81 lines
1.9 KiB
YAML
81 lines
1.9 KiB
YAML
|
---
|
||
|
|
cis_benchmark_version: "2.0.0"
|
||
|
|
|
||
|
|
cis_disable_root_login: true
|
||
|
|
cis_disable_password_auth: false
|
||
|
|
cis_install_auditd: true
|
||
|
|
cis_enable_chrony: true
|
||
|
|
cis_enable_rsyslog: true
|
||
|
|
cis_remove_legacy_packages: true
|
||
|
|
cis_enable_sysctl_hardening: true
|
||
|
|
cis_manage_mount_options: false
|
||
|
|
|
||
|
|
cis_ssh_max_auth_tries: 4
|
||
|
|
cis_ssh_login_grace_time: 60
|
||
|
|
cis_ssh_client_alive_interval: 300
|
||
|
|
cis_ssh_client_alive_count_max: 3
|
||
|
|
cis_ssh_dropin_path: /etc/ssh/sshd_config.d/50-cis-rhel9-hardening.conf
|
||
|
|
|
||
|
|
cis_min_root_free_mb: 1024
|
||
|
|
|
||
|
|
cis_legacy_packages:
|
||
|
|
- telnet
|
||
|
|
- rsh-server
|
||
|
|
- ypbind
|
||
|
|
|
||
|
|
cis_legacy_services:
|
||
|
|
- telnet.socket
|
||
|
|
- rsh.socket
|
||
|
|
- rexec.socket
|
||
|
|
- rlogin.socket
|
||
|
|
- ypbind.service
|
||
|
|
|
||
|
|
cis_sysctl_settings:
|
||
|
|
net.ipv4.ip_forward: 0
|
||
|
|
net.ipv4.conf.all.send_redirects: 0
|
||
|
|
net.ipv4.conf.default.send_redirects: 0
|
||
|
|
net.ipv4.conf.all.accept_source_route: 0
|
||
|
|
net.ipv4.conf.default.accept_source_route: 0
|
||
|
|
net.ipv4.conf.all.accept_redirects: 0
|
||
|
|
net.ipv4.conf.default.accept_redirects: 0
|
||
|
|
net.ipv4.tcp_syncookies: 1
|
||
|
|
|
||
|
|
cis_sysctl_config_file: /etc/sysctl.d/60-cis-rhel9-hardening.conf
|
||
|
|
|
||
|
|
cis_audit_rules_path: /etc/audit/rules.d/50-cis-rhel9-hardening.rules
|
||
|
|
cis_audit_backlog_limit: 8192
|
||
|
|
cis_audit_rules:
|
||
|
|
- "-w /etc/passwd -p wa -k identity"
|
||
|
|
- "-w /etc/shadow -p wa -k identity"
|
||
|
|
- "-w /etc/group -p wa -k identity"
|
||
|
|
- "-w /etc/gshadow -p wa -k identity"
|
||
|
|
- "-w /etc/sudoers -p wa -k scope"
|
||
|
|
- "-w /etc/sudoers.d/ -p wa -k scope"
|
||
|
|
- "-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change"
|
||
|
|
|
||
|
|
cis_sudoers_dropin_path: /etc/sudoers.d/50-cis-rhel9-hardening
|
||
|
|
cis_sudo_logfile: /var/log/sudo.log
|
||
|
|
|
||
|
|
cis_mount_option_targets:
|
||
|
|
- path: /tmp
|
||
|
|
options:
|
||
|
|
- nodev
|
||
|
|
- nosuid
|
||
|
|
- noexec
|
||
|
|
- path: /var/tmp
|
||
|
|
options:
|
||
|
|
- nodev
|
||
|
|
- nosuid
|
||
|
|
- noexec
|
||
|
|
- path: /home
|
||
|
|
options:
|
||
|
|
- nodev
|
||
|
|
|
||
|
|
cis_container_virtualization_types:
|
||
|
|
- container
|
||
|
|
- docker
|
||
|
|
- lxc
|
||
|
|
- podman
|
||
|
|
- containerd
|
||
|
|
- systemd-nspawn
|