Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Review PCI-DSS requirements and rules for RHEL 10 #12347

Merged
merged 7 commits into from
Aug 28, 2024
Merged

Review PCI-DSS requirements and rules for RHEL 10 #12347

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
78082a7
Include authselect variable in pcidss control file
marcusburghardt Aug 28, 2024
6a750c0
Inform correct hashing algorithm for pcidss rhel10
marcusburghardt Aug 28, 2024
0bc85f2
Clean comments based on RHEL 9
marcusburghardt Aug 28, 2024
0f22bba
Confirm rules not applicable to RHEL 10
marcusburghardt Aug 28, 2024
2aa0b6c
Remove ip6tables rule from pcidss RHEL 10
marcusburghardt Aug 28, 2024
ba21b9c
Remove exclusion for rules already compatible with RHEL 10
marcusburghardt Aug 28, 2024
136edc4
Update profile stability references for pci-dss
marcusburghardt Aug 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions controls/pcidss_4.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2047,6 +2047,7 @@ controls:
status: automated
rules:
- enable_authselect
- var_authselect_profile=sssd
- accounts_passwords_pam_faillock_deny
- var_accounts_passwords_pam_faillock_deny=10
- accounts_passwords_pam_faillock_unlock_time
Expand Down
57 changes: 30 additions & 27 deletions products/rhel10/profiles/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,49 +24,52 @@ description: |-

selections:
- pcidss_4:all
# audit-audispd-plugins package does not exist in RHEL 10 (based on RHEL 9)
# use only package_audispd-plugins_installed
- '!package_audit-audispd-plugins_installed'
- var_password_hashing_algorithm=yescrypt
- var_password_hashing_algorithm_pam=yescrypt

# More tests are needed to identify which rule is conflicting with rpm_verify_permissions.
# https://github.com/ComplianceAsCode/content/issues/11285
- '!rpm_verify_permissions'

# these rules do not apply to RHEL 10
- '!package_audit-audispd-plugins_installed'
- '!service_ntp_enabled'
- '!ntpd_specify_remote_server'
- '!ntpd_specify_multiple_servers'
- '!set_ipv6_loopback_traffic'
- '!set_loopback_traffic'
- '!service_ntpd_enabled'
- '!package_ypserv_removed'
- '!package_ypbind_removed'
- '!package_talk_removed'
- '!package_talk-server_removed'
- '!package_xinetd_removed'
- '!package_rsh_removed'
- '!package_rsh-server_removed'
# Following are incompatible with the rhel10 product (based on RHEL9)
- '!service_chronyd_or_ntpd_enabled'

- '!service_ntp_enabled'
- '!service_ntpd_enabled'
- '!service_timesyncd_enabled'
- '!ntpd_specify_remote_server'
- '!ntpd_specify_multiple_servers'

- '!accounts_passwords_pam_tally2'
- '!accounts_passwords_pam_tally2_unlock_time'
- '!cracklib_accounts_password_pam_dcredit'
- '!cracklib_accounts_password_pam_lcredit'
- '!cracklib_accounts_password_pam_minlen'
- '!cracklib_accounts_password_pam_retry'
- '!ensure_firewall_rules_for_open_ports'
- '!ensure_shadow_group_empty'
- '!ensure_suse_gpgkey_installed'
- '!install_PAE_kernel_on_x86-32'
- '!mask_nonessential_services'
- '!aide_periodic_checking_systemd_timer'
- '!nftables_ensure_default_deny_policy'
- '!cracklib_accounts_password_pam_lcredit'
- '!file_owner_at_allow'
- '!ensure_firewall_rules_for_open_ports'
- '!cracklib_accounts_password_pam_retry'
- '!gnome_gdm_disable_guest_login'
- '!set_ipv6_loopback_traffic'
- '!set_ip6tables_default_rule'
- '!set_loopback_traffic'
- '!set_password_hashing_algorithm_commonauth'

# Following are incompatible with the rhel10 product (based on RHEL9)
- '!service_chronyd_or_ntpd_enabled'
- '!aide_periodic_checking_systemd_timer'
- '!gnome_gdm_disable_unattended_automatic_login'
- '!permissions_local_var_log'
- '!sshd_use_strong_kex'
- '!sshd_use_approved_macs'
- '!permissions_local_var_log'
- '!sshd_use_approved_ciphers'
- '!accounts_passwords_pam_tally2'
- '!ensure_suse_gpgkey_installed'
- '!gnome_gdm_disable_unattended_automatic_login'
- '!accounts_passwords_pam_tally2_unlock_time'
- '!cracklib_accounts_password_pam_minlen'
- '!set_password_hashing_algorithm_commonauth'
- '!cracklib_accounts_password_pam_dcredit'
- '!ensure_shadow_group_empty'
- '!service_timesyncd_enabled'
- '!security_patches_up_to_date'
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel8/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,6 +289,7 @@ selections:
- var_password_pam_dcredit=1
- var_password_pam_lcredit=1
- var_password_pam_minlen=12
- var_authselect_profile=sssd
- var_accounts_passwords_pam_faillock_deny=10
- var_accounts_passwords_pam_faillock_unlock_time=1800
- var_password_pam_tally2=10
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel9/pci-dss.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,6 +281,7 @@ selections:
- var_password_pam_dcredit=1
- var_password_pam_lcredit=1
- var_password_pam_minlen=12
- var_authselect_profile=sssd
- var_accounts_passwords_pam_faillock_deny=10
- var_accounts_passwords_pam_faillock_unlock_time=1800
- var_password_pam_tally2=10
Expand Down
Loading