99 lines
1.8 KiB
YAML
99 lines
1.8 KiB
YAML
|
---
|
||
|
|
cis_benchmark_version: "1.2.0"
|
||
|
|
|
||
|
|
cis_disable_root_login: true
|
||
|
|
cis_disable_password_auth: false
|
||
|
|
cis_enable_network_hardening: true
|
||
|
|
cis_enable_password_policy: true
|
||
|
|
cis_enable_audit: false
|
||
|
|
cis_manage_mount_options: false
|
||
|
|
|
||
|
|
cis_ssh_max_auth_tries: 4
|
||
|
|
cis_ssh_login_grace_time: 60
|
||
|
|
cis_ssh_client_alive_interval: 300
|
||
|
|
cis_ssh_client_alive_count_max: 3
|
||
|
|
cis_ssh_config_path: /etc/ssh/sshd_config
|
||
|
|
cis_sshd_test_command: sshd -t
|
||
|
|
|
||
|
|
cis_min_root_free_mb: 1024
|
||
|
|
|
||
|
|
cis_password_minlen: 14
|
||
|
|
cis_password_histsize: 10
|
||
|
|
cis_password_maxage_weeks: 12
|
||
|
|
cis_password_minalpha: 1
|
||
|
|
cis_password_minother: 1
|
||
|
|
cis_password_maxrepeats: 2
|
||
|
|
cis_password_minage_weeks: 1
|
||
|
|
cis_login_retries: 5
|
||
|
|
cis_login_lockout: 30
|
||
|
|
|
||
|
|
cis_required_commands:
|
||
|
|
- lsattr
|
||
|
|
- chdev
|
||
|
|
- lssrc
|
||
|
|
- chsec
|
||
|
|
- lssec
|
||
|
|
- pwdadm
|
||
|
|
- "no"
|
||
|
|
- audit
|
||
|
|
- cron
|
||
|
|
|
||
|
|
cis_ssh_candidate_paths:
|
||
|
|
- /usr/sbin/sshd
|
||
|
|
- /usr/bin/sshd
|
||
|
|
- /opt/freeware/sbin/sshd
|
||
|
|
- /opt/freeware/bin/sshd
|
||
|
|
|
||
|
|
cis_network_no_settings:
|
||
|
|
ipforwarding: "0"
|
||
|
|
ipsendredirects: "0"
|
||
|
|
ipignoreredirects: "1"
|
||
|
|
ipsrcrouteforward: "0"
|
||
|
|
clean_partial_conns: "1"
|
||
|
|
tcp_pmtu_discover: "0"
|
||
|
|
|
||
|
|
cis_network_nfso_settings: {}
|
||
|
|
|
||
|
|
cis_legacy_inetd_services:
|
||
|
|
- telnet
|
||
|
|
- shell
|
||
|
|
- login
|
||
|
|
- exec
|
||
|
|
- comsat
|
||
|
|
- talk
|
||
|
|
- ntalk
|
||
|
|
- tftp
|
||
|
|
- uucp
|
||
|
|
- finger
|
||
|
|
|
||
|
|
cis_src_subsystems:
|
||
|
|
- sshd
|
||
|
|
- inetd
|
||
|
|
- syslogd
|
||
|
|
- audit
|
||
|
|
|
||
|
|
cis_mount_option_targets:
|
||
|
|
- path: /tmp
|
||
|
|
options:
|
||
|
|
- nosuid
|
||
|
|
- path: /var/tmp
|
||
|
|
options:
|
||
|
|
- nosuid
|
||
|
|
|
||
|
|
cis_manage_sudo: true
|
||
|
|
cis_sudoers_path: /etc/sudoers
|
||
|
|
cis_sudo_logfile: /var/log/sudo.log
|
||
|
|
cis_sudo_use_pty: true
|
||
|
|
|
||
|
|
cis_cron_allow_path: /var/adm/cron/cron.allow
|
||
|
|
cis_cron_deny_path: /var/adm/cron/cron.deny
|
||
|
|
cis_at_allow_path: /var/adm/cron/at.allow
|
||
|
|
cis_at_deny_path: /var/adm/cron/at.deny
|
||
|
|
cis_cron_directories:
|
||
|
|
- /var/adm/cron
|
||
|
|
- /var/spool/cron
|
||
|
|
- /var/spool/cron/crontabs
|
||
|
|
|
||
|
|
cis_syslog_config_path: /etc/syslog.conf
|
||
|
|
cis_audit_config_path: /etc/security/audit/config
|