From f3e6ef75a941307be8a203ac06c40b8f6b79e8ef Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 30 Sep 2021 13:43:34 -0500 Subject: [PATCH] Add rule for RHEL8 CIS 5.2.16 and RHEL7 CIS 5.3.19 Fixes #5526 --- controls/cis_rhel7.yml | 4 +++- controls/cis_rhel8.yml | 6 +++--- .../services/ssh/ssh_server/sshd_enable_pam/rule.yml | 11 +++++++++-- shared/references/cce-redhat-avail.txt | 3 --- 4 files changed, 15 insertions(+), 9 deletions(-) diff --git a/controls/cis_rhel7.yml b/controls/cis_rhel7.yml index bd68e32ed99..dcc639072d7 100644 --- a/controls/cis_rhel7.yml +++ b/controls/cis_rhel7.yml @@ -1841,7 +1841,9 @@ controls: levels: - l1_server - l1_workstation - automated: no # rule missing + status: automated + rules: + - sshd_enable_pam - id: 5.3.20 title: Ensure SSH AllowTcpForwarding is disabled (Automated) diff --git a/controls/cis_rhel8.yml b/controls/cis_rhel8.yml index cbe1fc4e6a4..a505c4e80d4 100644 --- a/controls/cis_rhel8.yml +++ b/controls/cis_rhel8.yml @@ -1751,14 +1751,14 @@ controls: - l1_workstation automated: no - # NEEDS RULE - # https://github.com/ComplianceAsCode/content/issues/5526 - id: 5.2.16 title: Ensure SSH PAM is enabled (Automated) levels: - l1_server - l1_workstation - automated: no + status: automated + rules: + - sshd_enable_pam - id: 5.2.17 title: Ensure SSH AllowTcpForwarding is disabled (Automated) diff --git a/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml b/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml index fe02c963e58..75a5855c196 100644 --- a/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml +++ b/linux_os/guide/services/ssh/ssh_server/sshd_enable_pam/rule.yml @@ -18,14 +18,21 @@ rationale: |- the account. Additionally, you can make sure users inherit certain environment variables on login or disallow access to the server. +severity: medium + +identifiers: + cce@rhel7: CCE-86720-0 + cce@rhel8: CCE-86721-8 + cce@rhel9: CCE-86722-6 + references: + cis@rhel7: 5.3.19 + cis@rhel8: 5.2.16 cis@ubuntu2004: 5.2.19 disa: CCI-000877 srg: SRG-OS-000125-GPOS-00065 stigid@ubuntu2004: UBTU-20-010035 -severity: medium - ocil_clause: 'it is commented out or is not enabled' ocil: |- diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 46f9559ea84..5e5b9d17897 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -805,9 +805,6 @@ CCE-86716-8 CCE-86717-6 CCE-86718-4 CCE-86719-2 -CCE-86720-0 -CCE-86721-8 -CCE-86722-6 CCE-86723-4 CCE-86724-2 CCE-86725-9