cis_rhel7.yml

policy: 'CIS benchmark for Red Hat Enterprise Linux 7'
title: 'CIS benchmark for Red Hat Enterprise Linux 7'
id: cis_rhel7
version: '3.1.1'
source: https://www.cisecurity.org/cis-benchmarks/#red_hat_linux
levels:
  - id: l1_server
  - id: l2_server
    inherits_from:
    - l1_server
  - id: l1_workstation
  - id: l2_workstation
    inherits_from:
    - l1_workstation

controls:
  - id: reload_dconf_db
    title: Reload Dconf database
    levels:
    - l1_server
    - l1_workstation
    - l2_server
    - l2_workstation
    notes: <-
      This is a helper rule to reload Dconf datbase correctly.
    status: automated
    rules:
    - dconf_db_up_to_date

  - id: 1.1.1.1
    title: Ensure mounting of cramfs filesystems is disabled (Automated)
    levels:
    - l1_workstation
    - l1_server
    status: automated
    rules:
    - kernel_module_cramfs_disabled

  - id: 1.1.1.2
    title: Ensure mounting of squashfs filesystems is disabled (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - kernel_module_squashfs_disabled

  - id: 1.1.1.3
    title: Ensure mounting of udf filesystems is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - kernel_module_udf_disabled

  - id: 1.1.2
    title: Ensure /tmp is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - partition_for_tmp

  - id: 1.1.3
    title: Ensure noexec option set on /tmp partition (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_tmp_noexec

  - id: 1.1.4
    title: Ensure nodev option set on /tmp partition (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_tmp_nodev

  - id: 1.1.5
    title: Ensure nosuid option set on /tmp partition (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_tmp_nosuid

  - id: 1.1.6
    title: Ensure /dev/shm is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 1.1.7
    title: Ensure noexec option set on /dev/shm partition (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_dev_shm_noexec

  - id: 1.1.8
    title: Ensure nodev option set on /dev/shm partition (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_dev_shm_nodev

  - id: 1.1.9
    title: Ensure nosuid option set on /dev/shm partition (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_dev_shm_nosuid

  - id: 1.1.10
    title: Ensure separate partition exists for /var (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - partition_for_var

  - id: 1.1.11
    title: Ensure separate partition exists for /var/tmp (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - partition_for_var_tmp

  - id: 1.1.12
    title: Ensure /var/tmp partition includes the noexec option (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_var_tmp_noexec

  - id: 1.1.13
    title: Ensure /var/tmp partition includes the nodev option (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_var_tmp_nodev

  - id: 1.1.14
    title: Ensure /var/tmp partition includes the nosuid option (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_var_tmp_nosuid

  - id: 1.1.15
    title: Ensure separate partition exists for /var/log (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - partition_for_var_log

  - id: 1.1.16
    title: Ensure separate partition exists for /var/log/audit (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - partition_for_var_log_audit

  - id: 1.1.17
    title: Ensure separate partition exists for /home (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - partition_for_home

  - id: 1.1.18
    title: Ensure /home partition includes the nodev option (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_home_nodev

  - id: 1.1.19
    title: Ensure removable media partitions include noexec option (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_noexec_removable_partitions

  - id: 1.1.20
    title: Ensure nodev option set on removable media partitions (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_nodev_removable_partitions

  - id: 1.1.21
    title: Ensure nosuid option set on removable media partitions (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - mount_option_nosuid_removable_partitions

  - id: 1.1.22
    title: Ensure sticky bit is set on all world-writable directories (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - dir_perms_world_writable_sticky_bits

  - id: 1.1.23
    title: Disable Automounting (Automated)
    levels:
    - l1_server
    - l2_workstation
    status: automated
    rules:
    - service_autofs_disabled

  - id: 1.1.24
    title: Disable USB Storage (Automated)
    levels:
    - l1_server
    - l2_workstation
    status: automated
    rules:
    - kernel_module_usb-storage_disabled

  - id: 1.2.1
    title: Ensure GPG keys are configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 1.2.2
    title: Ensure package manager repositories are configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 1.2.3
    title: Ensure gpgcheck is globally activated (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - ensure_gpgcheck_globally_activated
    - ensure_gpgcheck_never_disabled

  - id: 1.2.4
    title: Ensure Red Hat Subscription Manager connection is configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 1.2.4
    title: Ensure Red Hat Subscription Manager connection is configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 1.2.5
    title: Disable the rhnsd Daemon (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 1.3.1
    title: Ensure AIDE is installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_aide_installed
    - aide_build_database

  - id: 1.3.2
    title: Ensure filesystem integrity is regularly checked (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - aide_periodic_cron_checking

  - id: 1.4.1
    title: Ensure bootloader password is set (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - grub2_password
    - grub2_uefi_password

  - id: 1.4.2
    title: Ensure permissions on bootloader config are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_grub2_cfg
    - file_owner_grub2_cfg
    - file_permissions_grub2_cfg
    - file_groupowner_efi_grub2_cfg
    - file_owner_efi_grub2_cfg
    - file_permissions_efi_grub2_cfg

  - id: 1.4.3
    title: Ensure authentication required for single user mode (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - require_emergency_target_auth
    - require_singleuser_auth

  - id: 1.5.1
    title: Ensure core dumps are restricted (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - disable_users_coredumps
    - sysctl_fs_suid_dumpable
    - coredump_disable_backtraces
    - coredump_disable_storage

  - id: 1.5.2
    title: Ensure XD/NX support is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial
    notes: >-
      Automatic remediation of these rules is not available.
    rules:
    - bios_enable_execution_restrictions
    - install_PAE_kernel_on_x86-32

  - id: 1.5.3
    title: Ensure address space layout randomization (ASLR) is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_kernel_randomize_va_space

  - id: 1.5.4
    title: Ensure prelink is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: planned
    notes: >-
      The rule to remove prelink package is missing.

  - id: 1.6.1.1
    title: Ensure SELinux is installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_libselinux_installed

  - id: 1.6.1.2
    title: Ensure SELinux is not disabled in bootloader configuration (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - grub2_enable_selinux # the rule does not check for uefi configuration

  - id: 1.6.1.3
    title: Ensure SELinux policy is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - selinux_policytype
    - var_selinux_policy_name=targeted

  - id: 1.6.1.4
    title: Ensure the SELinux mode is enforcing or permissive (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    notes: >-
      The SELinux mode is set to "enforcing" by default.
      Configuring the "permissive" mode greatly lowers security of the system.
      If necessary, the mode can be changed by tailoring the "var_selinux_state" XCCDF variable.
    rules:
    - selinux_state
    - var_selinux_state=enforcing

  - id: 1.6.1.6
    title: Ensure no unconfined services exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - selinux_confinement_of_daemons

  - id: 1.6.1.7
    title: Ensure SETroubleshoot is not installed (Automated)
    levels:
    - l1_server
    status: automated
    rules:
    - package_setroubleshoot_removed

  - id: 1.6.1.8
    title: Ensure the MCS Translation Service (mcstrans) is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_mcstrans_removed

  - id: 1.7.1
    title: Ensure message of the day is configured properly (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - banner_etc_motd
    - login_banner_text=cis_banners

  - id: 1.7.2
    title: Ensure local login warning banner is configured properly (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - banner_etc_issue
    - login_banner_text=cis_banners

  - id: 1.7.3
    title: Ensure remote login warning banner is configured properly (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule is missing

  - id: 1.7.4
    title: Ensure permissions on /etc/motd are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_etc_motd
    - file_owner_etc_motd
    - file_permissions_etc_motd

  - id: 1.7.5
    title: Ensure permissions on /etc/issue are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_etc_issue
    - file_owner_etc_issue
    - file_permissions_etc_issue

  - id: 1.7.6
    title: Ensure permissions on /etc/issue.net are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 1.8.1
    title: Ensure GNOME Display Manager is removed (Manual)
    levels:
    - l2_server
    status: manual

  - id: 1.8.2
    title: Ensure GDM login banner is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - dconf_gnome_banner_enabled
    - dconf_gnome_login_banner_text
    - login_banner_text=cis_default

  - id: 1.8.3
    title: Ensure last logged in user display is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - dconf_gnome_disable_user_list

  - id: 1.8.4
    title: Ensure XDCMP is not enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - gnome_gdm_disable_xdmcp

  - id: 1.9
    title: Ensure updates, patches, and additional security software are installed (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 2.1.1
    title: Ensure xinetd is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_xinetd_removed

  - id: 2.2.1.1
    title: Ensure time synchronization is in use (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 2.2.1.2
    title: Ensure chrony is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - chronyd_specify_remote_server
    - var_multiple_time_servers=rhel
    - chronyd_run_as_chrony_user

  - id: 2.2.1.3
    title: Ensure ntp is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - service_ntpd_enabled
    - ntpd_configure_restrictions
    - ntpd_specify_remote_server
    - ntpd_run_as_ntp_user

  - id: 2.2.2
    title: Ensure X11 Server components are not installed (Automated)
    levels:
    - l1_server
    status: automated
    notes: >-
      The rule also configures correct run level to prevent unbootable system.
    rules:
    - xwindows_remove_packages

  - id: 2.2.3
    title: Ensure Avahi Server is not installed (Automated)
    levels:
    - l1_server
    - l2_workstation
    status: partial # rule for package removal is missing
    rules:
    - service_avahi-daemon_disabled

  - id: 2.2.4
    title: Ensure CUPS is not installed (Automated)
    levels:
    - l1_server
    automated: no # rule for package removal is missing

  - id: 2.2.5
    title: Ensure DHCP Server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_dhcp_removed

  - id: 2.2.6
    title: Ensure LDAP server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_openldap-servers_removed

  - id: 2.2.7
    title: Ensure DNS Server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_bind_removed

  - id: 2.2.8
    title: Ensure FTP Server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_vsftpd_removed

  - id: 2.2.9
    title: Ensure HTTP server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_httpd_removed

  - id: 2.2.10
    title: Ensure IMAP and POP3 server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_dovecot_removed

  - id: 2.2.11
    title: Ensure Samba is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_samba_removed

  - id: 2.2.12
    title: Ensure HTTP Proxy Server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_squid_removed

  - id: 2.2.13
    title: Ensure net-snmp is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_net-snmp_removed

  - id: 2.2.14
    title: Ensure NIS server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_ypserv_removed

  - id: 2.2.15
    title: Ensure telnet-server is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_telnet-server_removed

  - id: 2.2.16
    title: Ensure mail transfer agent is configured for local-only mode (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - postfix_network_listening_disabled
    - var_postfix_inet_interfaces=loopback-only

  - id: 2.2.17
    title: Ensure nfs-utils is not installed or the nfs-server service is masked (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_nfs-utils_removed

  - id: 2.2.18
    title: Ensure rpcbind is not installed or the rpcbind services are masked (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial
    rules:
    - service_rpcbind_disabled

  - id: 2.2.19
    title: Ensure rsync is not installed or the rsyncd service is masked (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - service_rsyncd_disabled

  - id: 2.3.1
    title: Ensure NIS Client is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_ypbind_removed

  - id: 2.3.2
    title: Ensure rsh client is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_rsh_removed

  - id: 2.3.3
    title: Ensure talk client is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_talk_removed

  - id: 2.3.4
    title: Ensure telnet client is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_telnet_removed

  - id: 2.3.5
    title: Ensure LDAP client is not installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_openldap-clients_removed

  - id: 2.4
    title: Ensure nonessential services are removed or masked (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.1.1
    title: Disable IPv6 (Manual)
    levels:
    - l2_server
    - l2_workstation
    status: manual

  - id: 3.1.2
    title: Ensure wireless interfaces are disabled (Automated)
    levels:
    - l1_server
    - l2_workstation
    status: automated
    rules:
    - wireless_disable_interfaces # the rule remediation is not exactly on par with the benchmark

  - id: 3.2.1
    title: Ensure IP forwarding is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_ip_forward
    - sysctl_net_ipv6_conf_all_forwarding
    - sysctl_net_ipv6_conf_all_forwarding_value=disabled

  - id: 3.2.2
    title: Ensure packet redirect sending is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_conf_all_send_redirects
    - sysctl_net_ipv4_conf_default_send_redirects

  - id: 3.3.1
    title: Ensure source routed packets are not accepted (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_conf_all_accept_source_route
    - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
    - sysctl_net_ipv4_conf_default_accept_source_route
    - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
    - sysctl_net_ipv6_conf_all_accept_source_route
    - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled
    - sysctl_net_ipv6_conf_default_accept_source_route
    - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled

  - id: 3.3.2
    title: Ensure ICMP redirects are not accepted (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_conf_all_accept_redirects
    - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
    - sysctl_net_ipv4_conf_default_accept_redirects
    - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled
    - sysctl_net_ipv6_conf_all_accept_redirects
    - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled
    - sysctl_net_ipv6_conf_default_accept_redirects
    - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled

  - id: 3.3.3
    title: Ensure secure ICMP redirects are not accepted (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_conf_all_secure_redirects
    - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
    - sysctl_net_ipv4_conf_default_secure_redirects
    - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled

  - id: 3.3.4
    title: Ensure suspicious packets are logged (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_conf_all_log_martians
    - sysctl_net_ipv4_conf_all_log_martians_value=enabled
    - sysctl_net_ipv4_conf_default_log_martians
    - sysctl_net_ipv4_conf_default_log_martians_value=enabled

  - id: 3.3.5
    title: Ensure broadcast ICMP requests are ignored (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
    - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled

  - id: 3.3.6
    title: Ensure bogus ICMP responses are ignored (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
    - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled

  - id: 3.3.7
    title: Ensure Reverse Path Filtering is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_conf_all_rp_filter
    - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
    - sysctl_net_ipv4_conf_default_rp_filter
    - sysctl_net_ipv4_conf_default_rp_filter_value=enabled

  - id: 3.3.8
    title: Ensure TCP SYN Cookies is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv4_tcp_syncookies
    - sysctl_net_ipv4_tcp_syncookies_value=enabled

  - id: 3.3.9
    title: Ensure IPv6 router advertisements are not accepted (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sysctl_net_ipv6_conf_all_accept_ra
    - sysctl_net_ipv6_conf_all_accept_ra_value=disabled
    - sysctl_net_ipv6_conf_default_accept_ra
    - sysctl_net_ipv6_conf_default_accept_ra_value=disabled

  - id: 3.4.1
    title: Ensure DCCP is disabled (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - kernel_module_dccp_disabled

  - id: 3.4.2
    title: Ensure SCTP is disabled (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - kernel_module_sctp_disabled

  - id: 3.5.1.1
    title: Ensure firewalld is installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_iptables_installed
    - package_firewalld_installed

  - id: 3.5.1.2
    title: Ensure iptables-services not installed with firewalld (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # missing rule

  - id: 3.5.1.3
    title: Ensure nftables either not installed or masked with firewalld (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.1.4
    title: Ensure firewalld service enabled and running (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # only checking systemd service, not running "firewall-cmd --state"
    rules:
    - service_firewalld_enabled

  - id: 3.5.1.5
    title: Ensure firewalld default zone is set (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - set_firewalld_default_zone

  - id: 3.5.1.6
    title: Ensure network interfaces are assigned to appropriate zone (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.5.1.7
    title: Ensure firewalld drops unnecessary services and ports (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.5.2.1
    title: Ensure nftables is installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    notes: <-
      CIS benchmark allows to choose from several firewall applications. This interpretation of the benchmark chose the Firewalld application and other subsections are not automated.
    automated: no # rule missing

  - id: 3.5.2.2
    title: Ensure firewalld is either not installed or masked with nftables (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.3
    title: Ensure iptables-services not installed with nftables (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.4
    title:  Ensure iptables are flushed with nftables (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.5.2.5
    title: Ensure an nftables table exists (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.6
    title: Ensure nftables base chains exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.7
    title: Ensure nftables loopback traffic is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.8
    title: Ensure nftables outbound and established connections are configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.5.2.9
    title: Ensure nftables default deny firewall policy (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.10
    title: Ensure nftables service is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.2.11
    title: Ensure nftables rules are permanent (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.1.1
    title: Ensure iptables packages are installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no
    notes: <-
      CIS benchmark allows to choose from several firewall applications. This interpretation of the benchmark chose the Firewalld application and other subsections are not automated.
    related_rules:
    - package_iptables_installed

  - id: 3.5.3.1.2
    title: Ensure nftables is not installed with iptables (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.1.3
    title: Ensure firewalld is either not installed or masked with iptables
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.2.1
    title: Ensure iptables loopback traffic is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.2.2
    title: Ensure iptables outbound and established connections are configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.5.3.2.3
    title: Ensure iptables rules exist for all open ports (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.2.4
    title: Ensure iptables default deny firewall policy (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule not completed

  - id: 3.5.3.2.5
    title: Ensure iptables rules are saved (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.2.6
    title: Ensure iptables is enabled and running (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no
    related_rules:
    - service_iptables_enabled

  - id: 3.5.3.3.1
    title: Ensure ip6tables loopback traffic is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.3.2
    title: Ensure ip6tables outbound and established connections are configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 3.5.3.3.3
    title: Ensure ip6tables firewall rules exist for all open ports (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.3.4
    title: Ensure ip6tables default deny firewall policy (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.3.5
    title: Ensure ip6tables rules are saved (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 3.5.3.3.6
    title: Ensure ip6tables is enabled and running (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no
    related_rules:
    - service_ip6tables_enabled

  - id: 4.1.1.1
    title: Ensure auditd is installed (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: partial # we do not check for audit-libs package
    rules:
    - package_audit_installed

  - id: 4.1.1.2
    title: Ensure auditd service is enabled and running (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - service_auditd_enabled

  - id: 4.1.1.3
    title: Ensure auditing for processes that start prior to auditd is enabled (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - grub2_audit_argument

  - id: 4.1.2.1
    title: Ensure audit log storage size is configured (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - auditd_data_retention_max_log_file
    - var_auditd_max_log_file=6

  - id: 4.1.2.2
    title: Ensure audit logs are not automatically deleted (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - auditd_data_retention_max_log_file_action
    - var_auditd_max_log_file_action=keep_logs

  - id: 4.1.2.3
    title: Ensure system is disabled when audit logs are full (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - auditd_data_retention_space_left_action
    - var_auditd_space_left_action=email
    - auditd_data_retention_action_mail_acct
    - var_auditd_action_mail_acct=root
    - auditd_data_retention_admin_space_left_action
    - var_auditd_admin_space_left_action=halt

  - id: 4.1.2.4
    title: Ensure audit_backlog_limit is sufficient (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    notes: <-
      Note that currently the value is hardcoded to 8192
    rules:
    - grub2_audit_backlog_limit_argument

  - id: 4.1.3
    title: Ensure events that modify date and time information are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: partial # we do not have rule for clock_settime
    rules:
    - audit_rules_time_adjtimex
    - audit_rules_time_settimeofday
    - audit_rules_time_stime
    - audit_rules_time_watch_localtime

  - id: 4.1.4
    title: Ensure events that modify user/group information are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_usergroup_modification_group
    - audit_rules_usergroup_modification_gshadow
    - audit_rules_usergroup_modification_opasswd
    - audit_rules_usergroup_modification_passwd
    - audit_rules_usergroup_modification_shadow

  - id: 4.1.5
    title: Ensure events that modify the system's network environment are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_networkconfig_modification

  - id: 4.1.6
    title: Ensure events that modify the system's Mandatory Access Controls are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: partial # rule for checking audit watch on /usr/share/selinux is missing
    rules:
    - audit_rules_mac_modification

  - id: 4.1.7
    title: Ensure login and logout events are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_login_events_faillock
    - audit_rules_login_events_lastlog

  - id: 4.1.8
    title: Ensure session initiation information is collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_session_events

  - id: 4.1.9
    title: Ensure discretionary access control permission modification events are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_dac_modification_fchmod
    - audit_rules_dac_modification_fchmodat
    - audit_rules_dac_modification_chmod
    - audit_rules_dac_modification_fchown
    - audit_rules_dac_modification_fchownat
    - audit_rules_dac_modification_chown
    - audit_rules_dac_modification_lchown
    - audit_rules_dac_modification_fremovexattr
    - audit_rules_dac_modification_fsetxattr
    - audit_rules_dac_modification_lremovexattr
    - audit_rules_dac_modification_lsetxattr
    - audit_rules_dac_modification_removexattr
    - audit_rules_dac_modification_setxattr

  - id: 4.1.10
    title: Ensure unsuccessful unauthorized file access attempts are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_unsuccessful_file_modification_creat
    - audit_rules_unsuccessful_file_modification_open
    - audit_rules_unsuccessful_file_modification_openat
    - audit_rules_unsuccessful_file_modification_truncate
    - audit_rules_unsuccessful_file_modification_ftruncate

  - id: 4.1.11
    title: Ensure use of privileged commands is collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    automated: no # we have audit_rules_privileged_commands, but it does not set perm=x

  - id: 4.1.12
    title: Ensure successful file system mounts are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_media_export

  - id: 4.1.13
    title: Ensure file deletion events by users are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_file_deletion_events_rename
    - audit_rules_file_deletion_events_renameat
    - audit_rules_file_deletion_events_unlink
    - audit_rules_file_deletion_events_unlinkat

  - id: 4.1.14
    title: Ensure changes to system administration scope (sudoers) is collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_sysadmin_actions

  - id: 4.1.15
    title: Ensure system administrator command executions (sudo) are collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    automated: no # missing rule

  - id: 4.1.16
    title: Ensure kernel module loading and unloading is collected (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_privileged_commands_insmod
    - audit_rules_privileged_commands_rmmod
    - audit_rules_privileged_commands_modprobe
    - audit_rules_kernel_module_loading_delete
    - audit_rules_kernel_module_loading_init

  - id: 4.1.17
    title: Ensure the audit configuration is immutable (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - audit_rules_immutable

  - id: 4.2.1.1
    title: Ensure rsyslog is installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_rsyslog_installed

  - id: 4.2.1.2
    title: Ensure rsyslog Service is enabled and running (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - service_rsyslog_enabled

  - id: 4.2.1.3
    title: Ensure rsyslog default file permissions configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 4.2.1.4
    title: Ensure logging is configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 4.2.1.5
    title: Ensure rsyslog is configured to send logs to a remote log host (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - rsyslog_remote_loghost

  - id: 4.2.1.6
    title: Ensure remote rsyslog messages are only accepted on designated log hosts. (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 4.2.2.1
    title: Ensure journald is configured to send logs to rsyslog (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - journald_forward_to_syslog

  - id: 4.2.2.2
    title: Ensure journald is configured to compress large log files (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - journald_compress

  - id: 4.2.2.3
    title: Ensure journald is configured to write logfiles to persistent disk (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - journald_storage

  - id: 4.2.3
    title: Ensure permissions on all logfiles are configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 4.2.4
    title: Ensure logrotate is configured (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 5.1.1
    title: Ensure cron daemon is enabled and running (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - service_crond_enabled

  - id: 5.1.2
    title: Ensure permissions on /etc/crontab are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_crontab
    - file_owner_crontab
    - file_permissions_crontab

  - id: 5.1.3
    title: Ensure permissions on /etc/cron.hourly are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_cron_hourly
    - file_owner_cron_hourly
    - file_permissions_cron_hourly

  - id: 5.1.4
    title: Ensure permissions on /etc/cron.daily are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_cron_daily
    - file_owner_cron_daily
    - file_permissions_cron_daily

  - id: 5.1.5
    title: Ensure permissions on /etc/cron.weekly are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_cron_weekly
    - file_owner_cron_weekly
    - file_permissions_cron_weekly

  - id: 5.1.6
    title: Ensure permissions on /etc/cron.monthly are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_cron_monthly
    - file_owner_cron_monthly
    - file_permissions_cron_monthly

  - id: 5.1.7
    title: Ensure permissions on /etc/cron.d are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_cron_d
    - file_owner_cron_d
    - file_permissions_cron_d

  - id: 5.1.8
    title: Ensure cron is restricted to authorized users (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_cron_allow
    - file_owner_cron_allow
    - file_cron_deny_not_exist
    - file_permissions_cron_allow

  - id: 5.1.9
    title: Ensure at is restricted to authorized users (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_at_allow
    - file_owner_at_allow
    - file_at_deny_not_exist
    - file_permissions_at_allow

  - id: 5.2.1
    title: Ensure sudo is installed (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - package_sudo_installed

  - id: 5.2.2
    title: Ensure sudo commands use pty (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sudo_add_use_pty

  - id: 5.2.3
    title: Ensure sudo log file exists (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sudo_custom_logfile
    - var_sudo_logfile=var_log_sudo_log

  - id: 5.3.1
    title: Ensure permissions on /etc/ssh/sshd_config are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_sshd_config
    - file_owner_sshd_config
    - file_permissions_sshd_config

  - id: 5.3.2
    title: Ensure permissions on SSH private host key files are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing (we have similar)

  - id: 5.3.3
    title: Ensure permissions on SSH public host key files are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # missing rules for ownership
    rules:
    - file_permissions_sshd_pub_key

  - id: 5.3.4
    title: Ensure SSH access is limited (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 5.3.5
    title: Ensure SSH LogLevel is appropriate (Automated)
    levels:
    - l1_server
    - l1_workstation
    notes: <-
      The default rule is configured to enforce the "verbose" log level. Use
      tailoring to change it to "info" level.
    status: automated # we have two rules either for info or verbose, no way to select
    related_rules:
    - sshd_set_loglevel_info
    rules:
    - sshd_set_loglevel_verbose

  - id: 5.3.6
    title: Ensure SSH X11 forwarding is disabled (Automated)
    levels:
    - l2_server
    - l1_workstation
    status: automated
    rules:
    - sshd_disable_x11_forwarding

  - id: 5.3.7
    title: Ensure SSH MaxAuthTries is set to 4 or less (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_set_max_auth_tries
    - sshd_max_auth_tries_value=4

  - id: 5.3.8
    title: Ensure SSH IgnoreRhosts is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_disable_rhosts

  - id: 5.3.9
    title: Ensure SSH HostbasedAuthentication is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - disable_host_auth

  - id: 5.3.10
    title: Ensure SSH root login is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_disable_root_login

  - id: 5.3.11
    title: Ensure SSH PermitEmptyPasswords is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_disable_empty_passwords

  - id: 5.3.12
    title: Ensure SSH PermitUserEnvironment is disabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_do_not_permit_user_env

  - id: 5.3.13
    title: Ensure only strong Ciphers are used (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    notes: <-
      The rule checks for default list of ciphers provided in the benchmark.
    rules:
    - sshd_approved_ciphers=cis_rhel7
    - sshd_use_approved_ciphers

  - id: 5.3.14
    title: Ensure only strong MAC algorithms are used (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    notes: <-
      The rule checks for default list of MACs provided in the benchmark.
    rules:
    - sshd_approved_macs=cis_rhel7
    - sshd_use_approved_macs

  - id: 5.3.15
    title: Ensure only strong Key Exchange algorithms are used (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 5.3.16
    title: Ensure SSH Idle Timeout Interval is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_set_idle_timeout
    - sshd_idle_timeout_value=15_minutes
    - sshd_set_keepalive
    - var_sshd_set_keepalive=0

  - id: 5.3.17
    title: Ensure SSH LoginGraceTime is set to one minute or less (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - sshd_set_login_grace_time
      - var_sshd_set_login_grace_time=60

  - id: 5.3.18
    title: Ensure SSH warning banner is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # our rule configures /etc/issue, /etc/issue.net is required

  - id: 5.3.19
    title: Ensure SSH PAM is enabled (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - sshd_enable_pam

  - id: 5.3.20
    title: Ensure SSH AllowTcpForwarding is disabled (Automated)
    levels:
    - l2_server
    - l2_workstation
    status: automated
    rules:
    - sshd_disable_tcp_forwarding

  - id: 5.3.21
    title: Ensure SSH MaxStartups is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_set_maxstartups
    - var_sshd_set_maxstartups=10:30:60

  - id: 5.3.22
    title: Ensure SSH MaxSessions is limited (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - sshd_set_max_sessions
    - var_sshd_max_sessions=10

  - id: 5.4.1
    title: Ensure password creation requirements are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # rule checking for retry needs modification and we are missing rule for try_first_pass
    notes: <-
      There are two ways how to check this control.
      One way is to check for minclass, this is currently selected.
      Another way is to check for dcredit, lcredit,ocredit, ucredit, this is shown in rleated_rules.
    related_rules:
    - accounts_password_pam_dcredit
    - var_password_pam_dcredit=1
    - accounts_password_pam_ucredit
    - var_password_pam_ucredit=1
    - accounts_password_pam_lcredit
    - var_password_pam_lcredit=1
    - accounts_password_pam_ocredit
    - var_password_pam_ocredit=1
    rules:
    - accounts_password_pam_minlen
    - var_password_pam_minlen=14
    - accounts_password_pam_minclass
    - var_password_pam_minclass=4

  - id: 5.4.2
    title: Ensure lockout for failed password attempts is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # we can check only certain parts, we need probably some complex rule for this

  - id: 5.4.3
    title: Ensure password hashing algorithm is SHA-512 (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # our rule does not check for password-auth
    rules:
    - set_password_hashing_algorithm_systemauth

  - id: 5.4.4
    title: Ensure password reuse is limited (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    notes: |-
      Usage of pam_unix.so module together with "remember" option is deprecated and is not supported by this policy interpretation.
      See here for more details about pam_unix.so:
      https://bugzilla.redhat.com/show_bug.cgi?id=1778929
    rules:
    - var_password_pam_remember=5
    - var_password_pam_remember_control_flag=required
    - accounts_password_pam_pwhistory_remember_system_auth
    - accounts_password_pam_pwhistory_remember_password_auth

  - id: 5.5.1.1
    title: Ensure password expiration is 365 days or less (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # missing rule for checking of /etc/shadow
    rules:
    - accounts_maximum_age_login_defs
    - var_accounts_maximum_age_login_defs=365

  - id: 5.5.1.2
    title: Ensure minimum days between password changes is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # missing rule for checking of /etc/shadow
    rules:
    - accounts_minimum_age_login_defs
    - var_accounts_minimum_age_login_defs=1

  - id: 5.5.1.3
    title: Ensure password expiration warning days is 7 or more (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # missing rule for checking of /etc/shadow
    rules:
    - accounts_password_warn_age_login_defs
    - var_accounts_password_warn_age_login_defs=7

  - id: 5.5.1.4
    title: Ensure inactive password lock is 30 days or less (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # we do not check /et/shadow
    rules:
    - account_disable_post_pw_expiration
    - var_account_disable_post_pw_expiration=30

  - id: 5.5.1.5
    title: Ensure all users last password change date is in the past (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 5.5.2
    title: Ensure system accounts are secured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # missing rule for locking of accounts
    rules:
    - no_shelllogin_for_systemaccounts

  - id: 5.5.3
    title: Ensure default group for the root account is GID 0 (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - accounts_root_gid_zero

  - id: 5.5.4
    title: Ensure default user shell timeout is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # we check only for value of tmout variable, no export or readonly and we do not check /etc/bashrc
    rules:
    - accounts_tmout
    - var_accounts_tmout=15_min

  - id: 5.5.5
    title: Ensure default user umask is configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial # checking only for numeric umask and we do not check for user_enab in /etc/login.defs
    rules:
    - accounts_umask_etc_bashrc
    - accounts_umask_etc_login_defs
    - accounts_umask_etc_profile
    - var_accounts_user_umask=027

  - id: 5.6
    title: Ensure root login is restricted to system console (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 5.7
    title: Ensure access to the su command is restricted (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: partial  # we check only for usage of use_uid with pam_su, not for the group
    rules:
    - use_pam_wheel_for_su

  - id: 6.1.1
    title: Audit system file permissions (Manual)
    levels:
    - l2_server
    - l2_workstation
    status: manual

  - id: 6.1.2
    title: Ensure permissions on /etc/passwd are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_etc_passwd
    - file_owner_etc_passwd
    - file_permissions_etc_passwd

  - id: 6.1.3
    title: Ensure permissions on /etc/passwd- are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_backup_etc_passwd
    - file_owner_backup_etc_passwd
    - file_permissions_backup_etc_passwd

  - id: 6.1.4
    title: Ensure permissions on /etc/shadow are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_etc_shadow
    - file_owner_etc_shadow
    - file_permissions_etc_shadow

  - id: 6.1.5
    title: Ensure permissions on /etc/shadow- are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_backup_etc_shadow
    - file_owner_backup_etc_shadow
    - file_permissions_backup_etc_shadow

  - id: 6.1.6
    title: Ensure permissions on /etc/gshadow- are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_backup_etc_gshadow
    - file_owner_backup_etc_gshadow
    - file_permissions_backup_etc_gshadow

  - id: 6.1.7
    title: Ensure permissions on /etc/gshadow are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_etc_gshadow
    - file_owner_etc_gshadow
    - file_permissions_etc_gshadow

  - id: 6.1.8
    title: Ensure permissions on /etc/group are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_etc_group
    - file_owner_etc_group
    - file_permissions_etc_group

  - id: 6.1.9
    title: Ensure permissions on /etc/group- are configured (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_groupowner_backup_etc_group
    - file_owner_backup_etc_group
    - file_permissions_backup_etc_group

  - id: 6.1.10
    title: Ensure no world writable files exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_permissions_unauthorized_world_writable

  - id: 6.1.11
    title: Ensure no unowned files or directories exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - no_files_unowned_by_user

  - id: 6.1.12
    title: Ensure no ungrouped files or directories exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_permissions_ungroupowned

  - id: 6.1.13
    title: Audit SUID executables (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 6.1.14
    title: Audit SGID executables (Manual)
    levels:
    - l1_server
    - l1_workstation
    status: manual

  - id: 6.2.1
    title: Ensure accounts in /etc/passwd use shadowed passwords (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - accounts_password_all_shadowed

  - id: 6.2.2
    title: Ensure /etc/shadow password fields are not empty (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 6.2.3
    title: Ensure all groups in /etc/passwd exist in /etc/group (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - gid_passwd_group_same

  - id: 6.2.4
    title: Ensure shadow group is empty (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 6.2.5
    title: Ensure no duplicate user names exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - account_unique_name

  - id: 6.2.6
    title: Ensure no duplicate group names exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - group_unique_name

  - id: 6.2.7
    title: Ensure no duplicate UIDs exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - account_unique_id

  - id: 6.2.8
    title: Ensure no duplicate GIDs exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
      - group_unique_id

  - id: 6.2.9
    title: Ensure root is the only UID 0 account (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - accounts_no_uid_except_zero

  - id: 6.2.10
    title: Ensure root PATH Integrity (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - accounts_root_path_dirs_no_write
    - root_path_no_dot

  - id: 6.2.11
    title: Ensure all users' home directories exist (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - accounts_user_interactive_home_directory_exists

  - id: 6.2.12
    title: Ensure users own their home directories (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_ownership_home_directories

  - id: 6.2.13
    title: Ensure users' home directories permissions are 750 or more restrictive (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    rules:
    - file_permissions_home_directories

  - id: 6.2.14
    title: Ensure users' dot files are not group or world writable (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 6.2.15
    title: Ensure no users have .forward files (Automated)
    levels:
    - l1_server
    - l1_workstation
    automated: no # rule missing

  - id: 6.2.16
    title: Ensure no users have .netrc files (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    notes: <-
      The rule is checking only for existence of files, not for their permissions.
    rules:
    - no_netrc_files

  - id: 6.2.17
    title: Ensure no users have .rhosts files (Automated)
    levels:
    - l1_server
    - l1_workstation
    status: automated
    notes: The rule also removes /etc/hosts.equiv
    rules:
    - no_rsh_trust_files