Product:
BigFix Compliance
Title:
Updated CIS Checklist for Red Hat Enterprise Linux 9
Security Benchmark:
CIS Red Hat Enterprise Linux 9 Benchmark , V3.0.0
Published Sites:
CIS Checklist for Red Hat Enterprise Linux 9, site version 20
(The site version is provided for air-gap customers.)
Details:
Total New Fixlets: 85
Total Updated Fixlets: 30
Total Deleted Fixlets: 34
Total Fixlets in Site: 344
New Fixlets:
Ensure a graphical user interface is not in use
Ensure a rsyslog TLS network stream driver is installed
Ensure access on sudoers configuration files is configured
Ensure access on the /etc/sudoers.d directory is configured
Ensure access to /etc/cron.yearly is configured
Ensure access to /etc/ssh/sshd_config.d/ directory is configured
Ensure access to rsyslog configuration files is configured
Ensure access to the /etc/rsyslog.d directory is configured
Ensure access to the rsyslog work directory is configured
Ensure atm kernel module is not available
Ensure authentication is required when booting into emergency mode
Ensure authentication is required when booting into rescue mode
Ensure can kernel module is not available
Ensure cockpit web services are not in use
Ensure conflicting firewall utilities are not in use with firewalld
Ensure core file size is configured
Ensure default user umask is configured in /etc/login.defs
Ensure discretionary access control permission modification events chmod,fchmod,fchmodat are collected
Ensure discretionary access control permission modification events chown,fchown,lchown,fchownat are collected
Ensure discretionary access control permission modification events setxattr,lsetxattr,fsetxattr,removexattr,lremovexattr,fremovexattr collected
Ensure events that modify /etc/group information are collected
Ensure events that modify /etc/hosts and /etc/hostname are collected
Ensure events that modify /etc/issue and /etc/issue.net are collected
Ensure events that modify /etc/NetworkManager directory are collected
Ensure events that modify /etc/nsswitch.conf file are collected
Ensure events that modify /etc/pam.conf and /etc/pam.d/ information are collected
Ensure events that modify /etc/passwd information are collected
Ensure events that modify /etc/security/opasswd are collected
Ensure events that modify /etc/shadow and /etc/gshadow are collected
Ensure events that modify /etc/sysconfig/network and /etc/NetworkManager/system-connections/ are collected
Ensure events that modify sethostname and setdomainname are collected
Ensure firewalld backend is configured
Ensure firewalld default zone is set to drop
Ensure firewalld is installed
Ensure firewalld logs denied packets
Ensure firewalld loopback source address traffic is configured
Ensure firewalld.service is configured
Ensure firewire-core kernel module is not available
Ensure fs.protected_hardlinks is configured
Ensure fs.protected_symlinks is configured
Ensure fs.suid_dumpable is configured
Ensure journald log file access is configured
Ensure kernel "delete_module" loading unloading and modification is collected
Ensure kernel "init_module" and "finit_module" loading unloading and modification is collected
Ensure kernel.dmesg_restrict is configured
Ensure kernel.kptr_restrict is configured
Ensure net.ipv4.conf.all.accept_redirects is configured
Ensure net.ipv4.conf.all.accept_source_route is configured
Ensure net.ipv4.conf.all.forwarding is configured
Ensure net.ipv4.conf.all.log_martians is configured
Ensure net.ipv4.conf.all.route_localnet is configured
Ensure net.ipv4.conf.all.rp_filter is configured
Ensure net.ipv4.conf.all.secure_redirects is configured
Ensure net.ipv4.conf.all.send_redirects is configured
Ensure net.ipv4.conf.default.accept_redirects is configured
Ensure net.ipv4.conf.default.accept_source_route is configured
Ensure net.ipv4.conf.default.forwarding is configured
Ensure net.ipv4.conf.default.log_martians is configured
Ensure net.ipv4.conf.default.route_localnet is configured
Ensure net.ipv4.conf.default.rp_filter is configured
Ensure net.ipv4.conf.default.secure_redirects is configured
Ensure net.ipv4.conf.default.send_redirects is configured
Ensure net.ipv4.ip_forward is configured
Ensure net.ipv6.conf.all.accept_ra is configured
Ensure net.ipv6.conf.all.accept_redirects is configured
Ensure net.ipv6.conf.all.accept_source_route is configured
Ensure net.ipv6.conf.all.forwarding is configured
Ensure net.ipv6.conf.default.accept_ra is configured
Ensure net.ipv6.conf.default.accept_redirects is configured
Ensure net.ipv6.conf.default.accept_source_route is configured
Ensure net.ipv6.conf.default.forwarding is configured
Ensure overlay kernel module is not available
Ensure rename file deletion events by users are collected
Ensure report_url is configured
Ensure rsyslog is not configured as a log server
Ensure rsyslog network forwarding uses TLS
Ensure sudo pwfeedback is configured
Ensure sudo timestamp_type is configured
Ensure sudo visiblepw is configured
Ensure system wide crypto policy enables post-quantum algorithms
Ensure systemd ability to spawn an interactive boot process is disabled
Ensure the audit configuration is loaded regardless of errors
Ensure unlink file deletion events by users are collected
Ensure Wayland is configured
Ensure weak dependencies are configured
Updated Fixlets:
Ensure gpgcheck is configured
Ensure repo_gpgcheck is configured
Ensure kernel.randomize_va_space is configured
Ensure kernel.yama.ptrace_scope is configured
Ensure systemd-coredump Storage is configured
Ensure system wide crypto policy is not legacy
Ensure system wide crypto policy macs are configured
Ensure /etc/motd is configured
Ensure /etc/issue is configured
Ensure /etc/issue.net is configured
Ensure GDM disable-user-list is configured
Ensure GDM screen lock is configured
Ensure GDM screen lock is configured
Ensure GDM automount is configured
Ensure GDM automount is configured
Ensure GDM autorun-never is configured
Ensure GDM autorun-never is configured
Ensure a graphical user interface is not in use
Ensure wireless interfaces are not available
Ensure firewalld services and ports are configured
Ensure access to /etc/ssh/sshd_config is configured
Ensure access to SSH private host key files is configured
Ensure access to SSH public host key files is configured
Ensure sudo timestamp_timeout is configured
Ensure PAM is managed by an active authselect profile
Ensure journald service is active
Ensure systemd-journal-remote is not in use
Ensure rsyslog is not configured as a log server
Ensure rsyslog logging rules are configured
Ensure audit_backlog_limit is configured
Deleted Fixlets:
Ensure a single firewall configuration utility is in use
Ensure discretionary access control permission modification events are collected
Ensure events that modify the system's network environment are collected
Ensure events that modify user/group information are collected
Ensure file deletion events by users are collected
Ensure GDM autorun-never is not overridden
Ensure GDM disabling automatic mounting of removable media is not overridden
Ensure GDM screen locks cannot be overridden
Ensure GNOME Display Manager is removed
Ensure icmp redirects are not accepted
Ensure ip forwarding is disabled
Ensure ipv6 router advertisements are not accepted
Ensure journald Compress is configured
Ensure journald ForwardToSyslog is disabled
Ensure journald Storage is configured
Ensure nftables base chains exist
Ensure nftables default deny firewall policy
Ensure nftables established connections are configured
Ensure nftables is installed
Ensure nftables loopback traffic is configured
Ensure nis client is not installed
Ensure nis server services are not in use
Ensure only one logging system is in use
Ensure packet redirect sending is disabled
Ensure reverse path filtering is enabled
Ensure rsyslog is not configured to receive logs from a remote client
Ensure secure icmp redirects are not accepted
Ensure source routed packets are not accepted
Ensure suspicious packets are logged
Ensure system wide crypto policy is not set in sshd configuration
Ensure systemd-journal-remote is installed
Ensure systemd-journal-upload authentication is configured
Ensure systemd-journal-upload is enabled and active
Ensure xinetd services are not in use
Additional details:
Both analysis and remediation checks are included.
Some of the checks allow you to use the parameterized setting to enable customization for compliance evaluation. Note that parameterization and remediation actions require the creation of a custom site.
Improved a few checks by adding the pending restart feature to them. The pending restart feature works in the following ways:
The action results will show “Pending Restart” instead of “Fixed” for those checks which require OS reboot.
The check will show relevant for those endpoints until they are rebooted.
Post reboot of the endpoint the action results will show as “Fixed” and the check will be compliant.
Action to take:
To subscribe to the above site, you can use the License Overview Dashboard to enable and gather the site. Note that you must be entitled to the BigFix Compliance product and you must be using BigFix version 10.0.0 and later.
If you use custom sites, update your custom sites accordingly to use the latest content. You can synchronize your content by using the Synchronize Custom Checks wizard. For more information, see Using the Synchronize Custom Checks wizard
More information:
To know more about the BigFix Compliance SCM checklists, please see the following resources:
BigFix Forum:
Compliance (Release Announcements)
This category is used by HCL to announce new releases for BigFix Compliance.
BigFix Compliance SCM Checklists:
SCM Checklists
This category is the central reference for all SCM Checklists supported by BigFix Compliance. It covers the complete list of active checklists across all supported frameworks and platforms, including CIS, DISA STIG, PCI DSS, NIST, and more, along with site name, version details, and supported OS versions.
We hope you find this latest release of SCM content useful and effective. Thank you!
– The BigFix Compliance team