Skip to content

Commit 00fc166

Browse files
seanlongccwdowerDMedina6jrmetzgerJon Metzger
authored
V2r4 delta (#91)
* removing vagrant from list of default users in inspec.yml Signed-off-by: Will <[email protected]> * rhel9 v2r4 delta * 270175, 270176, 270177, 270178, 270180, 272488 * 270174 * SV-257837 gui check * bugs in dconf control grep commands Signed-off-by: Will <[email protected]> * fixing busted regex in 258032 Signed-off-by: Will <[email protected]> * include --> match for SV-258026 Signed-off-by: Will <[email protected]> * SV-258024 also needed match and not include Signed-off-by: Will <[email protected]> * more dconf Signed-off-by: Will <[email protected]> * var options needs its own hash Signed-off-by: Will <[email protected]> * typo Signed-off-by: Will <[email protected]> * typo Signed-off-by: Will <[email protected]> * fixing SV-258024 Signed-off-by: Will <[email protected]> * typo 8-->9 Signed-off-by: Will <[email protected]> * Adjust Chrony_Conf Control (#70) * update chrony ctrl and inspec.yml * remove explicit space char in split call Was making the linter sad --------- Co-authored-by: wdower <[email protected]> * fixes #74 Signed-off-by: Will <[email protected]> * Root CA File Hash (like rhel8) (#76) * Update inspec.yml * Update SV-258131.rb * cookstyle --------- Co-authored-by: Jon Metzger <[email protected]> * fips updates * Update inspec.yml * use input from rhel8 * taken from rhel8 * Update SV-258237.rb * Update SV-258236.rb * Update inspec.yml * Delete controls/SV-258010.rb Deprecated... rhel8 too https://www.tenable.com/audits/items/DISA_STIG_Red_Hat_Enterprise_Linux_9_v1r1.audit:3baf360f4c45501641cc9da71d8d7ccd * Update SV-258236.rb * stop_idle_session_sec from rhel8 taken from rhel8 * kerberos * fix idle time * fix client path * cookstyle * input update * typo in fix description * 10 min intervals (latest nessus) * add back PrivSeparation (dep in later releases) * cookstyle * Apply suggestions from code review Co-authored-by: Jonathan Metzger <[email protected]> * calculating the SHA so that it matches GitHub's own, to make it easier to find the right pipeline run in Heimdall Signed-off-by: wdower <[email protected]> * typo in aws key Signed-off-by: wdower <[email protected]> * update 257978, 257987, 258003, 258171, 272496 * update inspec.yml * rerun delta with new profile.json * Dconf (#87) * removing vagrant from list of default users in inspec.yml Signed-off-by: Will <[email protected]> * bugs in dconf control grep commands Signed-off-by: Will <[email protected]> * fixing busted regex in 258032 Signed-off-by: Will <[email protected]> * include --> match for SV-258026 Signed-off-by: Will <[email protected]> * SV-258024 also needed match and not include Signed-off-by: Will <[email protected]> * more dconf Signed-off-by: Will <[email protected]> * var options needs its own hash Signed-off-by: Will <[email protected]> * typo Signed-off-by: Will <[email protected]> * typo Signed-off-by: Will <[email protected]> * fixing SV-258024 Signed-off-by: Will <[email protected]> * typo 8-->9 Signed-off-by: Will <[email protected]> * Adjust Chrony_Conf Control (#70) * update chrony ctrl and inspec.yml * remove explicit space char in split call Was making the linter sad --------- Co-authored-by: wdower <[email protected]> * fixes #74 Signed-off-by: Will <[email protected]> * Root CA File Hash (like rhel8) (#76) * Update inspec.yml * Update SV-258131.rb * cookstyle --------- Co-authored-by: Jon Metzger <[email protected]> * fips updates * Update inspec.yml * use input from rhel8 * taken from rhel8 * Update SV-258237.rb * Update SV-258236.rb * Update inspec.yml * Delete controls/SV-258010.rb Deprecated... rhel8 too https://www.tenable.com/audits/items/DISA_STIG_Red_Hat_Enterprise_Linux_9_v1r1.audit:3baf360f4c45501641cc9da71d8d7ccd * Update SV-258236.rb * stop_idle_session_sec from rhel8 taken from rhel8 * kerberos * fix idle time * fix client path * cookstyle * input update * typo in fix description * 10 min intervals (latest nessus) * add back PrivSeparation (dep in later releases) * cookstyle * Apply suggestions from code review Co-authored-by: Jonathan Metzger <[email protected]> * calculating the SHA so that it matches GitHub's own, to make it easier to find the right pipeline run in Heimdall Signed-off-by: wdower <[email protected]> * typo in aws key Signed-off-by: wdower <[email protected]> * better tagged suites, adapting to use local repo vars in pipeline Signed-off-by: wdower <[email protected]> * testing new workflow pattern Signed-off-by: wdower <[email protected]> * working out kitchen + workflow file Signed-off-by: wdower <[email protected]> * realizing we need all files committed to support the workflow Signed-off-by: wdower <[email protected]> * typo'd line in kitchen Signed-off-by: wdower <[email protected]> * taking out currently unused sg and subnet vars Signed-off-by: wdower <[email protected]> * trying to match report file Signed-off-by: wdower <[email protected]> * updating the other workflows to match the disa one Signed-off-by: wdower <[email protected]> * another broken regex fix for 258015 Signed-off-by: Will <[email protected]> * accounting for server pools in 257945 Signed-off-by: Will <[email protected]> * kernel.core_pattern update (#81) |/bin/false * audit_conf_mode outside of resource (#82) * audit_conf_mode outside of resource * Update controls/SV-258171.rb * renaming the workflows Signed-off-by: wdower <[email protected]> * deleted too much of the kitchen command last time Signed-off-by: wdower <[email protected]> * fixing linter issues Signed-off-by: wdower <[email protected]> * typo in kitchenfile Signed-off-by: wdower <[email protected]> * too much detail in suite name Signed-off-by: wdower <[email protected]> * turns out we do actually want the github.sha in the context of a pulkl request - these workflows should only run for PRs anywayu Signed-off-by: wdower <[email protected]> * using local IB vars to check if we have a good account Signed-off-by: wdower <[email protected]> * missed describe block in SV-230484 Signed-off-by: Will <[email protected]> * replacing SAF vars for the pipeline Signed-off-by: Will <[email protected]> --------- Signed-off-by: Will <[email protected]> Signed-off-by: wdower <[email protected]> Co-authored-by: DMedina6 <[email protected]> Co-authored-by: Jonathan Metzger <[email protected]> Co-authored-by: Jon Metzger <[email protected]> * updating version tag Signed-off-by: Will <[email protected]> * rhel9 v2r4 delta * bugs in dconf control grep commands Signed-off-by: Will <[email protected]> * Adjust Chrony_Conf Control (#70) * update chrony ctrl and inspec.yml * remove explicit space char in split call Was making the linter sad --------- Co-authored-by: wdower <[email protected]> * Root CA File Hash (like rhel8) (#76) * Update inspec.yml * Update SV-258131.rb * cookstyle --------- Co-authored-by: Jon Metzger <[email protected]> * kerberos * fix idle time * input update * rerun delta with new profile.json * remove extra files * remove rhel8 mentions, fix 258022 and 258143 * add missing inspec input for SV-258143 * revert 257974 * bumping version in inspec.yml, using different aws account Signed-off-by: Will <[email protected]> * updating luks control SV-257879 Signed-off-by: Will <[email protected]> * update controls and inputs * update controls and run rubocop * update controls * update controls and inputs * rubocop * update controls and fix lint issue * remove uncessary check, add luks default * removing unneeded steps in lint, fixing filename in ec2 jobs Signed-off-by: Will <[email protected]> * making linter happy, swapping keys Signed-off-by: Will <[email protected]> * Revert change since it's causing us to overwrite the results file with the summary file * Revert change cause it's causing us to overwrite the results file with the summary file * Readme now has the correct version number * Fix typo in readme * swapping keys Signed-off-by: Will <[email protected]> --------- Signed-off-by: Will <[email protected]> Signed-off-by: wdower <[email protected]> Co-authored-by: Will <[email protected]> Co-authored-by: DMedina6 <[email protected]> Co-authored-by: wdower <[email protected]> Co-authored-by: Jonathan Metzger <[email protected]> Co-authored-by: Jon Metzger <[email protected]> Co-authored-by: Amndeep Singh Mann <[email protected]>
1 parent 0f98c54 commit 00fc166

File tree

486 files changed

+17761
-4192
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

486 files changed

+17761
-4192
lines changed

‎.github/workflows/lint-profile.yml‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,18 +24,6 @@ jobs:
2424
- name: Check out repository
2525
uses: actions/checkout@v4
2626

27-
- name: Clone full repository so we can push
28-
run: git fetch --prune --unshallow
29-
30-
- name: Set short git commit SHA
31-
id: vars
32-
run: |
33-
calculatedSha=$(git rev-parse --short ${{ github.sha }})
34-
echo "COMMIT_SHORT_SHA=$calculatedSha" >> $GITHUB_ENV
35-
36-
- name: Confirm git commit SHA output
37-
run: echo ${{ env.COMMIT_SHORT_SHA }}
38-
3927
- name: Setup Ruby
4028
uses: ruby/setup-ruby@v1
4129
with:

‎.github/workflows/validate-ec2-ansible-lockdown.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ jobs:
1111
CHEF_LICENSE: accept-silent
1212
CHEF_LICENSE_KEY: ${{ secrets.SAF_CHEF_LICENSE_KEY }}
1313
KITCHEN_LOCAL_YAML: kitchen.ec2.ansible_lockdown.yml
14-
SAF_PIPELINE_SUBNET: ${{ secrets.SAF_PIPELINE_SUBNET }}
15-
SAF_PIPELINE_SG: ${{ secrets.SAF_PIPELINE_SG }}
14+
#SAF_PIPELINE_SUBNET: ${{ secrets.SAF_PIPELINE_SUBNET }}
15+
#SAF_PIPELINE_SG: ${{ secrets.SAF_PIPELINE_SG }}
1616
DEPLOYMENT: "ec2"
1717
HARDENING_SOURCE: "ansible_lockdown"
1818
PLATFORM: "rhel-9"
@@ -30,8 +30,8 @@ jobs:
3030
- name: Configure AWS credentials
3131
uses: aws-actions/configure-aws-credentials@v4
3232
with:
33-
aws-access-key-id: ${{ secrets.SAF_AWS_ACCESS_KEY }}
34-
aws-secret-access-key: ${{ secrets.SAF_AWS_SECRET_ACCESS_KEY }}
33+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
34+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
3535
aws-region: us-east-1
3636

3737
- name: Check out repository

‎.github/workflows/validate-ec2-disa.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ jobs:
1111
CHEF_LICENSE: accept-silent
1212
CHEF_LICENSE_KEY: ${{ secrets.SAF_CHEF_LICENSE_KEY }}
1313
KITCHEN_LOCAL_YAML: kitchen.ec2.disa.yml
14-
SAF_PIPELINE_SUBNET: ${{ secrets.SAF_PIPELINE_SUBNET }}
15-
SAF_PIPELINE_SG: ${{ secrets.SAF_PIPELINE_SG }}
14+
#SAF_PIPELINE_SUBNET: ${{ secrets.SAF_PIPELINE_SUBNET }}
15+
#SAF_PIPELINE_SG: ${{ secrets.SAF_PIPELINE_SG }}
1616
DEPLOYMENT: "ec2"
1717
HARDENING_SOURCE: "disa"
1818
PLATFORM: "rhel-9"
@@ -30,8 +30,8 @@ jobs:
3030
- name: Configure AWS credentials
3131
uses: aws-actions/configure-aws-credentials@v4
3232
with:
33-
aws-access-key-id: ${{ secrets.SAF_AWS_ACCESS_KEY }}
34-
aws-secret-access-key: ${{ secrets.SAF_AWS_SECRET_ACCESS_KEY }}
33+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY }}
34+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
3535
aws-region: us-east-1
3636

3737
- name: Check out repository
@@ -94,7 +94,7 @@ jobs:
9494
-F "public=true" -F "evaluationTags=${{ env.COMMIT_SHORT_SHA }},${{ github.repository }},${{ github.workflow }},${{ matrix.suite }},${{ env.DEPLOYMENT }},${{ env.HARDENING_SOURCE }},${{ env.PLATFORM }}" \
9595
-H "Authorization: Api-Key ${{ secrets.SAF_HEIMDALL_UPLOAD_KEY }}" \
9696
"${{ vars.SAF_HEIMDALL_URL }}/evaluations"
97-
97+
9898
- name: Display our ${{ matrix.suite }} results summary
9999
if: ${{ !contains(steps.commit.outputs.message, 'only-validate-profile') }}
100100
uses: mitre/[email protected]

‎.gitignore‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
aws
2+
awscliv2.zip
13
.DS_Store
24
*.gem
35
*.rbc
@@ -68,8 +70,8 @@ build-iPhoneSimulator/
6870
.vscode
6971

7072
# delta files
71-
delta.json
72-
report.md
73-
*xccdf.xml
73+
# delta.json
74+
# report.md
75+
# *xccdf.xml
7476
check-results.txt
7577
kitchen.local.ec2.yml

‎README.md‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22

33
The Redhat Enterprise Linux 9.X Security Technical Implementation Guide (RHEL9.x STIG) InSpec Profile can help programs automate their compliance checks of RedHat Enterprise Linux 9.x System to Department of Defense (DoD) requirements.
44

5-
- Profile Version: `1.2.2`
6-
- RedHat Enterprise Linux 9 Security Technical Implementation Guide v1r2
5+
- Profile Version: `2.4.0`
6+
- RedHat Enterprise Linux 9 Security Technical Implementation Guide v2r4
77

88
This profile was developed to reduce the time it takes to perform a security checks based upon the STIG Guidance from the Defense Information Systems Agency (DISA) in partnership between the DISA Services Directorate (SD) and the DISA Risk Management Executive (RME) office.
99

@@ -14,17 +14,17 @@ The RHEL8 STIG Profile uses the [InSpec](https://github.com/inspec/inspec) open-
1414
Table of Contents
1515
=================
1616

17-
* [RedHat Enterprise Linux 9.x Security Technical Implementation Guide InSpec Profile](#redhat-enterprise-linux-9x-security-technical-implementation-guide-inspec-profile)
18-
* [RedHat 9.x Enterprise Linux Security Technical Implementation Guide (RHEL9 STIG)](#redhat-9x-enterprise-linux-security-technical-implementation-guide-rhel9-stig)
19-
* [Getting Started and Intended Usage](#getting-started-and-intended-usage)
20-
* [Intended Usage - main vs releases](#intended-usage---main-vs-releases)
21-
* [Environment Aware Testing](#environment-aware-testing)
22-
* [Tailoring to Your Environment](#tailoring-to-your-environment)
23-
* [Running the Profile](#running-the-profile)
24-
* [(connected) Running the Profile Directly](#connected-running-the-profile-directly)
25-
* [(disconnected) Running the profile from a local archive copy](#disconnected-running-the-profile-from-a-local-archive-copy)
26-
* [Different Run Options](#different-run-options)
27-
* [Using Heimdall for Viewing Test Results and Exporting for Checklist and eMASS](#using-heimdall-for-viewing-test-results-and-exporting-for-checklist-and-emass)
17+
- [RedHat Enterprise Linux 9.x Security Technical Implementation Guide InSpec Profile](#redhat-enterprise-linux-9x-security-technical-implementation-guide-inspec-profile)
18+
- [RedHat 9.x Enterprise Linux Security Technical Implementation Guide (RHEL9 STIG)](#redhat-9x-enterprise-linux-security-technical-implementation-guide-rhel9-stig)
19+
- [Getting Started and Intended Usage](#getting-started-and-intended-usage)
20+
- [Intended Usage - main vs releases](#intended-usage---main-vs-releases)
21+
- [Environment Aware Testing](#environment-aware-testing)
22+
- [Tailoring to Your Environment](#tailoring-to-your-environment)
23+
- [Running the Profile](#running-the-profile)
24+
- [(connected) Running the Profile Directly](#connected-running-the-profile-directly)
25+
- [(disconnected) Running the profile from a local archive copy](#disconnected-running-the-profile-from-a-local-archive-copy)
26+
- [Different Run Options](#different-run-options)
27+
- [Using Heimdall for Viewing Test Results and Exporting for Checklist and eMASS](#using-heimdall-for-viewing-test-results-and-exporting-for-checklist-and-emass)
2828

2929
## RedHat 9.x Enterprise Linux Security Technical Implementation Guide (RHEL9 STIG)
3030

@@ -38,7 +38,7 @@ The RHEL9.x STIG profile checks were developed to provide technical implementati
3838

3939
### Source Guidance
4040

41-
- RedHat Enterprise Linux 9 Security Technical Implementation Guide v1r2
41+
- RedHat Enterprise Linux 9 Security Technical Implementation Guide v2r4
4242

4343
### Current Profile Statistics
4444

@@ -150,11 +150,12 @@ You can deploy your own instances of Heimdall-Lite or Heimdall Server easily via
150150

151151
# Authors
152152

153-
Defense Information Systems Agency (DISA) https://www.disa.mil/
153+
Defense Information Systems Agency (DISA) <https://www.disa.mil/>
154154

155-
STIG support by DISA Risk Management Team and Cyber Exchange https://public.cyber.mil/
155+
STIG support by DISA Risk Management Team and Cyber Exchange <https://public.cyber.mil/>
156156

157-
MITRE Security Automation Framework Team https://saf.mitre.org
157+
MITRE Security Automation Framework Team <https://saf.mitre.org>
158158

159159
### NOTICE
160-
DISA STIGs are published by DISA IASE, see: https://iase.disa.mil/Pages/privacy_policy.aspx
160+
161+
DISA STIGs are published by DISA IASE, see: <https://iase.disa.mil/Pages/privacy_policy.aspx>

‎container.hardened.inputs.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,4 +276,8 @@ approved_tunnels: []
276276
# Is the target expected to be a virtual machine
277277
virtual_machine: true
278278

279+
# SV-257978
279280
allow_container_openssh_server: false
281+
282+
# SV-257978
283+
physical_protections_employed: false

‎container.vanilla.inputs.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -276,4 +276,8 @@ approved_tunnels: []
276276
# Is the target expected to be a virtual machine
277277
virtual_machine: true
278278

279+
# SV-257978
279280
allow_container_openssh_server: true
281+
282+
# SV-257978
283+
physical_protections_employed: false

‎control_list.txt.bak.20231227000426‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎controls/SV-257777.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,10 @@
1212
If the installed version of RHEL 9 is not supported, this is a finding.'
1313
desc 'fix', 'Upgrade to a supported version of RHEL 9.'
1414
impact 0.7
15-
ref 'DPMS Target Red Hat Enterprise Linux 9'
1615
tag severity: 'high'
1716
tag gtitle: 'SRG-OS-000480-GPOS-00227'
1817
tag gid: 'V-257777'
19-
tag rid: 'SV-257777r925318_rule'
18+
tag rid: 'SV-257777r991589_rule'
2019
tag stig_id: 'RHEL-09-211010'
2120
tag fix_id: 'F-61442r925317_fix'
2221
tag cci: ['CCI-000366']

‎controls/SV-257778.rb‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,10 @@
2323
2424
$ sudo dnf update'
2525
impact 0.5
26-
ref 'DPMS Target Red Hat Enterprise Linux 9'
2726
tag severity: 'medium'
2827
tag gtitle: 'SRG-OS-000480-GPOS-00227'
2928
tag gid: 'V-257778'
30-
tag rid: 'SV-257778r925321_rule'
29+
tag rid: 'SV-257778r991589_rule'
3130
tag stig_id: 'RHEL-09-211015'
3231
tag fix_id: 'F-61443r925320_fix'
3332
tag cci: ['CCI-000366']

0 commit comments

Comments
 (0)