Version 2.8.0

Released 28 July 2026

With SCE for Linux v2.8.0, you can strengthen your security posture by assessing system configurations against updated CIS Benchmarks for Red Hat Enterprise Linux 8 and related operating systems. This release also updates the puppetlabs-stdlib dependency and resolves issues affecting firewall zone enforcement, the Advanced Intrusion Detection Environment (AIDE), and log forwarding.

New features and enhancements

• Updated CIS Benchmarks. The Center for Internet Security (CIS) Benchmarks are updated from v3.0.0 to v4.0.0 for the following operating systems:

  • Red Hat Enterprise Linux (RHEL) 8

  • AlmaLinux 8

  • Oracle Linux 8
    
    

For Rocky Linux 8, the CIS Benchmark is updated from v2.0.0 to v3.0.0.

For detailed information about controls that were added, changed, or removed, see the following topics:

• Control updates introduced for CIS Red Hat Enterprise Linux 8 Benchmark v4.0.0

• Control updates introduced for CIS AlmaLinux 8 Benchmark v4.0.0

• Control updates introduced for CIS Oracle Linux 8 Benchmark v4.0.0

• Control updates introduced for CIS Rocky Linux 8 Benchmark v3.0.0

• Updated dependency. To take advantage of improvements in the puppetlabs-stdlib module, SCE for Linux now supports the latest module versions:
  puppetlabs-stdlib: ≥ 9.2.0 < 11.0.0
  To help avoid operational issues, do not use earlier versions of the puppetlabs-stdlib module.
  

Resolved issues

• Default_zone setting not enforced. Previously, the user-specified default_zone setting was not enforced for CIS control 3.4.1.2 - Ensure a single firewall configuration utility is in use. The issue is now resolved to ensure that users can enforce their specified zone setting.

• aide --init command fails. Previously, the aide --init command failed for version 8 users of the RHEL, AlmaLinux, Oracle Linux, and Rocky Linux operating systems, which are shipped with AIDE 0.16.x. The failure occurred because the database directive was renamed from database= in AIDE 0.16 to database_in= in AIDE 0.17. To resolve the issue, the deprecated database directive was updated in SCE for users of RHEL 8 and similar operating systems.

• Log forwarding control fails to work as designed. The purpose of CIS control 6.2.2.2 is to prevent journald logging data from being forwarded to the system log. This control failed to work as designed on versions 9 and 10 of the RHEL, AlmaLinux, Oracle Linux, and Rocky Linux operating systems. To resolve the issue, the configuration of CIS control 6.2.2.2 was updated, and CIS control 6.2.3.3 was added.