Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CIS correction for Centos7 #163

Open
wants to merge 8 commits into
base: develop
Choose a base branch
from
Open

Add CIS correction for Centos7 #163

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
04545db
Refined CIS-1.2.3
rbthomp Aug 14, 2019
1699cd9
Correct CIS-4.2.1.3
rbthomp Aug 14, 2019
64e4a2d
Pass CIS-5.1.8 if file is missing.
rbthomp Aug 14, 2019
1dc6bfb
CIS-5.1.4 allow more restrictive mode.
rbthomp Aug 14, 2019
3134f4c
Correct CIS-2.2.1.2
rbthomp Aug 14, 2019
2e0d395
Merge pull request #1 from rbthomp/develop
rbthomp Aug 14, 2019
da7de94
Fix spacing
rbthomp Aug 14, 2019
0f2c9ea
Fix typo
rbthomp Aug 15, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 23 additions & 14 deletions hubblestack_nova_profiles/cis/centos-7-level-1-scored-v2-2-0.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,6 +62,20 @@ grep:
pattern: "^vfat "
tag: CIS-1.1.1.8
description: Ensure mounting of FAT filesystems is disabled
activate_gpg_check:
data:
CentOS Linux-7:
- /etc/yum.conf:
pattern: '^\s*gpgcheck\s*=\s*0'
tag: CIS-1.2.3
- /etc/yum.repos.d/:
pattern: '^\s*gpgcheck\s*=\s*0'
grep_args:
- '-r'
- '-h'
- '--include=*.repo'
tag: CIS-1.2.3
description: Ensure gpgcheck is globally activated
legacy_passwd_entries_group:
data:
CentOS Linux-7:
Expand Down Expand Up @@ -171,18 +185,6 @@ grep:
pattern: ^SINGLE
tag: CIS-1.4.3
description: Ensure authentication required for single user mode
activate_gpg_check:
data:
CentOS Linux-7:
- /etc/yum.conf:
pattern: '^\s*gpgcheck\s*=\s*1'
tag: CIS-1.2.2
- /etc/yum.repos.d:
pattern: '^\s*gpgcheck\s*=\s*1'
grep_args:
- '-r'
tag: CIS-1.2.2
description: Ensure gpgcheck is globally activated
aide_filesystem_scans:
data:
CentOS Linux-7:
Expand Down Expand Up @@ -212,7 +214,7 @@ grep:
- /etc/ntp.conf:
tag: CIS-2.2.1.2
pattern: '^server'
- /etc/sysconfig/ntpd:
- /usr/lib/systemd/system/ntpd.service /etc/sysconf/ntpd:
tag: CIS-2.2.1.2
pattern: 'ntp:ntp'
description: Ensure ntp is configured
Expand Down Expand Up @@ -370,9 +372,13 @@ grep:
rsyslog_file_perms:
data:
CentOS Linux-7:
- /etc/rsyslog.conf:
- /etc/rsyslog.conf /etc/rsyslog.d/:
pattern: '^\$FileCreateMode'
match_output: '0640'
grep_args:
- '-h'
- '-r'
- '--include=*.conf'
tag: CIS-4.2.1.3
description: Ensure rsyslog default file permissions configured
rsyslog_remote_logging:
Expand Down Expand Up @@ -709,13 +715,15 @@ stat:
tag: CIS-5.1.8
uid: null
user: null
match_on_file_missing: True
- /etc/at.deny:
gid: null
group: null
mode: null
tag: CIS-5.1.8
uid: null
user: null
match_on_file_missing: True
- /etc/cron.allow:
gid: 0
group: root
Expand Down Expand Up @@ -750,6 +758,7 @@ stat:
gid: 0
group: root
mode: 700
allow_more_strict: true
tag: CIS-5.1.4
uid: 0
user: root
Expand Down