Control updates introduced for CIS Rocky Linux 8 Benchmark v2.0.0

1.1.1.3 - Ensure hfs kernel module is not available

1.1.1.4 - Ensure hfsplus kernel module is not available

1.1.1.5 - Ensure jffs2 kernel module is not available

1.1.1.6 - Ensure squashfs kernel module is not available

1.1.1.7 - Ensure udf kernel module is not available

1.1.1.8 - Ensure usb-storage kernel module is not available

1.4.2 - Ensure ptrace_scope is restricted

1.6.1 - Ensure system wide crypto policy is not set to legacy

1.6.2 - Ensure system wide crypto policy disables sha1 hash and signature support

1.6.3 - Ensure system wide crypto policy disables cbc for ssh

1.6.4 - Ensure system wide crypto policy disables macs less than 128 bits

1.7.4 - Ensure access to /etc/motd is configured

1.7.5 - Ensure access to /etc/issue is configured

1.7.6 - Ensure access to /etc/issue.net is configured

1.8.3 - Ensure GDM disableuser-list option is enabled

1.8.4 - Ensure GDM screen locks when the user is idle

1.8.5 - Ensure GDM screen locks cannot be overridden

1.8.6 - Ensure GDM automatic mounting of removable media is disabled

1.8.7 - Ensure GDM disabling automatic mounting of removable media is not overridden

1.8.8 - Ensure GDM autorun-never is enabled

1.8.9 - Ensure GDM autorun-never is not overridden

2.1.3 - Ensure chrony is not run as the root user

2.2.1 - Ensure autofs services are not in use

2.2.2 - Ensure avahi daemon services are not in use

2.2.3 - Ensure dhcp server services are not in use

2.2.4 - Ensure dns server services are not in use

2.2.5 - Ensure dnsmasq services are not in use

2.2.6 - Ensure samba file server services are not in use

2.2.7 - Ensure ftp server services are not in use

2.2.8 - Ensure message access server services are not in use

2.2.9 - Ensure network file system services are not in use

2.2.10 - Ensure nis server services are not in use

2.2.11 - Ensure print server services are not in use

2.2.12 - Ensure rpcbind services are not in use

2.2.13 - Ensure rsync services are not in use

2.2.14 - Ensure snmp services are not in use

2.2.15 - Ensure telnet server services are not in use

2.2.16 - Ensure tftp server services are not in use

2.2.17 - Ensure web proxy server services are not in use

2.2.18 - Ensure web server services are not in use

2.2.19 - Ensure xinetd services are not in use

2.2.20 - Ensure X window server services are not in use

2.2.21 - Ensure mail transfer agents are configured for local-only mode

2.3.1 - Ensure ftp client is not installed

2.3.2 - Ensure ldap client is not installed

2.3.3 - Ensure nis client is not installed

2.3.5 - Ensure tftp client is not installed

3.1.3 - Ensure bluetooth services are not in use

3.2.1 - Ensure dccp kernel module is not available

3.2.2 - Ensure tipc kernel module is not available

3.2.3 - Ensure rds kernel module is not available

3.2.4 - Ensure sctp kernel module is not available

3.3.1 - Ensure ip forwarding is disabled

3.3.3 - Ensure bogus icmp responses are ignored

3.3.4 - Ensure broadcast icmp requests are ignored

3.3.5 - Ensure icmp redirects are not accepted

3.3.6 - Ensure secure icmp redirects are not accepted

3.3.7 - Ensure reverse path filtering is enabled

3.3.10 - Ensure tcp syn cookies is enabled

3.3.11 - Ensure ipv6 router advertisements are not accepted

3.4.1.2 - Ensure a single firewall configuration utility is in use

3.4.2.2 - Ensure host based firewall loopback traffic is configured

4.1.1.1 - Ensure cron daemon is enabled and active

4.1.1.8 - Ensure crontab is restricted to authorized users

4.2.4 - Ensure sshd access is configured

4.2.5 - Ensure sshd Banner is configured

4.2.6 - Ensure sshd Ciphers are configured

4.2.7 - Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured

4.2.8 - Ensure sshd DisableForwarding is enabled

4.2.9 - Ensure sshd HostbasedAuthentication is disabled

4.2.10 - Ensure sshd IgnoreRhosts is enabled

4.2.11 - Ensure sshd KexAlgorithms is configured

4.2.12 - Ensure sshd LoginGraceTime is configured

4.2.13 - Ensure sshd LogLevel is configured

4.2.14 - Ensure sshd MACs are configured

4.2.15 - Ensure sshd MaxAuthTries is configured

4.2.16 - Ensure sshd MaxSessions is configured

4.2.17 - Ensure sshd MaxStartups is configured

4.2.18 - Ensure sshd PermitEmptyPasswords is disabled

4.2.19 - Ensure sshd PermitRootLogin is disabled

4.2.20 - Ensure sshd PermitUserEnvironment is disabled

4.2.21 - Ensure sshd UsePAM is enabled

4.2.22 - Ensure sshd crypto_policy is not set

4.4.1.1 - Ensure latest version of pam is installed

4.4.3.1.1 - Ensure password failed attempts lockout is configured

4.4.3.1.2 - Ensure password unlock time is configured

4.4.3.1.3 - Ensure password failed attempts lockout includes root account

4.4.3.2.1 - Ensure password number of changed characters is configured

4.4.3.2.2 - Ensure password length is configured

4.4.3.2.3 - Ensure password complexity is configured

4.4.3.2.4 - Ensure password same consecutive characters is configured

4.4.3.2.5 - Ensure password maximum sequential characters is configured

4.4.3.2.6 - Ensure password dictionary check is enabled

4.4.3.2.7 - Ensure password quality is enforced for the root user

4.4.3.3.1 - Ensure password history remember is configured

4.4.3.3.2 - Ensure password history is enforced for the root user

4.4.3.3.3 - Ensure pam_pwhistory includes use_authtok

4.4.3.4.1 - Ensure pam_unix does not include nullok

4.4.3.4.2 - Ensure pam_unix does not include remember

4.4.3.4.3 - Ensure pam_unix includes a strong password hashing algorithm

4.4.3.4.4 - Ensure pam_unix includes use_authtok

4.5.1.1 - Ensure strong password hashing algorithm is configured

4.5.2.2 - Ensure root user umask is configured

4.5.3.1 - Ensure nologin is not listed in /etc/shells

4.5.3.2 - Ensure default user shell timeout is configured

4.5.3.3 - Ensure default user umask is configured

5.1.1.7 - Ensure rsyslog is not configured to receive logs from a remote client

5.1.2.1.4 - Ensure journald is not configured to receive logs from a remote client

5.1.4 - Ensure all logfiles have appropriate access configured

5.2.1.1 - Ensure audit is installed

5.2.2.4 - Ensure system warns when audit logs are low on space

5.2.4.1 - Ensure the audit log directory is 0750 or more restrictive

5.2.4.2 - Ensure audit log files are mode 0640 or less permissive

5.2.4.3 - Ensure only authorized users own audit log files

5.2.4.4 - Ensure only authorized groups are assigned ownership of audit log files

5.2.4.5 - Ensure audit configuration files are 640 or more restrictive

5.2.4.6 - Ensure audit configuration files are owned by root

5.2.4.7 - Ensure audit configuration files belong to group root

5.2.4.8 - Ensure audit tools are 755 or more restrictive

5.2.4.9 - Ensure audit tools are owned by root

5.2.4.10 - Ensure audit tools belong to group root

5.3.3 - Ensure cryptographic mechanisms are used to protect the integrity of audit tools

6.1.10 - Ensure permissions on /etc/shells are configured

6.1.11 - Ensure world writable files and directories are secured

6.1.12 - Ensure no unowned or ungrouped files or directories exist

6.1.3 - Ensure permissions on /etc/opasswd are configured

1.4.4 - Ensure core dump storage is disabled - updated from 1.5.1.

1.5.1.1 - Ensure SELinux is installed - updated from 1.6.1.1.

1.5.1.2 - Ensure SELinux is not disabled in bootloader configuration - updated from 1.6.1.2.

1.5.1.3 - Ensure SELinux policy is configured - updated from 1.6.1.3.

1.5.1.4 - Ensure the SELinux mode is not disabled - updated from 1.6.1.4.

1.5.1.5 - Ensure the SELinux mode is enforcing - updated from 1.6.1.5.

1.5.1.6 - Ensure no unconfined services exist - updated from 1.6.1.6.

1.5.1.7 - Ensure the MCS Translation Service (mcstrans) is not installed - updated from 1.6.1.8.

1.5.1.8 - Ensure SETroubleshoot is not installed - updated from 1.6.1.7.

1.8.10 - Ensure XDMCP is not enabled - updated from 1.8.4.

3.1.2 - Ensure wireless interfaces are disabled - updated from 3.1.4.

3.3.2 - Ensure packet redirect sending is disabled - updated from 3.2.2.

3.3.8 - Ensure source routed packets are not accepted - updated from 3.3.1.

3.3.9 - Ensure suspicious packets are logged - updated from 3.3.4.

4.1.1.2 - Ensure permissions on /etc/crontab are configured - updated from 5.1.2.

4.1.1.3 - Ensure permissions on /etc/cron.hourly are configured - updated from 5.1.3.

4.1.1.4 - Ensure permissions on /etc/cron.daily are configured - updated from 5.1.4.

4.1.1.5 - Ensure permissions on /etc/cron.weekly are configured - updated from 5.1.5.

4.1.1.6 - Ensure permissions on /etc/cron.monthly are configured - updated from 5.1.6.

4.1.1.7 - Ensure permissions on /etc/cron.d are configured - updated from 5.1.7.

4.1.2.1 - Ensure at is restricted to authorized users - updated from 5.1.9.

This control helps to enforce secure configurations for at jobs. Authorized users or groups define permissions for at jobs by specifying the at.allow and at.deny files.

The control enforces a default setting of manage_at_deny=true, which means that the module manages the owner, group, and permissions of the at.deny file. If the at.deny file exists, only the assigned user or group has read and write access. If the value is changed to false, the module does not control the owner, group, or permissions.

The control also manages file purging. The default setting is purge_at_deny=false, which means that the at.deny file will not be removed from disk. If the value is changed to true, the file will be removed from disk.

4.2.1 - Ensure permissions on /etc/ssh/sshd_config are configured - updated from 5.2.1.

4.2.2 - Ensure permissions on SSH private host key files are configured - updated from 5.2.2.

4.2.3 - Ensure permissions on SSH public host key files are configured - updated from 5.2.3.

4.3.1 - Ensure sudo is installed - updated from 5.3.1.

4.3.2 - Ensure sudo commands use pty - updated from 5.3.2.

4.3.3 - Ensure sudo log file exists - updated from 5.3.3.

4.3.4 - Ensure users must provide password for escalation - updated from 5.3.4.

4.3.5 - Ensure reauthentication for privilege escalation is not disabled globally - updated from 5.3.5.

4.3.6 - Ensure sudo authentication timeout is configured correctly - updated from 5.3.6.

4.3.7 - Ensure access to the su command is restricted - updated from 5.3.7.

4.5.1.2 - Ensure password expiration is 365 days or less - updated from 5.6.1.1.

4.5.1.3 - Ensure password expiration warning days is 7 or more - updated from 5.6.1.3.

4.5.1.4 - Ensure inactive password lock is 30 days or less - updated from 5.6.1.4.

4.5.2.1 - Ensure default group for the root account is GID 0 - updated from 5.6.4.

4.5.2.3 - Ensure system accounts are secured - updated from 5.6.2.

5.1.1.1 - Ensure rsyslog is installed - updated from 4.2.1.1.

5.1.1.2 - Ensure rsyslog service is enabled - updated from 4.2.1.2.

5.1.1.3 - Ensure journald is configured to send logs to rsyslog - updated from 4.2.1.3.

5.1.1.4 - Ensure rsyslog default file permissions are configured - updated from 4.2.1.4.

5.1.1.5 - Ensure logging is configured - updated from 4.2.1.5.

5.1.1.6 - Ensure rsyslog is configured to send logs to a remote log host - updated from 4.2.1.6.

5.1.2.1.1 - Ensure systemdjournal-remote is installed - updated from 4.2.2.1.1.

5.1.2.1.2 - Ensure journald service is enabled - updated from 4.2.2.1.2.

5.1.2.1.3 - Ensure systemdjournal-remote is enabled - updated from 4.2.2.1.3.

5.1.2.2 - Ensure journald service is enabled – updated from 4.2.2.2.

5.1.2.3 - Ensure journald is configured to compress large log files - updated from 4.2.2.3.

5.1.2.4 - Ensure journald is configured to write logfiles to persistent disk - updated from 4.2.2.4.

5.1.3 - Ensure logrotate is configured - updated from 4.3.

5.2.1.2 - Ensure auditing for processes that start prior to auditd is enabled - updated from 4.1.1.3.

5.2.1.3 - Ensure audit_backlog_limit is sufficient - updated from 4.1.1.4.

5.2.1.4 - Ensure auditd service is enabled - updated from 4.1.1.2.

5.2.2.1 - Ensure audit log storage size is configured - updated from 4.1.2.1.

5.2.2.2 - Ensure audit logs are not automatically deleted - updated from 4.1.2.2.

5.2.2.3 - Ensure system is disabled when audit logs are full - updated from 4.1.2.3. Parameter values are updated. The disk_full_action and the disk_error_action parameters now have a default value of halt.

5.2.3.1 - Ensure changes to system administration scope (sudoers) is collected - updated from 4.1.3.1.

5.2.3.2 - Ensure actions as another user are always logged - updated from 4.1.3.2.

5.2.3.3 - Ensure events that modify the sudo log file are collected - updated from 4.1.3.3.

5.2.3.4 - Ensure events that modify date and time information are collected - updated from 4.1.3.4.

5.2.3.5 - Ensure events that modify the system's network environment are collected - updated from 4.1.3.5.

5.2.3.6 - Ensure use of privileged commands are collected - updated from 4.1.3.6.

5.2.3.7 - Ensure unsuccessful file access attempts are collected - updated from 4.1.3.7.

5.2.3.8 - Ensure events that modify user/group information are collected - updated from 4.1.3.8.

5.2.3.9 - Ensure discretionary access control permission modification events are collected - updated from 4.1.3.9.

5.2.3.10 - Ensure successful file system mounts are collected - updated from 4.1.3.10.

5.2.3.11 - Ensure session initiation information is collected - updated from 4.1.3.11.

5.2.3.12 - Ensure login and logout events are collected - updated from 4.1.3.12.

5.2.3.13 - Ensure file deletion events by users are collected - updated from 4.1.3.13.

5.2.3.14 - Ensure events that modify the system's Mandatory Access Controls are collected - updated from 4.1.3.14.

5.2.3.15 - Ensure successful and unsuccessful attempts to use the chcon command are recorded - updated from 4.1.3.15.

5.2.3.16 - Ensure successful and unsuccessful attempts to use the setfacl command are recorded - updated from 4.1.3.16.

5.2.3.17 - Ensure successful and unsuccessful attempts to use the chacl command are recorded - updated from 4.1.3.17.

5.2.3.18 - Ensure successful and unsuccessful attempts to use the usermod command are recorded - updated from 4.1.3.18.

5.2.3.19 - Ensure kernel module loading unloading and modification is collected - updated from 4.1.3.19.

5.2.3.20 - Ensure the audit configuration is immutable - updated from 4.1.3.20.

5.3.1 - Ensure AIDE is installed - updated from 1.3.1.

5.3.2 - Ensure filesystem integrity is regularly checked - updated from 1.3.2.

6.1.1 - Ensure permissions on /etc/passwd are configured - updated from 6.1.3.

6.1.2 - Ensure permissions on /etc/passwd- are configured - updated from 6.1.7.

6.1.4 - Ensure permissions on /etc/group are configured - updated from 6.1.5.

6.1.5 - Ensure permissions on /etc/group- are configured - updated from 6.1.9.

6.1.6 - Ensure permissions on /etc/shadow are configured - updated from 6.1.4.

6.1.7 - Ensure permissions on /etc/shadow- are configured - updated from 6.1.8.

6.1.8 - Ensure permissions on /etc/gshadow are configured - updated from 6.1.6.

6.1.9 - Ensure permissions on /etc/gshadow- are configured - updated from 6.1.10.