From 22f89f4b55ddab3308591205f053be13c6ad7cd1 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Fri, 6 Dec 2024 13:55:43 +0000 Subject: [PATCH] seperated mount opts tests Signed-off-by: Mark Bolwell --- section_1/cis_1.1/cis_1.1.2.1.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.1.2_4.yml | 66 --------------------------- section_1/cis_1.1/cis_1.1.2.1.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.1.4.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.2.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.2.2_4.yml | 66 --------------------------- section_1/cis_1.1/cis_1.1.2.2.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.2.4.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.3.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.3.2_4.yml | 58 ----------------------- section_1/cis_1.1/cis_1.1.2.3.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.4.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.4.2_3.yml | 58 ----------------------- section_1/cis_1.1/cis_1.1.2.4.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.5.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.5.2_4.yml | 66 --------------------------- section_1/cis_1.1/cis_1.1.2.5.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.5.4.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.6.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.6.2_4.yml | 66 --------------------------- section_1/cis_1.1/cis_1.1.2.6.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.6.4.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.7.2.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.7.2_4.yml | 66 --------------------------- section_1/cis_1.1/cis_1.1.2.7.3.yml | 46 +++++++++++++++++++ section_1/cis_1.1/cis_1.1.2.7.4.yml | 46 +++++++++++++++++++ 26 files changed, 874 insertions(+), 446 deletions(-) create mode 100644 section_1/cis_1.1/cis_1.1.2.1.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.1.2_4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.1.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.1.4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.2.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.2.2_4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.2.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.2.4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.3.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.3.2_4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.3.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.4.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.4.2_3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.4.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.5.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.5.2_4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.5.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.5.4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.6.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.6.2_4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.6.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.6.4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.7.2.yml delete mode 100644 section_1/cis_1.1/cis_1.1.2.7.2_4.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.7.3.yml create mode 100644 section_1/cis_1.1/cis_1.1.2.7.4.yml diff --git a/section_1/cis_1.1/cis_1.1.2.1.2.yml b/section_1/cis_1.1/cis_1.1.2.1.2.yml new file mode 100644 index 0000000..d2e29b8 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.1.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_1_2 }} +mount: + tmp_nodev_options: + title: 1.1.2.1.2 | Ensure nodev option set on /tmp partition + mountpoint: /tmp + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + tmp_nodev_fstab_options: + title: 1.1.2.1.2 | Ensure nodev option set on /tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/tmp.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.1.2_4.yml b/section_1/cis_1.1/cis_1.1.2.1.2_4.yml deleted file mode 100644 index 2fc3c42..0000000 --- a/section_1/cis_1.1/cis_1.1.2.1.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_1_1 }} -mount: - tmp_options: - title: | - 1.1.2.1.2 | Ensure nodev option set on /tmp partition - 1.1.2.1.3 | Ensure nosuid option set on /tmp partition - 1.1.2.1.4 | Ensure noexec option set on /tmp partition - mountpoint: /tmp - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_1_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_1_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_1_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.1.2 - - 1.1.2.1.3 - - 1.1.2.1.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - tmp_fstab_options: - title: | - 1.1.2.1.2 | Ensure nodev option set on /tmp partition - 1.1.2.1.3 | Ensure nosuid option set on /tmp partition - 1.1.2.1.4 | Ensure noexec option set on /tmp partition - exists: true - path: /etc/fstab - contents: - - '/\s\/tmp.*{{ if .Vars.ubtu24cis_rule_1_1_2_1_2 }}nodev{{ end }}/' - - '/\s\/tmp.*{{ if .Vars.ubtu24cis_rule_1_1_2_1_3 }}nosuid{{ end }}.*/' - - '/\s\/tmp.*{{ if .Vars.ubtu24cis_rule_1_1_2_1_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.1.2 - - 1.1.2.1.3 - - 1.1.2.1.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.1.3.yml b/section_1/cis_1.1/cis_1.1.2.1.3.yml new file mode 100644 index 0000000..ef481a8 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.1.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_1_3 }} +mount: + tmp_nosuid_options: + title: 1.1.2.1.3 | Ensure nosuid option set on /tmp partition + mountpoint: /tmp + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + tmp_nosuid_fstab_options: + title: 1.1.2.1.3 | Ensure nosuid option set on /tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/tmp.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.1.4.yml b/section_1/cis_1.1/cis_1.1.2.1.4.yml new file mode 100644 index 0000000..6a732d5 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.1.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_1_4 }} +mount: + tmp_noexec_options: + title: 1.1.2.1.4 | Ensure noexec option set on /tmp partition + mountpoint: /tmp + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + tmp_fstab_noexec_options: + title: 1.1.2.1.4 | Ensure noexec option set on /tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/tmp.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.2.yml b/section_1/cis_1.1/cis_1.1.2.2.2.yml new file mode 100644 index 0000000..4221a16 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.2.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_2_2 }} +mount: + dev_shm_nodev_options: + title: 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition + mountpoint: /dev/shm + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + dev_shm_nodev_fstab_options: + title: 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition + exists: true + path: /etc/fstab + contents: + - '/\s\/dev\/shm.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.2_4.yml b/section_1/cis_1.1/cis_1.1.2.2.2_4.yml deleted file mode 100644 index dd0fd21..0000000 --- a/section_1/cis_1.1/cis_1.1.2.2.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_2_1 }} -mount: - dev_shm_options: - title: | - 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition - 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition - 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition - mountpoint: /dev/shm - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_2_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_2_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_2_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.2.2 - - 1.1.2.2.3 - - 1.1.2.2.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - dev_shm_fstab_options: - title: | - 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition - 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition - 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition - exists: true - path: /etc/fstab - contents: - - '/\s\/dev\/shm.*{{ if .Vars.ubtu24cis_rule_1_1_2_2_2 }}nodev{{ end }}/' - - '/\s\/dev\/shm.*{{ if .Vars.ubtu24cis_rule_1_1_2_2_3 }}nosuid{{ end }}.*/' - - '/\s\/dev\/shm.*{{ if .Vars.ubtu24cis_rule_1_1_2_2_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.2.2 - - 1.1.2.2.3 - - 1.1.2.2.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.3.yml b/section_1/cis_1.1/cis_1.1.2.2.3.yml new file mode 100644 index 0000000..152251a --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.2.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_2_3 }} +mount: + dev_shm_nosuid_options: + title: 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition + mountpoint: /dev/shm + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + dev_shm_nosuid_fstab_options: + title: 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition + exists: true + path: /etc/fstab + contents: + - '/\s\/dev\/shm.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.4.yml b/section_1/cis_1.1/cis_1.1.2.2.4.yml new file mode 100644 index 0000000..2393f9d --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.2.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_2_4 }} +mount: + dev_shm_noexec_options: + title: 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition + mountpoint: /dev/shm + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + dev_shm_noexec_fstab_options: + title: 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition + exists: true + path: /etc/fstab + contents: + - '/\s\/dev\/shm.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.3.2.yml b/section_1/cis_1.1/cis_1.1.2.3.2.yml new file mode 100644 index 0000000..d313e08 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.3.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_3_2 }} +mount: + home_nodev_options: + title: 1.1.2.3.2 | Ensure nodev option set on /home partition + mountpoint: /home + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + home_nodev_fstab_options: + title: 1.1.2.3.2 | Ensure nodev option set on /home partition + exists: true + path: /etc/fstab + contents: + - '/\s\/home.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.3.2_4.yml b/section_1/cis_1.1/cis_1.1.2.3.2_4.yml deleted file mode 100644 index 8737809..0000000 --- a/section_1/cis_1.1/cis_1.1.2.3.2_4.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_3_1 }} -mount: - home_options: - title: | - 1.1.2.3.2 | Ensure nodev option set on /home partition - 1.1.2.3.3 | Ensure nosuid option set on /home partition - mountpoint: /home - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_3_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_3_3 }} - - nosuid - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.3.2 - - 1.1.2.3.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - home_fstab_options: - title: | - 1.1.2.3.2 | Ensure nodev option set on /home partition - 1.1.2.3.3 | Ensure nosuid option set on /home partition - exists: true - path: /etc/fstab - contents: - - '/\s\/home.*{{ if .Vars.ubtu24cis_rule_1_1_2_3_2 }}nodev{{ end }}/' - - '/\s\/home.*{{ if .Vars.ubtu24cis_rule_1_1_2_3_3 }}nosuid{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.3.2 - - 1.1.2.3.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.3.3.yml b/section_1/cis_1.1/cis_1.1.2.3.3.yml new file mode 100644 index 0000000..6183d16 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.3.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_3_3 }} +mount: + home_nosuid_options: + title: 1.1.2.3.3 | Ensure nosuid option set on /home partition + mountpoint: /home + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + home_nosuid_fstab_options: + title: 1.1.2.3.3 | Ensure nosuid option set on /home partition + exists: true + path: /etc/fstab + contents: + - '/\s\/home.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.4.2.yml b/section_1/cis_1.1/cis_1.1.2.4.2.yml new file mode 100644 index 0000000..8e44559 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.4.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_4_2 }} +mount: + var_nodev_options: + title: 1.1.2.4.2 | Ensure nodev option set on /var partition + mountpoint: '/var' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_fstab_nodev_options: + title: 1.1.2.4.2 | Ensure nodev option set on /var partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.4.2_3.yml b/section_1/cis_1.1/cis_1.1.2.4.2_3.yml deleted file mode 100644 index f5dd3cc..0000000 --- a/section_1/cis_1.1/cis_1.1.2.4.2_3.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_4_1 }} -mount: - var_options: - title: | - 1.1.2.4.2 | Ensure nodev option set on /var partition - 1.1.2.4.3 | Ensure nosuid option set on /var partition - mountpoint: '/var' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_4_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_4_3 }} - - nosuid - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.4.2 - - 1.1.2.4.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_fstab_options: - title: | - 1.1.2.4.2 | Ensure nodev option set on /var partition - 1.1.2.4.3 | Ensure nosuid option set on /var partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_4_2 }}nodev{{ end }}/' - - '/\s\/var\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_4_3 }}nosuid{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.4.2 - - 1.1.2.4.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.4.3.yml b/section_1/cis_1.1/cis_1.1.2.4.3.yml new file mode 100644 index 0000000..932409f --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.4.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_4_3 }} +mount: + var_nosuid_options: + title: 1.1.2.4.3 | Ensure nosuid option set on /var partition + mountpoint: '/var' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_nosuid_fstab_options: + title: 1.1.2.4.3 | Ensure nosuid option set on /var partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.2.yml b/section_1/cis_1.1/cis_1.1.2.5.2.yml new file mode 100644 index 0000000..5cc84e9 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.5.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_5_2 }} +mount: + var_tmp_nodev_options: + title: 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition + mountpoint: '/var/tmp' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_tmp_nodev_fstab_options: + title: 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/tmp\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.2_4.yml b/section_1/cis_1.1/cis_1.1.2.5.2_4.yml deleted file mode 100644 index 6067e7e..0000000 --- a/section_1/cis_1.1/cis_1.1.2.5.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_5_1 }} -mount: - var_tmp_options: - title: | - 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition - 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition - 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition - mountpoint: '/var/tmp' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_5_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_5_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_5_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.5.2 - - 1.1.2.5.3 - - 1.1.2.5.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_tmp_fstab_options: - title: | - 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition - 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition - 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\/tmp\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_5_2 }}nodev{{ end }}/' - - '/\s\/var\/tmp\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_5_3 }}nosuid{{ end }}.*/' - - '/\s\/var\/tmp\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_5_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.5.2 - - 1.1.2.5.3 - - 1.1.2.5.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.3.yml b/section_1/cis_1.1/cis_1.1.2.5.3.yml new file mode 100644 index 0000000..ab18019 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.5.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_5_3 }} +mount: + var_tmp_nosuid_options: + title: 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition + mountpoint: '/var/tmp' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_tmp_nosuid_fstab_options: + title: 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/tmp\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.4.yml b/section_1/cis_1.1/cis_1.1.2.5.4.yml new file mode 100644 index 0000000..0be9c83 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.5.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_5_4 }} +mount: + var_tmp_noexec_options: + title: 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition + mountpoint: '/var/tmp' + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_tmp_noexec_fstab_options: + title: 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/tmp\s.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.2.yml b/section_1/cis_1.1/cis_1.1.2.6.2.yml new file mode 100644 index 0000000..116ce3e --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.6.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_6_2 }} +mount: + var_log_nodev_options: + title: 1.1.2.6.2 | Ensure nodev option set on /var/log partition + mountpoint: '/var/log' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_nodev_fstab_options: + title: 1.1.2.6.2 | Ensure nodev option set on /var/log partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.2_4.yml b/section_1/cis_1.1/cis_1.1.2.6.2_4.yml deleted file mode 100644 index 1029cc8..0000000 --- a/section_1/cis_1.1/cis_1.1.2.6.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_6_1 }} -mount: - var_log_options: - title: | - 1.1.2.6.2 | Ensure nodev option set on /var/log partition - 1.1.2.6.3 | Ensure nosuid option set on /var/log partition - 1.1.2.6.4 | Ensure noexec option set on /var/log partition - mountpoint: '/var/log' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_6_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_6_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_6_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.6.2 - - 1.1.2.6.3 - - 1.1.2.6.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_log_fstab_options: - title: | - 1.1.2.6.2 | Ensure nodev option set on /var/log partition - 1.1.2.6.3 | Ensure nosuid option set on /var/log partition - 1.1.2.6.4 | Ensure noexec option set on /var/log partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\/log\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_6_2 }}nodev{{ end }}/' - - '/\s\/var\/log\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_6_3 }}nosuid{{ end }}.*/' - - '/\s\/var\/log\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_6_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.6.2 - - 1.1.2.6.3 - - 1.1.2.6.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.3.yml b/section_1/cis_1.1/cis_1.1.2.6.3.yml new file mode 100644 index 0000000..ef6453a --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.6.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_6_3 }} +mount: + var_log_nosuid_options: + title: 1.1.2.6.3 | Ensure nosuid option set on /var/log partition + mountpoint: '/var/log' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_nosuid_fstab_options: + title: 1.1.2.6.3 | Ensure nosuid option set on /var/log partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.4.yml b/section_1/cis_1.1/cis_1.1.2.6.4.yml new file mode 100644 index 0000000..c277444 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.6.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_6_1 }} +mount: + var_log_noexec_options: + title: 1.1.2.6.4 | Ensure noexec option set on /var/log partition + mountpoint: '/var/log' + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_noexec_fstab_options: + title: 1.1.2.6.4 | Ensure noexec option set on /var/log partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\s.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.2.yml b/section_1/cis_1.1/cis_1.1.2.7.2.yml new file mode 100644 index 0000000..f451476 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.7.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_7_2 }} +mount: + var_log_nodev_audit_options: + title: 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition + mountpoint: '/var/log/audit' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_audit_nodev_fstab_options: + title: 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\/audit\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.2_4.yml b/section_1/cis_1.1/cis_1.1.2.7.2_4.yml deleted file mode 100644 index 2bf61ca..0000000 --- a/section_1/cis_1.1/cis_1.1.2.7.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_7_1 }} -mount: - var_log_audit_options: - title: | - 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition - 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition - 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition - mountpoint: '/var/log/audit' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_7_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_7_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_7_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.7.2 - - 1.1.2.7.3 - - 1.1.2.7.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_log_audit_fstab_options: - title: | - 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition - 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition - 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\/log\/audit\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_7_2 }}nodev{{ end }}/' - - '/\s\/var\/log\/audit\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_7_3 }}nosuid{{ end }}.*/' - - '/\s\/var\/log\/audit\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_7_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.7.2 - - 1.1.2.7.3 - - 1.1.2.7.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.3.yml b/section_1/cis_1.1/cis_1.1.2.7.3.yml new file mode 100644 index 0000000..b8f6952 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.7.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_7_1 }} +mount: + var_log_audit_options: + title: 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition + mountpoint: '/var/log/audit' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_audit_nosuid_fstab_options: + title: 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\/audit\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.4.yml b/section_1/cis_1.1/cis_1.1.2.7.4.yml new file mode 100644 index 0000000..2ce6a31 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.7.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_7_4 }} +mount: + var_log_audit_noexec_options: + title: 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition + mountpoint: '/var/log/audit' + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_audit_noexec_fstab_options: + title: 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\/audit\s.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }}