Control updates introduced for CIS Oracle Linux 8 Benchmark v4.0.0

SCE for Linux v2.8.0 introduces enforcement for Center for Internet Security (CIS) Oracle Linux 8 Benchmark v4.0.0. The transition from the previous CIS Benchmark, v3.0.0, to the new benchmark resulted in module updates.

  • Added

    The following controls are added to the module:

    • 1.1.1.6 - Ensure_overlay_kernel_module_is_not_available

    • 1.1.1.9 - Ensure_firewire_core_kernel_module_is_not_available

    • 1.2.1.5 - Ensure_install_weak_deps_is_disabled

    • 1.5.2 - Ensure_kernel_fs_protected_hardlinks_is_configured

    • 1.5.3 - Ensure_kernel_fs_protected_symlinks_is_configured

    • 1.5.5 - Ensure_kernel_dmesg_restrict_is_configured

    • 1.5.6 - Ensure_kernel_kptr_restrict_is_configured

    • 1.8.7- Ensure_gdm_xwayland_is_disabled

    • 2.1.3 - Ensure_cockpit_is_not_installed

    • 2.4.1.7 - Ensure_access_to_etccron_yearly_is_configured

    • 3.2.1 - Ensure_atm_kernel_module_is_not_available

    • 3.2.2 - Ensure_can_kernel_module_is_not_available

    • 3.3.1.1-3.3.1.18: These 18 individual IPv4 sysctl controls replace aggregate controls from v3.0.0.

    • 3.3.2.1-3.3.2.8: These 8 individual IPv6 sysctl controls replace aggregate controls from v3.

    • 4.1.1 - Ensure_firewalld_is_installed

    • 4.1.2 - Ensure_firewalld_backend_is_configured

    • 4.1.3 - Ensure_firewalld_service_is_enabled_and_active

    • 4.1.4 - Ensure_firewalld_default_zone_is_configured

    • 5.1.3 - Ensure_access_to_etcsysconfig_sshd_is_configured

    • 5.1.11 - Ensure_sshd_gssapiauthentication_is_configured

    • 5.4.1.2 - Ensure_minimum_password_age_is_configured

    • 5.4.2.3 - Ensure_root_is_the_only_uid_0_account

    • 5.4.2.4 - Ensure_root_account_access_is_controlled

    • 5.4.2.8 - Ensure_accounts_without_a_valid_login_shell_are_locked

    • 6.2.1.1.4 - Ensure_journald_forwardtosyslog_is_disabled

    • 6.3.3.20 - Ensure_audit_configuration_is_loaded_with_no_errors

  • Removed

    The following controls existed in v3.0.0 and have no equivalent in v4.0.0:

    • 3.4 (entire) - The nftables section is replaced by the firewalld section, 4.1.

    • 3.4.1.2 - Ensure_a_single_firewall_configuration_utility_is_in_use

    • 3.4.2.2 - Ensure_host_based_firewall_loopback_traffic_is_configured

  • Changed

    • In this list of renamed controls, the v3.0.0 name is shown first, followed by the v4.0.0 name. If you customized control_configs values in Hiera, you must update the customized keys before upgrading:

    • Section 1 - Initial Setup

      • Ensure_gpgcheck_is_globally_activated
        Ensure_gpgcheck_is_configured

      • Ensure_permissions_on_bootloader_config_are_configured Ensure_access_to_bootloader_config_is_configured

      • Ensure_ptrace_scope_is_restricted
        Ensure_kernel_yama_ptrace_scope_is_configured

      • Ensure_address_space_layout_randomization_aslr_is_enabled Ensure_kernel_randomize_va_space_is_configured

      • Ensure_core_dump_backtraces_are_disabled
        Ensure_systemd_coredump_processsizemax_is_configured

      • Ensure_core_dump_storage_is_disabled
        Ensure_systemd_coredump_storage_is_configured

      • Ensure_system_wide_crypto_policy_disables_macs_less_than_128_bits
        Ensure_system_wide_crypto_policy_macs_are_configured

      • Ensure_message_of_the_day_is_configured_properly
        Ensure_etcmotd_is_configured

      • Ensure_local_login_warning_banner_is_configured_properly
        Ensure_etcissue_is_configured

      • Ensure_remote_login_warning_banner_is_configured_properly Ensure_etcissue_net_is_configured

      • Ensure_gdm_disable_user_list_option_is_enabled Ensure_gdm_disable_user_list_is_configured

    • Section 2 — Services (cron/at)

      • Ensure_permissions_on_etccrontab_are_configured
        Ensure_access_to_etccrontab_is_configured

      • Ensure_permissions_on_etccron_hourly_are_configured
        Ensure_access_to_etccron_hourly_is_configured

      • Ensure_permissions_on_etccron_daily_are_configured
        Ensure_access_to_etccron_daily_is_configured

      • Ensure_permissions_on_etccron_weekly_are_configured
        Ensure_access_to_etccron_weekly_is_configured

      • Ensure_permissions_on_etccron_monthly_are_configured Ensure_access_to_etccron_monthly_is_configured

      • Ensure_crontab_is_restricted_to_authorized_users Ensure_access_to_crontab_is_configured

      • Ensure_at_is_restricted_to_authorized_users
        Ensure_access_to_at_is_configured

    • Section 5 — Access, Authentication, Authorization

      • Ensure_permissions_on_etcsshsshd_config_are_configured Ensure_access_to_etcsshsshd_config_is_configured

      • Ensure_permissions_on_ssh_private_host_key_files_are_configured
        Ensure_access_to_ssh_private_host_key_files_is_configured

      • Ensure_permissions_on_ssh_public_host_key_files_are_configured
        Ensure_access_to_ssh_public_host_key_files_is_configured

      • Ensure_sudo_authentication_timeout_is_configured_correctly Ensure_sudo_timestamp_timeout_is_configured

      • Ensure_password_expiration_is_365_days_or_less
        Ensure_password_expiration_is_configured

      • Ensure_password_expiration_warning_days_is_7_or_more Ensure_password_expiration_warning_days_is_configured

      • Ensure_inactive_password_lock_is_30_days_or_less
        Ensure_inactive_password_lock_is_configured

      • Ensure_system_accounts_are_secured
        Ensure_system_accounts_do_not_have_a_valid_login_shell

      • Ensure_default_group_for_the_root_account_is_gid_0
        Ensure_root_is_the_only_gid_0_account

  • Section 6 — Logging and Auditing (journald)

    • Ensure_journald_service_is_enabled
      Ensure_journald_service_is_active

    • Ensure_journald_is_configured_to_write_logfiles_to_persistent_disk Ensure_journald_storage_is_configured

    • Ensure_journald_is_configured_to_compress_large_log_files
      Ensure_journald_compress_is_configured

    • Ensure_systemd_journal_remote_is_configured
      Ensure_systemd_journal_remote_authentication_is_configured

    • Ensure_systemd_journal_remote_is_enabled
      Ensure_systemd_journal_upload_is_enabled_and_active

    • Ensure_journald_is_not_configured_to_receive_logs_from_a_remote_client
      Ensure_systemd_journal_remote_service_is_not_in_use

    • Ensure_all_logfiles_have_appropriate_access_configured
      Ensure_access_to_all_logfiles_has_been_configured

  • The following controls kept their names but changed enforcement values.

    Control v3.0.0 v4.0.0
    Ensure_access_to_bootloader_config_is_configured Mode 0700 Mode 0600
    Ensure_system_wide_crypto_policy_macs_are_configured Excludes MACs with < 64-bit digests Excludes MACs with < 64-bit and < 128-bit digests
    Ensure_gpgcheck_is_configured Targets
    /etc/yum.conf    		 Targets
    /etc/dnf/dnf.conf
    Ensure_system_accounts_do_not_have_a_valid_login_shell Enforce_nologin was silently false Enforce_nologin: true — enforcement now active
    Ensure_root_is_the_only_gid_0_account Enforce_root_default_gid was silently false Enforce_root_default_gid: true — enforcement now active