(9) |
| 5154 | ······-·NIST-800-53-CM-6(a) | 5154 | ······-·NIST-800-53-CM-6(a) |
| Offset 5182, 16 lines modified | Offset 5182, 16 lines modified | ||
| 5182 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 5182 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 5183 | ······find: | 5183 | ······find: |
| 5184 | ········paths:·/etc/audit/rules.d | 5184 | ········paths:·/etc/audit/rules.d |
| 5185 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 5185 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 5186 | ········patterns:·'*.rules' | 5186 | ········patterns:·'*.rules' |
| 5187 | ······register:·find_existing_watch_rules_d | 5187 | ······register:·find_existing_watch_rules_d |
| 5188 | ······when: | 5188 | ······when: |
| 5189 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5190 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5189 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5190 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5191 | ······tags: | 5191 | ······tags: |
| 5192 | ······-·CCE-83721-1 | 5192 | ······-·CCE-83721-1 |
| 5193 | ······-·CJIS-5.4.1.1 | 5193 | ······-·CJIS-5.4.1.1 |
| 5194 | ······-·NIST-800-171-3.1.8 | 5194 | ······-·NIST-800-171-3.1.8 |
| 5195 | ······-·NIST-800-53-AU-12(c) | 5195 | ······-·NIST-800-53-AU-12(c) |
| 5196 | ······-·NIST-800-53-AU-2(d) | 5196 | ······-·NIST-800-53-AU-2(d) |
| 5197 | ······-·NIST-800-53-CM-6(a) | 5197 | ······-·NIST-800-53-CM-6(a) |
| Offset 5206, 16 lines modified | Offset 5206, 16 lines modified | ||
| 5206 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 5206 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 5207 | ······find: | 5207 | ······find: |
| 5208 | ········paths:·/etc/audit/rules.d | 5208 | ········paths:·/etc/audit/rules.d |
| 5209 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 5209 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 5210 | ········patterns:·'*.rules' | 5210 | ········patterns:·'*.rules' |
| 5211 | ······register:·find_watch_key | 5211 | ······register:·find_watch_key |
| 5212 | ······when: | 5212 | ······when: |
| 5213 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5214 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5213 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5214 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5215 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 5215 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 5216 | ········==·0 | 5216 | ········==·0 |
| 5217 | ······tags: | 5217 | ······tags: |
| 5218 | ······-·CCE-83721-1 | 5218 | ······-·CCE-83721-1 |
| 5219 | ······-·CJIS-5.4.1.1 | 5219 | ······-·CJIS-5.4.1.1 |
| 5220 | ······-·NIST-800-171-3.1.8 | 5220 | ······-·NIST-800-171-3.1.8 |
| 5221 | ······-·NIST-800-53-AU-12(c) | 5221 | ······-·NIST-800-53-AU-12(c) |
| Offset 5230, 16 lines modified | Offset 5230, 16 lines modified | ||
| 5230 | ······-·restrict_strategy | 5230 | ······-·restrict_strategy |
| 5231 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 5231 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 5232 | ······set_fact: | 5232 | ······set_fact: |
| 5233 | ········all_files: | 5233 | ········all_files: |
| 5234 | ········-·/etc/audit/rules.d/MAC-policy.rules | 5234 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 5235 | ······when: | 5235 | ······when: |
| 5236 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5237 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5236 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5237 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5238 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 5238 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 5239 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5239 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5240 | ······tags: | 5240 | ······tags: |
| 5241 | ······-·CCE-83721-1 | 5241 | ······-·CCE-83721-1 |
| 5242 | ······-·CJIS-5.4.1.1 | 5242 | ······-·CJIS-5.4.1.1 |
| 5243 | ······-·NIST-800-171-3.1.8 | 5243 | ······-·NIST-800-171-3.1.8 |
| 5244 | ······-·NIST-800-53-AU-12(c) | 5244 | ······-·NIST-800-53-AU-12(c) |
| Offset 5254, 16 lines modified | Offset 5254, 16 lines modified | ||
| 5254 | ······-·restrict_strategy | 5254 | ······-·restrict_strategy |
| 5255 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 5255 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 5256 | ······set_fact: | 5256 | ······set_fact: |
| 5257 | ········all_files: | 5257 | ········all_files: |
| 5258 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 5258 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 5259 | ······when: | 5259 | ······when: |
| 5260 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5261 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 5260 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 5261 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 5262 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 5262 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 5263 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 5263 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 5264 | ······tags: | 5264 | ······tags: |
| 5265 | ······-·CCE-83721-1 | 5265 | ······-·CCE-83721-1 |
| 5266 | ······-·CJIS-5.4.1.1 | 5266 | ······-·CJIS-5.4.1.1 |
| 5267 | ······-·NIST-800-171-3.1.8 | 5267 | ······-·NIST-800-171-3.1.8 |
| 5268 | ······-·NIST-800-53-AU-12(c) | 5268 | ······-·NIST-800-53-AU-12(c) |
| Offset 5280, 16 lines modified | Offset 5280, 16 lines modified | ||
| 5280 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 5280 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 156155/160788 bytes (97.12%) of diff not shown. | |||
| Offset 12055, 16 lines modified | Offset 12055, 16 lines modified | ||
| 12055 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 12055 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 12056 | ······find: | 12056 | ······find: |
| 12057 | ········paths:·/etc/audit/rules.d/ | 12057 | ········paths:·/etc/audit/rules.d/ |
| 12058 | ········patterns:·'*.rules' | 12058 | ········patterns:·'*.rules' |
| 12059 | ······register:·find_rules_d | 12059 | ······register:·find_rules_d |
| 12060 | ······when: | 12060 | ······when: |
| 12061 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12062 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12061 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12062 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12063 | ······tags: | 12063 | ······tags: |
| 12064 | ······-·CCE-83716-1 | 12064 | ······-·CCE-83716-1 |
| 12065 | ······-·CJIS-5.4.1.1 | 12065 | ······-·CJIS-5.4.1.1 |
| 12066 | ······-·NIST-800-171-3.3.1 | 12066 | ······-·NIST-800-171-3.3.1 |
| 12067 | ······-·NIST-800-171-3.4.3 | 12067 | ······-·NIST-800-171-3.4.3 |
| 12068 | ······-·NIST-800-53-AC-6(9) | 12068 | ······-·NIST-800-53-AC-6(9) |
| 12069 | ······-·NIST-800-53-CM-6(a) | 12069 | ······-·NIST-800-53-CM-6(a) |
| Offset 12080, 16 lines modified | Offset 12080, 16 lines modified | ||
| 12080 | ······lineinfile: | 12080 | ······lineinfile: |
| 12081 | ········path:·'{{·item·}}' | 12081 | ········path:·'{{·item·}}' |
| 12082 | ········regexp:·^\s*(?:-e)\s+.*$ | 12082 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 12083 | ········state:·absent | 12083 | ········state:·absent |
| 12084 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 12084 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 12085 | ········}}' | 12085 | ········}}' |
| 12086 | ······when: | 12086 | ······when: |
| 12087 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12088 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12087 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12088 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12089 | ······tags: | 12089 | ······tags: |
| 12090 | ······-·CCE-83716-1 | 12090 | ······-·CCE-83716-1 |
| 12091 | ······-·CJIS-5.4.1.1 | 12091 | ······-·CJIS-5.4.1.1 |
| 12092 | ······-·NIST-800-171-3.3.1 | 12092 | ······-·NIST-800-171-3.3.1 |
| 12093 | ······-·NIST-800-171-3.4.3 | 12093 | ······-·NIST-800-171-3.4.3 |
| 12094 | ······-·NIST-800-53-AC-6(9) | 12094 | ······-·NIST-800-53-AC-6(9) |
| 12095 | ······-·NIST-800-53-CM-6(a) | 12095 | ······-·NIST-800-53-CM-6(a) |
| Offset 12107, 16 lines modified | Offset 12107, 16 lines modified | ||
| 12107 | ········create:·true | 12107 | ········create:·true |
| 12108 | ········line:·-e·2 | 12108 | ········line:·-e·2 |
| 12109 | ········mode:·o-rwx | 12109 | ········mode:·o-rwx |
| 12110 | ······loop: | 12110 | ······loop: |
| 12111 | ······-·/etc/audit/audit.rules | 12111 | ······-·/etc/audit/audit.rules |
| 12112 | ······-·/etc/audit/rules.d/immutable.rules | 12112 | ······-·/etc/audit/rules.d/immutable.rules |
| 12113 | ······when: | 12113 | ······when: |
| 12114 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12115 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12114 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12115 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12116 | ······tags: | 12116 | ······tags: |
| 12117 | ······-·CCE-83716-1 | 12117 | ······-·CCE-83716-1 |
| 12118 | ······-·CJIS-5.4.1.1 | 12118 | ······-·CJIS-5.4.1.1 |
| 12119 | ······-·NIST-800-171-3.3.1 | 12119 | ······-·NIST-800-171-3.3.1 |
| 12120 | ······-·NIST-800-171-3.4.3 | 12120 | ······-·NIST-800-171-3.4.3 |
| 12121 | ······-·NIST-800-53-AC-6(9) | 12121 | ······-·NIST-800-53-AC-6(9) |
| 12122 | ······-·NIST-800-53-CM-6(a) | 12122 | ······-·NIST-800-53-CM-6(a) |
| Offset 12148, 16 lines modified | Offset 12148, 16 lines modified | ||
| 12148 | ······-·reboot_required | 12148 | ······-·reboot_required |
| 12149 | ······-·restrict_strategy | 12149 | ······-·restrict_strategy |
| 12150 | ····-·name:·Set·architecture·for·audit·mount·tasks | 12150 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 12151 | ······set_fact: | 12151 | ······set_fact: |
| 12152 | ········audit_arch:·b64 | 12152 | ········audit_arch:·b64 |
| 12153 | ······when: | 12153 | ······when: |
| 12154 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12155 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12154 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12155 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12156 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 12156 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 12157 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 12157 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 12158 | ······tags: | 12158 | ······tags: |
| 12159 | ······-·CCE-83735-1 | 12159 | ······-·CCE-83735-1 |
| 12160 | ······-·CJIS-5.4.1.1 | 12160 | ······-·CJIS-5.4.1.1 |
| 12161 | ······-·NIST-800-171-3.1.7 | 12161 | ······-·NIST-800-171-3.1.7 |
| 12162 | ······-·NIST-800-53-AC-6(9) | 12162 | ······-·NIST-800-53-AC-6(9) |
| Offset 12289, 16 lines modified | Offset 12289, 16 lines modified | ||
| 12289 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 12289 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 12290 | ············-F·auid!=unset·-F·key=perm_mod | 12290 | ············-F·auid!=unset·-F·key=perm_mod |
| 12291 | ··········create:·true | 12291 | ··········create:·true |
| 12292 | ··········mode:·o-rwx | 12292 | ··········mode:·o-rwx |
| 12293 | ··········state:·present | 12293 | ··········state:·present |
| 12294 | ········when:·syscalls_found·|·length·==·0 | 12294 | ········when:·syscalls_found·|·length·==·0 |
| 12295 | ······when: | 12295 | ······when: |
| 12296 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12297 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12296 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12297 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12298 | ······tags: | 12298 | ······tags: |
| 12299 | ······-·CCE-83735-1 | 12299 | ······-·CCE-83735-1 |
| 12300 | ······-·CJIS-5.4.1.1 | 12300 | ······-·CJIS-5.4.1.1 |
| 12301 | ······-·NIST-800-171-3.1.7 | 12301 | ······-·NIST-800-171-3.1.7 |
| 12302 | ······-·NIST-800-53-AC-6(9) | 12302 | ······-·NIST-800-53-AC-6(9) |
| 12303 | ······-·NIST-800-53-AU-12(c) | 12303 | ······-·NIST-800-53-AU-12(c) |
| 12304 | ······-·NIST-800-53-AU-2(d) | 12304 | ······-·NIST-800-53-AU-2(d) |
| Offset 12428, 16 lines modified | Offset 12428, 16 lines modified | ||
| 12428 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 12428 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 12429 | ············-F·auid!=unset·-F·key=perm_mod | 12429 | ············-F·auid!=unset·-F·key=perm_mod |
| 12430 | ··········create:·true | 12430 | ··········create:·true |
| 12431 | ··········mode:·o-rwx | 12431 | ··········mode:·o-rwx |
| 12432 | ··········state:·present | 12432 | ··········state:·present |
| 12433 | ········when:·syscalls_found·|·length·==·0 | 12433 | ········when:·syscalls_found·|·length·==·0 |
| 12434 | ······when: | 12434 | ······when: |
| 12435 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12436 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12435 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12436 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12437 | ······-·audit_arch·==·"b64" | 12437 | ······-·audit_arch·==·"b64" |
| 12438 | ······tags: | 12438 | ······tags: |
| 12439 | ······-·CCE-83735-1 | 12439 | ······-·CCE-83735-1 |
| 12440 | ······-·CJIS-5.4.1.1 | 12440 | ······-·CJIS-5.4.1.1 |
| 12441 | ······-·NIST-800-171-3.1.7 | 12441 | ······-·NIST-800-171-3.1.7 |
| 12442 | ······-·NIST-800-53-AC-6(9) | 12442 | ······-·NIST-800-53-AC-6(9) |
| 12443 | ······-·NIST-800-53-AU-12(c) | 12443 | ······-·NIST-800-53-AU-12(c) |
| Offset 12467, 16 lines modified | Offset 12467, 16 lines modified | ||
| 12467 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 12467 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 12468 | ······find: | 12468 | ······find: |
| 12469 | ········paths:·/etc/audit/rules.d | 12469 | ········paths:·/etc/audit/rules.d |
| 12470 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 12470 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 12471 | ········patterns:·'*.rules' | 12471 | ········patterns:·'*.rules' |
| 12472 | ······register:·find_existing_watch_rules_d | 12472 | ······register:·find_existing_watch_rules_d |
| 12473 | ······when: | 12473 | ······when: |
| 12474 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12475 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12474 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12475 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12476 | ······tags: | 12476 | ······tags: |
| 12477 | ······-·CCE-90176-9 | 12477 | ······-·CCE-90176-9 |
| 12478 | ······-·audit_rules_sudoers | 12478 | ······-·audit_rules_sudoers |
| 12479 | ······-·low_complexity | 12479 | ······-·low_complexity |
| 12480 | ······-·low_disruption | 12480 | ······-·low_disruption |
| 12481 | ······-·medium_severity | 12481 | ······-·medium_severity |
| 12482 | ······-·no_reboot_needed | 12482 | ······-·no_reboot_needed |
| Offset 12485, 16 lines modified | Offset 12485, 16 lines modified | ||
| 12485 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 12485 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| Max diff block lines reached; 163005/167488 bytes (97.32%) of diff not shown. | |||
| Offset 12027, 16 lines modified | Offset 12027, 16 lines modified | ||
| 12027 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 12027 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 12028 | ······find: | 12028 | ······find: |
| 12029 | ········paths:·/etc/audit/rules.d/ | 12029 | ········paths:·/etc/audit/rules.d/ |
| 12030 | ········patterns:·'*.rules' | 12030 | ········patterns:·'*.rules' |
| 12031 | ······register:·find_rules_d | 12031 | ······register:·find_rules_d |
| 12032 | ······when: | 12032 | ······when: |
| 12033 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12034 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12033 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12034 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12035 | ······tags: | 12035 | ······tags: |
| 12036 | ······-·CCE-83716-1 | 12036 | ······-·CCE-83716-1 |
| 12037 | ······-·CJIS-5.4.1.1 | 12037 | ······-·CJIS-5.4.1.1 |
| 12038 | ······-·NIST-800-171-3.3.1 | 12038 | ······-·NIST-800-171-3.3.1 |
| 12039 | ······-·NIST-800-171-3.4.3 | 12039 | ······-·NIST-800-171-3.4.3 |
| 12040 | ······-·NIST-800-53-AC-6(9) | 12040 | ······-·NIST-800-53-AC-6(9) |
| 12041 | ······-·NIST-800-53-CM-6(a) | 12041 | ······-·NIST-800-53-CM-6(a) |
| Offset 12052, 16 lines modified | Offset 12052, 16 lines modified | ||
| 12052 | ······lineinfile: | 12052 | ······lineinfile: |
| 12053 | ········path:·'{{·item·}}' | 12053 | ········path:·'{{·item·}}' |
| 12054 | ········regexp:·^\s*(?:-e)\s+.*$ | 12054 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 12055 | ········state:·absent | 12055 | ········state:·absent |
| 12056 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 12056 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 12057 | ········}}' | 12057 | ········}}' |
| 12058 | ······when: | 12058 | ······when: |
| 12059 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12060 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12059 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12060 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12061 | ······tags: | 12061 | ······tags: |
| 12062 | ······-·CCE-83716-1 | 12062 | ······-·CCE-83716-1 |
| 12063 | ······-·CJIS-5.4.1.1 | 12063 | ······-·CJIS-5.4.1.1 |
| 12064 | ······-·NIST-800-171-3.3.1 | 12064 | ······-·NIST-800-171-3.3.1 |
| 12065 | ······-·NIST-800-171-3.4.3 | 12065 | ······-·NIST-800-171-3.4.3 |
| 12066 | ······-·NIST-800-53-AC-6(9) | 12066 | ······-·NIST-800-53-AC-6(9) |
| 12067 | ······-·NIST-800-53-CM-6(a) | 12067 | ······-·NIST-800-53-CM-6(a) |
| Offset 12079, 16 lines modified | Offset 12079, 16 lines modified | ||
| 12079 | ········create:·true | 12079 | ········create:·true |
| 12080 | ········line:·-e·2 | 12080 | ········line:·-e·2 |
| 12081 | ········mode:·o-rwx | 12081 | ········mode:·o-rwx |
| 12082 | ······loop: | 12082 | ······loop: |
| 12083 | ······-·/etc/audit/audit.rules | 12083 | ······-·/etc/audit/audit.rules |
| 12084 | ······-·/etc/audit/rules.d/immutable.rules | 12084 | ······-·/etc/audit/rules.d/immutable.rules |
| 12085 | ······when: | 12085 | ······when: |
| 12086 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12087 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12086 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12087 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12088 | ······tags: | 12088 | ······tags: |
| 12089 | ······-·CCE-83716-1 | 12089 | ······-·CCE-83716-1 |
| 12090 | ······-·CJIS-5.4.1.1 | 12090 | ······-·CJIS-5.4.1.1 |
| 12091 | ······-·NIST-800-171-3.3.1 | 12091 | ······-·NIST-800-171-3.3.1 |
| 12092 | ······-·NIST-800-171-3.4.3 | 12092 | ······-·NIST-800-171-3.4.3 |
| 12093 | ······-·NIST-800-53-AC-6(9) | 12093 | ······-·NIST-800-53-AC-6(9) |
| 12094 | ······-·NIST-800-53-CM-6(a) | 12094 | ······-·NIST-800-53-CM-6(a) |
| Offset 12120, 16 lines modified | Offset 12120, 16 lines modified | ||
| 12120 | ······-·reboot_required | 12120 | ······-·reboot_required |
| 12121 | ······-·restrict_strategy | 12121 | ······-·restrict_strategy |
| 12122 | ····-·name:·Set·architecture·for·audit·mount·tasks | 12122 | ····-·name:·Set·architecture·for·audit·mount·tasks |
| 12123 | ······set_fact: | 12123 | ······set_fact: |
| 12124 | ········audit_arch:·b64 | 12124 | ········audit_arch:·b64 |
| 12125 | ······when: | 12125 | ······when: |
| 12126 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12127 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12126 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12127 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12128 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture | 12128 | ······-·ansible_architecture·==·"aarch64"·or·ansible_architecture·==·"ppc64"·or·ansible_architecture |
| 12129 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" | 12129 | ········==·"ppc64le"·or·ansible_architecture·==·"s390x"·or·ansible_architecture·==·"x86_64" |
| 12130 | ······tags: | 12130 | ······tags: |
| 12131 | ······-·CCE-83735-1 | 12131 | ······-·CCE-83735-1 |
| 12132 | ······-·CJIS-5.4.1.1 | 12132 | ······-·CJIS-5.4.1.1 |
| 12133 | ······-·NIST-800-171-3.1.7 | 12133 | ······-·NIST-800-171-3.1.7 |
| 12134 | ······-·NIST-800-53-AC-6(9) | 12134 | ······-·NIST-800-53-AC-6(9) |
| Offset 12261, 16 lines modified | Offset 12261, 16 lines modified | ||
| 12261 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 12261 | ··········line:·-a·always,exit·-F·arch=b32·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 12262 | ············-F·auid!=unset·-F·key=perm_mod | 12262 | ············-F·auid!=unset·-F·key=perm_mod |
| 12263 | ··········create:·true | 12263 | ··········create:·true |
| 12264 | ··········mode:·o-rwx | 12264 | ··········mode:·o-rwx |
| 12265 | ··········state:·present | 12265 | ··········state:·present |
| 12266 | ········when:·syscalls_found·|·length·==·0 | 12266 | ········when:·syscalls_found·|·length·==·0 |
| 12267 | ······when: | 12267 | ······when: |
| 12268 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12269 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12268 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12269 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12270 | ······tags: | 12270 | ······tags: |
| 12271 | ······-·CCE-83735-1 | 12271 | ······-·CCE-83735-1 |
| 12272 | ······-·CJIS-5.4.1.1 | 12272 | ······-·CJIS-5.4.1.1 |
| 12273 | ······-·NIST-800-171-3.1.7 | 12273 | ······-·NIST-800-171-3.1.7 |
| 12274 | ······-·NIST-800-53-AC-6(9) | 12274 | ······-·NIST-800-53-AC-6(9) |
| 12275 | ······-·NIST-800-53-AU-12(c) | 12275 | ······-·NIST-800-53-AU-12(c) |
| 12276 | ······-·NIST-800-53-AU-2(d) | 12276 | ······-·NIST-800-53-AU-2(d) |
| Offset 12400, 16 lines modified | Offset 12400, 16 lines modified | ||
| 12400 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 | 12400 | ··········line:·-a·always,exit·-F·arch=b64·-S·{{·syscalls·|·join(',')·}}·-F·auid>=1000 |
| 12401 | ············-F·auid!=unset·-F·key=perm_mod | 12401 | ············-F·auid!=unset·-F·key=perm_mod |
| 12402 | ··········create:·true | 12402 | ··········create:·true |
| 12403 | ··········mode:·o-rwx | 12403 | ··········mode:·o-rwx |
| 12404 | ··········state:·present | 12404 | ··········state:·present |
| 12405 | ········when:·syscalls_found·|·length·==·0 | 12405 | ········when:·syscalls_found·|·length·==·0 |
| 12406 | ······when: | 12406 | ······when: |
| 12407 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12408 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12407 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12408 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12409 | ······-·audit_arch·==·"b64" | 12409 | ······-·audit_arch·==·"b64" |
| 12410 | ······tags: | 12410 | ······tags: |
| 12411 | ······-·CCE-83735-1 | 12411 | ······-·CCE-83735-1 |
| 12412 | ······-·CJIS-5.4.1.1 | 12412 | ······-·CJIS-5.4.1.1 |
| 12413 | ······-·NIST-800-171-3.1.7 | 12413 | ······-·NIST-800-171-3.1.7 |
| 12414 | ······-·NIST-800-53-AC-6(9) | 12414 | ······-·NIST-800-53-AC-6(9) |
| 12415 | ······-·NIST-800-53-AU-12(c) | 12415 | ······-·NIST-800-53-AU-12(c) |
| Offset 12439, 16 lines modified | Offset 12439, 16 lines modified | ||
| 12439 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ | 12439 | ····-·name:·Check·if·watch·rule·for·/etc/sudoers·already·exists·in·/etc/audit/rules.d/ |
| 12440 | ······find: | 12440 | ······find: |
| 12441 | ········paths:·/etc/audit/rules.d | 12441 | ········paths:·/etc/audit/rules.d |
| 12442 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ | 12442 | ········contains:·^\s*-w\s+/etc/sudoers\s+-p\s+wa(\s|$)+ |
| 12443 | ········patterns:·'*.rules' | 12443 | ········patterns:·'*.rules' |
| 12444 | ······register:·find_existing_watch_rules_d | 12444 | ······register:·find_existing_watch_rules_d |
| 12445 | ······when: | 12445 | ······when: |
| 12446 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12447 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | 12446 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] |
| 12447 | ······-·'"audit"·in·ansible_facts.packages' | ||
| 12448 | ······tags: | 12448 | ······tags: |
| 12449 | ······-·CCE-90176-9 | 12449 | ······-·CCE-90176-9 |
| 12450 | ······-·audit_rules_sudoers | 12450 | ······-·audit_rules_sudoers |
| 12451 | ······-·low_complexity | 12451 | ······-·low_complexity |
| 12452 | ······-·low_disruption | 12452 | ······-·low_disruption |
| 12453 | ······-·medium_severity | 12453 | ······-·medium_severity |
| 12454 | ······-·no_reboot_needed | 12454 | ······-·no_reboot_needed |
| Offset 12457, 16 lines modified | Offset 12457, 16 lines modified | ||
| 12457 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions | 12457 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·actions |
| Max diff block lines reached; 163005/167488 bytes (97.32%) of diff not shown. | |||
| Offset 4494, 16 lines modified | Offset 4494, 16 lines modified | ||
| 4494 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension | 4494 | ····-·name:·Collect·all·files·from·/etc/audit/rules.d·with·.rules·extension |
| 4495 | ······find: | 4495 | ······find: |
| 4496 | ········paths:·/etc/audit/rules.d/ | 4496 | ········paths:·/etc/audit/rules.d/ |
| 4497 | ········patterns:·'*.rules' | 4497 | ········patterns:·'*.rules' |
| 4498 | ······register:·find_rules_d | 4498 | ······register:·find_rules_d |
| 4499 | ······when: | 4499 | ······when: |
| 4500 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4501 | ······-·'"audit"·in·ansible_facts.packages' | 4500 | ······-·'"audit"·in·ansible_facts.packages' |
| 4501 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4502 | ······tags: | 4502 | ······tags: |
| 4503 | ······-·CJIS-5.4.1.1 | 4503 | ······-·CJIS-5.4.1.1 |
| 4504 | ······-·NIST-800-171-3.3.1 | 4504 | ······-·NIST-800-171-3.3.1 |
| 4505 | ······-·NIST-800-171-3.4.3 | 4505 | ······-·NIST-800-171-3.4.3 |
| 4506 | ······-·NIST-800-53-AC-6(9) | 4506 | ······-·NIST-800-53-AC-6(9) |
| 4507 | ······-·NIST-800-53-CM-6(a) | 4507 | ······-·NIST-800-53-CM-6(a) |
| 4508 | ······-·PCI-DSS-Req-10.5.2 | 4508 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4518, 16 lines modified | Offset 4518, 16 lines modified | ||
| 4518 | ······lineinfile: | 4518 | ······lineinfile: |
| 4519 | ········path:·'{{·item·}}' | 4519 | ········path:·'{{·item·}}' |
| 4520 | ········regexp:·^\s*(?:-e)\s+.*$ | 4520 | ········regexp:·^\s*(?:-e)\s+.*$ |
| 4521 | ········state:·absent | 4521 | ········state:·absent |
| 4522 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] | 4522 | ······loop:·'{{·find_rules_d.files·|·map(attribute=''path'')·|·list·+·[''/etc/audit/audit.rules''] |
| 4523 | ········}}' | 4523 | ········}}' |
| 4524 | ······when: | 4524 | ······when: |
| 4525 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4526 | ······-·'"audit"·in·ansible_facts.packages' | 4525 | ······-·'"audit"·in·ansible_facts.packages' |
| 4526 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4527 | ······tags: | 4527 | ······tags: |
| 4528 | ······-·CJIS-5.4.1.1 | 4528 | ······-·CJIS-5.4.1.1 |
| 4529 | ······-·NIST-800-171-3.3.1 | 4529 | ······-·NIST-800-171-3.3.1 |
| 4530 | ······-·NIST-800-171-3.4.3 | 4530 | ······-·NIST-800-171-3.4.3 |
| 4531 | ······-·NIST-800-53-AC-6(9) | 4531 | ······-·NIST-800-53-AC-6(9) |
| 4532 | ······-·NIST-800-53-CM-6(a) | 4532 | ······-·NIST-800-53-CM-6(a) |
| 4533 | ······-·PCI-DSS-Req-10.5.2 | 4533 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4544, 16 lines modified | Offset 4544, 16 lines modified | ||
| 4544 | ········create:·true | 4544 | ········create:·true |
| 4545 | ········line:·-e·2 | 4545 | ········line:·-e·2 |
| 4546 | ········mode:·o-rwx | 4546 | ········mode:·o-rwx |
| 4547 | ······loop: | 4547 | ······loop: |
| 4548 | ······-·/etc/audit/audit.rules | 4548 | ······-·/etc/audit/audit.rules |
| 4549 | ······-·/etc/audit/rules.d/immutable.rules | 4549 | ······-·/etc/audit/rules.d/immutable.rules |
| 4550 | ······when: | 4550 | ······when: |
| 4551 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4552 | ······-·'"audit"·in·ansible_facts.packages' | 4551 | ······-·'"audit"·in·ansible_facts.packages' |
| 4552 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4553 | ······tags: | 4553 | ······tags: |
| 4554 | ······-·CJIS-5.4.1.1 | 4554 | ······-·CJIS-5.4.1.1 |
| 4555 | ······-·NIST-800-171-3.3.1 | 4555 | ······-·NIST-800-171-3.3.1 |
| 4556 | ······-·NIST-800-171-3.4.3 | 4556 | ······-·NIST-800-171-3.4.3 |
| 4557 | ······-·NIST-800-53-AC-6(9) | 4557 | ······-·NIST-800-53-AC-6(9) |
| 4558 | ······-·NIST-800-53-CM-6(a) | 4558 | ······-·NIST-800-53-CM-6(a) |
| 4559 | ······-·PCI-DSS-Req-10.5.2 | 4559 | ······-·PCI-DSS-Req-10.5.2 |
| Offset 4585, 16 lines modified | Offset 4585, 16 lines modified | ||
| 4585 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 4585 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 4586 | ······find: | 4586 | ······find: |
| 4587 | ········paths:·/etc/audit/rules.d | 4587 | ········paths:·/etc/audit/rules.d |
| 4588 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 4588 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 4589 | ········patterns:·'*.rules' | 4589 | ········patterns:·'*.rules' |
| 4590 | ······register:·find_existing_watch_rules_d | 4590 | ······register:·find_existing_watch_rules_d |
| 4591 | ······when: | 4591 | ······when: |
| 4592 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4593 | ······-·'"audit"·in·ansible_facts.packages' | 4592 | ······-·'"audit"·in·ansible_facts.packages' |
| 4593 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4594 | ······tags: | 4594 | ······tags: |
| 4595 | ······-·CJIS-5.4.1.1 | 4595 | ······-·CJIS-5.4.1.1 |
| 4596 | ······-·NIST-800-171-3.1.8 | 4596 | ······-·NIST-800-171-3.1.8 |
| 4597 | ······-·NIST-800-53-AU-12(c) | 4597 | ······-·NIST-800-53-AU-12(c) |
| 4598 | ······-·NIST-800-53-AU-2(d) | 4598 | ······-·NIST-800-53-AU-2(d) |
| 4599 | ······-·NIST-800-53-CM-6(a) | 4599 | ······-·NIST-800-53-CM-6(a) |
| 4600 | ······-·PCI-DSS-Req-10.5.5 | 4600 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 4608, 16 lines modified | Offset 4608, 16 lines modified | ||
| 4608 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 4608 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 4609 | ······find: | 4609 | ······find: |
| 4610 | ········paths:·/etc/audit/rules.d | 4610 | ········paths:·/etc/audit/rules.d |
| 4611 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 4611 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 4612 | ········patterns:·'*.rules' | 4612 | ········patterns:·'*.rules' |
| 4613 | ······register:·find_watch_key | 4613 | ······register:·find_watch_key |
| 4614 | ······when: | 4614 | ······when: |
| 4615 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4616 | ······-·'"audit"·in·ansible_facts.packages' | 4615 | ······-·'"audit"·in·ansible_facts.packages' |
| 4616 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4617 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 4617 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 4618 | ········==·0 | 4618 | ········==·0 |
| 4619 | ······tags: | 4619 | ······tags: |
| 4620 | ······-·CJIS-5.4.1.1 | 4620 | ······-·CJIS-5.4.1.1 |
| 4621 | ······-·NIST-800-171-3.1.8 | 4621 | ······-·NIST-800-171-3.1.8 |
| 4622 | ······-·NIST-800-53-AU-12(c) | 4622 | ······-·NIST-800-53-AU-12(c) |
| 4623 | ······-·NIST-800-53-AU-2(d) | 4623 | ······-·NIST-800-53-AU-2(d) |
| Offset 4631, 16 lines modified | Offset 4631, 16 lines modified | ||
| 4631 | ······-·restrict_strategy | 4631 | ······-·restrict_strategy |
| 4632 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 4632 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 4633 | ······set_fact: | 4633 | ······set_fact: |
| 4634 | ········all_files: | 4634 | ········all_files: |
| 4635 | ········-·/etc/audit/rules.d/MAC-policy.rules | 4635 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 4636 | ······when: | 4636 | ······when: |
| 4637 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4638 | ······-·'"audit"·in·ansible_facts.packages' | 4637 | ······-·'"audit"·in·ansible_facts.packages' |
| 4638 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4639 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 4639 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 4640 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4640 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4641 | ······tags: | 4641 | ······tags: |
| 4642 | ······-·CJIS-5.4.1.1 | 4642 | ······-·CJIS-5.4.1.1 |
| 4643 | ······-·NIST-800-171-3.1.8 | 4643 | ······-·NIST-800-171-3.1.8 |
| 4644 | ······-·NIST-800-53-AU-12(c) | 4644 | ······-·NIST-800-53-AU-12(c) |
| 4645 | ······-·NIST-800-53-AU-2(d) | 4645 | ······-·NIST-800-53-AU-2(d) |
| Offset 4654, 16 lines modified | Offset 4654, 16 lines modified | ||
| 4654 | ······-·restrict_strategy | 4654 | ······-·restrict_strategy |
| 4655 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 4655 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 4656 | ······set_fact: | 4656 | ······set_fact: |
| 4657 | ········all_files: | 4657 | ········all_files: |
| 4658 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 4658 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 4659 | ······when: | 4659 | ······when: |
| 4660 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4661 | ······-·'"audit"·in·ansible_facts.packages' | 4660 | ······-·'"audit"·in·ansible_facts.packages' |
| 4661 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 4662 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 4662 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 4663 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 4663 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 4664 | ······tags: | 4664 | ······tags: |
| 4665 | ······-·CJIS-5.4.1.1 | 4665 | ······-·CJIS-5.4.1.1 |
| 4666 | ······-·NIST-800-171-3.1.8 | 4666 | ······-·NIST-800-171-3.1.8 |
| 4667 | ······-·NIST-800-53-AU-12(c) | 4667 | ······-·NIST-800-53-AU-12(c) |
| 4668 | ······-·NIST-800-53-AU-2(d) | 4668 | ······-·NIST-800-53-AU-2(d) |
| Offset 4679, 16 lines modified | Offset 4679, 16 lines modified | ||
| 4679 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 4679 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| Max diff block lines reached; 103988/109023 bytes (95.38%) of diff not shown. | |||
| Offset 644, 16 lines modified | Offset 644, 16 lines modified | ||
| 644 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ | 644 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/rules.d/ |
| 645 | ······find: | 645 | ······find: |
| 646 | ········paths:·/etc/audit/rules.d | 646 | ········paths:·/etc/audit/rules.d |
| 647 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 647 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 648 | ········patterns:·'*.rules' | 648 | ········patterns:·'*.rules' |
| 649 | ······register:·find_existing_watch_rules_d | 649 | ······register:·find_existing_watch_rules_d |
| 650 | ······when: | 650 | ······when: |
| 651 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 652 | ······-·'"audit"·in·ansible_facts.packages' | 651 | ······-·'"audit"·in·ansible_facts.packages' |
| 652 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 653 | ······tags: | 653 | ······tags: |
| 654 | ······-·CJIS-5.4.1.1 | 654 | ······-·CJIS-5.4.1.1 |
| 655 | ······-·NIST-800-171-3.1.8 | 655 | ······-·NIST-800-171-3.1.8 |
| 656 | ······-·NIST-800-53-AU-12(c) | 656 | ······-·NIST-800-53-AU-12(c) |
| 657 | ······-·NIST-800-53-AU-2(d) | 657 | ······-·NIST-800-53-AU-2(d) |
| 658 | ······-·NIST-800-53-CM-6(a) | 658 | ······-·NIST-800-53-CM-6(a) |
| 659 | ······-·PCI-DSS-Req-10.5.5 | 659 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 667, 16 lines modified | Offset 667, 16 lines modified | ||
| 667 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy | 667 | ····-·name:·Search·/etc/audit/rules.d·for·other·rules·with·specified·key·MAC-policy |
| 668 | ······find: | 668 | ······find: |
| 669 | ········paths:·/etc/audit/rules.d | 669 | ········paths:·/etc/audit/rules.d |
| 670 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ | 670 | ········contains:·^.*(?:-F·key=|-k\s+)MAC-policy$ |
| 671 | ········patterns:·'*.rules' | 671 | ········patterns:·'*.rules' |
| 672 | ······register:·find_watch_key | 672 | ······register:·find_watch_key |
| 673 | ······when: | 673 | ······when: |
| 674 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 675 | ······-·'"audit"·in·ansible_facts.packages' | 674 | ······-·'"audit"·in·ansible_facts.packages' |
| 675 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 676 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 676 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 677 | ········==·0 | 677 | ········==·0 |
| 678 | ······tags: | 678 | ······tags: |
| 679 | ······-·CJIS-5.4.1.1 | 679 | ······-·CJIS-5.4.1.1 |
| 680 | ······-·NIST-800-171-3.1.8 | 680 | ······-·NIST-800-171-3.1.8 |
| 681 | ······-·NIST-800-53-AU-12(c) | 681 | ······-·NIST-800-53-AU-12(c) |
| 682 | ······-·NIST-800-53-AU-2(d) | 682 | ······-·NIST-800-53-AU-2(d) |
| Offset 690, 16 lines modified | Offset 690, 16 lines modified | ||
| 690 | ······-·restrict_strategy | 690 | ······-·restrict_strategy |
| 691 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule | 691 | ····-·name:·Use·/etc/audit/rules.d/MAC-policy.rules·as·the·recipient·for·the·rule |
| 692 | ······set_fact: | 692 | ······set_fact: |
| 693 | ········all_files: | 693 | ········all_files: |
| 694 | ········-·/etc/audit/rules.d/MAC-policy.rules | 694 | ········-·/etc/audit/rules.d/MAC-policy.rules |
| 695 | ······when: | 695 | ······when: |
| 696 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 697 | ······-·'"audit"·in·ansible_facts.packages' | 696 | ······-·'"audit"·in·ansible_facts.packages' |
| 697 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 698 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched | 698 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·==·0·and·find_existing_watch_rules_d.matched |
| 699 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 699 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 700 | ······tags: | 700 | ······tags: |
| 701 | ······-·CJIS-5.4.1.1 | 701 | ······-·CJIS-5.4.1.1 |
| 702 | ······-·NIST-800-171-3.1.8 | 702 | ······-·NIST-800-171-3.1.8 |
| 703 | ······-·NIST-800-53-AU-12(c) | 703 | ······-·NIST-800-53-AU-12(c) |
| 704 | ······-·NIST-800-53-AU-2(d) | 704 | ······-·NIST-800-53-AU-2(d) |
| Offset 713, 16 lines modified | Offset 713, 16 lines modified | ||
| 713 | ······-·restrict_strategy | 713 | ······-·restrict_strategy |
| 714 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule | 714 | ····-·name:·Use·matched·file·as·the·recipient·for·the·rule |
| 715 | ······set_fact: | 715 | ······set_fact: |
| 716 | ········all_files: | 716 | ········all_files: |
| 717 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' | 717 | ········-·'{{·find_watch_key.files·|·map(attribute=''path'')·|·list·|·first·}}' |
| 718 | ······when: | 718 | ······when: |
| 719 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 720 | ······-·'"audit"·in·ansible_facts.packages' | 719 | ······-·'"audit"·in·ansible_facts.packages' |
| 720 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 721 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched | 721 | ······-·find_watch_key.matched·is·defined·and·find_watch_key.matched·>·0·and·find_existing_watch_rules_d.matched |
| 722 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 | 722 | ········is·defined·and·find_existing_watch_rules_d.matched·==·0 |
| 723 | ······tags: | 723 | ······tags: |
| 724 | ······-·CJIS-5.4.1.1 | 724 | ······-·CJIS-5.4.1.1 |
| 725 | ······-·NIST-800-171-3.1.8 | 725 | ······-·NIST-800-171-3.1.8 |
| 726 | ······-·NIST-800-53-AU-12(c) | 726 | ······-·NIST-800-53-AU-12(c) |
| 727 | ······-·NIST-800-53-AU-2(d) | 727 | ······-·NIST-800-53-AU-2(d) |
| Offset 738, 16 lines modified | Offset 738, 16 lines modified | ||
| 738 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ | 738 | ····-·name:·Add·watch·rule·for·/etc/selinux/·in·/etc/audit/rules.d/ |
| 739 | ······lineinfile: | 739 | ······lineinfile: |
| 740 | ········path:·'{{·all_files[0]·}}' | 740 | ········path:·'{{·all_files[0]·}}' |
| 741 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 741 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 742 | ········create:·true | 742 | ········create:·true |
| 743 | ········mode:·'0640' | 743 | ········mode:·'0640' |
| 744 | ······when: | 744 | ······when: |
| 745 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 746 | ······-·'"audit"·in·ansible_facts.packages' | 745 | ······-·'"audit"·in·ansible_facts.packages' |
| 746 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 747 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched | 747 | ······-·find_existing_watch_rules_d.matched·is·defined·and·find_existing_watch_rules_d.matched |
| 748 | ········==·0 | 748 | ········==·0 |
| 749 | ······tags: | 749 | ······tags: |
| 750 | ······-·CJIS-5.4.1.1 | 750 | ······-·CJIS-5.4.1.1 |
| 751 | ······-·NIST-800-171-3.1.8 | 751 | ······-·NIST-800-171-3.1.8 |
| 752 | ······-·NIST-800-53-AU-12(c) | 752 | ······-·NIST-800-53-AU-12(c) |
| 753 | ······-·NIST-800-53-AU-2(d) | 753 | ······-·NIST-800-53-AU-2(d) |
| Offset 763, 16 lines modified | Offset 763, 16 lines modified | ||
| 763 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules | 763 | ····-·name:·Check·if·watch·rule·for·/etc/selinux/·already·exists·in·/etc/audit/audit.rules |
| 764 | ······find: | 764 | ······find: |
| 765 | ········paths:·/etc/audit/ | 765 | ········paths:·/etc/audit/ |
| 766 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ | 766 | ········contains:·^\s*-w\s+/etc/selinux/\s+-p\s+wa(\s|$)+ |
| 767 | ········patterns:·audit.rules | 767 | ········patterns:·audit.rules |
| 768 | ······register:·find_existing_watch_audit_rules | 768 | ······register:·find_existing_watch_audit_rules |
| 769 | ······when: | 769 | ······when: |
| 770 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 771 | ······-·'"audit"·in·ansible_facts.packages' | 770 | ······-·'"audit"·in·ansible_facts.packages' |
| 771 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 772 | ······tags: | 772 | ······tags: |
| 773 | ······-·CJIS-5.4.1.1 | 773 | ······-·CJIS-5.4.1.1 |
| 774 | ······-·NIST-800-171-3.1.8 | 774 | ······-·NIST-800-171-3.1.8 |
| 775 | ······-·NIST-800-53-AU-12(c) | 775 | ······-·NIST-800-53-AU-12(c) |
| 776 | ······-·NIST-800-53-AU-2(d) | 776 | ······-·NIST-800-53-AU-2(d) |
| 777 | ······-·NIST-800-53-CM-6(a) | 777 | ······-·NIST-800-53-CM-6(a) |
| 778 | ······-·PCI-DSS-Req-10.5.5 | 778 | ······-·PCI-DSS-Req-10.5.5 |
| Offset 787, 16 lines modified | Offset 787, 16 lines modified | ||
| 787 | ······lineinfile: | 787 | ······lineinfile: |
| 788 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy | 788 | ········line:·-w·/etc/selinux/·-p·wa·-k·MAC-policy |
| 789 | ········state:·present | 789 | ········state:·present |
| 790 | ········dest:·/etc/audit/audit.rules | 790 | ········dest:·/etc/audit/audit.rules |
| 791 | ········create:·true | 791 | ········create:·true |
| 792 | ········mode:·'0640' | 792 | ········mode:·'0640' |
| 793 | ······when: | 793 | ······when: |
| 794 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 795 | ······-·'"audit"·in·ansible_facts.packages' | 794 | ······-·'"audit"·in·ansible_facts.packages' |
| 795 | ······-·ansible_virtualization_type·not·in·["docker",·"lxc",·"openvz",·"podman",·"container"] | ||
| 796 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched | 796 | ······-·find_existing_watch_audit_rules.matched·is·defined·and·find_existing_watch_audit_rules.matched |
| 797 | ········==·0 | 797 | ········==·0 |
| 798 | ······tags: | 798 | ······tags: |
| 799 | ······-·CJIS-5.4.1.1 | 799 | ······-·CJIS-5.4.1.1 |
| 800 | ······-·NIST-800-171-3.1.8 | 800 | ······-·NIST-800-171-3.1.8 |
| 801 | ······-·NIST-800-53-AU-12(c) | 801 | ······-·NIST-800-53-AU-12(c) |
| 802 | ······-·NIST-800-53-AU-2(d) | 802 | ······-·NIST-800-53-AU-2(d) |
| Offset 829, 16 lines modified | Offset 829, 16 lines modified | ||
| 829 | ······-·reboot_required | 829 | ······-·reboot_required |
| Max diff block lines reached; 81679/86895 bytes (94.00%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Tailoring·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·id="xccdf_content-disa-delta_tailoring_default"> | 2 | <xccdf-1.2:Tailoring·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·id="xccdf_content-disa-delta_tailoring_default"> |
| 3 | ··<xccdf-1.2:version·time="202 | 3 | ··<xccdf-1.2:version·time="2025-02-23T07:19:33.994709">1</xccdf-1.2:version> |
| 4 | ··<xccdf-1.2:Profile·id="xccdf_org.ssgproject.content_profile_stig_delta_tailoring"·extends="xccdf_org.ssgproject.content_profile_stig"> | 4 | ··<xccdf-1.2:Profile·id="xccdf_org.ssgproject.content_profile_stig_delta_tailoring"·extends="xccdf_org.ssgproject.content_profile_stig"> |
| 5 | ····<xccdf-1.2:title·override="true">DISA·STIG·for·Red·Hat·Enterprise·Linux·7</xccdf-1.2:title> | 5 | ····<xccdf-1.2:title·override="true">DISA·STIG·for·Red·Hat·Enterprise·Linux·7</xccdf-1.2:title> |
| 6 | ····<xccdf-1.2:description·override="true">This·profile·contains·configuration·checks·that·align·to·the | 6 | ····<xccdf-1.2:description·override="true">This·profile·contains·configuration·checks·that·align·to·the |
| 7 | DISA·STIG·for·Red·Hat·Enterprise·Linux·V3R9. | 7 | DISA·STIG·for·Red·Hat·Enterprise·Linux·V3R9. |
| 8 | In·addition·to·being·applicable·to·Red·Hat·Enterprise·Linux·7,·DISA·recognizes·this | 8 | In·addition·to·being·applicable·to·Red·Hat·Enterprise·Linux·7,·DISA·recognizes·this |
| 9 | configuration·baseline·as·applicable·to·the·operating·system·tier·of | 9 | configuration·baseline·as·applicable·to·the·operating·system·tier·of |
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Tailoring·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·id="xccdf_content-disa-delta_tailoring_default"> | 2 | <xccdf-1.2:Tailoring·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·id="xccdf_content-disa-delta_tailoring_default"> |
| 3 | ··<xccdf-1.2:version·time="202 | 3 | ··<xccdf-1.2:version·time="2025-02-23T07:19:34.183602">1</xccdf-1.2:version> |
| 4 | ··<xccdf-1.2:Profile·id="xccdf_org.ssgproject.content_profile_stig_delta_tailoring"·extends="xccdf_org.ssgproject.content_profile_stig"> | 4 | ··<xccdf-1.2:Profile·id="xccdf_org.ssgproject.content_profile_stig_delta_tailoring"·extends="xccdf_org.ssgproject.content_profile_stig"> |
| 5 | ····<xccdf-1.2:title·override="true">DISA·STIG·for·Red·Hat·Enterprise·Linux·8</xccdf-1.2:title> | 5 | ····<xccdf-1.2:title·override="true">DISA·STIG·for·Red·Hat·Enterprise·Linux·8</xccdf-1.2:title> |
| 6 | ····<xccdf-1.2:description·override="true">This·profile·contains·configuration·checks·that·align·to·the | 6 | ····<xccdf-1.2:description·override="true">This·profile·contains·configuration·checks·that·align·to·the |
| 7 | DISA·STIG·for·Red·Hat·Enterprise·Linux·8·V1R8. | 7 | DISA·STIG·for·Red·Hat·Enterprise·Linux·8·V1R8. |
| 8 | In·addition·to·being·applicable·to·Red·Hat·Enterprise·Linux·8,·DISA·recognizes·this | 8 | In·addition·to·being·applicable·to·Red·Hat·Enterprise·Linux·8,·DISA·recognizes·this |
| 9 | configuration·baseline·as·applicable·to·the·operating·system·tier·of | 9 | configuration·baseline·as·applicable·to·the·operating·system·tier·of |
| Offset 3, 9238 lines modified | Offset 3, 8640 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> | ||
| 11 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1"> | ||
| 17 | ······<ocil:title>Install·libselinux·Package</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-package_libselinux_installed_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-sshd_disable_kerb_auth_ocil:questionnaire:1"> | ||
| 23 | ······<ocil:title>Disable·Kerberos·Authentication</ocil:title> | ||
| 24 | ······<ocil:actions> | ||
| 25 | ········<ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref> | ||
| 26 | ······</ocil:actions> | ||
| 27 | ····</ocil:questionnaire> | ||
| 28 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 29 | ······<ocil:title>Disallow·Configuration·to·Bypass·Password·Requirements·for·Privilege·Escalation</ocil:title> | ||
| 30 | ······<ocil:actions> | ||
| 31 | ········<ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref> | ||
| 32 | ······</ocil:actions> | ||
| 33 | ····</ocil:questionnaire> | ||
| 34 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 35 | ······<ocil:title>Audit·Configuration·Files·Must·Be·Owned·By·Group·root</ocil:title> | ||
| 36 | ······<ocil:actions> | ||
| 37 | ········<ocil:test_action_ref>ocil:ssg-file_groupownership_audit_configuration_action:testaction:1</ocil:test_action_ref> | ||
| 38 | ······</ocil:actions> | ||
| 39 | ····</ocil:questionnaire> | ||
| 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 41 | ······<ocil:title>Disable·TIPC·Support</ocil:title> | ||
| 42 | ······<ocil:actions> | ||
| 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_module_tipc_disabled_action:testaction:1</ocil:test_action_ref> | ||
| 44 | ······</ocil:actions> | ||
| 45 | ····</ocil:questionnaire> | ||
| 46 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Enable· | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 48 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_ | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> |
| 54 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg-sudo_add_requiretty_ocil:questionnaire:1"> | ||
| 59 | ···· | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>Ensure·auditd·Collects·Unauthorized·Access·Attempts·to·Files·(unsuccessful)</ocil:title> | ||
| 60 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-service_abrtd_disabled_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 29 | ······<ocil:title>Disable·Automatic·Bug·Reporting·Tool·(abrtd)</ocil:title> |
| 66 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-service_abrtd_disabled_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1"> | ||
| 71 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Record·Attempts·to·Alter·Logon·and·Logout·Events·-·lastlog</ocil:title> | ||
| 72 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-ss | 40 | ····<ocil:questionnaire·id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1"> |
| 77 | ······<ocil:title>Set· | 41 | ······<ocil:title>Set·PAM''s·Password·Hashing·Algorithm</ocil:title> |
| 78 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg-ss | 43 | ········<ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 47 | ······<ocil:title>Add·nosuid·Option·to·/tmp</ocil:title> |
| 84 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-mount_option_tmp_nosuid_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-con | 52 | ····<ocil:questionnaire·id="ocil:ssg-accounts_password_pam_ucredit_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 53 | ······<ocil:title>Ensure·PAM·Enforces·Password·Requirements·-·Minimum·Uppercase·Characters</ocil:title> |
| 90 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-con | 55 | ········<ocil:test_action_ref>ocil:ssg-accounts_password_pam_ucredit_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 59 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 96 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-gr | 64 | ····<ocil:questionnaire·id="ocil:ssg-group_unique_id_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 65 | ······<ocil:title>Ensure·All·Groups·on·the·System·Have·Unique·Group·ID</ocil:title> |
| 102 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg-gr | 67 | ········<ocil:test_action_ref>ocil:ssg-group_unique_id_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 71 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 108 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-mount_option_var_tmp_nodev_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 77 | ······<ocil:title>Add·nodev·Option·to·/var/tmp</ocil:title> |
| 114 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-mount_option_var_tmp_nodev_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 119 | ······<ocil:title> | 83 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> |
| 120 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1"> | ||
| 125 | ···· | 88 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1"> |
| 89 | ······<ocil:title>Verify·ownership·of·System·Login·Banner</ocil:title> | ||
| 126 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| Max diff block lines reached; 1096264/1107324 bytes (99.00%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_ALINUX-2"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_ALINUX-2"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Alibaba·Cloud·Linux·2</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Alibaba·Cloud·Linux·2</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Alibaba·Cloud·Linux·2.·It·is·a·rendering·of | 7 | configuration·settings·for·Alibaba·Cloud·Linux·2.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 118 lines modified | Offset 47, 118 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id="machine_and_partition-tmp"> | ||
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | ||
| 57 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-tmp"/> | ||
| 58 | ······</cpe-lang:logical-test> | ||
| 59 | ····</cpe-lang:platform> | ||
| 60 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 61 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 62 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 63 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 64 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 65 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 66 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 67 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 68 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 69 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 70 | ····<cpe-lang:platform·id="machine | 64 | ····<cpe-lang:platform·id="machine"> |
| 71 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 72 | ········<cpe-lang:logical-test·operator="OR"·negate="false"> | ||
| 73 | ··········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | ||
| 74 | ··········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | ||
| 75 | ········</cpe-lang:logical-test> | ||
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 77 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 82 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id="p | 74 | ····<cpe-lang:platform·id="postfix"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a:p | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 87 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id="machine"> | 79 | ····<cpe-lang:platform·id="machine_and_partition-var-tmp"> |
| 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 82 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-var-tmp"/> | ||
| 92 | ······</cpe-lang:logical-test> | 83 | ······</cpe-lang:logical-test> |
| 93 | ····</cpe-lang:platform> | 84 | ····</cpe-lang:platform> |
| 94 | ····<cpe-lang:platform·id=" | 85 | ····<cpe-lang:platform·id="s390x_arch"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 86 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a: | 87 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 97 | ······</cpe-lang:logical-test> | 88 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 89 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id="gdm"> | 90 | ····<cpe-lang:platform·id="gdm"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 91 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 92 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 102 | ······</cpe-lang:logical-test> | 93 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 94 | ····</cpe-lang:platform> |
| 95 | ····<cpe-lang:platform·id="chrony"> | ||
| 96 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 97 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | ||
| 98 | ······</cpe-lang:logical-test> | ||
| 99 | ····</cpe-lang:platform> | ||
| 104 | ····<cpe-lang:platform·id="non-uefi"> | 100 | ····<cpe-lang:platform·id="non-uefi"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 101 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> | 102 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 107 | ······</cpe-lang:logical-test> | 103 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 104 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id=" | 105 | ····<cpe-lang:platform·id="ntp"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 106 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a: | 107 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 112 | ······</cpe-lang:logical-test> | 108 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 109 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id=" | 110 | ····<cpe-lang:platform·id="grub2"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 111 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a: | 112 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 117 | ······</cpe-lang:logical-test> | 113 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 114 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id="s | 115 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 116 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:s | 117 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 122 | ······</cpe-lang:logical-test> | 118 | ······</cpe-lang:logical-test> |
| 123 | ····</cpe-lang:platform> | 119 | ····</cpe-lang:platform> |
| 124 | ····<cpe-lang:platform·id=" | 120 | ····<cpe-lang:platform·id="machine_and_partition-tmp"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 121 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a: | 122 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 123 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-tmp"/> | ||
| 127 | ······</cpe-lang:logical-test> | 124 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 125 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 126 | ····<cpe-lang:platform·id="audit"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 127 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 128 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 132 | ······</cpe-lang:logical-test> | 129 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 130 | ····</cpe-lang:platform> |
| 134 | ····<cpe-lang:platform·id=" | 131 | ····<cpe-lang:platform·id="pam"> |
| 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 132 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a: | 133 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 137 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-var-tmp"/> | ||
| 138 | ······</cpe-lang:logical-test> | 134 | ······</cpe-lang:logical-test> |
| 139 | ····</cpe-lang:platform> | 135 | ····</cpe-lang:platform> |
| 140 | ····<cpe-lang:platform·id=" | 136 | ····<cpe-lang:platform·id="yum"> |
| 141 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 137 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 142 | ········<cpe-lang:fact-ref·name="cpe:/a: | 138 | ········<cpe-lang:fact-ref·name="cpe:/a:yum"/> |
| 143 | ······</cpe-lang:logical-test> | 139 | ······</cpe-lang:logical-test> |
| 144 | ····</cpe-lang:platform> | 140 | ····</cpe-lang:platform> |
| 145 | ····<cpe-lang:platform·id="a | 141 | ····<cpe-lang:platform·id="machine_and_chrony_or_ntp"> |
| 146 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 142 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 143 | ········<cpe-lang:logical-test·operator="OR"·negate="false"> | ||
| 144 | ··········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | ||
| 145 | ··········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> | ||
| 146 | ········</cpe-lang:logical-test> | ||
| 147 | ········<cpe-lang:fact-ref·name="cpe:/a:a | 147 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 148 | ······</cpe-lang:logical-test> | 148 | ······</cpe-lang:logical-test> |
| 149 | ····</cpe-lang:platform> | 149 | ····</cpe-lang:platform> |
| 150 | ····<cpe-lang:platform·id=" | 150 | ····<cpe-lang:platform·id="uefi"> |
| 151 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 151 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| Max diff block lines reached; 604301/612098 bytes (98.73%) of diff not shown. | |||
| Offset 3, 6299 lines modified | Offset 3, 6299 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> | ||
| 11 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-package_libselinux_installed_ocil:questionnaire:1"> | ||
| 17 | ······<ocil:title>Install·libselinux·Package</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-package_libselinux_installed_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>Enable·PAM</ocil:title> | ||
| 23 | ······<ocil:title>Disable·Kerberos·Authentication</ocil:title> | ||
| 24 | ······<ocil:actions> | ||
| 25 | ········<ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref> | ||
| 26 | ······</ocil:actions> | ||
| 27 | ····</ocil:questionnaire> | ||
| 28 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 29 | ······<ocil:title>Disallow·Configuration·to·Bypass·Password·Requirements·for·Privilege·Escalation</ocil:title> | ||
| 30 | ······<ocil:actions> | ||
| 31 | ········<ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref> | ||
| 32 | ······</ocil:actions> | ||
| 33 | ····</ocil:questionnaire> | ||
| 34 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 35 | ······<ocil:title>Audit·Configuration·Files·Must·Be·Owned·By·Group·root</ocil:title> | ||
| 36 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 41 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 42 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"> | ||
| 47 | ····· | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>Ensure·auditd·Collects·Unauthorized·Access·Attempts·to·Files·(unsuccessful)</ocil:title> | ||
| 48 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-service_abrtd_disabled_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 29 | ······<ocil:title>Disable·Automatic·Bug·Reporting·Tool·(abrtd)</ocil:title> |
| 54 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-service_abrtd_disabled_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 34 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_login_events_lastlog_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 35 | ······<ocil:title>Record·Attempts·to·Alter·Logon·and·Logout·Events·-·lastlog</ocil:title> |
| 60 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_login_events_lastlog_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"> | ||
| 65 | ···· | 40 | ····<ocil:questionnaire·id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Set·PAM''s·Password·Hashing·Algorithm</ocil:title> | ||
| 66 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg-pa | 43 | ········<ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1"> | ||
| 71 | ···· | 46 | ····<ocil:questionnaire·id="ocil:ssg-mount_option_tmp_nosuid_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Add·nosuid·Option·to·/tmp</ocil:title> | ||
| 72 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-mount_option_tmp_nosuid_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg- | 52 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 53 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 78 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-group_unique_id_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 59 | ······<ocil:title>Ensure·All·Groups·on·the·System·Have·Unique·Group·ID</ocil:title> |
| 84 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-group_unique_id_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 89 | ······<ocil:title> | 65 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 90 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-mount_option_var_tmp_nodev_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 71 | ······<ocil:title>Add·nodev·Option·to·/var/tmp</ocil:title> |
| 96 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-mount_option_var_tmp_nodev_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 77 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> |
| 102 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_ | 82 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Verify· | 83 | ······<ocil:title>Verify·ownership·of·System·Login·Banner</ocil:title> |
| 108 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg-file_owner_ | 85 | ········<ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_ | 88 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 89 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 114 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_ | 91 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_sctp_disabled_ocil:questionnaire:1"> | ||
| 119 | ····· | 94 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> |
| 95 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> | ||
| 120 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| Max diff block lines reached; 1080677/1092060 bytes (98.96%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_ALINUX-3"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_ALINUX-3"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Alibaba·Cloud·Linux·3</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Alibaba·Cloud·Linux·3</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Alibaba·Cloud·Linux·3.·It·is·a·rendering·of | 7 | configuration·settings·for·Alibaba·Cloud·Linux·3.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 114 lines modified | Offset 47, 114 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id="machine_and_partition-tmp"> | ||
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | ||
| 57 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-tmp"/> | ||
| 58 | ······</cpe-lang:logical-test> | ||
| 59 | ····</cpe-lang:platform> | ||
| 60 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 61 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 62 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 63 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 64 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 65 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 66 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 67 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 68 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 69 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 70 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 71 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 72 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 73 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 74 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 75 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 76 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 77 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 78 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 79 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 80 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 81 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 82 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 83 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 84 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 85 | ····<cpe-lang:platform·id="machine"> | 79 | ····<cpe-lang:platform·id="machine_and_partition-var-tmp"> |
| 86 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 87 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 82 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-var-tmp"/> | ||
| 88 | ······</cpe-lang:logical-test> | 83 | ······</cpe-lang:logical-test> |
| 89 | ····</cpe-lang:platform> | 84 | ····</cpe-lang:platform> |
| 90 | ····<cpe-lang:platform·id=" | 85 | ····<cpe-lang:platform·id="s390x_arch"> |
| 91 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 86 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 92 | ········<cpe-lang:fact-ref·name="cpe:/a: | 87 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 93 | ······</cpe-lang:logical-test> | 88 | ······</cpe-lang:logical-test> |
| 94 | ····</cpe-lang:platform> | 89 | ····</cpe-lang:platform> |
| 95 | ····<cpe-lang:platform·id="gdm"> | 90 | ····<cpe-lang:platform·id="gdm"> |
| 96 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 91 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 97 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 92 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 98 | ······</cpe-lang:logical-test> | 93 | ······</cpe-lang:logical-test> |
| 99 | ····</cpe-lang:platform> | 94 | ····</cpe-lang:platform> |
| 100 | ····<cpe-lang:platform·id=" | 95 | ····<cpe-lang:platform·id="wifi-iface"> |
| 101 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 96 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 102 | ········<cpe-lang:fact-ref·name="cpe:/a: | 97 | ········<cpe-lang:fact-ref·name="cpe:/a:wifi-iface"/> |
| 103 | ······</cpe-lang:logical-test> | 98 | ······</cpe-lang:logical-test> |
| 104 | ····</cpe-lang:platform> | 99 | ····</cpe-lang:platform> |
| 105 | ····<cpe-lang:platform·id="chrony"> | 100 | ····<cpe-lang:platform·id="chrony"> |
| 106 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 101 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 107 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | 102 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 108 | ······</cpe-lang:logical-test> | 103 | ······</cpe-lang:logical-test> |
| 109 | ····</cpe-lang:platform> | 104 | ····</cpe-lang:platform> |
| 110 | ····<cpe-lang:platform·id=" | 105 | ····<cpe-lang:platform·id="non-uefi"> |
| 111 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 106 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 112 | ········<cpe-lang:fact-ref·name="cpe:/a: | 107 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 113 | ······</cpe-lang:logical-test> | 108 | ······</cpe-lang:logical-test> |
| 114 | ····</cpe-lang:platform> | 109 | ····</cpe-lang:platform> |
| 115 | ····<cpe-lang:platform·id=" | 110 | ····<cpe-lang:platform·id="ntp"> |
| 116 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 111 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 117 | ········<cpe-lang:fact-ref·name="cpe:/a: | 112 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 118 | ······</cpe-lang:logical-test> | 113 | ······</cpe-lang:logical-test> |
| 119 | ····</cpe-lang:platform> | 114 | ····</cpe-lang:platform> |
| 120 | ····<cpe-lang:platform·id=" | 115 | ····<cpe-lang:platform·id="grub2"> |
| 121 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 116 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 122 | ········<cpe-lang:fact-ref·name="cpe:/a: | 117 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 123 | ······</cpe-lang:logical-test> | 118 | ······</cpe-lang:logical-test> |
| 124 | ····</cpe-lang:platform> | 119 | ····</cpe-lang:platform> |
| 125 | ····<cpe-lang:platform·id="nt | 120 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 126 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 121 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 127 | ········<cpe-lang:fact-ref·name="cpe:/a:nt | 122 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 128 | ······</cpe-lang:logical-test> | 123 | ······</cpe-lang:logical-test> |
| 129 | ····</cpe-lang:platform> | 124 | ····</cpe-lang:platform> |
| 130 | ····<cpe-lang:platform·id="machine_and_partition- | 125 | ····<cpe-lang:platform·id="machine_and_partition-tmp"> |
| 131 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 126 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 132 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | 127 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 133 | ········<cpe-lang:fact-ref·name="cpe:/a:partition- | 128 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-tmp"/> |
| 134 | ······</cpe-lang:logical-test> | 129 | ······</cpe-lang:logical-test> |
| 135 | ····</cpe-lang:platform> | 130 | ····</cpe-lang:platform> |
| 136 | ····<cpe-lang:platform·id="a | 131 | ····<cpe-lang:platform·id="audit"> |
| 137 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 132 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 138 | ········<cpe-lang:fact-ref·name="cpe:/a:a | 133 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 139 | ······</cpe-lang:logical-test> | 134 | ······</cpe-lang:logical-test> |
| 140 | ····</cpe-lang:platform> | 135 | ····</cpe-lang:platform> |
| 141 | ····<cpe-lang:platform·id=" | 136 | ····<cpe-lang:platform·id="pam"> |
| 142 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 137 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 143 | ········<cpe-lang:fact-ref·name="cpe:/a: | 138 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 144 | ······</cpe-lang:logical-test> | 139 | ······</cpe-lang:logical-test> |
| 145 | ····</cpe-lang:platform> | 140 | ····</cpe-lang:platform> |
| 146 | ····<cpe-lang:platform·id=" | 141 | ····<cpe-lang:platform·id="yum"> |
| 147 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 142 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 148 | ········<cpe-lang:fact-ref·name="cpe:/a: | 143 | ········<cpe-lang:fact-ref·name="cpe:/a:yum"/> |
| 149 | ······</cpe-lang:logical-test> | 144 | ······</cpe-lang:logical-test> |
| 150 | ····</cpe-lang:platform> | 145 | ····</cpe-lang:platform> |
| 151 | ····<cpe-lang:platform·id=" | 146 | ····<cpe-lang:platform·id="uefi"> |
| 152 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 147 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 153 | ········<cpe-lang:fact-ref·name="cpe:/a: | 148 | ········<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 149 | ······</cpe-lang:logical-test> | ||
| 150 | ····</cpe-lang:platform> | ||
| 151 | ····<cpe-lang:platform·id="sssd"> | ||
| 152 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 153 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> | ||
| 154 | ······</cpe-lang:logical-test> | 154 | ······</cpe-lang:logical-test> |
| 155 | ····</cpe-lang:platform> | 155 | ····</cpe-lang:platform> |
| 156 | ··</cpe-lang:platform-specification> | 156 | ··</cpe-lang:platform-specification> |
| Max diff block lines reached; 615048/622853 bytes (98.75%) of diff not shown. | |||
| Offset 3, 5941 lines modified | Offset 3, 5941 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> | ||
| 11 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Disable·Kerberos·Authentication</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-sshd_disable_kerb_auth_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 23 | ······<ocil:title>Disallow·Configuration·to·Bypass·Password·Requirements·for·Privilege·Escalation</ocil:title> | ||
| 24 | ······<ocil:actions> | ||
| 25 | ········<ocil:test_action_ref>ocil:ssg-disallow_bypass_password_sudo_action:testaction:1</ocil:test_action_ref> | ||
| 26 | ······</ocil:actions> | ||
| 27 | ····</ocil:questionnaire> | ||
| 28 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 29 | ······<ocil:title>Audit·Configuration·Files·Must·Be·Owned·By·Group·root</ocil:title> | ||
| 30 | ······<ocil:actions> | ||
| 31 | ········<ocil:test_action_ref>ocil:ssg-file_groupownership_audit_configuration_action:testaction:1</ocil:test_action_ref> | ||
| 32 | ······</ocil:actions> | ||
| 33 | ····</ocil:questionnaire> | ||
| 34 | ····<ocil:questionnaire·id="ocil:ssg-kernel_module_tipc_disabled_ocil:questionnaire:1"> | ||
| 35 | ······<ocil:title> | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 36 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-ss | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 41 | ······<ocil:title> | 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> |
| 42 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg-ss | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg- | 22 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_unsuccessful_file_modification_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Ena | 23 | ······<ocil:title>Ensure·auditd·Collects·Unauthorized·Access·Attempts·to·Files·(unsuccessful)</ocil:title> |
| 48 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_unsuccessful_file_modification_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg-s | 28 | ····<ocil:questionnaire·id="ocil:ssg-service_abrtd_disabled_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 29 | ······<ocil:title>Disable·Automatic·Bug·Reporting·Tool·(abrtd)</ocil:title> |
| 54 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg-s | 31 | ········<ocil:test_action_ref>ocil:ssg-service_abrtd_disabled_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"> | ||
| 59 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-set_password_hashing_algorithm_systemauth_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Set·PAM''s·Password·Hashing·Algorithm</ocil:title> | ||
| 60 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg-pa | 37 | ········<ocil:test_action_ref>ocil:ssg-set_password_hashing_algorithm_systemauth_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-ensure_gpgcheck_globally_activated_ocil:questionnaire:1"> | ||
| 65 | ···· | 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> | ||
| 66 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 46 | ····<ocil:questionnaire·id="ocil:ssg-group_unique_id_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 47 | ······<ocil:title>Ensure·All·Groups·on·the·System·Have·Unique·Group·ID</ocil:title> |
| 72 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 49 | ········<ocil:test_action_ref>ocil:ssg-group_unique_id_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_randomize_base_ocil:questionnaire:1"> | ||
| 77 | ···· | 52 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 53 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> | ||
| 78 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-configure_crypto_policy_ocil:questionnaire:1"> | ||
| 83 | ···· | 58 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 59 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> | ||
| 84 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-file_ | 64 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_etc_issue_ocil:questionnaire:1"> |
| 89 | ······<ocil:title>Verify· | 65 | ······<ocil:title>Verify·ownership·of·System·Login·Banner</ocil:title> |
| 90 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg-file_ | 67 | ········<ocil:test_action_ref>ocil:ssg-file_owner_etc_issue_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 71 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 96 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 77 | ······<ocil:title>Disable·Accepting·ICMP·Redirects·for·All·IPv6·Interfaces</ocil:title> |
| 102 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_accept_redirects_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-file_ | 82 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_cron_allow_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Verify· | 83 | ······<ocil:title>Verify·Permissions·on·/etc/cron.allow·file</ocil:title> |
| 108 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg-file_ | 85 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_cron_allow_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 88 | ····<ocil:questionnaire·id="ocil:ssg-service_rsyncd_disabled_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 89 | ······<ocil:title>Ensure·rsyncd·service·is·disabled</ocil:title> |
| 114 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-service_rsyncd_disabled_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 119 | ······<ocil:title>Disable· | 95 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 120 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg- | 100 | ····<ocil:questionnaire·id="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1"> |
| 125 | ······<ocil:title> | 101 | ······<ocil:title>Configure·BIND·to·use·System·Crypto·Policy</ocil:title> |
| Max diff block lines reached; 990713/1002111 bytes (98.86%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_ANOLIS-8"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_ANOLIS-8"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Anolis·OS·8</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Anolis·OS·8</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Anolis·OS·8.·It·is·a·rendering·of | 7 | configuration·settings·for·Anolis·OS·8.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 102 lines modified | Offset 47, 102 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id="sssd"> | ||
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> | ||
| 57 | ······</cpe-lang:logical-test> | ||
| 58 | ····</cpe-lang:platform> | ||
| 59 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 61 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 62 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 63 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 64 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 67 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 68 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 69 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 71 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 72 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 73 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 74 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 77 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 82 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id=" | 79 | ····<cpe-lang:platform·id="s390x_arch"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a: | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 87 | ······</cpe-lang:logical-test> | 82 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 83 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id="gdm"> | 84 | ····<cpe-lang:platform·id="gdm"> |
| 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 92 | ······</cpe-lang:logical-test> | 87 | ······</cpe-lang:logical-test> |
| 93 | ····</cpe-lang:platform> | 88 | ····</cpe-lang:platform> |
| 94 | ····<cpe-lang:platform·id=" | 89 | ····<cpe-lang:platform·id="wifi-iface"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a: | 91 | ········<cpe-lang:fact-ref·name="cpe:/a:wifi-iface"/> |
| 97 | ······</cpe-lang:logical-test> | 92 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 93 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id="chrony"> | 94 | ····<cpe-lang:platform·id="chrony"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | 96 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 102 | ······</cpe-lang:logical-test> | 97 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 98 | ····</cpe-lang:platform> |
| 104 | ····<cpe-lang:platform·id=" | 99 | ····<cpe-lang:platform·id="non-uefi"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a: | 101 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 107 | ······</cpe-lang:logical-test> | 102 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 103 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id=" | 104 | ····<cpe-lang:platform·id="ntp"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a: | 106 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 112 | ······</cpe-lang:logical-test> | 107 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 108 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id=" | 109 | ····<cpe-lang:platform·id="grub2"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a: | 111 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 117 | ······</cpe-lang:logical-test> | 112 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 113 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id="nt | 114 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:nt | 116 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 122 | ······</cpe-lang:logical-test> | 117 | ······</cpe-lang:logical-test> |
| 123 | ····</cpe-lang:platform> | 118 | ····</cpe-lang:platform> |
| 124 | ····<cpe-lang:platform·id="a | 119 | ····<cpe-lang:platform·id="audit"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a:a | 121 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 127 | ······</cpe-lang:logical-test> | 122 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 123 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 124 | ····<cpe-lang:platform·id="pam"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 126 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 132 | ······</cpe-lang:logical-test> | 127 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 128 | ····</cpe-lang:platform> |
| 134 | ····<cpe-lang:platform·id=" | 129 | ····<cpe-lang:platform·id="yum"> |
| 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a: | 131 | ········<cpe-lang:fact-ref·name="cpe:/a:yum"/> |
| 137 | ······</cpe-lang:logical-test> | 132 | ······</cpe-lang:logical-test> |
| 138 | ····</cpe-lang:platform> | 133 | ····</cpe-lang:platform> |
| 139 | ····<cpe-lang:platform·id=" | 134 | ····<cpe-lang:platform·id="uefi"> |
| 140 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 141 | ········<cpe-lang:fact-ref·name="cpe:/a: | 136 | ········<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 137 | ······</cpe-lang:logical-test> | ||
| 138 | ····</cpe-lang:platform> | ||
| 139 | ····<cpe-lang:platform·id="sssd"> | ||
| 140 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 141 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> | ||
| 142 | ······</cpe-lang:logical-test> | 142 | ······</cpe-lang:logical-test> |
| 143 | ····</cpe-lang:platform> | 143 | ····</cpe-lang:platform> |
| 144 | ··</cpe-lang:platform-specification> | 144 | ··</cpe-lang:platform-specification> |
| 145 | ··<xccdf-1.2:platform·idref="cpe:/o:anolis:anolis_os:8"/> | 145 | ··<xccdf-1.2:platform·idref="cpe:/o:anolis:anolis_os:8"/> |
| 146 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 146 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 147 | ··<xccdf-1.2:metadata> | 147 | ··<xccdf-1.2:metadata> |
| 148 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 148 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 1638, 14 lines modified | Offset 1638, 35 lines modified | ||
| 1638 | ············<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> | 1638 | ············<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> |
| 1639 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> | 1639 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> |
| 1640 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> | 1640 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> |
| 1641 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> | 1641 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> |
| 1642 | ············<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and | 1642 | ············<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and |
| 1643 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms | 1643 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms |
| 1644 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> | 1644 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> |
| 1645 | ············<xccdf-1.2:fix·system="urn:xccdf:fix:script:sh"·id="configure_crypto_policy"> | ||
| Max diff block lines reached; 574680/583983 bytes (98.41%) of diff not shown. | |||
| Offset 28, 15 lines modified | Offset 28, 15 lines modified | ||
| 28 | ········<cpe-dict:title·xml:lang="en-us">Apple·macOS·10.15</cpe-dict:title> | 28 | ········<cpe-dict:title·xml:lang="en-us">Apple·macOS·10.15</cpe-dict:title> |
| 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-macos1015-cpe-oval.xml">oval:ssg-installed_OS_is_macos1015:def:1</cpe-dict:check> | 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-macos1015-cpe-oval.xml">oval:ssg-installed_OS_is_macos1015:def:1</cpe-dict:check> |
| 30 | ······</cpe-dict:cpe-item> | 30 | ······</cpe-dict:cpe-item> |
| 31 | ····</cpe-dict:cpe-list> | 31 | ····</cpe-dict:cpe-list> |
| 32 | ··</ds:component> | 32 | ··</ds:component> |
| 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-macos1015-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-macos1015-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_macOS-1015"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_macOS-1015"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 35 | ······<xccdf-1.2:status·date="202 | 35 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15</xccdf-1.2:title> | 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15</xccdf-1.2:title> |
| 37 | ······<xccdf-1.2:description> | 37 | ······<xccdf-1.2:description> |
| 38 | ········This·guide·presents·a·catalog·of·security-relevant | 38 | ········This·guide·presents·a·catalog·of·security-relevant |
| 39 | configuration·settings·for·Apple·macOS·10.15.·It·is·a·rendering·of | 39 | configuration·settings·for·Apple·macOS·10.15.·It·is·a·rendering·of |
| 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 41 | in·order·to·support·security·automation. | 41 | in·order·to·support·security·automation. |
| 42 | ········<html:br/> | 42 | ········<html:br/> |
| Offset 28, 15 lines modified | Offset 28, 15 lines modified | ||
| 28 | ········<cpe-dict:title·xml:lang="en-us">Apple·macOS·10.15</cpe-dict:title> | 28 | ········<cpe-dict:title·xml:lang="en-us">Apple·macOS·10.15</cpe-dict:title> |
| 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-macos1015-cpe-oval.xml">oval:ssg-installed_OS_is_macos1015:def:1</cpe-dict:check> | 29 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-macos1015-cpe-oval.xml">oval:ssg-installed_OS_is_macos1015:def:1</cpe-dict:check> |
| 30 | ······</cpe-dict:cpe-item> | 30 | ······</cpe-dict:cpe-item> |
| 31 | ····</cpe-dict:cpe-list> | 31 | ····</cpe-dict:cpe-list> |
| 32 | ··</ds:component> | 32 | ··</ds:component> |
| 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-macos1015-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 33 | ··<ds:component·id="scap_org.open-scap_comp_ssg-macos1015-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_macOS-1015"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 34 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_macOS-1015"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 35 | ······<xccdf-1.2:status·date="202 | 35 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15</xccdf-1.2:title> | 36 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15</xccdf-1.2:title> |
| 37 | ······<xccdf-1.2:description> | 37 | ······<xccdf-1.2:description> |
| 38 | ········This·guide·presents·a·catalog·of·security-relevant | 38 | ········This·guide·presents·a·catalog·of·security-relevant |
| 39 | configuration·settings·for·Apple·macOS·10.15.·It·is·a·rendering·of | 39 | configuration·settings·for·Apple·macOS·10.15.·It·is·a·rendering·of |
| 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 40 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 41 | in·order·to·support·security·automation. | 41 | in·order·to·support·security·automation. |
| 42 | ········<html:br/> | 42 | ········<html:br/> |
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_macOS-1015"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_macOS-1015"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Apple·macOS·10.15</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Apple·macOS·10.15.·It·is·a·rendering·of | 7 | configuration·settings·for·Apple·macOS·10.15.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation. | 9 | in·order·to·support·security·automation. |
| 10 | ····<html:br/> | 10 | ····<html:br/> |
| Offset 2742, 27 lines modified | Offset 2742, 27 lines modified | ||
| 2742 | ······<ind:subexpression·datatype="string"·operation="pattern·match">^s390x$</ind:subexpression> | 2742 | ······<ind:subexpression·datatype="string"·operation="pattern·match">^s390x$</ind:subexpression> |
| 2743 | ····</ind:textfilecontent54_state> | 2743 | ····</ind:textfilecontent54_state> |
| 2744 | ····<unix:uname_state·comment="64·bit·architecture"·id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"·version="1"> | 2744 | ····<unix:uname_state·comment="64·bit·architecture"·id="oval:ssg-state_system_info_architecture_ppcle_64:ste:1"·version="1"> |
| 2745 | ······<unix:processor_type·operation="equals">ppc64le</unix:processor_type> | 2745 | ······<unix:processor_type·operation="equals">ppc64le</unix:processor_type> |
| 2746 | ····</unix:uname_state> | 2746 | ····</unix:uname_state> |
| 2747 | ··</oval-def:states> | 2747 | ··</oval-def:states> |
| 2748 | ··<oval-def:variables> | 2748 | ··<oval-def:variables> |
| 2749 | ····<oval-def:local_variable·id="oval:ssg-hypershift_hosted_cluster_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·file·to·scan."·version="1"> | ||
| 2750 | ······<oval-def:literal_component>/kubernetes-api-resources/apis/apiextensions.k8s.io/v1/customresourcedefinitions/hostedclusters.hypershift.openshift.io</oval-def:literal_component> | ||
| 2751 | ····</oval-def:local_variable> | ||
| 2752 | ····<oval-def:local_variable·id="oval:ssg-ocp4_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·file·to·scan."·version="1"> | ||
| 2753 | ······<oval-def:literal_component>/kubernetes-api-resources/ocp/version</oval-def:literal_component> | ||
| 2754 | ····</oval-def:local_variable> | ||
| 2755 | ····<oval-def:local_variable·id="oval:ssg-ocp4_node_network_file_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·network·file·to·scan."·version="1"> | 2749 | ····<oval-def:local_variable·id="oval:ssg-ocp4_node_network_file_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·network·file·to·scan."·version="1"> |
| 2756 | ······<oval-def:literal_component>/etc/kubernetes/cni/net.d/00-multus.conf</oval-def:literal_component> | 2750 | ······<oval-def:literal_component>/etc/kubernetes/cni/net.d/00-multus.conf</oval-def:literal_component> |
| 2757 | ····</oval-def:local_variable> | 2751 | ····</oval-def:local_variable> |
| 2758 | ····<oval-def:local_variable·id="oval:ssg-ocp4_hypershift_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·file·to·scan."·version="1"> | 2752 | ····<oval-def:local_variable·id="oval:ssg-ocp4_hypershift_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·file·to·scan."·version="1"> |
| 2759 | ······<oval-def:literal_component>/kubernetes-api-resources/hypershift/version</oval-def:literal_component> | 2753 | ······<oval-def:literal_component>/kubernetes-api-resources/hypershift/version</oval-def:literal_component> |
| 2760 | ····</oval-def:local_variable> | 2754 | ····</oval-def:local_variable> |
| 2761 | ····<oval-def:local_variable·id="oval:ssg-ocp4_infra_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·infra·file·to·scan."·version="1"> | 2755 | ····<oval-def:local_variable·id="oval:ssg-ocp4_infra_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·infra·file·to·scan."·version="1"> |
| 2762 | ······<oval-def:literal_component>/kubernetes-api-resources/apis/config.openshift.io/v1/infrastructures/cluster</oval-def:literal_component> | 2756 | ······<oval-def:literal_component>/kubernetes-api-resources/apis/config.openshift.io/v1/infrastructures/cluster</oval-def:literal_component> |
| 2763 | ····</oval-def:local_variable> | 2757 | ····</oval-def:local_variable> |
| 2764 | ····<oval-def:local_variable·id="oval:ssg-ocp4_network_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·network·file·to·scan."·version="1"> | 2758 | ····<oval-def:local_variable·id="oval:ssg-ocp4_network_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·network·file·to·scan."·version="1"> |
| 2765 | ······<oval-def:literal_component>/kubernetes-api-resources/apis/config.openshift.io/v1/networks/cluster</oval-def:literal_component> | 2759 | ······<oval-def:literal_component>/kubernetes-api-resources/apis/config.openshift.io/v1/networks/cluster</oval-def:literal_component> |
| 2766 | ····</oval-def:local_variable> | 2760 | ····</oval-def:local_variable> |
| 2761 | ····<oval-def:local_variable·id="oval:ssg-hypershift_hosted_cluster_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·file·to·scan."·version="1"> | ||
| 2762 | ······<oval-def:literal_component>/kubernetes-api-resources/apis/apiextensions.k8s.io/v1/customresourcedefinitions/hostedclusters.hypershift.openshift.io</oval-def:literal_component> | ||
| 2763 | ····</oval-def:local_variable> | ||
| 2764 | ····<oval-def:local_variable·id="oval:ssg-ocp4_dump_location:var:1"·datatype="string"·comment="The·actual·filepath·of·the·file·to·scan."·version="1"> | ||
| 2765 | ······<oval-def:literal_component>/kubernetes-api-resources/ocp/version</oval-def:literal_component> | ||
| 2766 | ····</oval-def:local_variable> | ||
| 2767 | ··</oval-def:variables> | 2767 | ··</oval-def:variables> |
| 2768 | </oval-def:oval_definitions> | 2768 | </oval-def:oval_definitions> |
| Offset 128, 15 lines modified | Offset 128, 15 lines modified | ||
| 128 | ········<cpe-dict:title·xml:lang="en-us">Red·Hat·OpenShift·Container·Platform·4·Node</cpe-dict:title> | 128 | ········<cpe-dict:title·xml:lang="en-us">Red·Hat·OpenShift·Container·Platform·4·Node</cpe-dict:title> |
| 129 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-ocp4-cpe-oval.xml">oval:ssg-installed_app_is_ocp4_node:def:1</cpe-dict:check> | 129 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-ocp4-cpe-oval.xml">oval:ssg-installed_app_is_ocp4_node:def:1</cpe-dict:check> |
| 130 | ······</cpe-dict:cpe-item> | 130 | ······</cpe-dict:cpe-item> |
| 131 | ····</cpe-dict:cpe-list> | 131 | ····</cpe-dict:cpe-list> |
| 132 | ··</ds:component> | 132 | ··</ds:component> |
| 133 | ··<ds:component·id="scap_org.open-scap_comp_ssg-ocp4-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 133 | ··<ds:component·id="scap_org.open-scap_comp_ssg-ocp4-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 134 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OCP-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 134 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OCP-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 135 | ······<xccdf-1.2:status·date="202 | 135 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 136 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·OpenShift·Container·Platform·4</xccdf-1.2:title> | 136 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·OpenShift·Container·Platform·4</xccdf-1.2:title> |
| 137 | ······<xccdf-1.2:description> | 137 | ······<xccdf-1.2:description> |
| 138 | ········This·guide·presents·a·catalog·of·security-relevant | 138 | ········This·guide·presents·a·catalog·of·security-relevant |
| 139 | configuration·settings·for·Red·Hat·OpenShift·Container·Platform·4.·It·is·a·rendering·of | 139 | configuration·settings·for·Red·Hat·OpenShift·Container·Platform·4.·It·is·a·rendering·of |
| 140 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 140 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 141 | in·order·to·support·security·automation.··The·SCAP·content·is | 141 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 142 | is·available·in·the | 142 | is·available·in·the |
| Offset 179, 117 lines modified | Offset 179, 117 lines modified | ||
| 179 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 179 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 180 | ······</xccdf-1.2:front-matter> | 180 | ······</xccdf-1.2:front-matter> |
| 181 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 181 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 182 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 182 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 183 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 183 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 184 | respective·companies.</xccdf-1.2:rear-matter> | 184 | respective·companies.</xccdf-1.2:rear-matter> |
| 185 | ······<cpe-lang:platform-specification> | 185 | ······<cpe-lang:platform-specification> |
| 186 | ········<cpe-lang:platform·id="ocp4 | 186 | ········<cpe-lang:platform·id="ocp4-node-on-ovn"> |
| 187 | ··········<cpe-lang:logical-test·operator=" | 187 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 188 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 188 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_node_on_ovn:4"/> |
| 189 | ··········</cpe-lang:logical-test> | ||
| 190 | ········</cpe-lang:platform> | ||
| 191 | ········<cpe-lang:platform·id="ocp4-on-sdn"> | ||
| 192 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 189 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 193 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_on_sdn:4"/> |
| 194 | ··········</cpe-lang:logical-test> | ||
| 195 | ········</cpe-lang:platform> | ||
| 196 | ········<cpe-lang:platform·id="not_s390x_arch_and_ocp4-node"> | ||
| 197 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 198 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> | ||
| 190 | ············<cpe-lang:fact-ref·name="cpe:/ | 199 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 200 | ··········</cpe-lang:logical-test> | ||
| 201 | ········</cpe-lang:platform> | ||
| 202 | ········<cpe-lang:platform·id="ocp4-node-on-sdn"> | ||
| 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 204 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_node_on_sdn:4"/> | ||
| 191 | ··········</cpe-lang:logical-test> | 205 | ··········</cpe-lang:logical-test> |
| 192 | ········</cpe-lang:platform> | 206 | ········</cpe-lang:platform> |
| 193 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.6_or_ocp4.7_or_ocp4.8_or_ocp4.9"> | 207 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.6_or_ocp4.7_or_ocp4.8_or_ocp4.9"> |
| 194 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | 208 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 195 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> | 209 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 210 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 197 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 198 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> | 212 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 199 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> | 213 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> |
| 200 | ··········</cpe-lang:logical-test> | 214 | ··········</cpe-lang:logical-test> |
| 201 | ········</cpe-lang:platform> | 215 | ········</cpe-lang:platform> |
| 202 | ········<cpe-lang:platform·id="ocp4-node"> | 216 | ········<cpe-lang:platform·id="ocp4-node_and_s390x_arch"> |
| 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 217 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 204 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> | 218 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 219 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | ||
| 205 | ··········</cpe-lang:logical-test> | 220 | ··········</cpe-lang:logical-test> |
| 206 | ········</cpe-lang:platform> | 221 | ········</cpe-lang:platform> |
| 207 | ········<cpe-lang:platform·id="ocp4.11_or_ocp4.12"> | ||
| 208 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | ||
| 209 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> | ||
| 210 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 211 | ··········</cpe-lang:logical-test> | ||
| 212 | ········</cpe-lang:platform> | ||
| 213 | ········<cpe-lang:platform·id="ocp4 | 222 | ········<cpe-lang:platform·id="ocp4"> |
| 214 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 223 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 215 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 224 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.1"/> |
| 216 | ··········</cpe-lang:logical-test> | 225 | ··········</cpe-lang:logical-test> |
| 217 | ········</cpe-lang:platform> | 226 | ········</cpe-lang:platform> |
| 218 | ········<cpe-lang:platform·id="ocp4- | 227 | ········<cpe-lang:platform·id="ocp4-master-node"> |
| 219 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 228 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 220 | ············<cpe-lang:fact-ref·name="cpe:/a: | 229 | ············<cpe-lang:fact-ref·name="cpe:/a:ocp4-master-node"/> |
| 221 | ··········</cpe-lang:logical-test> | 230 | ··········</cpe-lang:logical-test> |
| 222 | ········</cpe-lang:platform> | 231 | ········</cpe-lang:platform> |
| 223 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7_or_ocp4.8"> | 232 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7_or_ocp4.8"> |
| 224 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | 233 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 225 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 234 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 235 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 227 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 228 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 229 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 230 | ········<cpe-lang:platform·id="ocp4 | 239 | ········<cpe-lang:platform·id="ocp4-on-azure"> |
| 231 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 240 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 232 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 241 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_on_azure:4"/> |
| 233 | ··········</cpe-lang:logical-test> | 242 | ··········</cpe-lang:logical-test> |
| 234 | ········</cpe-lang:platform> | 243 | ········</cpe-lang:platform> |
| 235 | ········<cpe-lang:platform·id="ocp4 | 244 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.11_or_ocp4.12_or_ocp4.9"> |
| 236 | ··········<cpe-lang:logical-test·operator=" | 245 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 246 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> | ||
| 247 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> | ||
| 248 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 237 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 249 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> |
| 238 | ··········</cpe-lang:logical-test> | 250 | ··········</cpe-lang:logical-test> |
| 239 | ········</cpe-lang:platform> | 251 | ········</cpe-lang:platform> |
| 240 | ········<cpe-lang:platform·id="ocp4 | 252 | ········<cpe-lang:platform·id="ocp4.11_or_ocp4.12"> |
| 241 | ··········<cpe-lang:logical-test·operator=" | 253 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 242 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 254 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> |
| 255 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 243 | ··········</cpe-lang:logical-test> | 256 | ··········</cpe-lang:logical-test> |
| 244 | ········</cpe-lang:platform> | 257 | ········</cpe-lang:platform> |
| 245 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7"> | 258 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7"> |
| 246 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | 259 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 247 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 260 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 248 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 261 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 249 | ··········</cpe-lang:logical-test> | 262 | ··········</cpe-lang:logical-test> |
| 250 | ········</cpe-lang:platform> | 263 | ········</cpe-lang:platform> |
| 251 | ········<cpe-lang:platform·id=" | 264 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.8_or_ocp4.9"> |
| 252 | ··········<cpe-lang:logical-test·operator=" | 265 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 253 | ············<cpe-lang:fact-ref·name="cpe:/a:n | 266 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> |
| 254 | ············<cpe-lang:fact-ref·name="cpe:/ | 267 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 268 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> | ||
| 255 | ··········</cpe-lang:logical-test> | 269 | ··········</cpe-lang:logical-test> |
| 256 | ········</cpe-lang:platform> | 270 | ········</cpe-lang:platform> |
| 257 | ········<cpe-lang:platform·id="ocp4-node | 271 | ········<cpe-lang:platform·id="ocp4-node"> |
| 258 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 272 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 259 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> | 273 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 260 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | ||
| 261 | ··········</cpe-lang:logical-test> | ||
| 262 | ········</cpe-lang:platform> | ||
| 263 | ········<cpe-lang:platform·id="ocp4"> | ||
| 264 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 265 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.1"/> | ||
| 266 | ··········</cpe-lang:logical-test> | ||
| 267 | ········</cpe-lang:platform> | ||
| 268 | ········<cpe-lang:platform·id="ocp4-master-node"> | ||
| 269 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| Max diff block lines reached; 931194/940932 bytes (98.97%) of diff not shown. | |||
| Offset 128, 15 lines modified | Offset 128, 15 lines modified | ||
| 128 | ········<cpe-dict:title·xml:lang="en-us">Red·Hat·OpenShift·Container·Platform·4·Node</cpe-dict:title> | 128 | ········<cpe-dict:title·xml:lang="en-us">Red·Hat·OpenShift·Container·Platform·4·Node</cpe-dict:title> |
| 129 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-ocp4-cpe-oval.xml">oval:ssg-installed_app_is_ocp4_node:def:1</cpe-dict:check> | 129 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-ocp4-cpe-oval.xml">oval:ssg-installed_app_is_ocp4_node:def:1</cpe-dict:check> |
| 130 | ······</cpe-dict:cpe-item> | 130 | ······</cpe-dict:cpe-item> |
| 131 | ····</cpe-dict:cpe-list> | 131 | ····</cpe-dict:cpe-list> |
| 132 | ··</ds:component> | 132 | ··</ds:component> |
| 133 | ··<ds:component·id="scap_org.open-scap_comp_ssg-ocp4-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 133 | ··<ds:component·id="scap_org.open-scap_comp_ssg-ocp4-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 134 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OCP-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 134 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OCP-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 135 | ······<xccdf-1.2:status·date="202 | 135 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 136 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·OpenShift·Container·Platform·4</xccdf-1.2:title> | 136 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·OpenShift·Container·Platform·4</xccdf-1.2:title> |
| 137 | ······<xccdf-1.2:description> | 137 | ······<xccdf-1.2:description> |
| 138 | ········This·guide·presents·a·catalog·of·security-relevant | 138 | ········This·guide·presents·a·catalog·of·security-relevant |
| 139 | configuration·settings·for·Red·Hat·OpenShift·Container·Platform·4.·It·is·a·rendering·of | 139 | configuration·settings·for·Red·Hat·OpenShift·Container·Platform·4.·It·is·a·rendering·of |
| 140 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 140 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 141 | in·order·to·support·security·automation.··The·SCAP·content·is | 141 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 142 | is·available·in·the | 142 | is·available·in·the |
| Offset 179, 117 lines modified | Offset 179, 117 lines modified | ||
| 179 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 179 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 180 | ······</xccdf-1.2:front-matter> | 180 | ······</xccdf-1.2:front-matter> |
| 181 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 181 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 182 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 182 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 183 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 183 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 184 | respective·companies.</xccdf-1.2:rear-matter> | 184 | respective·companies.</xccdf-1.2:rear-matter> |
| 185 | ······<cpe-lang:platform-specification> | 185 | ······<cpe-lang:platform-specification> |
| 186 | ········<cpe-lang:platform·id="ocp4 | 186 | ········<cpe-lang:platform·id="ocp4-node-on-ovn"> |
| 187 | ··········<cpe-lang:logical-test·operator=" | 187 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 188 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 188 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_node_on_ovn:4"/> |
| 189 | ··········</cpe-lang:logical-test> | ||
| 190 | ········</cpe-lang:platform> | ||
| 191 | ········<cpe-lang:platform·id="ocp4-on-sdn"> | ||
| 192 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 189 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 193 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_on_sdn:4"/> |
| 194 | ··········</cpe-lang:logical-test> | ||
| 195 | ········</cpe-lang:platform> | ||
| 196 | ········<cpe-lang:platform·id="not_s390x_arch_and_ocp4-node"> | ||
| 197 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 198 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> | ||
| 190 | ············<cpe-lang:fact-ref·name="cpe:/ | 199 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 200 | ··········</cpe-lang:logical-test> | ||
| 201 | ········</cpe-lang:platform> | ||
| 202 | ········<cpe-lang:platform·id="ocp4-node-on-sdn"> | ||
| 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 204 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_node_on_sdn:4"/> | ||
| 191 | ··········</cpe-lang:logical-test> | 205 | ··········</cpe-lang:logical-test> |
| 192 | ········</cpe-lang:platform> | 206 | ········</cpe-lang:platform> |
| 193 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.6_or_ocp4.7_or_ocp4.8_or_ocp4.9"> | 207 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.6_or_ocp4.7_or_ocp4.8_or_ocp4.9"> |
| 194 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | 208 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 195 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> | 209 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 210 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 197 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 198 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> | 212 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 199 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> | 213 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> |
| 200 | ··········</cpe-lang:logical-test> | 214 | ··········</cpe-lang:logical-test> |
| 201 | ········</cpe-lang:platform> | 215 | ········</cpe-lang:platform> |
| 202 | ········<cpe-lang:platform·id="ocp4-node"> | 216 | ········<cpe-lang:platform·id="ocp4-node_and_s390x_arch"> |
| 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 217 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 204 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> | 218 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 219 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | ||
| 205 | ··········</cpe-lang:logical-test> | 220 | ··········</cpe-lang:logical-test> |
| 206 | ········</cpe-lang:platform> | 221 | ········</cpe-lang:platform> |
| 207 | ········<cpe-lang:platform·id="ocp4.11_or_ocp4.12"> | ||
| 208 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | ||
| 209 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> | ||
| 210 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 211 | ··········</cpe-lang:logical-test> | ||
| 212 | ········</cpe-lang:platform> | ||
| 213 | ········<cpe-lang:platform·id="ocp4 | 222 | ········<cpe-lang:platform·id="ocp4"> |
| 214 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 223 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 215 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 224 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.1"/> |
| 216 | ··········</cpe-lang:logical-test> | 225 | ··········</cpe-lang:logical-test> |
| 217 | ········</cpe-lang:platform> | 226 | ········</cpe-lang:platform> |
| 218 | ········<cpe-lang:platform·id="ocp4- | 227 | ········<cpe-lang:platform·id="ocp4-master-node"> |
| 219 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 228 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 220 | ············<cpe-lang:fact-ref·name="cpe:/a: | 229 | ············<cpe-lang:fact-ref·name="cpe:/a:ocp4-master-node"/> |
| 221 | ··········</cpe-lang:logical-test> | 230 | ··········</cpe-lang:logical-test> |
| 222 | ········</cpe-lang:platform> | 231 | ········</cpe-lang:platform> |
| 223 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7_or_ocp4.8"> | 232 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7_or_ocp4.8"> |
| 224 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | 233 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 225 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 234 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 235 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 227 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 228 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 229 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 230 | ········<cpe-lang:platform·id="ocp4 | 239 | ········<cpe-lang:platform·id="ocp4-on-azure"> |
| 231 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 240 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 232 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 241 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_on_azure:4"/> |
| 233 | ··········</cpe-lang:logical-test> | 242 | ··········</cpe-lang:logical-test> |
| 234 | ········</cpe-lang:platform> | 243 | ········</cpe-lang:platform> |
| 235 | ········<cpe-lang:platform·id="ocp4 | 244 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.11_or_ocp4.12_or_ocp4.9"> |
| 236 | ··········<cpe-lang:logical-test·operator=" | 245 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 246 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> | ||
| 247 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> | ||
| 248 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 237 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 249 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> |
| 238 | ··········</cpe-lang:logical-test> | 250 | ··········</cpe-lang:logical-test> |
| 239 | ········</cpe-lang:platform> | 251 | ········</cpe-lang:platform> |
| 240 | ········<cpe-lang:platform·id="ocp4 | 252 | ········<cpe-lang:platform·id="ocp4.11_or_ocp4.12"> |
| 241 | ··········<cpe-lang:logical-test·operator=" | 253 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 242 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 254 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> |
| 255 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 243 | ··········</cpe-lang:logical-test> | 256 | ··········</cpe-lang:logical-test> |
| 244 | ········</cpe-lang:platform> | 257 | ········</cpe-lang:platform> |
| 245 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7"> | 258 | ········<cpe-lang:platform·id="ocp4.6_or_ocp4.7"> |
| 246 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> | 259 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 247 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 260 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 248 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 261 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 249 | ··········</cpe-lang:logical-test> | 262 | ··········</cpe-lang:logical-test> |
| 250 | ········</cpe-lang:platform> | 263 | ········</cpe-lang:platform> |
| 251 | ········<cpe-lang:platform·id=" | 264 | ········<cpe-lang:platform·id="ocp4.10_or_ocp4.8_or_ocp4.9"> |
| 252 | ··········<cpe-lang:logical-test·operator=" | 265 | ··········<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 253 | ············<cpe-lang:fact-ref·name="cpe:/a:n | 266 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> |
| 254 | ············<cpe-lang:fact-ref·name="cpe:/ | 267 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 268 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> | ||
| 255 | ··········</cpe-lang:logical-test> | 269 | ··········</cpe-lang:logical-test> |
| 256 | ········</cpe-lang:platform> | 270 | ········</cpe-lang:platform> |
| 257 | ········<cpe-lang:platform·id="ocp4-node | 271 | ········<cpe-lang:platform·id="ocp4-node"> |
| 258 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 272 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 259 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> | 273 | ············<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 260 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | ||
| 261 | ··········</cpe-lang:logical-test> | ||
| 262 | ········</cpe-lang:platform> | ||
| 263 | ········<cpe-lang:platform·id="ocp4"> | ||
| 264 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 265 | ············<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.1"/> | ||
| 266 | ··········</cpe-lang:logical-test> | ||
| 267 | ········</cpe-lang:platform> | ||
| 268 | ········<cpe-lang:platform·id="ocp4-master-node"> | ||
| 269 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| Max diff block lines reached; 931194/940932 bytes (98.97%) of diff not shown. | |||
| Offset 3, 6048 lines modified | Offset 3, 5981 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-api_server_admission_control_plugin_alwayspullimages_ocil:questionnaire:1"> | ||
| 11 | ······<ocil:title>Ensure·that·the·Admission·Control·Plugin·AlwaysPullImages·is·not·set</ocil:title> | ||
| 12 | ······<ocil:actions> | ||
| 13 | ········<ocil:test_action_ref>ocil:ssg-api_server_admission_control_plugin_alwayspullimages_action:testaction:1</ocil:test_action_ref> | ||
| 14 | ······</ocil:actions> | ||
| 15 | ····</ocil:questionnaire> | ||
| 16 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_client_cert_rotation_master_ocil:questionnaire:1"> |
| 11 | ······<ocil:title>kubelet·-·Enable·Client·Certificate·Rotation</ocil:title> | ||
| 17 | ······<ocil:title>kubelet·-·Set·Up·Sysctl·to·Enable·Protect·Kernel·Defaults·-·Check·sysctl·configuration·file·exist</ocil:title> | ||
| 18 | ······<ocil:actions> | ||
| 19 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_protect_kernel_sysctl_file_exist_action:testaction:1</ocil:test_action_ref> | ||
| 20 | ······</ocil:actions> | ||
| 21 | ····</ocil:questionnaire> | ||
| 22 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_available_deprecated_ocil:questionnaire:1"> | ||
| 23 | ······<ocil:title>Ensure·Eviction·threshold·Settings·Are·Set·-·evictionSoft:·imagefs.available</ocil:title> | ||
| 24 | ······<ocil:actions> | ||
| 25 | ········<ocil:test_action_ref>ocil:ssg-kubelet_eviction_thresholds_set_soft_imagefs_available_deprecated_action:testaction:1</ocil:test_action_ref> | ||
| 26 | ······</ocil:actions> | ||
| 27 | ····</ocil:questionnaire> | ||
| 28 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_etcd_data_files_ocil:questionnaire:1"> | ||
| 29 | ······<ocil:title>Verify·Group·Who·Owns·The·Etcd·Write-Ahead-Log·Files</ocil:title> | ||
| 30 | ······<ocil:actions> | ||
| 31 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_etcd_data_files_action:testaction:1</ocil:test_action_ref> | ||
| 32 | ······</ocil:actions> | ||
| 33 | ····</ocil:questionnaire> | ||
| 34 | ····<ocil:questionnaire·id="ocil:ssg-storageclass_encryption_enabled_ocil:questionnaire:1"> | ||
| 35 | ······<ocil:title>Ensure·that·EBS·volumes·declared·in·storageclasses·are·encrypted</ocil:title> | ||
| 36 | ······<ocil:actions> | ||
| 37 | ········<ocil:test_action_ref>ocil:ssg-storageclass_encryption_enabled_action:testaction:1</ocil:test_action_ref> | ||
| 38 | ······</ocil:actions> | ||
| 39 | ····</ocil:questionnaire> | ||
| 40 | ····<ocil:questionnaire·id="ocil:ssg-oauthclient_inactivity_timeout_ocil:questionnaire:1"> | ||
| 41 | ······<ocil:title>Configure·OAuth·clients·so·that·tokens·expire·after·a·set·period·of·inactivity</ocil:title> | ||
| 42 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg- | 13 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_client_cert_rotation_master_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-kubea | 16 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_anonymous_auth_worker_ocil:questionnaire:1"> |
| 47 | ······<ocil:title> | 17 | ······<ocil:title>Disable·Anonymous·Authentication·to·the·Kubelet</ocil:title> |
| 48 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg-kubea | 19 | ········<ocil:test_action_ref>ocil:ssg-kubelet_anonymous_auth_worker_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg-scheduler_port_is_zero_ocil:questionnaire:1"> | ||
| 53 | ···· | 22 | ····<ocil:questionnaire·id="ocil:ssg-api_server_admission_control_plugin_service_account_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>Enable·the·ServiceAccount·Admission·Control·Plugin</ocil:title> | ||
| 54 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg-s | 25 | ········<ocil:test_action_ref>ocil:ssg-api_server_admission_control_plugin_service_account_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_ovs_vswitchd_pid_ocil:questionnaire:1"> | ||
| 59 | ···· | 28 | ····<ocil:questionnaire·id="ocil:ssg-resource_requests_limits_in_statefulset_ocil:questionnaire:1"> |
| 29 | ······<ocil:title>Ensure·that·all·statefulsets·has·resource·limits</ocil:title> | ||
| 60 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-resource_requests_limits_in_statefulset_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_eviction_thresholds_set_hard_nodefs_available_master_ocil:questionnaire:1"> | ||
| 65 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-cluster_version_operator_verify_integrity_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Ensure·that·Cluster·Version·Operator·verifies·integrity</ocil:title> | ||
| 66 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-cluster_version_operator_verify_integrity_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_ | 40 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 41 | ······<ocil:title>kubelet·-·Enable·Server·Certificate·Rotation</ocil:title> |
| 72 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg-kubelet_ | 43 | ········<ocil:test_action_ref>ocil:ssg-kubelet_enable_server_cert_rotation_deprecated_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_configure_tls_cipher_suites_master_ocil:questionnaire:1"> | ||
| 77 | ···· | 46 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_deprecated_ocil:questionnaire:1"> |
| 47 | ······<ocil:title>Ensure·Eviction·threshold·Settings·Are·Set·-·evictionSoft:·nodefs.available</ocil:title> | ||
| 78 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg-kubelet_con | 49 | ········<ocil:test_action_ref>ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_deprecated_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-directory_permissions_var_log_ocp_audit_ocil:questionnaire:1"> | ||
| 83 | ···· | 52 | ····<ocil:questionnaire·id="ocil:ssg-controller_terminated_pod_gc_threshhold_ocil:questionnaire:1"> |
| 53 | ······<ocil:title>Enable·terminated-pod-gc-threshold·for·the·Controller·Manager</ocil:title> | ||
| 84 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-controller_terminated_pod_gc_threshhold_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-kubelet_eviction_thresholds_set_soft_nodefs_available_deprecated_ocil:questionnaire:1"> | ||
| 89 | ···· | 58 | ····<ocil:questionnaire·id="ocil:ssg-api_server_client_ca_ocil:questionnaire:1"> |
| 59 | ······<ocil:title>Configure·the·Client·Certificate·Authority·for·the·API·Server</ocil:title> | ||
| 90 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-api_server_client_ca_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_ovs_conf_db_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 65 | ······<ocil:title>Verify·Permissions·on·the·Open·vSwitch·Configuration·Database</ocil:title> |
| 96 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_ovs_conf_db_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_worker_service_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 71 | ······<ocil:title>Verify·Group·Who·Owns·The·OpenShift·Node·Service·File</ocil:title> |
| 102 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_worker_service_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-file_owner_worker_service_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 77 | ······<ocil:title>Verify·User·Who·Owns·The·OpenShift·Node·Service·File</ocil:title> |
| 108 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-file_owner_worker_service_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-api_server_auth_mode_no_aa_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 83 | ······<ocil:title>The·authorization-mode·cannot·be·AlwaysAllow</ocil:title> |
| 114 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-api_server_auth_mode_no_aa_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 88 | ····<ocil:questionnaire·id="ocil:ssg-gitops_operator_exists_ocil:questionnaire:1"> |
| 119 | ······<ocil:title> | 89 | ······<ocil:title>Ensure·that·GitOps·Operator·is·deployed</ocil:title> |
| 120 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-gitops_operator_exists_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| Max diff block lines reached; 879951/891891 bytes (98.66%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_OCP-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_OCP-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·OpenShift·Container·Platform·4</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·OpenShift·Container·Platform·4</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Red·Hat·OpenShift·Container·Platform·4.·It·is·a·rendering·of | 7 | configuration·settings·for·Red·Hat·OpenShift·Container·Platform·4.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 117 lines modified | Offset 47, 117 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id="ocp4 | 54 | ····<cpe-lang:platform·id="ocp4-node-on-ovn"> |
| 55 | ······<cpe-lang:logical-test·operator=" | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_node_on_ovn:4"/> |
| 57 | ······</cpe-lang:logical-test> | ||
| 58 | ····</cpe-lang:platform> | ||
| 59 | ····<cpe-lang:platform·id="ocp4-on-sdn"> | ||
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 57 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_on_sdn:4"/> |
| 62 | ······</cpe-lang:logical-test> | ||
| 63 | ····</cpe-lang:platform> | ||
| 64 | ····<cpe-lang:platform·id="not_s390x_arch_and_ocp4-node"> | ||
| 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> | ||
| 58 | ········<cpe-lang:fact-ref·name="cpe:/ | 67 | ········<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 68 | ······</cpe-lang:logical-test> | ||
| 69 | ····</cpe-lang:platform> | ||
| 70 | ····<cpe-lang:platform·id="ocp4-node-on-sdn"> | ||
| 71 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 72 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_node_on_sdn:4"/> | ||
| 59 | ······</cpe-lang:logical-test> | 73 | ······</cpe-lang:logical-test> |
| 60 | ····</cpe-lang:platform> | 74 | ····</cpe-lang:platform> |
| 61 | ····<cpe-lang:platform·id="ocp4.10_or_ocp4.6_or_ocp4.7_or_ocp4.8_or_ocp4.9"> | 75 | ····<cpe-lang:platform·id="ocp4.10_or_ocp4.6_or_ocp4.7_or_ocp4.8_or_ocp4.9"> |
| 62 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> | 76 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 63 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> | 77 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> |
| 64 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 78 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 65 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 79 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> | 80 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 67 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> |
| 68 | ······</cpe-lang:logical-test> | 82 | ······</cpe-lang:logical-test> |
| 69 | ····</cpe-lang:platform> | 83 | ····</cpe-lang:platform> |
| 70 | ····<cpe-lang:platform·id="ocp4-node"> | 84 | ····<cpe-lang:platform·id="ocp4-node_and_s390x_arch"> |
| 71 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 72 | ········<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> | 86 | ········<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 87 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | ||
| 73 | ······</cpe-lang:logical-test> | 88 | ······</cpe-lang:logical-test> |
| 74 | ····</cpe-lang:platform> | 89 | ····</cpe-lang:platform> |
| 75 | ····<cpe-lang:platform·id="ocp4.11_or_ocp4.12"> | ||
| 76 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> | ||
| 77 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> | ||
| 78 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 79 | ······</cpe-lang:logical-test> | ||
| 80 | ····</cpe-lang:platform> | ||
| 81 | ····<cpe-lang:platform·id="ocp4 | 90 | ····<cpe-lang:platform·id="ocp4"> |
| 82 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 91 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 83 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 92 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.1"/> |
| 84 | ······</cpe-lang:logical-test> | 93 | ······</cpe-lang:logical-test> |
| 85 | ····</cpe-lang:platform> | 94 | ····</cpe-lang:platform> |
| 86 | ····<cpe-lang:platform·id="ocp4- | 95 | ····<cpe-lang:platform·id="ocp4-master-node"> |
| 87 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 96 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 88 | ········<cpe-lang:fact-ref·name="cpe:/a: | 97 | ········<cpe-lang:fact-ref·name="cpe:/a:ocp4-master-node"/> |
| 89 | ······</cpe-lang:logical-test> | 98 | ······</cpe-lang:logical-test> |
| 90 | ····</cpe-lang:platform> | 99 | ····</cpe-lang:platform> |
| 91 | ····<cpe-lang:platform·id="ocp4.6_or_ocp4.7_or_ocp4.8"> | 100 | ····<cpe-lang:platform·id="ocp4.6_or_ocp4.7_or_ocp4.8"> |
| 92 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> | 101 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 93 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 102 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 94 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 103 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 95 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> | 104 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 96 | ······</cpe-lang:logical-test> | 105 | ······</cpe-lang:logical-test> |
| 97 | ····</cpe-lang:platform> | 106 | ····</cpe-lang:platform> |
| 98 | ····<cpe-lang:platform·id="ocp4 | 107 | ····<cpe-lang:platform·id="ocp4-on-azure"> |
| 99 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 108 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 100 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 109 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform_on_azure:4"/> |
| 101 | ······</cpe-lang:logical-test> | 110 | ······</cpe-lang:logical-test> |
| 102 | ····</cpe-lang:platform> | 111 | ····</cpe-lang:platform> |
| 103 | ····<cpe-lang:platform·id="ocp4 | 112 | ····<cpe-lang:platform·id="ocp4.10_or_ocp4.11_or_ocp4.12_or_ocp4.9"> |
| 104 | ······<cpe-lang:logical-test·operator=" | 113 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 114 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> | ||
| 115 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> | ||
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 105 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 117 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> |
| 106 | ······</cpe-lang:logical-test> | 118 | ······</cpe-lang:logical-test> |
| 107 | ····</cpe-lang:platform> | 119 | ····</cpe-lang:platform> |
| 108 | ····<cpe-lang:platform·id="ocp4 | 120 | ····<cpe-lang:platform·id="ocp4.11_or_ocp4.12"> |
| 109 | ······<cpe-lang:logical-test·operator=" | 121 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 110 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform | 122 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.11"/> |
| 123 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.12"/> | ||
| 111 | ······</cpe-lang:logical-test> | 124 | ······</cpe-lang:logical-test> |
| 112 | ····</cpe-lang:platform> | 125 | ····</cpe-lang:platform> |
| 113 | ····<cpe-lang:platform·id="ocp4.6_or_ocp4.7"> | 126 | ····<cpe-lang:platform·id="ocp4.6_or_ocp4.7"> |
| 114 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> | 127 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 115 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> | 128 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.6"/> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> | 129 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.7"/> |
| 117 | ······</cpe-lang:logical-test> | 130 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 131 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id=" | 132 | ····<cpe-lang:platform·id="ocp4.10_or_ocp4.8_or_ocp4.9"> |
| 120 | ······<cpe-lang:logical-test·operator=" | 133 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:n | 134 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.10"/> |
| 122 | ········<cpe-lang:fact-ref·name="cpe:/ | 135 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.8"/> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.9"/> | ||
| 123 | ······</cpe-lang:logical-test> | 137 | ······</cpe-lang:logical-test> |
| 124 | ····</cpe-lang:platform> | 138 | ····</cpe-lang:platform> |
| 125 | ····<cpe-lang:platform·id="ocp4-node | 139 | ····<cpe-lang:platform·id="ocp4-node"> |
| 126 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 140 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 127 | ········<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> | 141 | ········<cpe-lang:fact-ref·name="cpe:/o:redhat:openshift_container_platform_node:4"/> |
| 128 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | ||
| 129 | ······</cpe-lang:logical-test> | ||
| 130 | ····</cpe-lang:platform> | ||
| 131 | ····<cpe-lang:platform·id="ocp4"> | ||
| 132 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 133 | ········<cpe-lang:fact-ref·name="cpe:/a:redhat:openshift_container_platform:4.1"/> | ||
| 134 | ······</cpe-lang:logical-test> | 142 | ······</cpe-lang:logical-test> |
| 135 | ····</cpe-lang:platform> | 143 | ····</cpe-lang:platform> |
| 136 | ····<cpe-lang:platform·id="ocp4-master-node"> | ||
| 137 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 138 | ········<cpe-lang:fact-ref·name="cpe:/a:ocp4-master-node"/> | ||
| 139 | ······</cpe-lang:logical-test> | ||
| 140 | ····</cpe-lang:platform> | ||
| 141 | ····<cpe-lang:platform·id="ocp4 | 144 | ····<cpe-lang:platform·id="ocp4.6"> |
| 142 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 145 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| Max diff block lines reached; 1381/10767 bytes (12.83%) of diff not shown. | |||
| Offset 104, 15 lines modified | Offset 104, 15 lines modified | ||
| 104 | ········<cpe-dict:title·xml:lang="en-us">openSUSE·Leap·42.3</cpe-dict:title> | 104 | ········<cpe-dict:title·xml:lang="en-us">openSUSE·Leap·42.3</cpe-dict:title> |
| 105 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-opensuse-cpe-oval.xml">oval:ssg-installed_OS_is_opensuse_leap42:def:1</cpe-dict:check> | 105 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-opensuse-cpe-oval.xml">oval:ssg-installed_OS_is_opensuse_leap42:def:1</cpe-dict:check> |
| 106 | ······</cpe-dict:cpe-item> | 106 | ······</cpe-dict:cpe-item> |
| 107 | ····</cpe-dict:cpe-list> | 107 | ····</cpe-dict:cpe-list> |
| 108 | ··</ds:component> | 108 | ··</ds:component> |
| 109 | ··<ds:component·id="scap_org.open-scap_comp_ssg-opensuse-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 109 | ··<ds:component·id="scap_org.open-scap_comp_ssg-opensuse-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 110 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OPENSUSE"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 110 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OPENSUSE"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 111 | ······<xccdf-1.2:status·date="202 | 111 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 112 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·openSUSE</xccdf-1.2:title> | 112 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·openSUSE</xccdf-1.2:title> |
| 113 | ······<xccdf-1.2:description> | 113 | ······<xccdf-1.2:description> |
| 114 | ········This·guide·presents·a·catalog·of·security-relevant | 114 | ········This·guide·presents·a·catalog·of·security-relevant |
| 115 | configuration·settings·for·openSUSE.·It·is·a·rendering·of | 115 | configuration·settings·for·openSUSE.·It·is·a·rendering·of |
| 116 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 116 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 117 | in·order·to·support·security·automation.··The·SCAP·content·is | 117 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 118 | is·available·in·the | 118 | is·available·in·the |
| Offset 155, 92 lines modified | Offset 155, 92 lines modified | ||
| 155 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 155 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 156 | ······</xccdf-1.2:front-matter> | 156 | ······</xccdf-1.2:front-matter> |
| 157 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 157 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 158 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 158 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 159 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 159 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 160 | respective·companies.</xccdf-1.2:rear-matter> | 160 | respective·companies.</xccdf-1.2:rear-matter> |
| 161 | ······<cpe-lang:platform-specification> | 161 | ······<cpe-lang:platform-specification> |
| 162 | ········<cpe-lang:platform·id=" | 162 | ········<cpe-lang:platform·id="login_defs"> |
| 163 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 163 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 164 | ············<cpe-lang:fact-ref·name="cpe:/a: | 164 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 165 | ··········</cpe-lang:logical-test> | 165 | ··········</cpe-lang:logical-test> |
| 166 | ········</cpe-lang:platform> | 166 | ········</cpe-lang:platform> |
| 167 | ········<cpe-lang:platform·id=" | 167 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 168 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 168 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 169 | ············<cpe-lang:fact-ref·name="cpe:/a: | 169 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 170 | ··········</cpe-lang:logical-test> | 170 | ··········</cpe-lang:logical-test> |
| 171 | ········</cpe-lang:platform> | 171 | ········</cpe-lang:platform> |
| 172 | ········<cpe-lang:platform·id=" | 172 | ········<cpe-lang:platform·id="machine"> |
| 173 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 173 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 174 | ············<cpe-lang:fact-ref·name="cpe:/a: | 174 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 175 | ··········</cpe-lang:logical-test> | 175 | ··········</cpe-lang:logical-test> |
| 176 | ········</cpe-lang:platform> | 176 | ········</cpe-lang:platform> |
| 177 | ········<cpe-lang:platform·id=" | 177 | ········<cpe-lang:platform·id="sudo"> |
| 178 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 178 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 179 | ············<cpe-lang:fact-ref·name="cpe:/a: | 179 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 180 | ··········</cpe-lang:logical-test> | 180 | ··········</cpe-lang:logical-test> |
| 181 | ········</cpe-lang:platform> | 181 | ········</cpe-lang:platform> |
| 182 | ········<cpe-lang:platform·id=" | 182 | ········<cpe-lang:platform·id="postfix"> |
| 183 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 183 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 184 | ············<cpe-lang:fact-ref·name="cpe:/a: | 184 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 185 | ··········</cpe-lang:logical-test> | 185 | ··········</cpe-lang:logical-test> |
| 186 | ········</cpe-lang:platform> | 186 | ········</cpe-lang:platform> |
| 187 | ········<cpe-lang:platform·id=" | 187 | ········<cpe-lang:platform·id="s390x_arch"> |
| 188 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 188 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 189 | ············<cpe-lang:fact-ref·name="cpe:/a: | 189 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 190 | ··········</cpe-lang:logical-test> | 190 | ··········</cpe-lang:logical-test> |
| 191 | ········</cpe-lang:platform> | 191 | ········</cpe-lang:platform> |
| 192 | ········<cpe-lang:platform·id="gdm"> | 192 | ········<cpe-lang:platform·id="gdm"> |
| 193 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 193 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 194 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 194 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 195 | ··········</cpe-lang:logical-test> | 195 | ··········</cpe-lang:logical-test> |
| 196 | ········</cpe-lang:platform> | 196 | ········</cpe-lang:platform> |
| 197 | ········<cpe-lang:platform·id="non-uefi"> | ||
| 198 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 199 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> | ||
| 200 | ··········</cpe-lang:logical-test> | ||
| 201 | ········</cpe-lang:platform> | ||
| 202 | ········<cpe-lang:platform·id="chrony"> | 197 | ········<cpe-lang:platform·id="chrony"> |
| 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 198 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 204 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | 199 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 205 | ··········</cpe-lang:logical-test> | 200 | ··········</cpe-lang:logical-test> |
| 206 | ········</cpe-lang:platform> | 201 | ········</cpe-lang:platform> |
| 207 | ········<cpe-lang:platform·id=" | 202 | ········<cpe-lang:platform·id="non-uefi"> |
| 208 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 209 | ············<cpe-lang:fact-ref·name="cpe:/a: | 204 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 210 | ··········</cpe-lang:logical-test> | 205 | ··········</cpe-lang:logical-test> |
| 211 | ········</cpe-lang:platform> | 206 | ········</cpe-lang:platform> |
| 212 | ········<cpe-lang:platform·id=" | 207 | ········<cpe-lang:platform·id="ntp"> |
| 213 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 208 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 214 | ············<cpe-lang:fact-ref·name="cpe:/a: | 209 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 215 | ··········</cpe-lang:logical-test> | 210 | ··········</cpe-lang:logical-test> |
| 216 | ········</cpe-lang:platform> | 211 | ········</cpe-lang:platform> |
| 217 | ········<cpe-lang:platform·id=" | 212 | ········<cpe-lang:platform·id="grub2"> |
| 218 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 213 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 219 | ············<cpe-lang:fact-ref·name="cpe:/a: | 214 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 220 | ··········</cpe-lang:logical-test> | 215 | ··········</cpe-lang:logical-test> |
| 221 | ········</cpe-lang:platform> | 216 | ········</cpe-lang:platform> |
| 222 | ········<cpe-lang:platform·id=" | 217 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 223 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 218 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 224 | ············<cpe-lang:fact-ref·name="cpe:/a: | 219 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 225 | ··········</cpe-lang:logical-test> | 220 | ··········</cpe-lang:logical-test> |
| 226 | ········</cpe-lang:platform> | 221 | ········</cpe-lang:platform> |
| 227 | ········<cpe-lang:platform·id="audit"> | 222 | ········<cpe-lang:platform·id="audit"> |
| 228 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 223 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 229 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 224 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 230 | ··········</cpe-lang:logical-test> | 225 | ··········</cpe-lang:logical-test> |
| 231 | ········</cpe-lang:platform> | 226 | ········</cpe-lang:platform> |
| 232 | ········<cpe-lang:platform·id=" | 227 | ········<cpe-lang:platform·id="pam"> |
| 233 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 228 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 234 | ············<cpe-lang:fact-ref·name="cpe:/a: | 229 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 235 | ··········</cpe-lang:logical-test> | 230 | ··········</cpe-lang:logical-test> |
| 236 | ········</cpe-lang:platform> | 231 | ········</cpe-lang:platform> |
| 237 | ········<cpe-lang:platform·id=" | 232 | ········<cpe-lang:platform·id="uefi"> |
| 238 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 233 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 239 | ············<cpe-lang:fact-ref·name="cpe:/a: | 234 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 235 | ··········</cpe-lang:logical-test> | ||
| 236 | ········</cpe-lang:platform> | ||
| 237 | ········<cpe-lang:platform·id="sssd"> | ||
| 238 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 239 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> | ||
| 240 | ··········</cpe-lang:logical-test> | 240 | ··········</cpe-lang:logical-test> |
| 241 | ········</cpe-lang:platform> | 241 | ········</cpe-lang:platform> |
| 242 | ······</cpe-lang:platform-specification> | 242 | ······</cpe-lang:platform-specification> |
| 243 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:15.0"/> | 243 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:15.0"/> |
| 244 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.1"/> | 244 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.1"/> |
| 245 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.2"/> | 245 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.2"/> |
| 246 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.3"/> | 246 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.3"/> |
| Offset 1880, 27 lines modified | Offset 1880, 14 lines modified | ||
| 1880 | in | 1880 | in |
| 1881 | ················<html:code>/etc/sudoers.d/</html:code> | 1881 | ················<html:code>/etc/sudoers.d/</html:code> |
| 1882 | ················. | 1882 | ················. |
| 1883 | ··············</xccdf-1.2:description> | 1883 | ··············</xccdf-1.2:description> |
| 1884 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 1884 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 1885 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 1885 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 1886 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 1886 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 1887 | ··············<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 1888 | ··lineinfile: | ||
| 1889 | ····path:·/etc/sudoers | ||
| 1890 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 1891 | ····line:·Defaults·noexec | ||
| 1892 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| Max diff block lines reached; 1049584/1057879 bytes (99.22%) of diff not shown. | |||
| Offset 104, 15 lines modified | Offset 104, 15 lines modified | ||
| 104 | ········<cpe-dict:title·xml:lang="en-us">openSUSE·Leap·42.3</cpe-dict:title> | 104 | ········<cpe-dict:title·xml:lang="en-us">openSUSE·Leap·42.3</cpe-dict:title> |
| 105 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-opensuse-cpe-oval.xml">oval:ssg-installed_OS_is_opensuse_leap42:def:1</cpe-dict:check> | 105 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-opensuse-cpe-oval.xml">oval:ssg-installed_OS_is_opensuse_leap42:def:1</cpe-dict:check> |
| 106 | ······</cpe-dict:cpe-item> | 106 | ······</cpe-dict:cpe-item> |
| 107 | ····</cpe-dict:cpe-list> | 107 | ····</cpe-dict:cpe-list> |
| 108 | ··</ds:component> | 108 | ··</ds:component> |
| 109 | ··<ds:component·id="scap_org.open-scap_comp_ssg-opensuse-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 109 | ··<ds:component·id="scap_org.open-scap_comp_ssg-opensuse-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 110 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OPENSUSE"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 110 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_OPENSUSE"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 111 | ······<xccdf-1.2:status·date="202 | 111 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 112 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·openSUSE</xccdf-1.2:title> | 112 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·openSUSE</xccdf-1.2:title> |
| 113 | ······<xccdf-1.2:description> | 113 | ······<xccdf-1.2:description> |
| 114 | ········This·guide·presents·a·catalog·of·security-relevant | 114 | ········This·guide·presents·a·catalog·of·security-relevant |
| 115 | configuration·settings·for·openSUSE.·It·is·a·rendering·of | 115 | configuration·settings·for·openSUSE.·It·is·a·rendering·of |
| 116 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 116 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 117 | in·order·to·support·security·automation.··The·SCAP·content·is | 117 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 118 | is·available·in·the | 118 | is·available·in·the |
| Offset 155, 92 lines modified | Offset 155, 92 lines modified | ||
| 155 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 155 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 156 | ······</xccdf-1.2:front-matter> | 156 | ······</xccdf-1.2:front-matter> |
| 157 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 157 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 158 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 158 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 159 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 159 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 160 | respective·companies.</xccdf-1.2:rear-matter> | 160 | respective·companies.</xccdf-1.2:rear-matter> |
| 161 | ······<cpe-lang:platform-specification> | 161 | ······<cpe-lang:platform-specification> |
| 162 | ········<cpe-lang:platform·id=" | 162 | ········<cpe-lang:platform·id="login_defs"> |
| 163 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 163 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 164 | ············<cpe-lang:fact-ref·name="cpe:/a: | 164 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 165 | ··········</cpe-lang:logical-test> | 165 | ··········</cpe-lang:logical-test> |
| 166 | ········</cpe-lang:platform> | 166 | ········</cpe-lang:platform> |
| 167 | ········<cpe-lang:platform·id=" | 167 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 168 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 168 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 169 | ············<cpe-lang:fact-ref·name="cpe:/a: | 169 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 170 | ··········</cpe-lang:logical-test> | 170 | ··········</cpe-lang:logical-test> |
| 171 | ········</cpe-lang:platform> | 171 | ········</cpe-lang:platform> |
| 172 | ········<cpe-lang:platform·id=" | 172 | ········<cpe-lang:platform·id="machine"> |
| 173 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 173 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 174 | ············<cpe-lang:fact-ref·name="cpe:/a: | 174 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 175 | ··········</cpe-lang:logical-test> | 175 | ··········</cpe-lang:logical-test> |
| 176 | ········</cpe-lang:platform> | 176 | ········</cpe-lang:platform> |
| 177 | ········<cpe-lang:platform·id=" | 177 | ········<cpe-lang:platform·id="sudo"> |
| 178 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 178 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 179 | ············<cpe-lang:fact-ref·name="cpe:/a: | 179 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 180 | ··········</cpe-lang:logical-test> | 180 | ··········</cpe-lang:logical-test> |
| 181 | ········</cpe-lang:platform> | 181 | ········</cpe-lang:platform> |
| 182 | ········<cpe-lang:platform·id=" | 182 | ········<cpe-lang:platform·id="postfix"> |
| 183 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 183 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 184 | ············<cpe-lang:fact-ref·name="cpe:/a: | 184 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 185 | ··········</cpe-lang:logical-test> | 185 | ··········</cpe-lang:logical-test> |
| 186 | ········</cpe-lang:platform> | 186 | ········</cpe-lang:platform> |
| 187 | ········<cpe-lang:platform·id=" | 187 | ········<cpe-lang:platform·id="s390x_arch"> |
| 188 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 188 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 189 | ············<cpe-lang:fact-ref·name="cpe:/a: | 189 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 190 | ··········</cpe-lang:logical-test> | 190 | ··········</cpe-lang:logical-test> |
| 191 | ········</cpe-lang:platform> | 191 | ········</cpe-lang:platform> |
| 192 | ········<cpe-lang:platform·id="gdm"> | 192 | ········<cpe-lang:platform·id="gdm"> |
| 193 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 193 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 194 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 194 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 195 | ··········</cpe-lang:logical-test> | 195 | ··········</cpe-lang:logical-test> |
| 196 | ········</cpe-lang:platform> | 196 | ········</cpe-lang:platform> |
| 197 | ········<cpe-lang:platform·id="non-uefi"> | ||
| 198 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 199 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> | ||
| 200 | ··········</cpe-lang:logical-test> | ||
| 201 | ········</cpe-lang:platform> | ||
| 202 | ········<cpe-lang:platform·id="chrony"> | 197 | ········<cpe-lang:platform·id="chrony"> |
| 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 198 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 204 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | 199 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 205 | ··········</cpe-lang:logical-test> | 200 | ··········</cpe-lang:logical-test> |
| 206 | ········</cpe-lang:platform> | 201 | ········</cpe-lang:platform> |
| 207 | ········<cpe-lang:platform·id=" | 202 | ········<cpe-lang:platform·id="non-uefi"> |
| 208 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 203 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 209 | ············<cpe-lang:fact-ref·name="cpe:/a: | 204 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 210 | ··········</cpe-lang:logical-test> | 205 | ··········</cpe-lang:logical-test> |
| 211 | ········</cpe-lang:platform> | 206 | ········</cpe-lang:platform> |
| 212 | ········<cpe-lang:platform·id=" | 207 | ········<cpe-lang:platform·id="ntp"> |
| 213 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 208 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 214 | ············<cpe-lang:fact-ref·name="cpe:/a: | 209 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 215 | ··········</cpe-lang:logical-test> | 210 | ··········</cpe-lang:logical-test> |
| 216 | ········</cpe-lang:platform> | 211 | ········</cpe-lang:platform> |
| 217 | ········<cpe-lang:platform·id=" | 212 | ········<cpe-lang:platform·id="grub2"> |
| 218 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 213 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 219 | ············<cpe-lang:fact-ref·name="cpe:/a: | 214 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 220 | ··········</cpe-lang:logical-test> | 215 | ··········</cpe-lang:logical-test> |
| 221 | ········</cpe-lang:platform> | 216 | ········</cpe-lang:platform> |
| 222 | ········<cpe-lang:platform·id=" | 217 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 223 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 218 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 224 | ············<cpe-lang:fact-ref·name="cpe:/a: | 219 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 225 | ··········</cpe-lang:logical-test> | 220 | ··········</cpe-lang:logical-test> |
| 226 | ········</cpe-lang:platform> | 221 | ········</cpe-lang:platform> |
| 227 | ········<cpe-lang:platform·id="audit"> | 222 | ········<cpe-lang:platform·id="audit"> |
| 228 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 223 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 229 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 224 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 230 | ··········</cpe-lang:logical-test> | 225 | ··········</cpe-lang:logical-test> |
| 231 | ········</cpe-lang:platform> | 226 | ········</cpe-lang:platform> |
| 232 | ········<cpe-lang:platform·id=" | 227 | ········<cpe-lang:platform·id="pam"> |
| 233 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 228 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 234 | ············<cpe-lang:fact-ref·name="cpe:/a: | 229 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 235 | ··········</cpe-lang:logical-test> | 230 | ··········</cpe-lang:logical-test> |
| 236 | ········</cpe-lang:platform> | 231 | ········</cpe-lang:platform> |
| 237 | ········<cpe-lang:platform·id=" | 232 | ········<cpe-lang:platform·id="uefi"> |
| 238 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 233 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 239 | ············<cpe-lang:fact-ref·name="cpe:/a: | 234 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 235 | ··········</cpe-lang:logical-test> | ||
| 236 | ········</cpe-lang:platform> | ||
| 237 | ········<cpe-lang:platform·id="sssd"> | ||
| 238 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 239 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> | ||
| 240 | ··········</cpe-lang:logical-test> | 240 | ··········</cpe-lang:logical-test> |
| 241 | ········</cpe-lang:platform> | 241 | ········</cpe-lang:platform> |
| 242 | ······</cpe-lang:platform-specification> | 242 | ······</cpe-lang:platform-specification> |
| 243 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:15.0"/> | 243 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:15.0"/> |
| 244 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.1"/> | 244 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.1"/> |
| 245 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.2"/> | 245 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.2"/> |
| 246 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.3"/> | 246 | ······<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.3"/> |
| Offset 1880, 27 lines modified | Offset 1880, 14 lines modified | ||
| 1880 | in | 1880 | in |
| 1881 | ················<html:code>/etc/sudoers.d/</html:code> | 1881 | ················<html:code>/etc/sudoers.d/</html:code> |
| 1882 | ················. | 1882 | ················. |
| 1883 | ··············</xccdf-1.2:description> | 1883 | ··············</xccdf-1.2:description> |
| 1884 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 1884 | ··············<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 1885 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 1885 | ··············<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 1886 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 1886 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 1887 | ··············<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 1888 | ··lineinfile: | ||
| 1889 | ····path:·/etc/sudoers | ||
| 1890 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 1891 | ····line:·Defaults·noexec | ||
| 1892 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| Max diff block lines reached; 1049584/1057879 bytes (99.22%) of diff not shown. | |||
| Offset 3, 1927 lines modified | Offset 3, 1927 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title> | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 12 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_ | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 14 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 15 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 16 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 17 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 18 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg- | 22 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>A | 23 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 24 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg- | 28 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 29 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 30 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg- | 31 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_warning_banner_ocil:questionnaire:1"> | ||
| 35 | ···· | 34 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> |
| 35 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> | ||
| 36 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg- | 37 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | 38 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 39 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> | 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> | 41 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 42 | ······<ocil:actions> | 42 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> | 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-s | 46 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 47 | ······<ocil:title> | 47 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 48 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg-s | 49 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg-package_syslogng_installed_ocil:questionnaire:1"> | ||
| 53 | ···· | 52 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 53 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> | ||
| 54 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 55 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 59 | ······<ocil:title>Disable·kernel·support·for·MISC·binaries</ocil:title> |
| 60 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 65 | ······<ocil:title>Configure·System·to·Forward·All·Mail·From·Postmaster·to·The·Root·Account</ocil:title> |
| 66 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 71 | ······<ocil:title>Remove·Rsh·Trust·Files</ocil:title> |
| 72 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 77 | ······<ocil:title>Verify·iptables·Enabled</ocil:title> |
| 78 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_ | 82 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"> |
| 83 | ······<ocil:title> | 83 | ······<ocil:title>Unmap·kernel·when·running·in·userspace·(aka·KAISER)</ocil:title> |
| 84 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_ | 85 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-sudo_remove_nopasswd_ocil:questionnaire:1"> | ||
| 89 | ···· | 88 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"> |
| 89 | ······<ocil:title>Verify·Group·Who·Owns·Backup·gshadow·File</ocil:title> | ||
| 90 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg- | 94 | ····<ocil:questionnaire·id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"> |
| 95 | ······<ocil:title> | 95 | ······<ocil:title>Configure·L1·Terminal·Fault·mitigations</ocil:title> |
| 96 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-grub2_l1tf_argument_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_ | 100 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 101 | ······<ocil:title>Ensure·auditd·Collects·File·Deletion·Events·by·User·-·renameat</ocil:title> |
| 102 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_ | 103 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg-chronyd_server_directive_ocil:questionnaire:1"> | ||
| 107 | ···· | 106 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1"> |
| 107 | ······<ocil:title>Verify·Permissions·on·Backup·group·File</ocil:title> | ||
| 108 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 109 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_group_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg- | 112 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1"> |
| 113 | ······<ocil:title> | 113 | ······<ocil:title>Verify·Permissions·on·SSH·Server·Public·*.pub·Key·Files</ocil:title> |
| 114 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 115 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_sshd_pub_key_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 118 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_seccomp_ocil:questionnaire:1"> |
| 119 | ······<ocil:title> | 119 | ······<ocil:title>Enable·seccomp·to·safely·compute·untrusted·bytecode</ocil:title> |
| 120 | ······<ocil:actions> | 120 | ······<ocil:actions> |
| 121 | ········<ocil:test_action_ref>ocil:ssg- | 121 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_seccomp_action:testaction:1</ocil:test_action_ref> |
| 122 | ······</ocil:actions> | 122 | ······</ocil:actions> |
| 123 | ····</ocil:questionnaire> | 123 | ····</ocil:questionnaire> |
| 124 | ····<ocil:questionnaire·id="ocil:ssg-grub2_systemd_debug-shell_argument_absent_ocil:questionnaire:1"> | ||
| Max diff block lines reached; 640406/652825 bytes (98.10%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_OPENSUSE"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_OPENSUSE"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·openSUSE</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·openSUSE</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·openSUSE.·It·is·a·rendering·of | 7 | configuration·settings·for·openSUSE.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 92 lines modified | Offset 47, 92 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 57 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 58 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 59 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 61 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 62 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 63 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 64 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 67 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 68 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 69 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 71 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 72 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 73 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 74 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 77 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 79 | ····<cpe-lang:platform·id="s390x_arch"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 82 | ······</cpe-lang:logical-test> | 82 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 83 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id="gdm"> | 84 | ····<cpe-lang:platform·id="gdm"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 87 | ······</cpe-lang:logical-test> | 87 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 88 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id="non-uefi"> | ||
| 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> | ||
| 92 | ······</cpe-lang:logical-test> | ||
| 93 | ····</cpe-lang:platform> | ||
| 94 | ····<cpe-lang:platform·id="chrony"> | 89 | ····<cpe-lang:platform·id="chrony"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | 91 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 97 | ······</cpe-lang:logical-test> | 92 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 93 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id=" | 94 | ····<cpe-lang:platform·id="non-uefi"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a: | 96 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 102 | ······</cpe-lang:logical-test> | 97 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 98 | ····</cpe-lang:platform> |
| 104 | ····<cpe-lang:platform·id=" | 99 | ····<cpe-lang:platform·id="ntp"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a: | 101 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 107 | ······</cpe-lang:logical-test> | 102 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 103 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id=" | 104 | ····<cpe-lang:platform·id="grub2"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a: | 106 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 112 | ······</cpe-lang:logical-test> | 107 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 108 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id=" | 109 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a: | 111 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 117 | ······</cpe-lang:logical-test> | 112 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 113 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id="audit"> | 114 | ····<cpe-lang:platform·id="audit"> |
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> | 116 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 122 | ······</cpe-lang:logical-test> | 117 | ······</cpe-lang:logical-test> |
| 123 | ····</cpe-lang:platform> | 118 | ····</cpe-lang:platform> |
| 124 | ····<cpe-lang:platform·id=" | 119 | ····<cpe-lang:platform·id="pam"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a: | 121 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 127 | ······</cpe-lang:logical-test> | 122 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 123 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 124 | ····<cpe-lang:platform·id="uefi"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 126 | ········<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 127 | ······</cpe-lang:logical-test> | ||
| 128 | ····</cpe-lang:platform> | ||
| 129 | ····<cpe-lang:platform·id="sssd"> | ||
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> | ||
| 132 | ······</cpe-lang:logical-test> | 132 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 133 | ····</cpe-lang:platform> |
| 134 | ··</cpe-lang:platform-specification> | 134 | ··</cpe-lang:platform-specification> |
| 135 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:15.0"/> | 135 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:15.0"/> |
| 136 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.1"/> | 136 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.1"/> |
| 137 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.2"/> | 137 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.2"/> |
| 138 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.3"/> | 138 | ··<xccdf-1.2:platform·idref="cpe:/o:opensuse:leap:42.3"/> |
| Offset 1772, 27 lines modified | Offset 1772, 14 lines modified | ||
| 1772 | in | 1772 | in |
| 1773 | ············<html:code>/etc/sudoers.d/</html:code> | 1773 | ············<html:code>/etc/sudoers.d/</html:code> |
| 1774 | ············. | 1774 | ············. |
| 1775 | ··········</xccdf-1.2:description> | 1775 | ··········</xccdf-1.2:description> |
| 1776 | ··········<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> | 1776 | ··········<xccdf-1.2:reference·href="http://www.ssi.gouv.fr/administration/bonnes-pratiques/">BP28(R58)</xccdf-1.2:reference> |
| 1777 | ··········<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands | 1777 | ··········<xccdf-1.2:rationale>Restricting·the·capability·of·sudo·allowed·commands·to·execute·sub-commands |
| 1778 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> | 1778 | prevents·users·from·running·programs·with·privileges·they·wouldn't·have·otherwise.</xccdf-1.2:rationale> |
| 1779 | ··········<xccdf-1.2:fix·system="urn:xccdf:fix:script:ansible"·id="sudo_add_noexec"·complexity="low"·disruption="low"·reboot="false"·strategy="restrict">-·name:·Ensure·noexec·is·enabled·in·/etc/sudoers | ||
| 1780 | ··lineinfile: | ||
| 1781 | ····path:·/etc/sudoers | ||
| 1782 | ····regexp:·^[\s]*Defaults.*\bnoexec\b.*$ | ||
| 1783 | ····line:·Defaults·noexec | ||
| 1784 | ····validate:·/usr/sbin/visudo·-cf·%s | ||
| 1785 | ··tags: | ||
| 1786 | ··-·high_severity | ||
| 1787 | ··-·low_complexity | ||
| 1788 | ··-·low_disruption | ||
| 1789 | ··-·no_reboot_needed | ||
| Max diff block lines reached; 360199/367815 bytes (97.93%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_RHCOS-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_RHCOS-4"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·Enterprise·Linux·CoreOS·4</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·Red·Hat·Enterprise·Linux·CoreOS·4</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·Red·Hat·Enterprise·Linux·CoreOS·4.·It·is·a·rendering·of | 7 | configuration·settings·for·Red·Hat·Enterprise·Linux·CoreOS·4.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 150 lines modified | Offset 47, 150 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 57 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-tmp"/> | ||
| 58 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 59 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 60 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 61 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 62 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 63 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 64 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 65 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 66 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 67 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 68 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 69 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 70 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 71 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 72 | ········<cpe-lang:logical-test·operator="OR"·negate="false"> | ||
| 73 | ··········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | ||
| 74 | ········ | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 75 | ········</cpe-lang:logical-test> | ||
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | ||
| 77 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 77 | ······</cpe-lang:logical-test> | ||
| 78 | ····</cpe-lang:platform> | ||
| 79 | ····<cpe-lang:platform·id="machine_and_partition-var-tmp"> | ||
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> | ||
| 82 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-var-tmp"/> | ||
| 82 | ······</cpe-lang:logical-test> | 83 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 84 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id="systemd"> | 85 | ····<cpe-lang:platform·id="systemd"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 86 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a:systemd"/> | 87 | ········<cpe-lang:fact-ref·name="cpe:/a:systemd"/> |
| 87 | ······</cpe-lang:logical-test> | 88 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 89 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id=" | 90 | ····<cpe-lang:platform·id="chrony_or_ntp"> |
| 90 | ······<cpe-lang:logical-test·operator=" | 91 | ······<cpe-lang:logical-test·operator="OR"·negate="false"> |
| 92 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | ||
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a: | 93 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 92 | ······</cpe-lang:logical-test> | 94 | ······</cpe-lang:logical-test> |
| 93 | ····</cpe-lang:platform> | 95 | ····</cpe-lang:platform> |
| 94 | ····<cpe-lang:platform·id=" | 96 | ····<cpe-lang:platform·id="s390x_arch"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 97 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a: | 98 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 97 | ······</cpe-lang:logical-test> | 99 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 100 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id=" | 101 | ····<cpe-lang:platform·id="gdm"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 102 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a: | 103 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 102 | ······</cpe-lang:logical-test> | 104 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 105 | ····</cpe-lang:platform> |
| 104 | ····<cpe-lang:platform·id=" | 106 | ····<cpe-lang:platform·id="wifi-iface"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 107 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a: | 108 | ········<cpe-lang:fact-ref·name="cpe:/a:wifi-iface"/> |
| 107 | ······</cpe-lang:logical-test> | 109 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 110 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id=" | 111 | ····<cpe-lang:platform·id="chrony"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 112 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a: | 113 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 112 | ······</cpe-lang:logical-test> | 114 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 115 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id="usbguard"> | 116 | ····<cpe-lang:platform·id="usbguard"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 117 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a:usbguard"/> | 118 | ········<cpe-lang:fact-ref·name="cpe:/a:usbguard"/> |
| 117 | ······</cpe-lang:logical-test> | 119 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 120 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id="gdm"> | ||
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | ||
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | ||
| 122 | ······</cpe-lang:logical-test> | ||
| 123 | ····</cpe-lang:platform> | ||
| 124 | ····<cpe-lang:platform·id="non-uefi"> | 121 | ····<cpe-lang:platform·id="non-uefi"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 122 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> | 123 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 127 | ······</cpe-lang:logical-test> | 124 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 125 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 126 | ····<cpe-lang:platform·id="ntp"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 127 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 128 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 132 | ······</cpe-lang:logical-test> | 129 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 130 | ····</cpe-lang:platform> |
| 134 | ····<cpe-lang:platform·id=" | 131 | ····<cpe-lang:platform·id="grub2"> |
| 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 132 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a: | 133 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 137 | ······</cpe-lang:logical-test> | 134 | ······</cpe-lang:logical-test> |
| 138 | ····</cpe-lang:platform> | 135 | ····</cpe-lang:platform> |
| 139 | ····<cpe-lang:platform·id=" | 136 | ····<cpe-lang:platform·id="krb5_server_older_than_1_17-18_and_krb5_workstation_older_than_1_17-18"> |
| 140 | ······<cpe-lang:logical-test·operator=" | 137 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 141 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> | ||
| 142 | ········<cpe-lang:fact-ref·name="cpe:/a:n | 138 | ········<cpe-lang:fact-ref·name="cpe:/a:krb5_server_older_than_1_17-18"/> |
| 139 | ········<cpe-lang:fact-ref·name="cpe:/a:krb5_workstation_older_than_1_17-18"/> | ||
| 143 | ······</cpe-lang:logical-test> | 140 | ······</cpe-lang:logical-test> |
| 144 | ····</cpe-lang:platform> | 141 | ····</cpe-lang:platform> |
| 145 | ····<cpe-lang:platform·id="s390x_arch"> | 142 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 146 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 143 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 147 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> | 144 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 148 | ······</cpe-lang:logical-test> | 145 | ······</cpe-lang:logical-test> |
| 149 | ····</cpe-lang:platform> | 146 | ····</cpe-lang:platform> |
| 150 | ····<cpe-lang:platform·id=" | 147 | ····<cpe-lang:platform·id="machine_and_partition-tmp"> |
| 151 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 148 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 152 | ········<cpe-lang:fact-ref·name="cpe:/a: | 149 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 150 | ········<cpe-lang:fact-ref·name="cpe:/a:partition-tmp"/> | ||
| 153 | ······</cpe-lang:logical-test> | 151 | ······</cpe-lang:logical-test> |
| Max diff block lines reached; 2855/10826 bytes (26.37%) of diff not shown. | |||
| Offset 96, 15 lines modified | Offset 96, 15 lines modified | ||
| 96 | ········<cpe-dict:title·xml:lang="en-us">UnionTech·OS·Server·20</cpe-dict:title> | 96 | ········<cpe-dict:title·xml:lang="en-us">UnionTech·OS·Server·20</cpe-dict:title> |
| 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-uos20-cpe-oval.xml">oval:ssg-installed_OS_is_uos20:def:1</cpe-dict:check> | 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-uos20-cpe-oval.xml">oval:ssg-installed_OS_is_uos20:def:1</cpe-dict:check> |
| 98 | ······</cpe-dict:cpe-item> | 98 | ······</cpe-dict:cpe-item> |
| 99 | ····</cpe-dict:cpe-list> | 99 | ····</cpe-dict:cpe-list> |
| 100 | ··</ds:component> | 100 | ··</ds:component> |
| 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-uos20-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-uos20-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_UOS-20"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_UOS-20"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 103 | ······<xccdf-1.2:status·date="202 | 103 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·UnionTech·OS·Server·20</xccdf-1.2:title> | 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·UnionTech·OS·Server·20</xccdf-1.2:title> |
| 105 | ······<xccdf-1.2:description> | 105 | ······<xccdf-1.2:description> |
| 106 | ········This·guide·presents·a·catalog·of·security-relevant | 106 | ········This·guide·presents·a·catalog·of·security-relevant |
| 107 | configuration·settings·for·UnionTech·OS·Server·20.·It·is·a·rendering·of | 107 | configuration·settings·for·UnionTech·OS·Server·20.·It·is·a·rendering·of |
| 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 109 | in·order·to·support·security·automation.··The·SCAP·content·is | 109 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 110 | is·available·in·the | 110 | is·available·in·the |
| Offset 147, 97 lines modified | Offset 147, 97 lines modified | ||
| 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 148 | ······</xccdf-1.2:front-matter> | 148 | ······</xccdf-1.2:front-matter> |
| 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 152 | respective·companies.</xccdf-1.2:rear-matter> | 152 | respective·companies.</xccdf-1.2:rear-matter> |
| 153 | ······<cpe-lang:platform-specification> | 153 | ······<cpe-lang:platform-specification> |
| 154 | ········<cpe-lang:platform·id=" | 154 | ········<cpe-lang:platform·id="login_defs"> |
| 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 156 | ············<cpe-lang:fact-ref·name="cpe:/a: | 156 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 157 | ··········</cpe-lang:logical-test> | 157 | ··········</cpe-lang:logical-test> |
| 158 | ········</cpe-lang:platform> | 158 | ········</cpe-lang:platform> |
| 159 | ········<cpe-lang:platform·id=" | 159 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 161 | ············<cpe-lang:fact-ref·name="cpe:/a: | 161 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 162 | ··········</cpe-lang:logical-test> | 162 | ··········</cpe-lang:logical-test> |
| 163 | ········</cpe-lang:platform> | 163 | ········</cpe-lang:platform> |
| 164 | ········<cpe-lang:platform·id=" | 164 | ········<cpe-lang:platform·id="machine"> |
| 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 166 | ············<cpe-lang:fact-ref·name="cpe:/a: | 166 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 167 | ··········</cpe-lang:logical-test> | 167 | ··········</cpe-lang:logical-test> |
| 168 | ········</cpe-lang:platform> | 168 | ········</cpe-lang:platform> |
| 169 | ········<cpe-lang:platform·id=" | 169 | ········<cpe-lang:platform·id="sudo"> |
| 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 171 | ············<cpe-lang:fact-ref·name="cpe:/a: | 171 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 172 | ··········</cpe-lang:logical-test> | 172 | ··········</cpe-lang:logical-test> |
| 173 | ········</cpe-lang:platform> | 173 | ········</cpe-lang:platform> |
| 174 | ········<cpe-lang:platform·id=" | 174 | ········<cpe-lang:platform·id="postfix"> |
| 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 176 | ············<cpe-lang:fact-ref·name="cpe:/a: | 176 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 177 | ··········</cpe-lang:logical-test> | 177 | ··········</cpe-lang:logical-test> |
| 178 | ········</cpe-lang:platform> | 178 | ········</cpe-lang:platform> |
| 179 | ········<cpe-lang:platform·id=" | 179 | ········<cpe-lang:platform·id="s390x_arch"> |
| 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 181 | ············<cpe-lang:fact-ref·name="cpe:/a: | 181 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 182 | ··········</cpe-lang:logical-test> | 182 | ··········</cpe-lang:logical-test> |
| 183 | ········</cpe-lang:platform> | 183 | ········</cpe-lang:platform> |
| 184 | ········<cpe-lang:platform·id="gdm"> | 184 | ········<cpe-lang:platform·id="gdm"> |
| 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 187 | ··········</cpe-lang:logical-test> | 187 | ··········</cpe-lang:logical-test> |
| 188 | ········</cpe-lang:platform> | 188 | ········</cpe-lang:platform> |
| 189 | ········<cpe-lang:platform·id=" | 189 | ········<cpe-lang:platform·id="chrony"> |
| 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 191 | ············<cpe-lang:fact-ref·name="cpe:/a: | 191 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 192 | ··········</cpe-lang:logical-test> | 192 | ··········</cpe-lang:logical-test> |
| 193 | ········</cpe-lang:platform> | 193 | ········</cpe-lang:platform> |
| 194 | ········<cpe-lang:platform·id=" | 194 | ········<cpe-lang:platform·id="non-uefi"> |
| 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a: | 196 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 197 | ··········</cpe-lang:logical-test> | 197 | ··········</cpe-lang:logical-test> |
| 198 | ········</cpe-lang:platform> | 198 | ········</cpe-lang:platform> |
| 199 | ········<cpe-lang:platform·id=" | 199 | ········<cpe-lang:platform·id="ntp"> |
| 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 201 | ············<cpe-lang:fact-ref·name="cpe:/a: | 201 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 202 | ··········</cpe-lang:logical-test> | 202 | ··········</cpe-lang:logical-test> |
| 203 | ········</cpe-lang:platform> | 203 | ········</cpe-lang:platform> |
| 204 | ········<cpe-lang:platform·id=" | 204 | ········<cpe-lang:platform·id="grub2"> |
| 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 206 | ············<cpe-lang:fact-ref·name="cpe:/a: | 206 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 207 | ··········</cpe-lang:logical-test> | 207 | ··········</cpe-lang:logical-test> |
| 208 | ········</cpe-lang:platform> | 208 | ········</cpe-lang:platform> |
| 209 | ········<cpe-lang:platform·id=" | 209 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 211 | ············<cpe-lang:fact-ref·name="cpe:/a: | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 212 | ··········</cpe-lang:logical-test> | 212 | ··········</cpe-lang:logical-test> |
| 213 | ········</cpe-lang:platform> | 213 | ········</cpe-lang:platform> |
| 214 | ········<cpe-lang:platform·id=" | 214 | ········<cpe-lang:platform·id="audit"> |
| 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 216 | ············<cpe-lang:fact-ref·name="cpe:/a: | 216 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 217 | ··········</cpe-lang:logical-test> | 217 | ··········</cpe-lang:logical-test> |
| 218 | ········</cpe-lang:platform> | 218 | ········</cpe-lang:platform> |
| 219 | ········<cpe-lang:platform·id=" | 219 | ········<cpe-lang:platform·id="pam"> |
| 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 221 | ············<cpe-lang:fact-ref·name="cpe:/a: | 221 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 222 | ··········</cpe-lang:logical-test> | 222 | ··········</cpe-lang:logical-test> |
| 223 | ········</cpe-lang:platform> | 223 | ········</cpe-lang:platform> |
| 224 | ········<cpe-lang:platform·id=" | 224 | ········<cpe-lang:platform·id="yum"> |
| 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a: | 226 | ············<cpe-lang:fact-ref·name="cpe:/a:yum"/> |
| 227 | ··········</cpe-lang:logical-test> | 227 | ··········</cpe-lang:logical-test> |
| 228 | ········</cpe-lang:platform> | 228 | ········</cpe-lang:platform> |
| 229 | ········<cpe-lang:platform·id=" | 229 | ········<cpe-lang:platform·id="uefi"> |
| 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 231 | ············<cpe-lang:fact-ref·name="cpe:/a: | 231 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 232 | ··········</cpe-lang:logical-test> | 232 | ··········</cpe-lang:logical-test> |
| 233 | ········</cpe-lang:platform> | 233 | ········</cpe-lang:platform> |
| 234 | ········<cpe-lang:platform·id=" | 234 | ········<cpe-lang:platform·id="sssd"> |
| 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 236 | ············<cpe-lang:fact-ref·name="cpe:/a: | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 237 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 238 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 239 | ······</cpe-lang:platform-specification> | 239 | ······</cpe-lang:platform-specification> |
| 240 | ······<xccdf-1.2:platform·idref="cpe:/o:uos:uniontech_os_server:20"/> | 240 | ······<xccdf-1.2:platform·idref="cpe:/o:uos:uniontech_os_server:20"/> |
| 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 242 | ······<xccdf-1.2:metadata> | 242 | ······<xccdf-1.2:metadata> |
| 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 1275, 14 lines modified | Offset 1275, 35 lines modified | ||
| 1275 | ················<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> | 1275 | ················<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> |
| 1276 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> | 1276 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> |
| 1277 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> | 1277 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> |
| 1278 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> | 1278 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> |
| 1279 | ················<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and | 1279 | ················<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and |
| 1280 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms | 1280 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms |
| 1281 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> | 1281 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> |
| 1282 | ················<xccdf-1.2:fix·system="urn:xccdf:fix:script:sh"·id="configure_crypto_policy"> | ||
| 1283 | ··················var_system_crypto_policy=' | ||
| 1284 | ··················<xccdf-1.2:sub·idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy"·use="legacy"/> | ||
| 1285 | ··················' | ||
| Max diff block lines reached; 1126968/1136668 bytes (99.15%) of diff not shown. | |||
| Offset 96, 15 lines modified | Offset 96, 15 lines modified | ||
| 96 | ········<cpe-dict:title·xml:lang="en-us">UnionTech·OS·Server·20</cpe-dict:title> | 96 | ········<cpe-dict:title·xml:lang="en-us">UnionTech·OS·Server·20</cpe-dict:title> |
| 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-uos20-cpe-oval.xml">oval:ssg-installed_OS_is_uos20:def:1</cpe-dict:check> | 97 | ········<cpe-dict:check·system="http://oval.mitre.org/XMLSchema/oval-definitions-5"·href="ssg-uos20-cpe-oval.xml">oval:ssg-installed_OS_is_uos20:def:1</cpe-dict:check> |
| 98 | ······</cpe-dict:cpe-item> | 98 | ······</cpe-dict:cpe-item> |
| 99 | ····</cpe-dict:cpe-list> | 99 | ····</cpe-dict:cpe-list> |
| 100 | ··</ds:component> | 100 | ··</ds:component> |
| 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-uos20-xccdf.xml"·timestamp="2022-12-20T09:54:05"> | 101 | ··<ds:component·id="scap_org.open-scap_comp_ssg-uos20-xccdf.xml"·timestamp="2022-12-20T09:54:05"> |
| 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_UOS-20"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 102 | ····<xccdf-1.2:Benchmark·id="xccdf_org.ssgproject.content_benchmark_UOS-20"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 103 | ······<xccdf-1.2:status·date="202 | 103 | ······<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·UnionTech·OS·Server·20</xccdf-1.2:title> | 104 | ······<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·UnionTech·OS·Server·20</xccdf-1.2:title> |
| 105 | ······<xccdf-1.2:description> | 105 | ······<xccdf-1.2:description> |
| 106 | ········This·guide·presents·a·catalog·of·security-relevant | 106 | ········This·guide·presents·a·catalog·of·security-relevant |
| 107 | configuration·settings·for·UnionTech·OS·Server·20.·It·is·a·rendering·of | 107 | configuration·settings·for·UnionTech·OS·Server·20.·It·is·a·rendering·of |
| 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 108 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 109 | in·order·to·support·security·automation.··The·SCAP·content·is | 109 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 110 | is·available·in·the | 110 | is·available·in·the |
| Offset 147, 97 lines modified | Offset 147, 97 lines modified | ||
| 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 147 | ········<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 148 | ······</xccdf-1.2:front-matter> | 148 | ······</xccdf-1.2:front-matter> |
| 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 149 | ······<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 150 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 151 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 152 | respective·companies.</xccdf-1.2:rear-matter> | 152 | respective·companies.</xccdf-1.2:rear-matter> |
| 153 | ······<cpe-lang:platform-specification> | 153 | ······<cpe-lang:platform-specification> |
| 154 | ········<cpe-lang:platform·id=" | 154 | ········<cpe-lang:platform·id="login_defs"> |
| 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 155 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 156 | ············<cpe-lang:fact-ref·name="cpe:/a: | 156 | ············<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 157 | ··········</cpe-lang:logical-test> | 157 | ··········</cpe-lang:logical-test> |
| 158 | ········</cpe-lang:platform> | 158 | ········</cpe-lang:platform> |
| 159 | ········<cpe-lang:platform·id=" | 159 | ········<cpe-lang:platform·id="aarch64_arch"> |
| 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 160 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 161 | ············<cpe-lang:fact-ref·name="cpe:/a: | 161 | ············<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 162 | ··········</cpe-lang:logical-test> | 162 | ··········</cpe-lang:logical-test> |
| 163 | ········</cpe-lang:platform> | 163 | ········</cpe-lang:platform> |
| 164 | ········<cpe-lang:platform·id=" | 164 | ········<cpe-lang:platform·id="machine"> |
| 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 165 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 166 | ············<cpe-lang:fact-ref·name="cpe:/a: | 166 | ············<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 167 | ··········</cpe-lang:logical-test> | 167 | ··········</cpe-lang:logical-test> |
| 168 | ········</cpe-lang:platform> | 168 | ········</cpe-lang:platform> |
| 169 | ········<cpe-lang:platform·id=" | 169 | ········<cpe-lang:platform·id="sudo"> |
| 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 170 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 171 | ············<cpe-lang:fact-ref·name="cpe:/a: | 171 | ············<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 172 | ··········</cpe-lang:logical-test> | 172 | ··········</cpe-lang:logical-test> |
| 173 | ········</cpe-lang:platform> | 173 | ········</cpe-lang:platform> |
| 174 | ········<cpe-lang:platform·id=" | 174 | ········<cpe-lang:platform·id="postfix"> |
| 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 175 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 176 | ············<cpe-lang:fact-ref·name="cpe:/a: | 176 | ············<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 177 | ··········</cpe-lang:logical-test> | 177 | ··········</cpe-lang:logical-test> |
| 178 | ········</cpe-lang:platform> | 178 | ········</cpe-lang:platform> |
| 179 | ········<cpe-lang:platform·id=" | 179 | ········<cpe-lang:platform·id="s390x_arch"> |
| 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 180 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 181 | ············<cpe-lang:fact-ref·name="cpe:/a: | 181 | ············<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 182 | ··········</cpe-lang:logical-test> | 182 | ··········</cpe-lang:logical-test> |
| 183 | ········</cpe-lang:platform> | 183 | ········</cpe-lang:platform> |
| 184 | ········<cpe-lang:platform·id="gdm"> | 184 | ········<cpe-lang:platform·id="gdm"> |
| 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 185 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 186 | ············<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 187 | ··········</cpe-lang:logical-test> | 187 | ··········</cpe-lang:logical-test> |
| 188 | ········</cpe-lang:platform> | 188 | ········</cpe-lang:platform> |
| 189 | ········<cpe-lang:platform·id=" | 189 | ········<cpe-lang:platform·id="chrony"> |
| 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 190 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 191 | ············<cpe-lang:fact-ref·name="cpe:/a: | 191 | ············<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 192 | ··········</cpe-lang:logical-test> | 192 | ··········</cpe-lang:logical-test> |
| 193 | ········</cpe-lang:platform> | 193 | ········</cpe-lang:platform> |
| 194 | ········<cpe-lang:platform·id=" | 194 | ········<cpe-lang:platform·id="non-uefi"> |
| 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 195 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 196 | ············<cpe-lang:fact-ref·name="cpe:/a: | 196 | ············<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 197 | ··········</cpe-lang:logical-test> | 197 | ··········</cpe-lang:logical-test> |
| 198 | ········</cpe-lang:platform> | 198 | ········</cpe-lang:platform> |
| 199 | ········<cpe-lang:platform·id=" | 199 | ········<cpe-lang:platform·id="ntp"> |
| 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 200 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 201 | ············<cpe-lang:fact-ref·name="cpe:/a: | 201 | ············<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 202 | ··········</cpe-lang:logical-test> | 202 | ··········</cpe-lang:logical-test> |
| 203 | ········</cpe-lang:platform> | 203 | ········</cpe-lang:platform> |
| 204 | ········<cpe-lang:platform·id=" | 204 | ········<cpe-lang:platform·id="grub2"> |
| 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 205 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 206 | ············<cpe-lang:fact-ref·name="cpe:/a: | 206 | ············<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 207 | ··········</cpe-lang:logical-test> | 207 | ··········</cpe-lang:logical-test> |
| 208 | ········</cpe-lang:platform> | 208 | ········</cpe-lang:platform> |
| 209 | ········<cpe-lang:platform·id=" | 209 | ········<cpe-lang:platform·id="not_s390x_arch"> |
| 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 210 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 211 | ············<cpe-lang:fact-ref·name="cpe:/a: | 211 | ············<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 212 | ··········</cpe-lang:logical-test> | 212 | ··········</cpe-lang:logical-test> |
| 213 | ········</cpe-lang:platform> | 213 | ········</cpe-lang:platform> |
| 214 | ········<cpe-lang:platform·id=" | 214 | ········<cpe-lang:platform·id="audit"> |
| 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 215 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 216 | ············<cpe-lang:fact-ref·name="cpe:/a: | 216 | ············<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 217 | ··········</cpe-lang:logical-test> | 217 | ··········</cpe-lang:logical-test> |
| 218 | ········</cpe-lang:platform> | 218 | ········</cpe-lang:platform> |
| 219 | ········<cpe-lang:platform·id=" | 219 | ········<cpe-lang:platform·id="pam"> |
| 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 220 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 221 | ············<cpe-lang:fact-ref·name="cpe:/a: | 221 | ············<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 222 | ··········</cpe-lang:logical-test> | 222 | ··········</cpe-lang:logical-test> |
| 223 | ········</cpe-lang:platform> | 223 | ········</cpe-lang:platform> |
| 224 | ········<cpe-lang:platform·id=" | 224 | ········<cpe-lang:platform·id="yum"> |
| 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 225 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 226 | ············<cpe-lang:fact-ref·name="cpe:/a: | 226 | ············<cpe-lang:fact-ref·name="cpe:/a:yum"/> |
| 227 | ··········</cpe-lang:logical-test> | 227 | ··········</cpe-lang:logical-test> |
| 228 | ········</cpe-lang:platform> | 228 | ········</cpe-lang:platform> |
| 229 | ········<cpe-lang:platform·id=" | 229 | ········<cpe-lang:platform·id="uefi"> |
| 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 230 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 231 | ············<cpe-lang:fact-ref·name="cpe:/a: | 231 | ············<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 232 | ··········</cpe-lang:logical-test> | 232 | ··········</cpe-lang:logical-test> |
| 233 | ········</cpe-lang:platform> | 233 | ········</cpe-lang:platform> |
| 234 | ········<cpe-lang:platform·id=" | 234 | ········<cpe-lang:platform·id="sssd"> |
| 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> | 235 | ··········<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 236 | ············<cpe-lang:fact-ref·name="cpe:/a: | 236 | ············<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 237 | ··········</cpe-lang:logical-test> | 237 | ··········</cpe-lang:logical-test> |
| 238 | ········</cpe-lang:platform> | 238 | ········</cpe-lang:platform> |
| 239 | ······</cpe-lang:platform-specification> | 239 | ······</cpe-lang:platform-specification> |
| 240 | ······<xccdf-1.2:platform·idref="cpe:/o:uos:uniontech_os_server:20"/> | 240 | ······<xccdf-1.2:platform·idref="cpe:/o:uos:uniontech_os_server:20"/> |
| 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 241 | ······<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 242 | ······<xccdf-1.2:metadata> | 242 | ······<xccdf-1.2:metadata> |
| 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 243 | ········<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 1275, 14 lines modified | Offset 1275, 35 lines modified | ||
| 1275 | ················<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> | 1275 | ················<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> |
| 1276 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> | 1276 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> |
| 1277 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> | 1277 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> |
| 1278 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> | 1278 | ················<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> |
| 1279 | ················<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and | 1279 | ················<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and |
| 1280 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms | 1280 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms |
| 1281 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> | 1281 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> |
| 1282 | ················<xccdf-1.2:fix·system="urn:xccdf:fix:script:sh"·id="configure_crypto_policy"> | ||
| 1283 | ··················var_system_crypto_policy=' | ||
| 1284 | ··················<xccdf-1.2:sub·idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy"·use="legacy"/> | ||
| 1285 | ··················' | ||
| Max diff block lines reached; 1126968/1136668 bytes (99.15%) of diff not shown. | |||
| Offset 3, 4005 lines modified | Offset 3, 4005 lines modified | ||
| 3 | ··<ocil:generator> | 3 | ··<ocil:generator> |
| 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> | 4 | ····<ocil:product_name>build_shorthand.py·from·SCAP·Security·Guide</ocil:product_name> |
| 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> | 5 | ····<ocil:product_version>ssg:·0.1.65</ocil:product_version> |
| 6 | ····<ocil:schema_version>2.0</ocil:schema_version> | 6 | ····<ocil:schema_version>2.0</ocil:schema_version> |
| 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> | 7 | ····<ocil:timestamp>2022-12-20T09:54:05</ocil:timestamp> |
| 8 | ··</ocil:generator> | 8 | ··</ocil:generator> |
| 9 | ··<ocil:questionnaires> | 9 | ··<ocil:questionnaires> |
| 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_ | 10 | ····<ocil:questionnaire·id="ocil:ssg-sshd_enable_pam_ocil:questionnaire:1"> |
| 11 | ······<ocil:title> | 11 | ······<ocil:title>Enable·PAM</ocil:title> |
| 12 | ······<ocil:actions> | 12 | ······<ocil:actions> |
| 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_ | 13 | ········<ocil:test_action_ref>ocil:ssg-sshd_enable_pam_action:testaction:1</ocil:test_action_ref> |
| 14 | ······</ocil:actions> | 14 | ······</ocil:actions> |
| 15 | ····</ocil:questionnaire> | 15 | ····</ocil:questionnaire> |
| 16 | ····<ocil:questionnaire·id="ocil:ssg-disallow_bypass_password_sudo_ocil:questionnaire:1"> | ||
| 17 | ···· | 16 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_ocil:questionnaire:1"> |
| 17 | ······<ocil:title>Configure·ARP·filtering·for·All·IPv4·Interfaces</ocil:title> | ||
| 18 | ······<ocil:actions> | 18 | ······<ocil:actions> |
| 19 | ········<ocil:test_action_ref>ocil:ssg- | 19 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv4_conf_all_arp_filter_action:testaction:1</ocil:test_action_ref> |
| 20 | ······</ocil:actions> | 20 | ······</ocil:actions> |
| 21 | ····</ocil:questionnaire> | 21 | ····</ocil:questionnaire> |
| 22 | ····<ocil:questionnaire·id="ocil:ssg-file_groupownership_audit_configuration_ocil:questionnaire:1"> | ||
| 23 | ···· | 22 | ····<ocil:questionnaire·id="ocil:ssg-service_abrtd_disabled_ocil:questionnaire:1"> |
| 23 | ······<ocil:title>Disable·Automatic·Bug·Reporting·Tool·(abrtd)</ocil:title> | ||
| 24 | ······<ocil:actions> | 24 | ······<ocil:actions> |
| 25 | ········<ocil:test_action_ref>ocil:ssg- | 25 | ········<ocil:test_action_ref>ocil:ssg-service_abrtd_disabled_action:testaction:1</ocil:test_action_ref> |
| 26 | ······</ocil:actions> | 26 | ······</ocil:actions> |
| 27 | ····</ocil:questionnaire> | 27 | ····</ocil:questionnaire> |
| 28 | ····<ocil:questionnaire·id="ocil:ssg-kernel_ | 28 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_retpoline_ocil:questionnaire:1"> |
| 29 | ······<ocil:title> | 29 | ······<ocil:title>Avoid·speculative·indirect·branches·in·kernel</ocil:title> |
| 30 | ······<ocil:actions> | 30 | ······<ocil:actions> |
| 31 | ········<ocil:test_action_ref>ocil:ssg-kernel_ | 31 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_retpoline_action:testaction:1</ocil:test_action_ref> |
| 32 | ······</ocil:actions> | 32 | ······</ocil:actions> |
| 33 | ····</ocil:questionnaire> | 33 | ····</ocil:questionnaire> |
| 34 | ····<ocil:questionnaire·id="ocil:ssg-s | 34 | ····<ocil:questionnaire·id="ocil:ssg-set_ipv6_loopback_traffic_ocil:questionnaire:1"> |
| 35 | ······<ocil:title> | 35 | ······<ocil:title>Set·configuration·for·IPv6·loopback·traffic</ocil:title> |
| 36 | ······<ocil:actions> | 36 | ······<ocil:actions> |
| 37 | ········<ocil:test_action_ref>ocil:ssg-s | 37 | ········<ocil:test_action_ref>ocil:ssg-set_ipv6_loopback_traffic_action:testaction:1</ocil:test_action_ref> |
| 38 | ······</ocil:actions> | ||
| 39 | ····</ocil:questionnaire> | ||
| 40 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_usergroup_modification_ocil:questionnaire:1"> | ||
| 41 | ······<ocil:title>Record·Events·that·Modify·User/Group·Information</ocil:title> | ||
| 42 | ······<ocil:actions> | ||
| 43 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_usergroup_modification_action:testaction:1</ocil:test_action_ref> | ||
| 38 | ······</ocil:actions> | 44 | ······</ocil:actions> |
| 39 | ····</ocil:questionnaire> | 45 | ····</ocil:questionnaire> |
| 40 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> | 46 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_bug_ocil:questionnaire:1"> |
| 41 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> | 47 | ······<ocil:title>Enable·support·for·BUG()</ocil:title> |
| 42 | ······<ocil:actions> | 48 | ······<ocil:actions> |
| 43 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> | 49 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_bug_action:testaction:1</ocil:test_action_ref> |
| 44 | ······</ocil:actions> | 50 | ······</ocil:actions> |
| 45 | ····</ocil:questionnaire> | 51 | ····</ocil:questionnaire> |
| 46 | ····<ocil:questionnaire·id="ocil:ssg-s | 52 | ····<ocil:questionnaire·id="ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_ocil:questionnaire:1"> |
| 47 | ······<ocil:title> | 53 | ······<ocil:title>Disable·IPv6·Addressing·on·All·IPv6·Interfaces</ocil:title> |
| 48 | ······<ocil:actions> | 54 | ······<ocil:actions> |
| 49 | ········<ocil:test_action_ref>ocil:ssg-s | 55 | ········<ocil:test_action_ref>ocil:ssg-sysctl_net_ipv6_conf_all_disable_ipv6_action:testaction:1</ocil:test_action_ref> |
| 50 | ······</ocil:actions> | 56 | ······</ocil:actions> |
| 51 | ····</ocil:questionnaire> | 57 | ····</ocil:questionnaire> |
| 52 | ····<ocil:questionnaire·id="ocil:ssg- | 58 | ····<ocil:questionnaire·id="ocil:ssg-configure_bind_crypto_policy_ocil:questionnaire:1"> |
| 53 | ······<ocil:title> | 59 | ······<ocil:title>Configure·BIND·to·use·System·Crypto·Policy</ocil:title> |
| 54 | ······<ocil:actions> | 60 | ······<ocil:actions> |
| 55 | ········<ocil:test_action_ref>ocil:ssg- | 61 | ········<ocil:test_action_ref>ocil:ssg-configure_bind_crypto_policy_action:testaction:1</ocil:test_action_ref> |
| 56 | ······</ocil:actions> | 62 | ······</ocil:actions> |
| 57 | ····</ocil:questionnaire> | 63 | ····</ocil:questionnaire> |
| 58 | ····<ocil:questionnaire·id="ocil:ssg- | 64 | ····<ocil:questionnaire·id="ocil:ssg-sshd_allow_only_protocol2_ocil:questionnaire:1"> |
| 59 | ······<ocil:title> | 65 | ······<ocil:title>Allow·Only·SSH·Protocol·2</ocil:title> |
| 60 | ······<ocil:actions> | 66 | ······<ocil:actions> |
| 61 | ········<ocil:test_action_ref>ocil:ssg- | 67 | ········<ocil:test_action_ref>ocil:ssg-sshd_allow_only_protocol2_action:testaction:1</ocil:test_action_ref> |
| 62 | ······</ocil:actions> | 68 | ······</ocil:actions> |
| 63 | ····</ocil:questionnaire> | 69 | ····</ocil:questionnaire> |
| 64 | ····<ocil:questionnaire·id="ocil:ssg- | 70 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_binfmt_misc_ocil:questionnaire:1"> |
| 65 | ······<ocil:title> | 71 | ······<ocil:title>Disable·kernel·support·for·MISC·binaries</ocil:title> |
| 66 | ······<ocil:actions> | 72 | ······<ocil:actions> |
| 67 | ········<ocil:test_action_ref>ocil:ssg- | 73 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_binfmt_misc_action:testaction:1</ocil:test_action_ref> |
| 68 | ······</ocil:actions> | 74 | ······</ocil:actions> |
| 69 | ····</ocil:questionnaire> | 75 | ····</ocil:questionnaire> |
| 70 | ····<ocil:questionnaire·id="ocil:ssg- | 76 | ····<ocil:questionnaire·id="ocil:ssg-postfix_client_configure_mail_alias_postmaster_ocil:questionnaire:1"> |
| 71 | ······<ocil:title> | 77 | ······<ocil:title>Configure·System·to·Forward·All·Mail·From·Postmaster·to·The·Root·Account</ocil:title> |
| 72 | ······<ocil:actions> | 78 | ······<ocil:actions> |
| 73 | ········<ocil:test_action_ref>ocil:ssg- | 79 | ········<ocil:test_action_ref>ocil:ssg-postfix_client_configure_mail_alias_postmaster_action:testaction:1</ocil:test_action_ref> |
| 74 | ······</ocil:actions> | 80 | ······</ocil:actions> |
| 75 | ····</ocil:questionnaire> | 81 | ····</ocil:questionnaire> |
| 76 | ····<ocil:questionnaire·id="ocil:ssg- | 82 | ····<ocil:questionnaire·id="ocil:ssg-no_rsh_trust_files_ocil:questionnaire:1"> |
| 77 | ······<ocil:title> | 83 | ······<ocil:title>Remove·Rsh·Trust·Files</ocil:title> |
| 78 | ······<ocil:actions> | 84 | ······<ocil:actions> |
| 79 | ········<ocil:test_action_ref>ocil:ssg- | 85 | ········<ocil:test_action_ref>ocil:ssg-no_rsh_trust_files_action:testaction:1</ocil:test_action_ref> |
| 80 | ······</ocil:actions> | 86 | ······</ocil:actions> |
| 81 | ····</ocil:questionnaire> | 87 | ····</ocil:questionnaire> |
| 82 | ····<ocil:questionnaire·id="ocil:ssg- | 88 | ····<ocil:questionnaire·id="ocil:ssg-service_iptables_enabled_ocil:questionnaire:1"> |
| 83 | ······<ocil:title>Verify· | 89 | ······<ocil:title>Verify·iptables·Enabled</ocil:title> |
| 84 | ······<ocil:actions> | 90 | ······<ocil:actions> |
| 85 | ········<ocil:test_action_ref>ocil:ssg- | 91 | ········<ocil:test_action_ref>ocil:ssg-service_iptables_enabled_action:testaction:1</ocil:test_action_ref> |
| 86 | ······</ocil:actions> | 92 | ······</ocil:actions> |
| 87 | ····</ocil:questionnaire> | 93 | ····</ocil:questionnaire> |
| 88 | ····<ocil:questionnaire·id="ocil:ssg-grub2_enable_iommu_force_ocil:questionnaire:1"> | ||
| 89 | ···· | 94 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_unmap_kernel_at_el0_ocil:questionnaire:1"> |
| 95 | ······<ocil:title>Unmap·kernel·when·running·in·userspace·(aka·KAISER)</ocil:title> | ||
| 90 | ······<ocil:actions> | 96 | ······<ocil:actions> |
| 91 | ········<ocil:test_action_ref>ocil:ssg- | 97 | ········<ocil:test_action_ref>ocil:ssg-kernel_config_unmap_kernel_at_el0_action:testaction:1</ocil:test_action_ref> |
| 92 | ······</ocil:actions> | 98 | ······</ocil:actions> |
| 93 | ····</ocil:questionnaire> | 99 | ····</ocil:questionnaire> |
| 94 | ····<ocil:questionnaire·id="ocil:ssg-kernel_config_x86_vsyscall_emulation_ocil:questionnaire:1"> | ||
| 95 | ···· | 100 | ····<ocil:questionnaire·id="ocil:ssg-file_groupowner_backup_etc_gshadow_ocil:questionnaire:1"> |
| 101 | ······<ocil:title>Verify·Group·Who·Owns·Backup·gshadow·File</ocil:title> | ||
| 96 | ······<ocil:actions> | 102 | ······<ocil:actions> |
| 97 | ········<ocil:test_action_ref>ocil:ssg- | 103 | ········<ocil:test_action_ref>ocil:ssg-file_groupowner_backup_etc_gshadow_action:testaction:1</ocil:test_action_ref> |
| 98 | ······</ocil:actions> | 104 | ······</ocil:actions> |
| 99 | ····</ocil:questionnaire> | 105 | ····</ocil:questionnaire> |
| 100 | ····<ocil:questionnaire·id="ocil:ssg- | 106 | ····<ocil:questionnaire·id="ocil:ssg-grub2_l1tf_argument_ocil:questionnaire:1"> |
| 101 | ······<ocil:title> | 107 | ······<ocil:title>Configure·L1·Terminal·Fault·mitigations</ocil:title> |
| 102 | ······<ocil:actions> | 108 | ······<ocil:actions> |
| 103 | ········<ocil:test_action_ref>ocil:ssg- | 109 | ········<ocil:test_action_ref>ocil:ssg-grub2_l1tf_argument_action:testaction:1</ocil:test_action_ref> |
| 104 | ······</ocil:actions> | 110 | ······</ocil:actions> |
| 105 | ····</ocil:questionnaire> | 111 | ····</ocil:questionnaire> |
| 106 | ····<ocil:questionnaire·id="ocil:ssg- | 112 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_file_deletion_events_renameat_ocil:questionnaire:1"> |
| 107 | ······<ocil:title> | 113 | ······<ocil:title>Ensure·auditd·Collects·File·Deletion·Events·by·User·-·renameat</ocil:title> |
| 108 | ······<ocil:actions> | 114 | ······<ocil:actions> |
| 109 | ········<ocil:test_action_ref>ocil:ssg- | 115 | ········<ocil:test_action_ref>ocil:ssg-audit_rules_file_deletion_events_renameat_action:testaction:1</ocil:test_action_ref> |
| 110 | ······</ocil:actions> | 116 | ······</ocil:actions> |
| 111 | ····</ocil:questionnaire> | 117 | ····</ocil:questionnaire> |
| 112 | ····<ocil:questionnaire·id="ocil:ssg-audit_rules_dac_modification_fchmod_ocil:questionnaire:1"> | ||
| 113 | ···· | 118 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_backup_etc_group_ocil:questionnaire:1"> |
| 119 | ······<ocil:title>Verify·Permissions·on·Backup·group·File</ocil:title> | ||
| 114 | ······<ocil:actions> | 120 | ······<ocil:actions> |
| 115 | ········<ocil:test_action_ref>ocil:ssg- | 121 | ········<ocil:test_action_ref>ocil:ssg-file_permissions_backup_etc_group_action:testaction:1</ocil:test_action_ref> |
| 116 | ······</ocil:actions> | 122 | ······</ocil:actions> |
| 117 | ····</ocil:questionnaire> | 123 | ····</ocil:questionnaire> |
| 118 | ····<ocil:questionnaire·id="ocil:ssg- | 124 | ····<ocil:questionnaire·id="ocil:ssg-file_permissions_sshd_pub_key_ocil:questionnaire:1"> |
| Max diff block lines reached; 700370/712388 bytes (98.31%) of diff not shown. | |||
| Offset 1, 10 lines modified | Offset 1, 10 lines modified | ||
| 1 | <?xml·version="1.0"·encoding="utf-8"?> | 1 | <?xml·version="1.0"·encoding="utf-8"?> |
| 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_UOS-20"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> | 2 | <xccdf-1.2:Benchmark·xmlns:cpe-lang="http://cpe.mitre.org/language/2.0"·xmlns:dc="http://purl.org/dc/elements/1.1/"·xmlns:html="http://www.w3.org/1999/xhtml"·xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2"·xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"·id="xccdf_org.ssgproject.content_benchmark_UOS-20"·xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.2·xccdf-1.2.4.xsd"·style="SCAP_1.2"·resolved="true"·xml:lang="en-US"> |
| 3 | ··<xccdf-1.2:status·date="202 | 3 | ··<xccdf-1.2:status·date="2025-02-23">draft</xccdf-1.2:status> |
| 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·UnionTech·OS·Server·20</xccdf-1.2:title> | 4 | ··<xccdf-1.2:title>Guide·to·the·Secure·Configuration·of·UnionTech·OS·Server·20</xccdf-1.2:title> |
| 5 | ··<xccdf-1.2:description> | 5 | ··<xccdf-1.2:description> |
| 6 | ····This·guide·presents·a·catalog·of·security-relevant | 6 | ····This·guide·presents·a·catalog·of·security-relevant |
| 7 | configuration·settings·for·UnionTech·OS·Server·20.·It·is·a·rendering·of | 7 | configuration·settings·for·UnionTech·OS·Server·20.·It·is·a·rendering·of |
| 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) | 8 | content·structured·in·the·eXtensible·Configuration·Checklist·Description·Format·(XCCDF) |
| 9 | in·order·to·support·security·automation.··The·SCAP·content·is | 9 | in·order·to·support·security·automation.··The·SCAP·content·is |
| 10 | is·available·in·the | 10 | is·available·in·the |
| Offset 47, 97 lines modified | Offset 47, 97 lines modified | ||
| 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> | 47 | ····<html:a·href="https://www.open-scap.org/security-policies/scap-security-guide">https://www.open-scap.org/security-policies/scap-security-guide</html:a> |
| 48 | ··</xccdf-1.2:front-matter> | 48 | ··</xccdf-1.2:front-matter> |
| 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered | 49 | ··<xccdf-1.2:rear-matter>Red·Hat·and·Red·Hat·Enterprise·Linux·are·either·registered |
| 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other | 50 | trademarks·or·trademarks·of·Red·Hat,·Inc.·in·the·United·States·and·other |
| 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their | 51 | countries.·All·other·names·are·registered·trademarks·or·trademarks·of·their |
| 52 | respective·companies.</xccdf-1.2:rear-matter> | 52 | respective·companies.</xccdf-1.2:rear-matter> |
| 53 | ··<cpe-lang:platform-specification> | 53 | ··<cpe-lang:platform-specification> |
| 54 | ····<cpe-lang:platform·id=" | 54 | ····<cpe-lang:platform·id="login_defs"> |
| 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 55 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 56 | ········<cpe-lang:fact-ref·name="cpe:/a: | 56 | ········<cpe-lang:fact-ref·name="cpe:/a:login_defs"/> |
| 57 | ······</cpe-lang:logical-test> | 57 | ······</cpe-lang:logical-test> |
| 58 | ····</cpe-lang:platform> | 58 | ····</cpe-lang:platform> |
| 59 | ····<cpe-lang:platform·id=" | 59 | ····<cpe-lang:platform·id="aarch64_arch"> |
| 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 60 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 61 | ········<cpe-lang:fact-ref·name="cpe:/a: | 61 | ········<cpe-lang:fact-ref·name="cpe:/a:aarch64_arch"/> |
| 62 | ······</cpe-lang:logical-test> | 62 | ······</cpe-lang:logical-test> |
| 63 | ····</cpe-lang:platform> | 63 | ····</cpe-lang:platform> |
| 64 | ····<cpe-lang:platform·id=" | 64 | ····<cpe-lang:platform·id="machine"> |
| 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 65 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 66 | ········<cpe-lang:fact-ref·name="cpe:/a: | 66 | ········<cpe-lang:fact-ref·name="cpe:/a:machine"/> |
| 67 | ······</cpe-lang:logical-test> | 67 | ······</cpe-lang:logical-test> |
| 68 | ····</cpe-lang:platform> | 68 | ····</cpe-lang:platform> |
| 69 | ····<cpe-lang:platform·id=" | 69 | ····<cpe-lang:platform·id="sudo"> |
| 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 70 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 71 | ········<cpe-lang:fact-ref·name="cpe:/a: | 71 | ········<cpe-lang:fact-ref·name="cpe:/a:sudo"/> |
| 72 | ······</cpe-lang:logical-test> | 72 | ······</cpe-lang:logical-test> |
| 73 | ····</cpe-lang:platform> | 73 | ····</cpe-lang:platform> |
| 74 | ····<cpe-lang:platform·id=" | 74 | ····<cpe-lang:platform·id="postfix"> |
| 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 75 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 76 | ········<cpe-lang:fact-ref·name="cpe:/a: | 76 | ········<cpe-lang:fact-ref·name="cpe:/a:postfix"/> |
| 77 | ······</cpe-lang:logical-test> | 77 | ······</cpe-lang:logical-test> |
| 78 | ····</cpe-lang:platform> | 78 | ····</cpe-lang:platform> |
| 79 | ····<cpe-lang:platform·id=" | 79 | ····<cpe-lang:platform·id="s390x_arch"> |
| 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 80 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 81 | ········<cpe-lang:fact-ref·name="cpe:/a: | 81 | ········<cpe-lang:fact-ref·name="cpe:/a:s390x_arch"/> |
| 82 | ······</cpe-lang:logical-test> | 82 | ······</cpe-lang:logical-test> |
| 83 | ····</cpe-lang:platform> | 83 | ····</cpe-lang:platform> |
| 84 | ····<cpe-lang:platform·id="gdm"> | 84 | ····<cpe-lang:platform·id="gdm"> |
| 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 85 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> | 86 | ········<cpe-lang:fact-ref·name="cpe:/a:gdm"/> |
| 87 | ······</cpe-lang:logical-test> | 87 | ······</cpe-lang:logical-test> |
| 88 | ····</cpe-lang:platform> | 88 | ····</cpe-lang:platform> |
| 89 | ····<cpe-lang:platform·id=" | 89 | ····<cpe-lang:platform·id="chrony"> |
| 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 90 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 91 | ········<cpe-lang:fact-ref·name="cpe:/a: | 91 | ········<cpe-lang:fact-ref·name="cpe:/a:chrony"/> |
| 92 | ······</cpe-lang:logical-test> | 92 | ······</cpe-lang:logical-test> |
| 93 | ····</cpe-lang:platform> | 93 | ····</cpe-lang:platform> |
| 94 | ····<cpe-lang:platform·id=" | 94 | ····<cpe-lang:platform·id="non-uefi"> |
| 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 95 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 96 | ········<cpe-lang:fact-ref·name="cpe:/a: | 96 | ········<cpe-lang:fact-ref·name="cpe:/a:non-uefi"/> |
| 97 | ······</cpe-lang:logical-test> | 97 | ······</cpe-lang:logical-test> |
| 98 | ····</cpe-lang:platform> | 98 | ····</cpe-lang:platform> |
| 99 | ····<cpe-lang:platform·id=" | 99 | ····<cpe-lang:platform·id="ntp"> |
| 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 100 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 101 | ········<cpe-lang:fact-ref·name="cpe:/a: | 101 | ········<cpe-lang:fact-ref·name="cpe:/a:ntp"/> |
| 102 | ······</cpe-lang:logical-test> | 102 | ······</cpe-lang:logical-test> |
| 103 | ····</cpe-lang:platform> | 103 | ····</cpe-lang:platform> |
| 104 | ····<cpe-lang:platform·id=" | 104 | ····<cpe-lang:platform·id="grub2"> |
| 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 105 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 106 | ········<cpe-lang:fact-ref·name="cpe:/a: | 106 | ········<cpe-lang:fact-ref·name="cpe:/a:grub2"/> |
| 107 | ······</cpe-lang:logical-test> | 107 | ······</cpe-lang:logical-test> |
| 108 | ····</cpe-lang:platform> | 108 | ····</cpe-lang:platform> |
| 109 | ····<cpe-lang:platform·id=" | 109 | ····<cpe-lang:platform·id="not_s390x_arch"> |
| 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 110 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 111 | ········<cpe-lang:fact-ref·name="cpe:/a: | 111 | ········<cpe-lang:fact-ref·name="cpe:/a:not_s390x_arch"/> |
| 112 | ······</cpe-lang:logical-test> | 112 | ······</cpe-lang:logical-test> |
| 113 | ····</cpe-lang:platform> | 113 | ····</cpe-lang:platform> |
| 114 | ····<cpe-lang:platform·id=" | 114 | ····<cpe-lang:platform·id="audit"> |
| 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 115 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 116 | ········<cpe-lang:fact-ref·name="cpe:/a: | 116 | ········<cpe-lang:fact-ref·name="cpe:/a:audit"/> |
| 117 | ······</cpe-lang:logical-test> | 117 | ······</cpe-lang:logical-test> |
| 118 | ····</cpe-lang:platform> | 118 | ····</cpe-lang:platform> |
| 119 | ····<cpe-lang:platform·id=" | 119 | ····<cpe-lang:platform·id="pam"> |
| 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 120 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 121 | ········<cpe-lang:fact-ref·name="cpe:/a: | 121 | ········<cpe-lang:fact-ref·name="cpe:/a:pam"/> |
| 122 | ······</cpe-lang:logical-test> | 122 | ······</cpe-lang:logical-test> |
| 123 | ····</cpe-lang:platform> | 123 | ····</cpe-lang:platform> |
| 124 | ····<cpe-lang:platform·id=" | 124 | ····<cpe-lang:platform·id="yum"> |
| 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 125 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 126 | ········<cpe-lang:fact-ref·name="cpe:/a: | 126 | ········<cpe-lang:fact-ref·name="cpe:/a:yum"/> |
| 127 | ······</cpe-lang:logical-test> | 127 | ······</cpe-lang:logical-test> |
| 128 | ····</cpe-lang:platform> | 128 | ····</cpe-lang:platform> |
| 129 | ····<cpe-lang:platform·id=" | 129 | ····<cpe-lang:platform·id="uefi"> |
| 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 130 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 131 | ········<cpe-lang:fact-ref·name="cpe:/a: | 131 | ········<cpe-lang:fact-ref·name="cpe:/a:uefi"/> |
| 132 | ······</cpe-lang:logical-test> | 132 | ······</cpe-lang:logical-test> |
| 133 | ····</cpe-lang:platform> | 133 | ····</cpe-lang:platform> |
| 134 | ····<cpe-lang:platform·id=" | 134 | ····<cpe-lang:platform·id="sssd"> |
| 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> | 135 | ······<cpe-lang:logical-test·operator="AND"·negate="false"> |
| 136 | ········<cpe-lang:fact-ref·name="cpe:/a: | 136 | ········<cpe-lang:fact-ref·name="cpe:/a:sssd"/> |
| 137 | ······</cpe-lang:logical-test> | 137 | ······</cpe-lang:logical-test> |
| 138 | ····</cpe-lang:platform> | 138 | ····</cpe-lang:platform> |
| 139 | ··</cpe-lang:platform-specification> | 139 | ··</cpe-lang:platform-specification> |
| 140 | ··<xccdf-1.2:platform·idref="cpe:/o:uos:uniontech_os_server:20"/> | 140 | ··<xccdf-1.2:platform·idref="cpe:/o:uos:uniontech_os_server:20"/> |
| 141 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> | 141 | ··<xccdf-1.2:version·update="https://github.com/ComplianceAsCode/content/releases/latest">0.1.65</xccdf-1.2:version> |
| 142 | ··<xccdf-1.2:metadata> | 142 | ··<xccdf-1.2:metadata> |
| 143 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> | 143 | ····<dc:publisher>SCAP·Security·Guide·Project</dc:publisher> |
| Offset 1175, 14 lines modified | Offset 1175, 35 lines modified | ||
| 1175 | ············<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> | 1175 | ············<xccdf-1.2:reference·href="https://www.niap-ccevs.org/Profile/PP.cfm">FCS_TLSC_EXT.1</xccdf-1.2:reference> |
| 1176 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> | 1176 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000396-GPOS-00176</xccdf-1.2:reference> |
| 1177 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> | 1177 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000393-GPOS-00173</xccdf-1.2:reference> |
| 1178 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> | 1178 | ············<xccdf-1.2:reference·href="https://public.cyber.mil/stigs/downloads/?_dl_facet_stigs=operating-systems%2Cgeneral-purpose-os">SRG-OS-000394-GPOS-00174</xccdf-1.2:reference> |
| 1179 | ············<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and | 1179 | ············<xccdf-1.2:rationale>Centralized·cryptographic·policies·simplify·applying·secure·ciphers·across·an·operating·system·and |
| 1180 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms | 1180 | the·applications·that·run·on·that·operating·system.·Use·of·weak·or·untested·encryption·algorithms |
| 1181 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> | 1181 | undermines·the·purposes·of·utilizing·encryption·to·protect·data.</xccdf-1.2:rationale> |
| 1182 | ············<xccdf-1.2:fix·system="urn:xccdf:fix:script:sh"·id="configure_crypto_policy"> | ||
| 1183 | ··············var_system_crypto_policy=' | ||
| 1184 | ··············<xccdf-1.2:sub·idref="xccdf_org.ssgproject.content_value_var_system_crypto_policy"·use="legacy"/> | ||
| 1185 | ··············' | ||
| 1186 | stderr_of_call=$(update-crypto-policies·--set·${var_system_crypto_policy}·2>&1·>·/dev/null) | ||
| 1187 | rc=$? | ||
| 1188 | if·test·"$rc"·=·127;·then | ||
| 1189 | » echo·"$stderr_of_call"·>&2 | ||
| Max diff block lines reached; 375703/384690 bytes (97.66%) of diff not shown. | |||