diff --git a/README.md b/README.md index dedfd9d..32bfa9f 100644 --- a/README.md +++ b/README.md @@ -2,30 +2,29 @@ ## Overview -### Based on CIS Ubuntu Linux 24.04 LTS Benchmark v1.0.0 [Release](https://downloads.cisecurity.org/#/) +### Based on CIS Benchmark for Ubuntu 24.04 LTS Benchmark v1.0.0 -Set of configuration files and directories to run the first stages of CIS of Ubuntu 24.04 servers +[Centre For Internet Security] + +This repository is set of configuration files and directories to run the audit of the relevant benchmark of Ubuntu 24.04 servers This is configured in a directory structure level. -This could do with further testing but sections 1.x should be complete - -Goss is run based on the goss.yml file in the top level directory. This specifies the configuration. - ## variables -file: vars/cis.yml +file: vars/{benchmark_type}.yml Please refer to the file for all options and their meanings -CIS listed variable for every control/benchmark can be turned on/off or section +The listed variable for every control/benchmark can be turned on/off or section -- other controls -enable_selinux -run_heavy_tasks +- Other controls + - enable_selinux + - run_heavy_tasks -- bespoke options -If a site has specific options e.g. password complexity these can also be set. +- Bespoke options + + If a site has specific options e.g. password complexity these can also be set. ## Requirements @@ -39,101 +38,47 @@ If running as part of the ansible playbook, this will pull in the relevant branc - e.g. v1.0.0 will pull in branch benchmark-v1.0.0 Devel is normally the latest benchmark version, so maybe different from the version of benchmark you wish to test. -Details will show in the README as to the benchmark for the version it is written for. +Details will show in the README as part of the remedation as to the benchmark for the version it is written for. ## Usage -You must have [goss](https://github.com/goss-org/goss/) available to your host you would like to test. +Fot the latest information on audit and how it can be used please visit -- Run as root not sudo due to sudo and shared memory access - -Assuming you have already clone this repository you can run goss from where you wish. - -- full check - -```sh -# {{path to your goss binary}} --vars {{ path to the vars file }} -g {{path to your clone of this repo }}/goss.yml --validate - -``` - -example: - -```sh -# /usr/local/bin/goss --vars ../vars/cis.yml -g /home/bolly/rh8_cis_goss/goss.yml validate -......FF....FF................FF...F..FF.............F........................FSSSS.............FS.F.F.F.F.........FFFFF.... - -Failures/Skipped: - -Title: 1.6.1 Ensure core dumps are restricted (Automated)_sysctl -Command: suid_dumpable_2: exit-status: -Expected - : 1 -to equal - : 0 -Command: suid_dumpable_2: stdout: patterns not found: [fs.suid_dumpable = 0] - - -Title: 1.4.2 Ensure filesystem integrity is regularly checked (Automated) -Service: aidecheck: enabled: -Expected - : false -to equal - : true -Service: aidecheck: running: -Expected - : false -to equal - : true - -< ---------cut ------- > - -Title: 1.1.22 Ensure sticky bit is set on all world-writable directories -Command: version: exit-status: -Expected - : 0 -to equal - : 123 - -Total Duration: 5.102s -Count: 124, Failed: 21, Skipped: 5 - -``` - -- running a particular section of tests - -```sh -# /usr/local/bin/goss -g /home/bolly/rh8_cis_goss/section_1/cis_1.1/cis_1.1.22.yml validate -............ - -Total Duration: 0.033s -Count: 12, Failed: 0, Skipped: 0 - -``` - -- changing the output - -```sh -# /usr/local/bin/goss -g /home/bolly/rh8_cis_goss/section_1/cis_1.1/cis_1.1.22.yml validate -f documentation -Title: 1.1.20 Check for removeable media nodev -Command: floppy_nodev: exit-status: matches expectation: [0] -Command: floppy_nodev: stdout: matches expectation: [OK] -< -------cut ------- > -Title: 1.1.20 Check for removeable media noexec -Command: floppy_noexec: exit-status: matches expectation: [0] -Command: floppy_noexec: stdout: matches expectation: [OK] - - -Total Duration: 0.022s -Count: 12, Failed: 0, Skipped: 0 -``` +[Read the Docs - Audit] ## Extra settings Ability to add your own requirements is available in several sections -## further information +## Support -- [goss documentation](https://github.com/goss-org/goss/blob/master/README.md) -- [CIS standards](https://www.cisecurity.org) +[Discord Community Discussions] -## Feedback required +[Enterprise Support] + +[MindPoint Group] + +## Links and Further information + +- [Goss] + - [Goss documentation] +- [Centre For Internet Security] + + + +[benchmark-type]: CIS +[OS-VERSION]: Ubuntu2404 +[os-type]: Linux +[Centre For Internet Security]: https://www.cisecurity.org +[Read the Docs - Audit]: https://ansible-lockdown.readthedocs.io/en/latest/audit/getting-started-audit.html + +[goss documentation]: (https://github.com/goss-org/goss/blob/master/README.md) + +[Goss]: https://goss.rocks +[DISA STIG]: https://public.cyber.mil/stigs + +[MindPoint Group]: https://mindpointgroup.com/cybersecurity-consulting/automate/baseline-modernization#GH_LockdownReadMe +[Discord Community Discussions]: https://www.lockdownenterprise.com/discord +[Enterprise Support]: https://lockdownenterprise.com#GH_LockdownReadMe diff --git a/run_audit.sh b/run_audit.sh index 2e2ab29..6fedef3 100755 --- a/run_audit.sh +++ b/run_audit.sh @@ -17,13 +17,14 @@ # benchmark vars moved # December 2023 Added goss version and testing # April 2024 Updating of OS discovery to work for all supported OSs +# August 2024 Improve failure capture # Variables in upper case tend to be able to be adjusted # lower case variables are discovered or built from other variables # Goss benchmark variables (these should not need changing unless new release) BENCHMARK=CIS # Benchmark Name aligns to the audit -BENCHMARK_VER=2.0.0 +BENCHMARK_VER=1.0.0 BENCHMARK_OS=UBUNTU24 # Goss host Variables @@ -202,12 +203,13 @@ echo $AUDIT_BIN -g "$audit_content_dir/$AUDIT_FILE" --vars "$varfile_path" --vars-inline "$audit_json_vars" v $format_output > "$audit_out" # create screen output -if [ "$(grep -c $BENCHMARK "$audit_out")" != 0 ] || [ "$format" = junit ] || [ "$format" = tap ]; then +if [ "$(grep -c Count: "$audit_out")" -ge 1 ] || [ "$format" = junit ] || [ "$format" = tap ]; then eval $output_summary echo "Completed file can be found at $audit_out" echo "###############" echo "Audit Completed" echo "###############" else - echo -e "Fail: There were issues when running the audit please investigate $audit_out" + echo -e "Fail: There were issues when running the audit please investigate $audit_out"; + exit 1 fi diff --git a/section_1/cis_1.1/cis_1.1.1.7.yml b/section_1/cis_1.1/cis_1.1.1.7.yml index c1d5726..65a004d 100644 --- a/section_1/cis_1.1/cis_1.1.1.7.yml +++ b/section_1/cis_1.1/cis_1.1.1.7.yml @@ -1,7 +1,7 @@ --- {{ if .Vars.ubtu24cis_level_2 }} - {{ if not .Vars.ubtu24cis_squashfs_required }} + {{ if .Vars.ubtu24cis_squashfs_required }} {{ if .Vars.ubtu24cis_rule_1_1_1_7 }} file: squashfs_disabled: diff --git a/section_1/cis_1.1/cis_1.1.2.1.2.yml b/section_1/cis_1.1/cis_1.1.2.1.2.yml new file mode 100644 index 0000000..d2e29b8 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.1.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_1_2 }} +mount: + tmp_nodev_options: + title: 1.1.2.1.2 | Ensure nodev option set on /tmp partition + mountpoint: /tmp + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + tmp_nodev_fstab_options: + title: 1.1.2.1.2 | Ensure nodev option set on /tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/tmp.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.1.2_4.yml b/section_1/cis_1.1/cis_1.1.2.1.2_4.yml deleted file mode 100644 index 2fc3c42..0000000 --- a/section_1/cis_1.1/cis_1.1.2.1.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_1_1 }} -mount: - tmp_options: - title: | - 1.1.2.1.2 | Ensure nodev option set on /tmp partition - 1.1.2.1.3 | Ensure nosuid option set on /tmp partition - 1.1.2.1.4 | Ensure noexec option set on /tmp partition - mountpoint: /tmp - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_1_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_1_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_1_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.1.2 - - 1.1.2.1.3 - - 1.1.2.1.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - tmp_fstab_options: - title: | - 1.1.2.1.2 | Ensure nodev option set on /tmp partition - 1.1.2.1.3 | Ensure nosuid option set on /tmp partition - 1.1.2.1.4 | Ensure noexec option set on /tmp partition - exists: true - path: /etc/fstab - contents: - - '/\s\/tmp.*{{ if .Vars.ubtu24cis_rule_1_1_2_1_2 }}nodev{{ end }}/' - - '/\s\/tmp.*{{ if .Vars.ubtu24cis_rule_1_1_2_1_3 }}nosuid{{ end }}.*/' - - '/\s\/tmp.*{{ if .Vars.ubtu24cis_rule_1_1_2_1_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.1.2 - - 1.1.2.1.3 - - 1.1.2.1.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.1.3.yml b/section_1/cis_1.1/cis_1.1.2.1.3.yml new file mode 100644 index 0000000..ef481a8 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.1.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_1_3 }} +mount: + tmp_nosuid_options: + title: 1.1.2.1.3 | Ensure nosuid option set on /tmp partition + mountpoint: /tmp + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + tmp_nosuid_fstab_options: + title: 1.1.2.1.3 | Ensure nosuid option set on /tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/tmp.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.1.4.yml b/section_1/cis_1.1/cis_1.1.2.1.4.yml new file mode 100644 index 0000000..6a732d5 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.1.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_1_4 }} +mount: + tmp_noexec_options: + title: 1.1.2.1.4 | Ensure noexec option set on /tmp partition + mountpoint: /tmp + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + tmp_fstab_noexec_options: + title: 1.1.2.1.4 | Ensure noexec option set on /tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/tmp.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.1.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.2.yml b/section_1/cis_1.1/cis_1.1.2.2.2.yml new file mode 100644 index 0000000..4221a16 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.2.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_2_2 }} +mount: + dev_shm_nodev_options: + title: 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition + mountpoint: /dev/shm + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + dev_shm_nodev_fstab_options: + title: 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition + exists: true + path: /etc/fstab + contents: + - '/\s\/dev\/shm.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.2_4.yml b/section_1/cis_1.1/cis_1.1.2.2.2_4.yml deleted file mode 100644 index dd0fd21..0000000 --- a/section_1/cis_1.1/cis_1.1.2.2.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_2_1 }} -mount: - dev_shm_options: - title: | - 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition - 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition - 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition - mountpoint: /dev/shm - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_2_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_2_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_2_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.2.2 - - 1.1.2.2.3 - - 1.1.2.2.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - dev_shm_fstab_options: - title: | - 1.1.2.2.2 | Ensure nodev option set on /dev/shm partition - 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition - 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition - exists: true - path: /etc/fstab - contents: - - '/\s\/dev\/shm.*{{ if .Vars.ubtu24cis_rule_1_1_2_2_2 }}nodev{{ end }}/' - - '/\s\/dev\/shm.*{{ if .Vars.ubtu24cis_rule_1_1_2_2_3 }}nosuid{{ end }}.*/' - - '/\s\/dev\/shm.*{{ if .Vars.ubtu24cis_rule_1_1_2_2_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.2.2 - - 1.1.2.2.3 - - 1.1.2.2.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.3.yml b/section_1/cis_1.1/cis_1.1.2.2.3.yml new file mode 100644 index 0000000..152251a --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.2.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_2_3 }} +mount: + dev_shm_nosuid_options: + title: 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition + mountpoint: /dev/shm + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + dev_shm_nosuid_fstab_options: + title: 1.1.2.2.3 | Ensure nosuid option set on /dev/shm partition + exists: true + path: /etc/fstab + contents: + - '/\s\/dev\/shm.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.2.4.yml b/section_1/cis_1.1/cis_1.1.2.2.4.yml new file mode 100644 index 0000000..2393f9d --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.2.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_2_4 }} +mount: + dev_shm_noexec_options: + title: 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition + mountpoint: /dev/shm + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + dev_shm_noexec_fstab_options: + title: 1.1.2.2.4 | Ensure noexec option set on /dev/shm partition + exists: true + path: /etc/fstab + contents: + - '/\s\/dev\/shm.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.2.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.3.2.yml b/section_1/cis_1.1/cis_1.1.2.3.2.yml new file mode 100644 index 0000000..d313e08 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.3.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_3_2 }} +mount: + home_nodev_options: + title: 1.1.2.3.2 | Ensure nodev option set on /home partition + mountpoint: /home + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + home_nodev_fstab_options: + title: 1.1.2.3.2 | Ensure nodev option set on /home partition + exists: true + path: /etc/fstab + contents: + - '/\s\/home.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.3.2_4.yml b/section_1/cis_1.1/cis_1.1.2.3.2_4.yml deleted file mode 100644 index 8737809..0000000 --- a/section_1/cis_1.1/cis_1.1.2.3.2_4.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_3_1 }} -mount: - home_options: - title: | - 1.1.2.3.2 | Ensure nodev option set on /home partition - 1.1.2.3.3 | Ensure nosuid option set on /home partition - mountpoint: /home - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_3_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_3_3 }} - - nosuid - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.3.2 - - 1.1.2.3.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - home_fstab_options: - title: | - 1.1.2.3.2 | Ensure nodev option set on /home partition - 1.1.2.3.3 | Ensure nosuid option set on /home partition - exists: true - path: /etc/fstab - contents: - - '/\s\/home.*{{ if .Vars.ubtu24cis_rule_1_1_2_3_2 }}nodev{{ end }}/' - - '/\s\/home.*{{ if .Vars.ubtu24cis_rule_1_1_2_3_3 }}nosuid{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.3.2 - - 1.1.2.3.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.3.3.yml b/section_1/cis_1.1/cis_1.1.2.3.3.yml new file mode 100644 index 0000000..6183d16 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.3.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_3_3 }} +mount: + home_nosuid_options: + title: 1.1.2.3.3 | Ensure nosuid option set on /home partition + mountpoint: /home + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + home_nosuid_fstab_options: + title: 1.1.2.3.3 | Ensure nosuid option set on /home partition + exists: true + path: /etc/fstab + contents: + - '/\s\/home.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.3.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.4.2.yml b/section_1/cis_1.1/cis_1.1.2.4.2.yml new file mode 100644 index 0000000..8e44559 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.4.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_4_2 }} +mount: + var_nodev_options: + title: 1.1.2.4.2 | Ensure nodev option set on /var partition + mountpoint: '/var' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_fstab_nodev_options: + title: 1.1.2.4.2 | Ensure nodev option set on /var partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.4.2_3.yml b/section_1/cis_1.1/cis_1.1.2.4.2_3.yml deleted file mode 100644 index f5dd3cc..0000000 --- a/section_1/cis_1.1/cis_1.1.2.4.2_3.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_4_1 }} -mount: - var_options: - title: | - 1.1.2.4.2 | Ensure nodev option set on /var partition - 1.1.2.4.3 | Ensure nosuid option set on /var partition - mountpoint: '/var' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_4_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_4_3 }} - - nosuid - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.4.2 - - 1.1.2.4.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_fstab_options: - title: | - 1.1.2.4.2 | Ensure nodev option set on /var partition - 1.1.2.4.3 | Ensure nosuid option set on /var partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_4_2 }}nodev{{ end }}/' - - '/\s\/var\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_4_3 }}nosuid{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.4.2 - - 1.1.2.4.3 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.4.3.yml b/section_1/cis_1.1/cis_1.1.2.4.3.yml new file mode 100644 index 0000000..932409f --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.4.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_4_3 }} +mount: + var_nosuid_options: + title: 1.1.2.4.3 | Ensure nosuid option set on /var partition + mountpoint: '/var' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_nosuid_fstab_options: + title: 1.1.2.4.3 | Ensure nosuid option set on /var partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.4.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.2.yml b/section_1/cis_1.1/cis_1.1.2.5.2.yml new file mode 100644 index 0000000..3d02481 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.5.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_5_2 }} +mount: + var_tmp_nodev_options: + title: 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition + mountpoint: '/var/tmp' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_tmp_nodev_fstab_options: + title: 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/tmp\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.2_4.yml b/section_1/cis_1.1/cis_1.1.2.5.2_4.yml deleted file mode 100644 index 6067e7e..0000000 --- a/section_1/cis_1.1/cis_1.1.2.5.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_5_1 }} -mount: - var_tmp_options: - title: | - 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition - 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition - 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition - mountpoint: '/var/tmp' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_5_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_5_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_5_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.5.2 - - 1.1.2.5.3 - - 1.1.2.5.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_tmp_fstab_options: - title: | - 1.1.2.5.2 | Ensure nodev option set on /var/tmp partition - 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition - 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\/tmp\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_5_2 }}nodev{{ end }}/' - - '/\s\/var\/tmp\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_5_3 }}nosuid{{ end }}.*/' - - '/\s\/var\/tmp\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_5_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.5.2 - - 1.1.2.5.3 - - 1.1.2.5.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.3.yml b/section_1/cis_1.1/cis_1.1.2.5.3.yml new file mode 100644 index 0000000..ab18019 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.5.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_5_3 }} +mount: + var_tmp_nosuid_options: + title: 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition + mountpoint: '/var/tmp' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_tmp_nosuid_fstab_options: + title: 1.1.2.5.3 | Ensure nosuid option set on /var/tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/tmp\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.5.4.yml b/section_1/cis_1.1/cis_1.1.2.5.4.yml new file mode 100644 index 0000000..0be9c83 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.5.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_5_4 }} +mount: + var_tmp_noexec_options: + title: 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition + mountpoint: '/var/tmp' + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_tmp_noexec_fstab_options: + title: 1.1.2.5.4 | Ensure noexec option set on /var/tmp partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/tmp\s.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.5.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.2.yml b/section_1/cis_1.1/cis_1.1.2.6.2.yml new file mode 100644 index 0000000..116ce3e --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.6.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_6_2 }} +mount: + var_log_nodev_options: + title: 1.1.2.6.2 | Ensure nodev option set on /var/log partition + mountpoint: '/var/log' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_nodev_fstab_options: + title: 1.1.2.6.2 | Ensure nodev option set on /var/log partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.2_4.yml b/section_1/cis_1.1/cis_1.1.2.6.2_4.yml deleted file mode 100644 index 1029cc8..0000000 --- a/section_1/cis_1.1/cis_1.1.2.6.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_6_1 }} -mount: - var_log_options: - title: | - 1.1.2.6.2 | Ensure nodev option set on /var/log partition - 1.1.2.6.3 | Ensure nosuid option set on /var/log partition - 1.1.2.6.4 | Ensure noexec option set on /var/log partition - mountpoint: '/var/log' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_6_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_6_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_6_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.6.2 - - 1.1.2.6.3 - - 1.1.2.6.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_log_fstab_options: - title: | - 1.1.2.6.2 | Ensure nodev option set on /var/log partition - 1.1.2.6.3 | Ensure nosuid option set on /var/log partition - 1.1.2.6.4 | Ensure noexec option set on /var/log partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\/log\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_6_2 }}nodev{{ end }}/' - - '/\s\/var\/log\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_6_3 }}nosuid{{ end }}.*/' - - '/\s\/var\/log\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_6_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.6.2 - - 1.1.2.6.3 - - 1.1.2.6.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.3.yml b/section_1/cis_1.1/cis_1.1.2.6.3.yml new file mode 100644 index 0000000..ef6453a --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.6.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_6_3 }} +mount: + var_log_nosuid_options: + title: 1.1.2.6.3 | Ensure nosuid option set on /var/log partition + mountpoint: '/var/log' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_nosuid_fstab_options: + title: 1.1.2.6.3 | Ensure nosuid option set on /var/log partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.6.4.yml b/section_1/cis_1.1/cis_1.1.2.6.4.yml new file mode 100644 index 0000000..c277444 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.6.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_6_1 }} +mount: + var_log_noexec_options: + title: 1.1.2.6.4 | Ensure noexec option set on /var/log partition + mountpoint: '/var/log' + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_noexec_fstab_options: + title: 1.1.2.6.4 | Ensure noexec option set on /var/log partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\s.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.6.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.2.yml b/section_1/cis_1.1/cis_1.1.2.7.2.yml new file mode 100644 index 0000000..f451476 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.7.2.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_7_2 }} +mount: + var_log_nodev_audit_options: + title: 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition + mountpoint: '/var/log/audit' + exists: true + opts: + - nodev + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_audit_nodev_fstab_options: + title: 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\/audit\s.*nodev/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.2 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.2_4.yml b/section_1/cis_1.1/cis_1.1.2.7.2_4.yml deleted file mode 100644 index 2bf61ca..0000000 --- a/section_1/cis_1.1/cis_1.1.2.7.2_4.yml +++ /dev/null @@ -1,66 +0,0 @@ ---- - -{{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_1_1_2_7_1 }} -mount: - var_log_audit_options: - title: | - 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition - 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition - 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition - mountpoint: '/var/log/audit' - exists: true - opts: - {{ if .Vars.ubtu24cis_rule_1_1_2_7_2 }} - - nodev - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_7_3 }} - - nosuid - {{ end }} - {{ if .Vars.ubtu24cis_rule_1_1_2_7_4 }} - - noexec - {{ end }} - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.7.2 - - 1.1.2.7.3 - - 1.1.2.7.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 -file: - var_log_audit_fstab_options: - title: | - 1.1.2.7.2 | Ensure nodev option set on /var/log/audit partition - 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition - 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition - exists: true - path: /etc/fstab - contents: - - '/\s\/var\/log\/audit\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_7_2 }}nodev{{ end }}/' - - '/\s\/var\/log\/audit\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_7_3 }}nosuid{{ end }}.*/' - - '/\s\/var\/log\/audit\s.*{{ if .Vars.ubtu24cis_rule_1_1_2_7_4 }}noexec{{ end }}.*/' - meta: - server: 1 - workstation: 1 - CIS_ID: - - 1.1.2.7.2 - - 1.1.2.7.3 - - 1.1.2.7.4 - CISv8: 3.3 - CISv8_IG1: true - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - CM-7 - - AC-3 - - MP-2 - {{ end }} -{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.3.yml b/section_1/cis_1.1/cis_1.1.2.7.3.yml new file mode 100644 index 0000000..b8f6952 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.7.3.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_7_1 }} +mount: + var_log_audit_options: + title: 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition + mountpoint: '/var/log/audit' + exists: true + opts: + - nosuid + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_audit_nosuid_fstab_options: + title: 1.1.2.7.3 | Ensure nosuid option set on /var/log/audit partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\/audit\s.*nosuid.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.3 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.1/cis_1.1.2.7.4.yml b/section_1/cis_1.1/cis_1.1.2.7.4.yml new file mode 100644 index 0000000..2ce6a31 --- /dev/null +++ b/section_1/cis_1.1/cis_1.1.2.7.4.yml @@ -0,0 +1,46 @@ +--- + +{{ if .Vars.ubtu24cis_level_1 }} + {{ if .Vars.ubtu24cis_rule_1_1_2_7_4 }} +mount: + var_log_audit_noexec_options: + title: 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition + mountpoint: '/var/log/audit' + exists: true + opts: + - noexec + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 +file: + var_log_audit_noexec_fstab_options: + title: 1.1.2.7.4 | Ensure noexec option set on /var/log/audit partition + exists: true + path: /etc/fstab + contents: + - '/\s\/var\/log\/audit\s.*noexec.*/' + meta: + server: 1 + workstation: 1 + CIS_ID: + - 1.1.2.7.4 + CISv8: 3.3 + CISv8_IG1: true + CISv8_IG2: true + CISv8_IG3: true + NIST800-53R5: + - CM-7 + - AC-3 + - MP-2 + {{ end }} +{{ end }} diff --git a/section_1/cis_1.5/cis_1.5.2.yml b/section_1/cis_1.5/cis_1.5.2.yml index 7f80d99..60f49f0 100644 --- a/section_1/cis_1.5/cis_1.5.2.yml +++ b/section_1/cis_1.5/cis_1.5.2.yml @@ -10,7 +10,7 @@ kernel-param: server: 1 workstation: 1 CIS_ID: - - 1.5.1 + - 1.5.2 CISv8: 10.5 CISv8_IG1: false CISv8_IG2: true @@ -18,7 +18,7 @@ kernel-param: NIST800-53R5: CM-6 command: ptrace_restrict_2: - title: 1.5.1 | Ensure ptrace_scope is restricted | sysctl_configured + title: 1.5.2 | Ensure ptrace_scope is restricted | sysctl_configured exit-status: or: - 0 @@ -30,7 +30,7 @@ command: server: 1 workstation: 1 CIS_ID: - - 1.5.1 + - 1.5.2 CISv8: 10.5 CISv8_IG1: false CISv8_IG2: true diff --git a/section_2/cis_2.3/cis_2.3.1.1.yml b/section_2/cis_2.3/cis_2.3.1.1.yml index 6b91037..e359200 100644 --- a/section_2/cis_2.3/cis_2.3.1.1.yml +++ b/section_2/cis_2.3/cis_2.3.1.1.yml @@ -49,27 +49,6 @@ package: NIST800-53R5: - AU-3 - AU-12 - {{ end }} - {{ if ne .Vars.ubtu24cis_time_sync_tool "systemd-timesyncd" }} -file: - timesync_masked: - title: 2.3.1.1 | Ensure time synchronization is in use | systemd-timesyncd masked - path: /etc/systemd/system/systemd-timesyncd.service - filetype: symlink - linked-to: /dev/null - exists: true - meta: - server: 1 - workstation: 1 - CIS_ID: 2.3.1.1 - CISv8: - - 8.4 - CISv8_IG1: false - CISv8_IG2: true - CISv8_IG3: true - NIST800-53R5: - - AU-3 - - AU-12 {{ end }} {{ end }} {{ end }} diff --git a/section_2/cis_2.3/cis_2.3.2.1.yml b/section_2/cis_2.3/cis_2.3.2.1.yml index 5b3cdae..578bcda 100644 --- a/section_2/cis_2.3/cis_2.3.2.1.yml +++ b/section_2/cis_2.3/cis_2.3.2.1.yml @@ -9,7 +9,7 @@ file: path: /etc/systemd/timesyncd.conf.d/50-timesyncd.conf exists: true contents: - - '/^NTP={{ .Vars.ubtu24cis_time_pool_name }}/' + - '/^NTP={{- range .Vars.ubtu24cis_time_pool }}{{ .name }}{{ end }}/' - '/^FallbackNTP={{- range .Vars.ubtu24cis_time_servers }}{{ .name }} {{ end }}/' meta: server: 1 diff --git a/section_2/cis_2.3/cis_2.3.3.2.yml b/section_2/cis_2.3/cis_2.3.3.2.yml index 143e150..cfc2a77 100644 --- a/section_2/cis_2.3/cis_2.3.3.2.yml +++ b/section_2/cis_2.3/cis_2.3.3.2.yml @@ -2,7 +2,7 @@ {{ if eq .Vars.ubtu24cis_time_sync_tool "chrony" }} {{ if .Vars.ubtu24cis_level_1 }} - {{ if .Vars.ubtu24cis_rule_2_1_2_2 }} + {{ if .Vars.ubtu24cis_rule_2_3_3_2 }} file: chrony_user: title: 2.3.3.2 | Ensure chrony is running as user _chrony diff --git a/section_3/cis_3.3/cis_3.3.6.yml b/section_3/cis_3.3/cis_3.3.6.yml index 5aab92d..32f1797 100644 --- a/section_3/cis_3.3/cis_3.3.6.yml +++ b/section_3/cis_3.3/cis_3.3.6.yml @@ -27,7 +27,7 @@ kernel-param: server: 1 workstation: 1 CIS_ID: - - 3.2.6 + - 3.3.6 CISv8: - 4.8 CISv8_IG1: false diff --git a/section_3/cis_3.3/cis_3.3.8.yml b/section_3/cis_3.3/cis_3.3.8.yml index 00e023a..1eda7f5 100644 --- a/section_3/cis_3.3/cis_3.3.8.yml +++ b/section_3/cis_3.3/cis_3.3.8.yml @@ -8,7 +8,7 @@ kernel-param: server: 1 workstation: 1 CIS_ID: - - 3.3.1 + - 3.3.8 CISv8: - 4.8 CISv8_IG1: false diff --git a/section_5/cis_5.1/cis_5.1.13.yml b/section_5/cis_5.1/cis_5.1.13.yml index 75bceb9..dce020b 100644 --- a/section_5/cis_5.1/cis_5.1.13.yml +++ b/section_5/cis_5.1/cis_5.1.13.yml @@ -4,7 +4,7 @@ {{ if .Vars.ubtu24cis_rule_5_1_13 }} file: ssh_logingrace: - title: 5.1.21 | Ensure sshd LoginGraceTime is configured + title: 5.1.13 | Ensure sshd LoginGraceTime is configured path: /etc/ssh/sshd_config exists: true contents: diff --git a/section_5/cis_5.1/cis_5.1.2.yml b/section_5/cis_5.1/cis_5.1.2.yml index 7f3fdc1..832692e 100644 --- a/section_5/cis_5.1/cis_5.1.2.yml +++ b/section_5/cis_5.1/cis_5.1.2.yml @@ -12,7 +12,7 @@ command: server: 1 workstation: 1 CIS_ID: - - 5.1.3 + - 5.1.2 CISv8: - 3.3 CISv8_IG1: true diff --git a/section_5/cis_5.3.3.2/cis_5.3.3.2.8.yml b/section_5/cis_5.3.3.2/cis_5.3.3.2.8.yml index 884f297..f14b83c 100644 --- a/section_5/cis_5.3.3.2/cis_5.3.3.2.8.yml +++ b/section_5/cis_5.3.3.2/cis_5.3.3.2.8.yml @@ -17,7 +17,7 @@ command: server: 1 workstation: 1 CIS_ID: - - 5.3.3.2.7 + - 5.3.3.2.8 CISv8: - 5.2 CISv8_IG1: true diff --git a/section_6/cis_6.1.1.x/cis_6.1.1.2.yml b/section_6/cis_6.1.1.x/cis_6.1.1.2.yml index ba4ebe3..9fa10ac 100644 --- a/section_6/cis_6.1.1.x/cis_6.1.1.2.yml +++ b/section_6/cis_6.1.1.x/cis_6.1.1.2.yml @@ -4,7 +4,7 @@ {{ if .Vars.ubtu24cis_rule_6_1_1_2 }} command: /etc/tmpfiles.d/systemd.conf: - title: 6.2.1.1.2 | Ensure journald log file access is configured | Manual Check Required + title: 6.1.1.2 | Ensure journald log file access is configured | Manual Check Required exec: echo "Manual - Please check journald default permissions" exit-status: 0 stdout: diff --git a/section_6/cis_6.1.2.x/cis_6.1.2.1.2.yml b/section_6/cis_6.1.2.x/cis_6.1.2.1.2.yml index 2a4e8ea..e88dbb5 100644 --- a/section_6/cis_6.1.2.x/cis_6.1.2.1.2.yml +++ b/section_6/cis_6.1.2.x/cis_6.1.2.1.2.yml @@ -10,9 +10,9 @@ file: exists: true contents: - '/^URL=/' - - '/ServerKeyFile=.*.pem' - - '/ServerCertificateFile=.*.pem' - - '/TrustedCertificateFile=.*.pem' + - '/ServerKeyFile=.*.pem/' + - '/ServerCertificateFile=.*.pem/' + - '/TrustedCertificateFile=.*.pem/' meta: server: 1 workstation: 1 diff --git a/section_6/cis_6.2.3/cis_6.2.3.14.yml b/section_6/cis_6.2.3/cis_6.2.3.14.yml index 3553544..a4a47c1 100644 --- a/section_6/cis_6.2.3/cis_6.2.3.14.yml +++ b/section_6/cis_6.2.3/cis_6.2.3.14.yml @@ -25,7 +25,7 @@ command: - AU-3 - CM-6 auditd_MAC_live: - title: 6.2.6 | Ensure events that modify the system's Mandatory Access Controls are collected | Live + title: 6.2.3.14 | Ensure events that modify the system's Mandatory Access Controls are collected | Live exec: auditctl -l | grep MAC-policy exit-status: 0 stdout: diff --git a/section_6/cis_6.2.3/cis_6.2.3.19.yml b/section_6/cis_6.2.3/cis_6.2.3.19.yml index e90b6e5..9454de5 100644 --- a/section_6/cis_6.2.3/cis_6.2.3.19.yml +++ b/section_6/cis_6.2.3/cis_6.2.3.19.yml @@ -33,6 +33,8 @@ command: meta: server: 2 workstation: 2 + CIS_ID: + - 6.2.3.19 CISv8: - 8.5 CISv8_IG1: false diff --git a/vars/CIS.yml b/vars/CIS.yml index 20126ec..38385bc 100644 --- a/vars/CIS.yml +++ b/vars/CIS.yml @@ -591,7 +591,8 @@ ubtu24cis_time_sync_tool: "systemd-timesyncd" # Each list item contains two settings, `name` (the domain name of the pool) and synchronization `options`. # The default setting for the `options` is `iburst maxsources 4` -- please refer to the documentation # of the time synchronization mechanism you are using. -ubtu24cis_time_pool_name: time.nist.gov +ubtu24cis_time_pool: + - name: time.nist.gov # The following variable represents a list of of time servers used # for configuring chrony and timesyncd