---
policy: 'CIS benchmark for SUSE Linux Enterprise 12'
title: 'CIS benchmark for SUSE Linux Enterprise 12'
id: cis_sle12
version: '3.1.0'
source: https://www.cisecurity.org/cis-benchmarks/#suse_linux

levels:
    - id: l1_server
    - id: l2_server
      inherits_from:
          - l1_server
    - id: l1_workstation
    - id: l2_workstation
      inherits_from:
          - l1_workstation

controls:
    - id: reload_dconf_db
      title: Reload Dconf database
      levels:
          - l1_server
          - l1_workstation
          - l2_server
          - l2_workstation
      notes: |-
          This is a helper rule to reload Dconf database correctly.
      status: automated
      rules:
          - dconf_db_up_to_date

    - id: 1.1.1.1
      title: Ensure mounting of squashfs filesystems is disabled (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - kernel_module_cramfs_disabled
          - kernel_module_squashfs_disabled

    - id: 1.1.1.2
      title: Ensure mounting of udf filesystems is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - kernel_module_udf_disabled

    - id: 1.1.2
      title: Ensure /tmp is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - partition_for_tmp

    - id: 1.1.3
      title: Ensure noexec option set on /tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_tmp_noexec

    - id: 1.1.4
      title: Ensure nodev option set on /tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_tmp_nodev

    - id: 1.1.5
      title: Ensure nosuid option set on /tmp partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_tmp_nosuid

    - id: 1.1.6
      title: Ensure /dev/shm is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - partition_for_dev_shm

    - id: 1.1.7
      title: Ensure noexec option set on /dev/shm partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_dev_shm_noexec

    - id: 1.1.8
      title: Ensure nodev option set on /dev/shm partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_dev_shm_nodev

    - id: 1.1.9
      title: Ensure nosuid option set on /dev/shm partition (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_dev_shm_nosuid

    - id: 1.1.10
      title: Ensure separate partition exists for /var (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - partition_for_var

    - id: 1.1.11
      title: Ensure separate partition exists for /var/tmp (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - partition_for_var_tmp

    - id: 1.1.12
      title: Ensure /var/tmp partition includes the noexec option (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_var_tmp_noexec

    - id: 1.1.13
      title: Ensure /var/tmp partition includes the nodev option (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_var_tmp_nodev

    - id: 1.1.14
      title: Ensure /var/tmp partition includes the nosuid option (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_var_tmp_nosuid

    - id: 1.1.15
      title: Ensure separate partition exists for /var/log (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - partition_for_var_log

    - id: 1.1.16
      title: Ensure separate partition exists for /var/log/audit (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - partition_for_var_log_audit

    - id: 1.1.17
      title: Ensure separate partition exists for /home (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - partition_for_home

    - id: 1.1.18
      title: Ensure /home partition includes the nodev option (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_home_nodev

    - id: 1.1.19
      title: Ensure noexec option set on removable media partitions (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_noexec_removable_partitions

    - id: 1.1.20
      title: Ensure nodev option set on removable media partitions (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_nodev_removable_partitions

    - id: 1.1.21
      title: Ensure nosuid option set on removable media partitions (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - mount_option_nosuid_removable_partitions

    - id: 1.1.22
      title: Ensure sticky bit is set on all world-writable directories (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - dir_perms_world_writable_sticky_bits

    - id: 1.1.23
      title: Disable Automounting (Automated)
      levels:
          - l1_server
          - l2_workstation
      status: automated
      rules:
          - service_autofs_disabled
          - kernel_module_usb-storage_disabled

    - id: 1.2.1
      title: Ensure GPG keys are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      notes: >-
          The control cannot be automated,
          and should be addressed manually.
      rules:
          - ensure_GPG_keys_are_configured

    - id: 1.2.2
      title: Ensure package manager repositories are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      notes: >-
          The control cannot be automated,
          and should be addressed manually.
      rules:
          - ensure_package_repositories_are_configured

    - id: 1.2.3
      title: Ensure gpgcheck is globally activated (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_never_disabled

    - id: 1.3.1
      title: Ensure sudo is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_sudo_installed

    - id: 1.3.2
      title: Ensure sudo commands use pty (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sudo_add_use_pty

    - id: 1.3.3
      title: Ensure sudo log file exists (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - var_sudo_logfile=var_log_sudo_log
          - sudo_custom_logfile

    - id: 1.4.1
      title: Ensure AIDE is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_aide_installed
          - aide_build_database

    - id: 1.4.2
      title: Ensure filesystem integrity is regularly checked (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - aide_periodic_cron_checking

    - id: 1.4.3
      title: Ensure authentication required for single user mode (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - require_emergency_target_auth
          - require_singleuser_auth

    - id: 1.5.1
      title: Ensure bootloader password is set (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - grub2_password
          - grub2_uefi_password

    - id: 1.5.2
      title: Ensure permissions on bootloader config are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_grub2_cfg
          - file_owner_grub2_cfg
          - file_permissions_grub2_cfg

    - id: 1.5.3
      title: Ensure authentication required for single user mode (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - require_emergency_target_auth
          - require_singleuser_auth

    - id: 1.6.1
      title: Ensure core dumps are restricted (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - disable_users_coredumps
          - sysctl_fs_suid_dumpable
          - coredump_disable_backtraces
          - coredump_disable_storage

    - id: 1.6.2
      title: Ensure XD/NX support is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially
      notes: >-
          Automatic remediation of these rules is not available.
      rules:
          - bios_enable_execution_restrictions
          - install_PAE_kernel_on_x86-32

    - id: 1.6.3
      title: Ensure address space layout randomization (ASLR) is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_kernel_randomize_va_space

    - id: 1.6.4
      title: Ensure prelink is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - disable_prelink

    - id: 1.7.1.1
      title: Ensure AppArmor is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_pam_apparmor_installed

    - id: 1.7.1.2
      title: Ensure AppArmor is enabled in the bootloader configuration (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - apparmor_configured

    - id: 1.7.1.3
      title: Ensure all AppArmor Profiles are in enforce or complain mode (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - all_apparmor_profiles_in_enforce_complain_mode
          - var_apparmor_mode=complain

    - id: 1.7.1.4
      title: Ensure all AppArmor Profiles are enforcing (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - all_apparmor_profiles_enforced

    - id: 1.8.1.1
      title: Ensure message of the day is configured properly (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - banner_etc_motd
          - motd_banner_text=cis_banners

    - id: 1.8.1.2
      title: Ensure local login warning banner is configured properly (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - banner_etc_issue
          - login_banner_text=cis_banners

    - id: 1.8.1.3
      title: Ensure remote login warning banner is configured properly (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - banner_etc_issue_net
          - remote_login_banner_text=cis_banners

    - id: 1.8.1.4
      title: Ensure permissions on /etc/motd are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_etc_motd
          - file_owner_etc_motd
          - file_permissions_etc_motd

    - id: 1.8.1.5
      title: Ensure permissions on /etc/issue are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_etc_issue
          - file_owner_etc_issue
          - file_permissions_etc_issue

    - id: 1.8.1.6
      title: Ensure permissions on /etc/issue.net are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_etc_issue_net
          - file_owner_etc_issue_net
          - file_permissions_etc_issue_net

    - id: "1.9"
      title: Ensure updates, patches, and additional security software are installed (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # rule is missing
      related_rules:
          - security_patches_up_to_date

    - id: 1.10
      title: Ensure GDM login banner is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      notes: |-
          The idea of the requirement is to have either package_gdm_removed rule
          or the rest of the rules as they are mutually exclusive.
      rules:
          - package_gdm_removed
          - enable_dconf_user_profile
          - dconf_gnome_disable_user_list
          - dconf_gnome_banner_enabled
          - dconf_gnome_login_banner_text
          - login_banner_text=cis_default

    - id: 2.1.1
      title: Ensure xinetd is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_xinetd_removed
          - service_xinetd_disabled
          - package_tcp_wrappers_removed

    - id: 2.2.1.1
      title: Ensure time synchronization is in use (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_chrony_installed

    - id: 2.2.1.2
      title: Ensure systemd-timesyncd is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_timesyncd_configured
          - service_timesyncd_enabled
          - service_timesyncd_root_distance_configured

    - id: 2.2.1.3
      title: Ensure chrony is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - chronyd_run_as_chrony_user
          - chronyd_configure_pool_and_server
          - var_multiple_time_servers=suse
          - var_multiple_time_pools=suse

    - id: 2.2.1.4
      title: Ensure ntp is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_ntpd_enabled
          - ntpd_configure_restrictions
          - ntpd_specify_remote_server
          - ntpd_run_as_ntp_user

    - id: 2.2.2
      title: Ensure X11 Server components are not installed (Automated)
      levels:
          - l1_server
      status: automated
      notes: >-
          The rule also configures correct run level to prevent unbootable system.
      rules:
          - package_xorg-x11-server-common_removed
          - xwindows_remove_packages

    - id: 2.2.3
      title: Ensure Avahi Server is not installed (Automated)
      levels:
          - l1_server
          - l2_workstation
      status: automated
      rules:
          - service_avahi-daemon_disabled
          - package_avahi_removed
          - package_avahi-autoipd_removed

    - id: 2.2.4
      title: Ensure CUPS is not installed (Automated)
      levels:
          - l1_server
      status: automated
      rules:
          - service_cups_disabled
          - package_cups_removed

    - id: 2.2.5
      title: Ensure DHCP Server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_dhcp_removed
          - package_dhcp_client_removed
          - service_dhcpd_disabled

    - id: 2.2.6
      title: Ensure LDAP server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_openldap-servers_removed

    - id: 2.2.7
      title: Ensure nfs-utils is not installed or the nfs-server service is masked (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_nfs_disabled
          - package_nfs-utils_removed

    - id: 2.2.8
      title: Ensure rpcbind is not installed or the rpcbind services are masked (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_rpcbind_disabled
          - package_rpcbind_removed

    - id: 2.2.9
      title: Ensure DNS Server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_named_disabled
          - package_bind_removed

    - id: 2.2.10
      title: Ensure FTP Server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_vsftpd_disabled
          - package_vsftpd_removed

    - id: 2.2.11
      title: Ensure HTTP server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially
      notes: >-
          Only httpd/apache2 is currently covered by this rule.
      rules:
          - service_httpd_disabled
          - package_httpd_removed

    - id: 2.2.12
      title: Ensure IMAP and POP3 server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_dovecot_disabled
          - package_dovecot_removed

    - id: 2.2.13
      title: Ensure Samba is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_smb_disabled
          - package_samba_removed

    - id: 2.2.14
      title: Ensure HTTP Proxy Server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_squid_disabled
          - package_squid_removed

    - id: 2.2.15
      title: Ensure net-snmp is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_snmpd_disabled
          - package_net-snmp_removed

    - id: 2.2.16
      title: Ensure mail transfer agent is configured for local-only mode (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - postfix_network_listening_disabled
          - var_postfix_inet_interfaces=loopback-only

    - id: 2.2.17
      title: Ensure rsync is not installed or the rsyncd service is masked (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_rsyncd_disabled
          - package_rsync_removed

    - id: 2.2.18
      title: Ensure NIS server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_ypserv_removed

    - id: 2.2.19
      title: Ensure telnet-server is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_telnet-server_removed

    - id: 2.3.1
      title: Ensure NIS Client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_ypbind_removed

    - id: 2.3.2
      title: Ensure rsh client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_rsh_removed

    - id: 2.3.3
      title: Ensure talk client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_talk_removed

    - id: 2.3.4
      title: Ensure telnet client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_telnet_removed

    - id: 2.3.5
      title: Ensure LDAP client is not installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_openldap-clients_removed

    - id: 2.4
      title: Ensure nonessential services are removed or masked (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual

    - id: 3.1.1
      title: Disable IPv6 (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - grub2_ipv6_disable_argument
          - sysctl_net_ipv6_conf_all_disable_ipv6

    - id: 3.1.2
      title: Ensure wireless interfaces are disabled (Manual)
      levels:
          - l1_server
          - l2_workstation
      status: automated
      notes: >-
          the rule remediation is not exactly on par with the benchmark
      rules:
          - wireless_disable_interfaces

    - id: 3.2.1
      title: Ensure IP forwarding is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_ip_forward
          - sysctl_net_ipv6_conf_all_forwarding
          - sysctl_net_ipv6_conf_all_forwarding_value=disabled

    - id: 3.2.2
      title: Ensure packet redirect sending is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
          - sysctl_net_ipv4_conf_default_send_redirects

    - id: 3.3.1
      title: Ensure source routed packets are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
          - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv4_conf_default_accept_source_route
          - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_all_accept_source_route
          - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_default_accept_source_route
          - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled

    - id: 3.3.2
      title: Ensure ICMP redirects are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
          - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_accept_redirects
          - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_all_accept_redirects
          - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_default_accept_redirects
          - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled

    - id: 3.3.3
      title: Ensure secure ICMP redirects are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_secure_redirects
          - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_secure_redirects
          - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled

    - id: 3.3.4
      title: Ensure suspicious packets are logged (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_log_martians
          - sysctl_net_ipv4_conf_all_log_martians_value=enabled
          - sysctl_net_ipv4_conf_default_log_martians
          - sysctl_net_ipv4_conf_default_log_martians_value=enabled

    - id: 3.3.5
      title: Ensure broadcast ICMP requests are ignored (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled

    - id: 3.3.6
      title: Ensure bogus ICMP responses are ignored (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled

    - id: 3.3.7
      title: Ensure Reverse Path Filtering is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
          - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
          - sysctl_net_ipv4_conf_default_rp_filter
          - sysctl_net_ipv4_conf_default_rp_filter_value=enabled

    - id: 3.3.8
      title: Ensure TCP SYN Cookies is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv4_tcp_syncookies
          - sysctl_net_ipv4_tcp_syncookies_value=enabled

    - id: 3.3.9
      title: Ensure IPv6 router advertisements are not accepted (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
          - sysctl_net_ipv6_conf_all_accept_ra_value=disabled
          - sysctl_net_ipv6_conf_default_accept_ra
          - sysctl_net_ipv6_conf_default_accept_ra_value=disabled

    - id: 3.4.1
      title: Ensure DCCP is disabled (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - kernel_module_dccp_disabled

    - id: 3.4.2
      title: Ensure SCTP is disabled (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - kernel_module_sctp_disabled

    - id: 3.5.1.1
      title: Ensure iptables package is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_iptables_installed
          - service_iptables_enabled

    - id: 3.5.2.1
      title: Ensure loopback traffic is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - set_loopback_traffic

    - id: 3.5.2.2
      title: Ensure outbound and established connections are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      rules:
          - set_iptables_outbound_n_established

    - id: 3.5.2.3
      title: Ensure firewall rules exist for all open ports (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # rule is missing

    - id: 3.5.2.4
      title: Ensure default deny firewall policy (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - set_iptables_default_rule

    - id: 3.5.3.1
      title: Ensure IPv6 loopback traffic is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - set_ipv6_loopback_traffic

    - id: 3.5.3.2
      title: Ensure IPv6 outbound and established connections are configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      rules:
          - set_iptables_outbound_n_established

    - id: 3.5.3.3
      title: Ensure IPv6 firewall rules exist for all open ports (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # rule is missing

    - id: 3.5.3.4
      title: Ensure IPv6 default deny firewall policy (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # rule is missing

    - id: 4.1.1.1
      title: Ensure auditd is installed (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - package_audit_installed
          - package_audit-libs_installed

    - id: 4.1.1.2
      title: Ensure auditd service is enabled and running (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - service_auditd_enabled

    - id: 4.1.1.3
      title: Ensure auditing for processes that start prior to auditd is enabled (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - grub2_audit_argument

    - id: 4.1.2.1
      title: Ensure audit log storage size is configured (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - auditd_data_retention_max_log_file
          - var_auditd_max_log_file=6

    - id: 4.1.2.2
      title: Ensure audit logs are not automatically deleted (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - auditd_data_retention_max_log_file_action
          - var_auditd_max_log_file_action=keep_logs

    - id: 4.1.2.3
      title: Ensure system is disabled when audit logs are full (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - auditd_data_retention_space_left_action
          - var_auditd_space_left_action=email
          - auditd_data_retention_action_mail_acct
          - var_auditd_action_mail_acct=root
          - auditd_data_retention_admin_space_left_action
          - var_auditd_admin_space_left_action=halt

    - id: 4.1.2.4
      title: Ensure audit_backlog_limit is sufficient (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192

    - id: 4.1.3
      title: Ensure events that modify date and time information are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      automated: partially  # we do not have rule for clock_settime
      rules:
          - audit_rules_time_adjtimex
          - audit_rules_time_settimeofday
          - audit_rules_time_stime
          - audit_rules_time_watch_localtime

    - id: 4.1.4
      title: Ensure events that modify user/group information are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow

    - id: 4.1.5
      title: Ensure events that modify the system's network environment are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_networkconfig_modification

    - id: 4.1.6
      title: Ensure events that modify the system's Mandatory Access Controls are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_mac_modification
          - audit_rules_mac_modification_usr_share

    - id: 4.1.7
      title: Ensure login and logout events are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_login_events_faillog
          - audit_rules_login_events_lastlog
          - audit_rules_login_events_tallylog

    - id: 4.1.8
      title: Ensure session initiation information is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_session_events

    - id: 4.1.9
      title: Ensure discretionary access control permission modification events are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_lchown
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr

    - id: 4.1.10
      title: Ensure unsuccessful unauthorized file access attempts are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_unsuccessful_file_modification_ftruncate

    - id: 4.1.11
      title: Ensure use of privileged commands is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: manual  # we have audit_rules_privileged_commands, but it does not set perm=x
      notes: >-
          Additional rules for priviliged commands are available and can be enabled.
      related_rules:
          - audit_rules_privileged_commands

    - id: 4.1.12
      title: Ensure successful file system mounts are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_media_export

    - id: 4.1.13
      title: Ensure file deletion events by users are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_unlinkat

    - id: 4.1.14
      title: Ensure changes to system administration scope (sudoers) is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_sysadmin_actions

    - id: 4.1.15
      title: Ensure system administrator actions (sudolog) are collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_sudo_log_events

    - id: 4.1.16
      title: Ensure kernel module loading and unloading is collected (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_privileged_commands_insmod
          - audit_rules_privileged_commands_rmmod
          - audit_rules_privileged_commands_modprobe
          - audit_rules_kernel_module_loading_delete
          - audit_rules_kernel_module_loading_init
          - audit_rules_kernel_module_loading

    - id: 4.1.17
      title: Ensure the audit configuration is immutable (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - audit_rules_immutable

    - id: 4.2.1.1
      title: Ensure rsyslog is installed (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_rsyslog_installed

    - id: 4.2.1.2
      title: Ensure rsyslog Service is enabled and running (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - service_rsyslog_enabled

    - id: 4.2.1.3
      title: Ensure rsyslog default file permissions configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - rsyslog_files_permissions
          - rsyslog_files_ownership
          - rsyslog_files_groupownership

    - id: 4.2.1.4
      title: Ensure logging is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      automated: yes
      rules:
          - rsyslog_logging_configured

    - id: 4.2.1.5
      title: Ensure rsyslog is configured to send logs to a remote log host (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # rule does not cover /etc/rsyslog.d/*.conf
      rules:
          - rsyslog_remote_loghost

    - id: 4.2.1.6
      title: Ensure remote rsyslog messages are only accepted on designated log hosts. (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      related_rules:
          - rsyslog_nolisten

    - id: 4.2.2.1
      title: Ensure journald is configured to send logs to rsyslog (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - journald_forward_to_syslog

    - id: 4.2.2.2
      title: Ensure journald is configured to compress large log files (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - journald_compress

    - id: 4.2.2.3
      title: Ensure journald is configured to write logfiles to persistent disk (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - journald_storage

    - id: 4.2.3
      title: Ensure permissions on all logfiles are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially
      rules:
          - permissions_local_var_log
      related_rules:
          - file_owner_var_log
          - file_groupowner_var_log
          - file_permissions_var_log
          - file_owner_var_log_messages
          - file_groupowner_var_log_messages
          - file_permissions_var_log

    - id: 4.2.4
      title: Ensure logrotate is configured (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      notes: >-
          Rule configures logrotate service.
      rules:
          - package_logrotate_installed
          - timer_logrotate_enabled
          - ensure_logrotate_activated

    - id: 5.1.1
      title: Ensure cron daemon is enabled and running (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - package_cron_installed
          - service_cron_enabled

    - id: 5.1.2
      title: Ensure permissions on /etc/crontab are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_crontab
          - file_owner_crontab
          - file_permissions_crontab

    - id: 5.1.3
      title: Ensure permissions on /etc/cron.hourly are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_cron_hourly
          - file_owner_cron_hourly
          - file_permissions_cron_hourly

    - id: 5.1.4
      title: Ensure permissions on /etc/cron.daily are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_cron_daily
          - file_owner_cron_daily
          - file_permissions_cron_daily

    - id: 5.1.5
      title: Ensure permissions on /etc/cron.weekly are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_cron_weekly
          - file_owner_cron_weekly
          - file_permissions_cron_weekly

    - id: 5.1.6
      title: Ensure permissions on /etc/cron.monthly are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_cron_monthly
          - file_owner_cron_monthly
          - file_permissions_cron_monthly

    - id: 5.1.7
      title: Ensure permissions on /etc/cron.d are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_cron_d
          - file_owner_cron_d
          - file_permissions_cron_d

    - id: 5.1.8
      title: Ensure cron is restricted to authorized users (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_cron_allow
          - file_owner_cron_allow
          - file_permissions_cron_allow
          - file_cron_deny_not_exist

    - id: 5.1.9
      title: Ensure at is restricted to authorized users (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_at_allow
          - file_owner_at_allow
          - file_permissions_at_allow
          - file_at_deny_not_exist

    - id: 5.2.1
      title: Ensure permissions on /etc/ssh/sshd_config are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_sshd_config
          - file_owner_sshd_config
          - file_permissions_sshd_config

    - id: 5.2.2
      title: Ensure permissions on SSH private host key files are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially
      notes: >-
          Rule is not covering User and group Ownership
      rules:
          - file_permissions_sshd_private_key

    - id: 5.2.3
      title: Ensure permissions on SSH public host key files are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially
      notes: >-
          Rule is not covering User and group Ownership
      rules:
          - file_permissions_sshd_pub_key

    - id: 5.2.4
      title: Ensure SSH access is limited (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_limit_user_access

    - id: 5.2.5
      title: Ensure SSH LogLevel is appropriate (Automated)
      levels:
          - l1_server
          - l1_workstation
      notes: >-
          The default rule is configured to enforce the "verbose" log level. Use
          tailoring to change it to "info" level.
      status: automated
      related_rules:
          - sshd_set_loglevel_info
      rules:
          - sshd_set_loglevel_verbose

    - id: 5.2.6
      title: Ensure SSH X11 forwarding is disabled (Automated)
      levels:
          - l2_server
          - l1_workstation
      status: automated
      rules:
          - sshd_disable_x11_forwarding

    - id: 5.2.7
      title: Ensure SSH MaxAuthTries is set to 4 or less (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_set_max_auth_tries
          - sshd_max_auth_tries_value=4

    - id: 5.2.8
      title: Ensure SSH IgnoreRhosts is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_disable_rhosts

    - id: 5.2.9
      title: Ensure SSH HostbasedAuthentication is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - disable_host_auth

    - id: 5.2.10
      title: Ensure SSH root login is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_disable_root_login

    - id: 5.2.11
      title: Ensure SSH PermitEmptyPasswords is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_disable_empty_passwords

    - id: 5.2.12
      title: Ensure SSH PermitUserEnvironment is disabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_do_not_permit_user_env

    - id: 5.2.13
      title: Ensure only strong Ciphers are used (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      notes: >-
          The rule checks for default list of ciphers provided in the benchmark.
      rules:
          - sshd_approved_ciphers=cis_sle12
          - sshd_use_approved_ciphers
          - sshd_use_strong_ciphers

    - id: 5.2.14
      title: Ensure only strong MAC algorithms are used (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      notes: >-
          The rule checks for default list of MACs provided in the benchmark.
      rules:
          - sshd_approved_macs=cis_sle12
          - sshd_use_approved_macs
          - sshd_strong_macs=cis_sle12
          - sshd_use_strong_macs

    - id: 5.2.15
      title: Ensure only strong Key Exchange algorithms are used (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_use_strong_kex
          - sshd_strong_kex=cis_sle12

    - id: 5.2.16
      title: Ensure SSH Idle Timeout Interval is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_set_idle_timeout
          - sshd_idle_timeout_value=5_minutes
          - sshd_set_keepalive
          - var_sshd_set_keepalive=0

    - id: 5.2.17
      title: Ensure SSH LoginGraceTime is set to one minute or less (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_set_login_grace_time
          - var_sshd_set_login_grace_time=60

    - id: 5.2.18
      title: Ensure SSH warning banner is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_enable_warning_banner

    - id: 5.2.19
      title: Ensure SSH PAM is enabled (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_enable_pam

    - id: 5.2.20
      title: Ensure SSH AllowTcpForwarding is disabled (Automated)
      levels:
          - l2_server
          - l2_workstation
      status: automated
      rules:
          - sshd_disable_tcp_forwarding

    - id: 5.2.21
      title: Ensure SSH MaxStartups is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_set_maxstartups
          - var_sshd_set_maxstartups=10:30:60

    - id: 5.2.22
      title: Ensure SSH MaxSessions is limited (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - sshd_set_max_sessions
          - var_sshd_max_sessions=10

    - id: 5.3.1
      title: Ensure password creation requirements are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - cracklib_accounts_password_pam_dcredit
          - var_password_pam_dcredit=1
          - cracklib_accounts_password_pam_ucredit
          - var_password_pam_ucredit=1
          - cracklib_accounts_password_pam_lcredit
          - var_password_pam_lcredit=1
          - cracklib_accounts_password_pam_ocredit
          - var_password_pam_ocredit=1
          - cracklib_accounts_password_pam_minlen
          - var_password_pam_minlen=14
          - cracklib_accounts_password_pam_retry
          - var_password_pam_retry=3

    - id: 5.3.2
      title: Ensure lockout for failed password attempts is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_passwords_pam_tally2
          - var_password_pam_tally2=5
          - accounts_passwords_pam_tally2_deny_root
          - accounts_passwords_pam_tally2_unlock_time
          - var_accounts_passwords_pam_tally2_unlock_time=1800

    - id: 5.3.3
      title: Ensure password reuse is limited (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_password_pam_pwhistory_remember
          - var_password_pam_remember=5

    - id: 5.4.1.1
      title: Ensure password hashing algorithm is SHA-512 (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - set_password_hashing_algorithm_logindefs
          - accounts_password_all_shadowed_sha512

    - id: 5.4.1.2
      title: Ensure password expiration is 365 days or less (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_maximum_age_login_defs
          - var_accounts_maximum_age_login_defs=365
          - accounts_password_set_max_life_existing

    - id: 5.4.1.3
      title: Ensure minimum days between password changes is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_minimum_age_login_defs
          - var_accounts_minimum_age_login_defs=1
          - accounts_password_set_min_life_existing

    - id: 5.4.1.4
      title: Ensure password expiration warning days is 7 or more (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_password_warn_age_login_defs
          - var_accounts_password_warn_age_login_defs=7
          - accounts_password_set_warn_age_existing

    - id: 5.4.1.5
      title: Ensure inactive password lock is 30 days or less (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - account_disable_post_pw_expiration
          - var_account_disable_post_pw_expiration=30
          - accounts_set_post_pw_existing

    - id: 5.4.1.6
      title: Ensure all users last password change date is in the past (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially
      rules:
          - accounts_password_last_change_is_in_past

    - id: 5.4.2
      title: Ensure system accounts are secured (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially  # missing rule for locking of accounts
      rules:
          - no_shelllogin_for_systemaccounts

    - id: 5.4.3
      title: Ensure default group for the root account is GID 0 (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_root_gid_zero

    - id: 5.4.4
      title: Ensure default user shell timeout is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially  # we check only for value of tmout variable, no export or readonly and we do not check /etc/bashrc
      rules:
          - accounts_tmout
          - var_accounts_tmout=15_min

    - id: 5.4.5
      title: Ensure default user umask is configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially  # checking only for numeric umask and we do not check for user_enab in /etc/login.defs
      rules:
          - accounts_umask_etc_bashrc
          - accounts_umask_etc_login_defs
          - accounts_umask_etc_profile
          - var_accounts_user_umask=027

    - id: 5.5
      title: Ensure root login is restricted to system console (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - no_direct_root_logins
          - securetty_root_login_console_only

    - id: 5.6
      title: Ensure access to the su command is restricted (Automated)
      levels:
          - l1_server
          - l1_workstation
      automated: partially  # we check only for usage of use_uid with pam_su, not for the group
      rules:
          - ensure_pam_wheel_group_empty
          - use_pam_wheel_group_for_su
          - var_pam_wheel_group_for_su=cis

    - id: 6.1.1
      title: Audit system file permissions (Manual)
      levels:
          - l2_server
          - l2_workstation
      status: manual
      related_rules:
          - rpm_verify_permissions
          - rpm_verify_ownership

    - id: 6.1.2
      title: Ensure permissions on /etc/passwd are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_etc_passwd
          - file_owner_etc_passwd
          - file_permissions_etc_passwd
          - file_permissions_etc_gshadow
          - file_groupowner_etc_gshadow
          - file_owner_etc_gshadow

    - id: 6.1.3
      title: Ensure permissions on /etc/shadow are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_etc_shadow
          - file_owner_etc_shadow
          - file_permissions_etc_shadow

    - id: 6.1.4
      title: Ensure permissions on /etc/group are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_etc_group
          - file_owner_etc_group
          - file_permissions_etc_group

    - id: 6.1.5
      title: Ensure permissions on /etc/passwd- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_backup_etc_passwd
          - file_owner_backup_etc_passwd
          - file_permissions_backup_etc_passwd
          - file_permissions_backup_etc_gshadow
          - file_groupowner_backup_etc_gshadow
          - file_owner_backup_etc_gshadow

    - id: 6.1.6
      title: Ensure permissions on /etc/shadow- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_backup_etc_shadow
          - file_owner_backup_etc_shadow
          - file_permissions_backup_etc_shadow

    - id: 6.1.7
      title: Ensure permissions on /etc/group- are configured (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_groupowner_backup_etc_group
          - file_owner_backup_etc_group
          - file_permissions_backup_etc_group

    - id: 6.1.8
      title: Ensure no world writable files exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_permissions_unauthorized_world_writable

    - id: 6.1.9
      title: Ensure no unowned files or directories exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - no_files_unowned_by_user

    - id: 6.1.10
      title: Ensure no ungrouped files or directories exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_permissions_ungroupowned

    - id: 6.1.11
      title: Audit SUID executables (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      related_rules:
          - file_permissions_unauthorized_suid

    - id: 6.1.12
      title: Audit SGID executables (Manual)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      related_rules:
          - file_permissions_unauthorized_sgid

    - id: 6.2.1
      title: Ensure accounts in /etc/passwd use shadowed passwords (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_password_all_shadowed

    - id: 6.2.2
      title: Ensure /etc/shadow password fields are not empty (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - no_legacy_plus_entries_etc_passwd
          - no_legacy_plus_entries_etc_shadow

    - id: 6.2.3
      title: Ensure root is the only UID 0 account (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_no_uid_except_zero

    - id: 6.2.4
      title: Ensure root PATH Integrity (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_root_path_dirs_no_write
          - root_path_no_dot

    - id: 6.2.5
      title: Ensure all users' home directories exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_user_interactive_home_directory_exists

    - id: 6.2.6
      title: Ensure users' home directories permissions are 750 or more restrictive (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - file_permissions_home_directories
          - accounts_users_home_files_permissions

    - id: 6.2.7
      title: Ensure users own their home directories (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # rule missing checks and remediations
      related_rules:
          - file_ownership_home_directories
          - file_groupownership_home_directories
          - accounts_users_home_files_ownership
          - accounts_users_home_files_groupownership

    - id: 6.2.8
      title: Ensure users' dot files are not group or world writable (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual
      related_rules:
          - accounts_user_dot_no_world_writable_programs
          - accounts_user_dot_group_ownership
          - accounts_user_dot_user_ownership

    - id: 6.2.9
      title: Ensure no users have .forward files (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - no_forward_files

    - id: 6.2.10
      title: Ensure no users have .netrc files (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - no_netrc_files

    - id: 6.2.11
      title: Ensure users' .netrc Files are not group or world accessible (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - accounts_users_netrc_file_permissions

    - id: 6.2.12
      title: Ensure no users have .rhosts files (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: manual  # we have a rule but it removes additionally /etc/hosts.equiv
      related_rules:
          - no_rsh_trust_files

    - id: 6.2.13
      title: Ensure all groups in /etc/passwd exist in /etc/group (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - gid_passwd_group_same

    - id: 6.2.14
      title: Ensure no duplicate UIDs exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - account_unique_id

    - id: 6.2.15
      title: Ensure no duplicate GIDs exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - group_unique_id

    - id: 6.2.16
      title: Ensure no duplicate user names exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - account_unique_name

    - id: 6.2.17
      title: Ensure no duplicate group names exist (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - group_unique_name

    - id: 6.2.18
      title: Ensure shadow group is empty (Automated)
      levels:
          - l1_server
          - l1_workstation
      status: automated
      rules:
          - ensure_shadow_group_empty
