---
policy: General System Security Profile for SUSE Linux Enterprise 15
title: General System Security Profile SUSE Linux Enterprise 15
id: general_sle15
version: '1.0'
source: not_publicly_available
reference_type: suse-general

levels:
    - id: high
    - id: medium
    - id: low

product: sle15

controls:
    - id: SLES-15-150150015
      title: Disable Mounting of cramfs
      levels:
          - low
      status: automated
      rules:
          - kernel_module_cramfs_disabled

    - id: SLES-15-150150030
      title: Disable Mounting of freevxfs
      levels:
          - low
      status: automated
      rules:
          - kernel_module_freevxfs_disabled

    - id: SLES-15-150150045
      title: Disable Mounting of hfs
      levels:
          - low
      status: automated
      rules:
          - kernel_module_hfs_disabled

    - id: SLES-15-150150060
      title: Disable Mounting of hfsplus
      levels:
          - low
      status: automated
      rules:
          - kernel_module_hfsplus_disabled

    - id: SLES-15-150150075
      title: Disable Mounting of jffs2
      levels:
          - low
      status: automated
      rules:
          - kernel_module_jffs2_disabled

    - id: SLES-15-150150090
      title: Disable Mounting of overlayfs
      levels:
          - low
      status: automated
      rules:
          - kernel_module_overlayfs_disabled

    - id: SLES-15-150150105
      title: Disable Mounting of squashfs
      levels:
          - low
      status: automated
      rules:
          - kernel_module_squashfs_disabled

    - id: SLES-15-150150120
      title: Disable Mounting of udf
      levels:
          - low
      rules:
          - kernel_module_udf_disabled
      status: automated

    - id: SLES-15-150150135
      levels:
          - low
      title: Disable Mounting of vFAT filesystems
      rules:
          - kernel_module_vfat_disabled
      status: automated

    - id: SLES-15-150150150
      title: Ensure /tmp Located On Separate Partition
      levels:
          - low
      rules:
          - partition_for_tmp
      status: automated

    - id: SLES-15-150150165
      title: Add nodev Option to /tmp
      levels:
          - medium
      rules:
          - mount_option_tmp_nodev
      status: automated

    - id: SLES-15-150150180
      title: Add nosuid Option to /tmp
      levels:
          - medium
      status: automated
      rules:
          - mount_option_tmp_nosuid

    - id: SLES-15-150150195
      title: Add noexec Option to /tmp
      levels:
          - medium
      status: automated
      rules:
          - mount_option_tmp_noexec

    - id: SLES-15-150150210
      title: Ensure /dev/shm Located On Separate Partition
      levels:
          - low
      status: automated
      rules:
          - partition_for_dev_shm

    - id: SLES-15-150150225
      title: Add nodev Option to /dev/shms
      levels:
          - medium
      rules:
          - mount_option_dev_shm_nodev
      status: automated

    - id: SLES-15-150150240
      title: Add nosuid Option to /dev/shm
      levels:
          - medium
      rules:
          - mount_option_dev_shm_nosuid
      status: automated

    - id: SLES-15-150150255
      title: Add noexec Option to /dev/shm
      levels:
          - medium
      rules:
          - mount_option_dev_shm_noexec
      status: automated

    - id: SLES-15-150150270
      title: Ensure /home Located On Separate Partition
      levels:
          - low
      status: automated
      rules:
          - partition_for_home

    - id: SLES-15-150150285
      title: Add nodev Option to /home
      levels:
          - medium
      status: automated
      rules:
          - mount_option_home_nodev

    - id: SLES-15-150150300
      title: Add nosuid Option to /home
      levels:
          - medium
      rules:
          - mount_option_home_nosuid
      status: automated

    - id: SLES-15-150150315
      title: Ensure /var Located On Separate Partition
      levels:
          - low
      status: automated
      rules:
          - partition_for_var

    - id: SLES-15-150150330
      title: Add nodev Option to /var
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_nodev

    - id: SLES-15-150150345
      title: Add nosuid Option to /var
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_nosuid

    - id: SLES-15-150150360
      title: Ensure /var/tmp Located On Separate Partition
      levels:
          - medium
      status: automated
      rules:
          - partition_for_var_tmp

    - id: SLES-15-150150375
      title: Add nodev Option to /var/tmp
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_tmp_nodev

    - id: SLES-15-150150390
      title: Add nosuid Option to /var/tmp
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_tmp_nosuid

    - id: SLES-15-150150405
      title: Add noexec Option to /var/tmp
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_tmp_noexec

    - id: SLES-15-150150420
      title: Ensure /var/log Located On Separate Partition
      levels:
          - low
      status: automated
      rules:
          - partition_for_var_log

    - id: SLES-15-150150435
      title: Add nodev Option to /var/log
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_log_nodev

    - id: SLES-15-150150450
      title: Add nosuid Option to /var/log
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_log_nosuid

    - id: SLES-15-150150465
      title: Add noexec Option to /var/log
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_log_noexec

    - id: SLES-15-150150480
      title: Ensure /var/log/audit Located On Separate Partition
      levels:
          - low
      status: automated
      rules:
          - partition_for_var_log_audit

    - id: SLES-15-150150495
      title: Add nodev Option to /var/log/audit
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_log_audit_nodev

    - id: SLES-15-150150510
      title: Add nosuid Option to /var/log/audit
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_log_audit_nosuid

    - id: SLES-15-150150525
      title: Add noexec Option to /var/log/audit
      levels:
          - medium
      status: automated
      rules:
          - mount_option_var_log_audit_noexec

    - id: SLES-15-150150540
      title: Encrypt Partitions
      levels:
          - high
      status: automated
      rules:
          - encrypt_partitions

    - id: SLES-15-150300015
      title: Configure GPG keys
      levels:
          - medium
      status: automated
      rules:
          - ensure_GPG_keys_are_configured

    - id: SLES-15-150300030
      title: Enable gpgcheck in Main Package Manager Configuration
      levels:
          - high
      status: automated
      rules:
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_never_disabled

    - id: SLES-15-150300045
      title: Ensure repo_gpgcheck is globally activated
      levels:
          - high
      status: manual

    - id: SLES-15-150300060
      title: Configure Package Manager Repositories
      levels:
          - high
      status: manual

    - id: SLES-15-150300075
      title: Ensure Software Patches Installed
      levels:
          - medium
      status: automated
      rules:
          - security_patches_up_to_date

    - id: SLES-15-150450015
      title: Install AppArmor
      levels:
          - medium
      status: automated
      rules:
          - package_apparmor_installed

    - id: SLES-15-150450030
      title: Ensure AppArmor is Active and Configured
      levels:
          - medium
      status: automated
      rules:
          - apparmor_configured

    - id: SLES-15-150450045
      title: All AppArmor Profiles are in enforce or complain mode
      levels:
          - medium
      status: automated
      rules:
          - all_apparmor_profiles_in_enforce_complain_mode
          - var_apparmor_mode=complain

    - id: SLES-15-150450060
      title: Enforce all AppArmor Profiles
      levels:
          - medium
      status: automated
      rules:
          - all_apparmor_profiles_enforced

    - id: SLES-15-150600015
      title: Set Boot Loader Password in grub2
      levels:
          - high
      status: automated
      rules:
          - grub2_password
          - grub2_uefi_password

    - id: SLES-15-150600030
      title: Configure Permissions on Bootloader Config
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_grub2_cfg
          - file_owner_grub2_cfg
          - file_permissions_grub2_cfg

    - id: SLES-15-150750015
      title: Enable Address Space Layout Randomization (ASLR)
      levels:
          - medium
      status: automated
      rules:
          - sysctl_kernel_randomize_va_space

    - id: SLES-15-150750030
      title: Restrict Core Dumps for All Users
      levels:
          - medium
      status: automated
      rules:
          - disable_users_coredumps
          - sysctl_fs_suid_dumpable
          - coredump_disable_backtraces
          - coredump_disable_storage

    - id: SLES-15-150750060
      title: Enable compile options for kernel security functions
      levels:
          - medium
      status: automated
      rules:
          - kernel_config_seccomp
          - kernel_config_seccomp_filter
          - kernel_config_security
          - kernel_config_security_yama
          - kernel_config_security_writable_hooks

    - id: SLES-15-150750180
      title: Enable Kernel Parameter to Enforce DAC on Hardlinks and Softlinks
      levels:
          - medium
      status: automated
      rules:
          - sysctl_fs_protected_hardlinks
          - sysctl_fs_protected_symlinks

    - id: SLES-15-150900015
      title: Configure System Cryptography Policy
      levels:
          - high
      status: automated
      rules:
          - configure_crypto_policy

    - id: SLES-15-150900030
      title: Configure System Cryptography Policy not set to Legacy
      levels:
          - high
      status: automated
      rules:
          - configure_crypto_policy
          - var_system_crypto_policy=default_nosha1

    - id: SLES-15-150900045
      title: Configure SSH to use System Crypto Policy
      levels:
          - medium
      status: automated
      rules:
          - configure_ssh_crypto_policy

    - id: SLES-15-150900105
      title: Disables chacha20-poly1305 for ssh
      levels:
          - medium
      status: manual

    - id: SLES-15-151050015
      title: Modify the System Message of the Day Banner
      levels:
          - medium
      status: automated
      rules:
          - banner_etc_motd
          - motd_banner_text=cis_banners

    - id: SLES-15-151050030
      title: Modify the System Login Banner
      levels:
          - medium
      status: automated
      rules:
          - banner_etc_issue
          - login_banner_text=cis_banners

    - id: SLES-15-151050045
      title: Modify the System Login Banner for Remote Connections
      levels:
          - medium
      status: automated
      rules:
          - banner_etc_issue_net
          - remote_login_banner_text=cis_banners

    - id: SLES-15-151050060
      title: Configure access to the Message of the Day Banner
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_motd
          - file_owner_etc_motd
          - file_permissions_etc_motd

    - id: SLES-15-151050075
      title: Configure access to the System Login Banner
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_issue
          - file_owner_etc_issue
          - file_permissions_etc_issue

    - id: SLES-15-151050090
      title: Configure access to the System Login Banner for Remote Connections
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_issue_net
          - file_owner_etc_issue_net
          - file_permissions_etc_issue_net

    - id: SLES-15-151200105
      title: Remove the GDM Package Group
      levels:
          - medium
      status: automated
      rules:
          - package_gdm_removed

    - id: SLES-15-151200120
      title: Configure GDM Login Banner
      levels:
          - medium
      status: automated
      rules:
          - dconf_gnome_banner_enabled
          - dconf_gnome_login_banner_text
          - login_banner_text=cis_default

    - id: SLES-15-151200135
      title: Disable the GDM Login User List
      levels:
          - medium
      rules:
          - dconf_gnome_disable_user_list
      status: automated

    - id: SLES-15-151200150
      title: Lock the GDM Screen When the User is Idle
      levels:
          - medium
      status: automated
      rules:
          - dconf_gnome_screensaver_idle_delay
          - dconf_gnome_screensaver_lock_delay
          - inactivity_timeout_value=15_minutes
          - var_screensaver_lock_delay=5_seconds

    - id: SLES-15-151200165
      title: Ensure the User cannot override the GDM screen locks
      levels:
          - medium
      status: automated
      rules:
          - dconf_gnome_session_idle_user_locks
          - dconf_gnome_screensaver_user_locks

    - id: SLES-15-151200180
      title: Disable the GDM automatic mounting of removable media
      levels:
          - medium
      status: automated
      rules:
          - dconf_gnome_disable_automount
          - dconf_gnome_disable_automount_open

    - id: SLES-15-151200210
      title: Disable GDM Automount running
      levels:
          - medium
      status: automated
      rules:
          - dconf_gnome_disable_autorun

    - id: SLES-15-151200240
      title: Disable XDMCP in GDM
      levels:
          - high
      status: automated
      rules:
          - gnome_gdm_disable_xdmcp

    - id: SLES-15-300150015
      title: Disable the Automounter
      levels:
          - medium
      status: automated
      rules:
          - service_autofs_disabled
          - kernel_module_usb-storage_disabled

    - id: SLES-15-300150030
      title: Disable Avahi Server Software
      levels:
          - medium
      status: automated
      rules:
          - service_avahi-daemon_disabled
          - package_avahi_removed
          - package_avahi-autoipd_removed

    - id: SLES-15-300150045
      title: Disable DHCP Service
      levels:
          - medium
      status: automated
      rules:
          - service_dhcpd_disabled
          - package_dhcp_removed
          - package_dhcp_client_removed

    - id: SLES-15-300150060
      title: Disable named Service
      levels:
          - high
      status: automated
      rules:
          - service_named_disabled
          - package_bind_removed

    - id: SLES-15-300150075
      title: Disable dnsmasq Service
      levels:
          - medium
      status: automated
      rules:
          - service_dnsmasq_disabled
          - package_dnsmasq_removed

    - id: SLES-15-300150090
      title: Disable Samba
      levels:
          - low
      status: automated
      rules:
          - service_smb_disabled
          - package_samba_removed

    - id: SLES-15-300150105
      title: Disable LDAP Server
      levels:
          - medium
      status: automated
      rules:
          - service_slapd_disabled
          - package_openldap-servers_removed

    - id: SLES-15-300150120
      title: Disable vsftpd Service
      levels:
          - medium
      status: automated
      rules:
          - service_vsftpd_disabled
          - package_vsftpd_removed

    - id: SLES-15-300150135
      levels:
          - medium
      title: Disable Message Access Server Services
      status: automated
      rules:
          - service_dovecot_disabled
          - package_dovecot_removed
          - package_cyrus-imapd_removed

    - id: SLES-15-300150150
      title: Disable Network File System
      levels:
          - medium
      status: automated
      rules:
          - service_nfs_disabled
          - package_nfs-utils_removed

    - id: SLES-15-300150165
      title: Disable ypserv Service
      levels:
          - high
      status: automated
      related_rules:
          - service_ypserv_disabled
          - package_ypserv_removed

    - id: SLES-15-300150180
      title: Disable the CUPS Service
      levels:
          - medium
      status: automated
      rules:
          - service_cups_disabled
          - package_cups_removed

    - id: SLES-15-300150195
      title: Disable rpcbind Service
      levels:
          - low
      status: automated
      rules:
          - service_rpcbind_disabled
          - package_rpcbind_removed

    - id: SLES-15-300150210
      title: Disable rsyncd Service
      levels:
          - medium
      status: automated
      rules:
          - service_rsyncd_disabled
          - package_rsync_removed

    - id: SLES-15-300150225
      title: Disable snmpd Service
      levels:
          - low
      status: automated
      rules:
          - service_snmpd_disabled
          - package_net-snmp_removed

    - id: SLES-15-300150240
      title: Disable telnet Service
      levels:
          - high
      status: automated
      rules:
          - service_telnet_disabled
          - package_telnet-server_removed

    - id: SLES-15-300150255
      title: Disable tftp Service
      levels:
          - high
      status: automated
      rules:
          - service_tftp_disabled
          - package_tftp-server_removed

    - id: SLES-15-300150270
      title: Disable Squid
      levels:
          - medium
      status: automated
      rules:
          - service_squid_disabled
          - package_squid_removed

    - id: SLES-15-300150285
      title: Disable httpd Service
      levels:
          - medium
      status: automated
      rules:
          - service_httpd_disabled
          - package_httpd_removed

    - id: SLES-15-300150300
      title: Disable xinetd Service
      levels:
          - medium
      status: automated
      rules:
          - service_xinetd_disabled
          - package_tcp_wrappers_removed
          - package_xinetd_removed

    - id: SLES-15-300150315
      title: Disable X window server services
      levels:
          - medium
      status: automated
      rules:
          - package_xorg-x11-server-common_removed
          - xwindows_remove_packages

    - id: SLES-15-300150330
      title: Disable Postfix Network Listening
      levels:
          - medium
      status: automated
      rules:
          - postfix_network_listening_disabled
          - var_postfix_inet_interfaces=loopback-only

    - id: SLES-15-300150345
      title: Disable not approved services to listen on a network interface
      levels:
          - medium
      status: manual

    - id: SLES-15-300300015
      title: Remove ftp Package
      levels:
          - low
      status: automated
      rules:
          - package_ftp_removed

    - id: SLES-15-300300030
      title: Remove LDAP clients
      levels:
          - low
      status: automated
      rules:
          - package_openldap-clients_removed

    - id: SLES-15-300300045
      title: Remove NIS Client
      levels:
          - medium
      status: automated
      rules:
          - package_ypbind_removed

    - id: SLES-15-300300060
      title: Remove telnet Clients
      levels:
          - low
      status: automated
      rules:
          - package_telnet_removed

    - id: SLES-15-300300075
      title: Remove tftp Daemon
      levels:
          - low
      status: automated
      rules:
          - package_tftp_removed

    - id: SLES-15-300450015
      title: The Chrony package is installed
      levels:
          - medium
      status: automated
      rules:
          - package_chrony_installed

    - id: SLES-15-300450030
      title: Configure Systemd Timesyncd Servers
      levels:
          - medium
      status: automated
      rules:
          - service_timesyncd_configured
          - service_timesyncd_root_distance_configured

    - id: SLES-15-300450045
      title: Enable systemd_timesyncd Service
      levels:
          - high
      status: automated
      rules:
          - service_timesyncd_enabled

    - id: SLES-15-300450060
      title: Configure chrony
      levels:
          - medium
      status: automated
      rules:
          - chronyd_run_as_chrony_user
          - chronyd_configure_pool_and_server
          - var_multiple_time_servers=suse
          - var_multiple_time_pools=suse

    - id: SLES-15-300450075
      title: Enable chrony
      levels:
          - medium
      status: automated
      rules:
          - service_chronyd_enabled

    - id: SLES-15-300450090
      title: Configure Time Service Maxpoll Interval
      levels:
          - medium
      status: automated
      rules:
          - chronyd_or_ntpd_set_maxpoll
          - var_time_service_set_maxpoll=18_hours

    - id: SLES-15-300600015
      title: Enable cron Service
      levels:
          - medium
      status: automated
      rules:
          - package_cron_installed
          - service_cron_enabled

    - id: SLES-15-300600030
      title: Configure permissions on /etc/crontab
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_crontab
          - file_owner_crontab
          - file_owner_crontab

    - id: SLES-15-300600045
      title: Configure permissions on /etc/cron.hourly
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_cron_hourly
          - file_owner_cron_hourly
          - file_permissions_cron_hourly

    - id: SLES-15-300600060
      title: Configure permissions on /etc/cron.daily
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_cron_daily
          - file_groupowner_cron_daily
          - file_permissions_cron_daily

    - id: SLES-15-300600075
      title: Configure permissions on /etc/cron.weekly
      levels:
          - high
      status: automated
      rules:
          - file_groupowner_cron_weekly
          - file_owner_cron_weekly
          - file_permissions_cron_weekly

    - id: SLES-15-300600090
      title: Configure permissions on /etc/cron.monthly
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_cron_monthly
          - file_owner_cron_monthly
          - file_permissions_cron_monthly

    - id: SLES-15-300600105
      title: Set SSH MaxSessions limit
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_cron_d
          - file_owner_cron_d
          - file_permissions_cron_d

    - id: SLES-15-300600120
      title: Configure cron permissions
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_cron_allow
          - file_owner_cron_allow
          - file_permissions_cron_allow
          - file_cron_deny_not_exist
          - file_cron_allow_exists

    - id: SLES-15-300600135
      title: Configure at permissions
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_at_allow
          - file_owner_at_allow
          - file_permissions_at_allow
          - file_at_deny_not_exist

    - id: SLES-15-450150015
      title: Identify IPv6 status
      levels:
          - medium
      status: manual

    - id: SLES-15-450150030
      title: Deactivate Wireless Network Interfaces
      levels:
          - medium
      status: automated
      rules:
          - wireless_disable_interfaces

    - id: SLES-15-450150045
      title: Disable Bluetooth Service
      levels:
          - medium
      status: automated
      rules:
          - service_bluetooth_disabled

    - id: SLES-15-450300015
      title: Disable DCCP Support
      levels:
          - medium
      status: automated
      rules:
          - kernel_module_dccp_disabled

    - id: SLES-15-450300030
      title: Disable TIPC Support
      levels:
          - low
      status: automated
      rules:
          - kernel_module_tipc_disabled

    - id: SLES-15-450300045
      title: Disable RDS Support
      levels:
          - low
      status: automated
      rules:
          - kernel_module_rds_disabled

    - id: SLES-15-450300060
      title: Disable SCTP Support
      levels:
          - medium
      status: automated
      rules:
          - kernel_module_sctp_disabled

    - id: SLES-15-450450015
      title: Disable IP forwarding
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_ip_forward
          - sysctl_net_ipv6_conf_all_forwarding
          - sysctl_net_ipv6_conf_all_forwarding_value=disabled

    - id: SLES-15-450450030
      title: Disable packet redirect sending
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
          - sysctl_net_ipv4_conf_default_send_redirects

    - id: SLES-15-450450045
      title: Ignore bogus ICMP error responses
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled

    - id: SLES-15-450450060
      title: Ignore ICMP Broadcast Echo Requests
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled

    - id: SLES-15-450450075
      title: Disable Accepting ICMP Redirects
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
          - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_accept_redirects
          - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_all_accept_redirects
          - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_default_accept_redirects
          - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled

    - id: SLES-15-450450090
      title: Disable Accepting Secure ICMP Redirects
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_secure_redirects
          - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_secure_redirects
          - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled

    - id: SLES-15-450450105
      title: Enable Reverse Path Filtering
      levels:
          - medium
      status: manual
      related_rules:
          - sysctl_net_ipv4_conf_all_rp_filter
          - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
          - sysctl_net_ipv4_conf_default_rp_filter
          - sysctl_net_ipv4_conf_default_rp_filter_value=enabled

    - id: SLES-15-450450120
      title: Disable Accepting Source-Routed Packets
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
          - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv4_conf_default_accept_source_route
          - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_all_accept_source_route
          - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_default_accept_source_route
          - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled

    - id: SLES-15-450450135
      title: Enable Logging Martian Packets
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_log_martians
          - sysctl_net_ipv4_conf_all_log_martians_value=enabled
          - sysctl_net_ipv4_conf_default_log_martians
          - sysctl_net_ipv4_conf_default_log_martians_value=enabled

    - id: SLES-15-450450150
      title: Enable TCP SYN Cookies
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_tcp_syncookies
          - sysctl_net_ipv4_tcp_syncookies_value=enabled

    - id: SLES-15-450450165
      title: Configure Accepting IPv6 Router Advertisements
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
          - sysctl_net_ipv6_conf_all_accept_ra_value=disabled
          - sysctl_net_ipv6_conf_default_accept_ra
          - sysctl_net_ipv6_conf_default_accept_ra_value=disabled

    - id: SLES-15-450450180
      title: Configure ARP filtering for All IPv4 Interfaces
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_arp_filter

    - id: SLES-15-450450195
      title: Configure Response Mode of ARP Requests for All IPv4 Interfaces
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_arp_ignore

    - id: SLES-15-450450210
      title: Prevent Routing External Traffic to Local Loopback on All IPv4 Interfaces
      levels:
          - medium
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_route_localnet

    - id: SLES-15-450600030
      title: Install firewalld Package
      levels:
          - medium
      rules:
          - package_firewalld_installed
      status: automated

    - id: SLES-15-450600045
      title: Configure unnecessary services and ports
      levels:
          - medium
      status: manual
      related_rules:
          - unnecessary_firewalld_services_ports_disabled

    - id: SLES-15-450600060
      title: Configre firewalld loopback traffic
      levels:
          - medium
      status: manual
      related_rules:
          - firewalld_loopback_traffic_trusted
          - firewalld_loopback_traffic_restricted

    - id: SLES-15-450600075
      title: Set Default firewalld Zone for Incoming Packets
      levels:
          - medium
      status: automated
      rules:
          - set_firewalld_default_zone

    - id: SLES-15-450600090
      title: Enable firewalld service
      levels:
          - medium
      status: automated
      rules:
          - service_firewalld_enabled

    - id: SLES-15-600150015
      title: Configure permissions on /etc/ssh/sshd_config
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_sshd_config
          - file_owner_sshd_config
          - file_permissions_sshd_config

    - id: SLES-15-600150030
      title: Verify Permissions on SSH Server Private *_key Key Files
      levels:
          - medium
      status: automated
      rules:
          - file_permissions_sshd_private_key

    - id: SLES-15-600150045
      title: Verify Permissions on SSH public host key files
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_cron_hourly
          - file_owner_cron_hourly
          - file_permissions_cron_hourly

    - id: SLES-15-600150060
      title: Configure sshd Ciphers
      levels:
          - medium
      status: automated
      rules:
          - sshd_use_approved_ciphers
          - sshd_use_strong_ciphers
          - sshd_approved_ciphers=cis_sle15

    - id: SLES-15-600150075
      title: Configure sshd KexAlgorithms
      levels:
          - medium
      status: automated
      rules:
          - sshd_use_strong_kex
          - sshd_strong_kex=cis_sle15

    - id: SLES-15-600150090
      title: Configure sshd MACs
      levels:
          - medium
      status: automated
      rules:
          - sshd_use_approved_macs
          - sshd_approved_macs=cis_sle15
          - sshd_use_strong_macs
          - sshd_strong_macs=cis_sle15

    - id: SLES-15-600150105
      title: Configure sshd access
      levels:
          - medium
      status: automated
      rules:
          - sshd_limit_user_access

    - id: SLEM-5-SMA-02100000
      title: Verify No netrc Files Exist
      levels:
          - medium
      status: automated
      rules:
          - no_netrc_files

    - id: SLES-15-600150120
      title: Configure sshd Banner
      levels:
          - medium
      status: automated
      rules:
          - sshd_enable_warning_banner

    - id: SLES-15-600150135
      title: Configure sshd ClientAliveInterval and ClientAliveCountMax
      levels:
          - medium
      status: automated
      related_rules:
          - sshd_set_idle_timeout
          - sshd_idle_timeout_value=5_minutes
          - sshd_set_keepalive
          - var_sshd_set_keepalive=0

    - id: SLES-15-600150150
      title: Disable sshd Forwarding
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_tcp_forwarding

    - id: SLES-15-600150165
      title: Disable sshd GSSAPIAuthentication
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_gssapi_auth

    - id: SLES-15-600150180
      title: Disable sshd HostbasedAuthentication
      levels:
          - medium
      status: automated
      rules:
          - disable_host_auth

    - id: SLES-15-600150195
      title: Enable sshd IgnoreRhosts
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_rhosts

    - id: SLES-15-600150210
      title: Configure sshd LoginGraceTime
      levels:
          - medium
      status: automated
      rules:
          - sshd_set_login_grace_time
          - var_sshd_set_login_grace_time=60

    - id: SLES-15-600150225
      title: Configure sshd LogLevel
      levels:
          - medium
      status: automated
      rules:
          - sshd_set_loglevel_verbose

    - id: SLES-15-600150240
      title: Configure sshd MaxAuthTries
      levels:
          - medium
      status: automated
      rules:
          - sshd_set_max_auth_tries
          - sshd_max_auth_tries_value=4

    - id: SLES-15-600150255
      title: Configure sshd MaxStartups
      levels:
          - medium
      status: automated
      rules:
          - sshd_set_maxstartups
          - var_sshd_set_maxstartups=10:30:60

    - id: SLES-15-600150270
      title: Configure sshd MaxSession
      levels:
          - medium
      status: automated
      rules:
          - sshd_set_max_sessions
          - var_sshd_max_sessions=10

    - id: SLES-15-600150285
      title: Disable sshd PermitEmptyPasswords
      levels:
          - high
      status: automated
      rules:
          - sshd_disable_empty_passwords

    - id: SLES-15-600150300
      title: Disable sshd PermitRootLogin
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_root_login

    - id: SLES-15-600150315
      title: Disable sshd PermitUserEnvironment
      levels:
          - medium
      status: automated
      rules:
          - sshd_do_not_permit_user_env

    - id: SLES-15-600150330
      title: Enable sshd PAM
      levels:
          - medium
      status: automated
      rules:
          - sshd_enable_pam

    - id: SLES-15-600150345
      title: Disable SSH Support for User Known Hosts
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_user_known_hosts

    - id: SLES-15-600150360
      title: Disable X11 Forwarding
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_x11_forwarding

    - id: SLES-15-600150375
      title: Enable Use of Strict Mode Checking
      levels:
          - medium
      status: automated
      rules:
          - sshd_enable_strictmodes

    - id: SLES-15-600150390
      title: Enable SSH Print Last Log
      levels:
          - medium
      status: automated
      rules:
          - sshd_print_last_log

    - id: SLES-15-600150405
      title: Allow Only SSH Protocol 2
      levels:
          - high
      status: automated
      rules:
          - sshd_allow_only_protocol2

    - id: SLES-15-600150435
      title: Disable Kerberos Authentication
      levels:
          - medium
      status: automated
      rules:
          - sshd_disable_kerb_auth

    - id: SLES-15-600300015
      title: Install sudo Package
      levels:
          - medium
      status: automated
      rules:
          - package_sudo_installed

    - id: SLES-15-600300030
      title: Ensure Only Users Logged In To Real tty Can Execute Sudo
      levels:
          - medium
      status: automated
      rules:
          - sudo_add_use_pty

    - id: SLES-15-600300045
      title: Configure a sudo Custom logfile
      levels:
          - low
      status: automated
      rules:
          - sudo_custom_logfile
          - var_sudo_logfile=var_log_sudo_log

    - id: SLES-15-600300060
      title: Ensure Users Re-Authenticate for Privilege Escalation - sudo
      levels:
          - medium
      status: automated
      rules:
          - sudo_require_authentication

    - id: SLES-15-600300075
      title: Require Re-Authentication When Using the sudo Command
      levels:
          - medium
      status: automated
      rules:
          - sudo_require_reauthentication

    - id: SLES-15-600300090
      title: Configure sudo authentication timeout
      levels:
          - medium
      status: automated
      rules:
          - sudo_require_reauthentication
          - var_sudo_timestamp_timeout=15_minutes

    - id: SLES-15-600300105
      title: Restrict access to the su command
      levels:
          - medium
      status: automated
      rules:
          - ensure_pam_wheel_group_empty
          - use_pam_wheel_group_for_su
          - var_pam_wheel_group_for_su=cis

    - id: SLES-15-600300120
      title: The operating system must restrict privilege elevation to authorized personnel
      levels:
          - medium
      status: automated
      rules:
          - sudo_restrict_privilege_elevation_to_authorized

    - id: SLES-15-600300135
      title: Ensure sudo only includes the default configuration directory
      levels:
          - medium
      status: automated
      rules:
          - sudoers_default_includedir

    - id: SLES-15-600300150
      title: Ensure sudo Runs In A Minimal Environment - sudo env_reset
      levels:
          - medium
      status: automated
      rules:
          - sudo_add_env_reset

    - id: SLES-15-600300165
      title: Ensure sudo Ignores Commands In Current Dir - sudo ignore_dot
      levels:
          - medium
      status: automated
      rules:
          - sudo_add_ignore_dot

    - id: SLES-15-600300180
      title: Ensure Privileged Escalated Commands Cannot Execute Other Commands - sudo NOEXEC
      levels:
          - high
      status: automated
      rules:
          - sudo_add_noexec

    - id: SLES-15-600300195
      title: Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo requiretty
      levels:
          - medium
      status: automated
      rules:
          - sudo_add_requiretty

    - id: SLES-15-600300210
      title: Ensure sudo umask is appropriate - sudo umask
      levels:
          - medium
      status: automated
      rules:
          - sudo_add_umask

    - id: SLES-15-600300225
      title: Ensure a dedicated group owns sudo
      levels:
          - medium
      status: automated
      rules:
          - sudo_dedicated_group

    - id: SLES-15-600300240
      title: Explicit arguments in sudo specifications
      levels:
          - medium
      status: automated
      rules:
          - sudoers_explicit_command_args

    - id: SLES-15-600300255
      title: Don't define allowed commands in sudoers by means of exclusion
      levels:
          - medium
      status: automated
      rules:
          - sudoers_no_command_negation

    - id: SLES-15-600300270
      title: Don't target root user in the sudoers file
      levels:
          - medium
      status: automated
      rules:
          - sudoers_no_root_target

    - id: SLES-15-600450030
      title: Configure lockout for failed password attempts
      levels:
          - medium
      status: automated
      rules:
          - accounts_passwords_pam_faillock_deny
          - var_accounts_passwords_pam_faillock_deny=5

    - id: SLES-15-600450045
      title: Configure password unlock time
      levels:
          - medium
      status: automated
      rules:
          - accounts_passwords_pam_faillock_unlock_time
          - var_accounts_passwords_pam_faillock_unlock_time=900

    - id: SLES-15-600450060
      title: Configure the root Account for Failed Password Attempts
      levels:
          - medium
      status: automated
      rules:
          - accounts_passwords_pam_faillock_deny_root

    - id: SLES-15-600450090
      title: Configure password number of changed characters
      levels:
          - medium
      status: automated
      rules:
          - cracklib_accounts_password_pam_difok
          - var_password_pam_difok=2

    - id: SLES-15-600450105
      title: Configure password length
      levels:
          - medium
      status: automated
      rules:
          - accounts_password_pam_minlen
          - var_password_pam_minlen=14

    - id: SLES-15-600450120
      title: Configure password complexity
      levels:
          - medium
      status: automated
      rules:
          - cracklib_accounts_password_pam_dcredit
          - var_password_pam_dcredit=1
          - cracklib_accounts_password_pam_ucredit
          - var_password_pam_ucredit=1
          - cracklib_accounts_password_pam_lcredit
          - var_password_pam_lcredit=1
          - cracklib_accounts_password_pam_ocredit
          - var_password_pam_ocredit=1

    - id: SLES-15-600450180
      title: Configure password history remember
      levels:
          - medium
      status: automated
      rules:
          - accounts_password_pam_pwhistory_remember
          - var_password_pam_remember=5

    - id: SLES-15-600450225
      title: Prevent Login to Accounts With Empty Password
      levels:
          - high
      status: automated
      rules:
          - no_empty_passwords

    - id: SLES-15-600450255
      title: Set PAM's Password Hashing Algorithm
      levels:
          - medium
      status: automated
      rules:
          - set_password_hashing_algorithm_systemauth
          - set_password_hashing_algorithm_passwordauth
          - var_password_hashing_algorithm_pam=sha512

    - id: SLES-15-600600015
      title: Configure password expiration
      levels:
          - medium
      status: automated
      rules:
          - accounts_maximum_age_login_defs
          - var_accounts_maximum_age_login_defs=365
          - accounts_password_set_max_life_existing

    - id: SLES-15-600600030
      title: Configure minimum password days
      levels:
          - medium
      status: automated
      rules:
          - accounts_minimum_age_login_defs
          - var_accounts_minimum_age_login_defs=1
          - accounts_password_set_min_life_existing

    - id: SLES-15-600600045
      title: Configure password expiration warning days
      levels:
          - medium
      status: automated
      rules:
          - accounts_password_warn_age_login_defs
          - var_accounts_password_warn_age_login_defs=7
          - accounts_password_set_warn_age_existing

    - id: SLES-15-600600060
      title: Configure strong password hashing algorithm
      levels:
          - medium
      status: automated
      rules:
          - set_password_hashing_algorithm_logindefs
          - accounts_password_all_shadowed_sha512

    - id: SLES-15-600600075
      title: Configure inactive password lock
      levels:
          - medium
      status: automated
      rules:
          - account_disable_post_pw_expiration
          - var_account_disable_post_pw_expiration=30
          - accounts_set_post_pw_existing

    - id: SLES-15-600600090
      title: Ensure all users last password change date is in the past
      levels:
          - medium
      status: automated
      rules:
          - accounts_password_last_change_is_in_past

    - id: SLES-15-600600105
      title: Verify Only Root Has UID 0
      levels:
          - high
      status: automated
      rules:
          - accounts_no_uid_except_zero

    - id: SLES-15-600600120
      title: Verify Root Has A Primary GID 0
      levels:
          - high
      status: automated
      rules:
          - accounts_root_gid_zero

    - id: SLES-15-600600135
      title: Verify Only Group Root Has GID 0
      levels:
          - high
      status: automated
      rules:
          - groups_no_zero_gid_except_root

    - id: SLES-15-600600150
      title: Ensure Authentication Required for with Single User Mode
      levels:
          - medium
      status: automated
      rules:
          - ensure_root_password_configured

    - id: SLES-15-600600165
      title: Verify root path integrity
      levels:
          - medium
      status: automated
      rules:
          - accounts_root_path_dirs_no_write
          - root_path_no_dot

    - id: SLES-15-600600180
      title: Ensure the Root Bash Umask is Set Correctly
      levels:
          - medium
      status: automated
      rules:
          - accounts_umask_root

    - id: SLES-15-600600195
      title: Verify system accounts do not have a valid login shell
      levels:
          - medium
      status: automated
      rules:
          - no_password_auth_for_systemaccounts
          - no_shelllogin_for_systemaccounts

    - id: SLES-15-600600210
      title: Verify Non-Interactive Accounts Are Locked
      levels:
          - medium
      status: automated
      rules:
          - no_invalid_shell_accounts_unlocked

    - id: SLES-15-600600215
      title: Only Authorized Local User Accounts Exist on Operating System
      levels:
          - medium
      status: automated
      rules:
          - accounts_authorized_local_users
          - var_accounts_authorized_local_users_regex=sle15

    - id: SLES-15-600600225
      title: Ensure nologin Shell is Not Listed in /etc/shells
      levels:
          - medium
      status: automated
      rules:
          - no_nologin_in_shells

    - id: SLES-15-600600240
      title: Configure default user shell timeout
      levels:
          - medium
      status: automated
      rules:
          - accounts_tmout
          - var_accounts_tmout=15_min

    - id: SLES-15-600600255
      title: Configure default user umask
      levels:
          - medium
      status: automated
      rules:
          - accounts_umask_etc_bashrc
          - accounts_umask_etc_login_defs
          - accounts_umask_etc_profile
          - var_accounts_user_umask=027

    - id: SLES-15-600600270
      title: Ensure Home Directories are Created for New Users
      levels:
          - medium
      status: automated
      rules:
          - accounts_have_homedir_login_defs

    - id: SLES-15-600600285
      title: Limit the Number of Concurrent Login Sessions Allowed Per User
      levels:
          - low
      status: automated
      rules:
          - accounts_max_concurrent_login_sessions

    - id: SLES-15-600600300
      title: Ensure that Users Path Contains Only Local Directories
      levels:
          - medium
      status: automated
      rules:
          - accounts_user_home_paths_only

    - id: SLES-15-600600315
      title: Install Smart Card Packages For Multifactor Authentication
      levels:
          - medium
      status: automated
      rules:
          - install_smartcard_packages

    - id: SLES-15-600600330
      title: Enable Smart Card Logins in PAM
      levels:
          - medium
      status: automated
      rules:
          - smartcard_pam_enabled

    - id: SLES-15-600600345
      title: Configure Smart Card Certificate Authority Validation
      levels:
          - medium
      status: automated
      rules:
          - smartcard_configure_ca

    - id: SLES-15-600600360
      title: Title
      levels:
          - medium
      status: automated
      rules:
          - smartcard_configure_cert_checking

    - id: SLES-15-750150015
      title: Install AIDE
      levels:
          - medium
      status: automated
      rules:
          - package_aide_installed
          - aide_build_database

    - id: SLES-15-750150030
      title: Configure Systemd Timer Execution of AIDE
      levels:
          - medium
      status: automated
      rules:
          - aide_periodic_checking_systemd_timer

    - id: SLES-15-750150045
      title: Configure AIDE to Verify the Audit Tools
      levels:
          - medium
      status: automated
      rules:
          - aide_check_audit_tools

    - id: SLES-15-750300015
      title: Enable systemd-journald Service
      levels:
          - medium
      status: automated
      rules:
          - service_systemd-journald_enabled

    - id: SLES-15-750300030
      title: Configure journald log file access
      levels:
          - medium
      status: manual

    - id: SLES-15-750300045
      title: Configure ournald log file rotation
      levels:
          - medium
      status: manual

    - id: SLES-15-750300060
      title: Ensure One Logging Service Is In Use
      levels:
          - medium
      status: automated
      rules:
          - logging_services_active

    - id: SLES-15-750300075
      title: Install systemd-journal-remote
      levels:
          - medium
      status: automated
      rules:
          - package_systemd-journal-remote_installed

    - id: SLES-15-750300090
      title: Configure systemd-journal-upload authentication
      levels:
          - medium
      status: automated
      rules:
          - systemd_journal_upload_url
          - systemd_journal_upload_server_tls

    - id: SLES-15-750300105
      title: Enable systemd-journal-upload Service
      levels:
          - medium
      status: automated
      rules:
          - service_systemd-journal-upload_enabled

    - id: SLES-15-750300120
      title: Disable systemd-journal-remote Socket
      levels:
          - medium
      status: automated
      rules:
          - socket_systemd-journal-remote_disabled

    - id: SLES-15-750300135
      title: Disable journald ForwardToSyslog
      levels:
          - medium
      status: automated
      rules:
          - journald_disable_forward_to_syslog

    - id: SLES-15-750300150
      title: Configure journald Compress
      levels:
          - medium
      status: automated
      rules:
          - journald_compress

    - id: SLES-15-750300165
      title: Configure journald Storage
      levels:
          - medium
      status: automated
      rules:
          - journald_storage

    - id: SLES-15-750300180
      title: Verify Logs Sent To Remote Host
      levels:
          - medium
      status: automated
      rules:
          - rsyslog_remote_loghost

    - id: SLES-15-750300195
      title: Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
      levels:
          - medium
      status: automated
      rules:
          - rsyslog_nolisten

    - id: SLES-15-750300210
      title: Ensure rsyslog is Installed
      levels:
          - medium
      status: automated
      rules:
          - package_rsyslog_installed

    - id: SLES-15-750300225
      title: Enable rsyslog Service
      levels:
          - medium
      status: automated
      rules:
          - service_rsyslog_enabled

    - id: SLES-15-750300240
      title: Configure journald to send logs to rsyslog
      levels:
          - medium
      status: automated
      rules:
          - journald_forward_to_syslog

    - id: SLES-15-750300255
      title: Configure rsyslog Default File Permissions
      levels:
          - medium
      status: automated
      rules:
          - rsyslog_filecreatemode

    - id: SLES-15-750300270
      title: Configure rsyslog logging
      levels:
          - medium
      status: automated
      rules:
          - rsyslog_logging_configured

    - id: SLES-15-750300285
      title: Configure rsyslog logrotate
      levels:
          - medium
      status: automated
      rules:
          - package_logrotate_installed
          - timer_logrotate_enabled
          - ensure_logrotate_activated

    - id: SLES-15-750300300
      title: Configure access to all logfiles has been
      levels:
          - medium
      status: automated
      rules:
          - rsyslog_files_groupownership
          - rsyslog_files_ownership
          - rsyslog_files_permissions

    - id: SLES-15-750450015
      title: Ensure the audit Subsystem is Installed
      levels:
          - medium
      status: automated
      rules:
          - package_audit_installed
          - package_audit-libs_installed

    - id: SLES-15-750450030
      title: Enable Auditing for Processes Which Start Prior to the Audit Daemon
      levels:
          - low
      status: automated
      rules:
          - grub2_audit_argument

    - id: SLES-15-750450045
      title: Extend Audit Backlog Limit for the Audit Daemon
      levels:
          - low
      status: automated
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192

    - id: SLES-15-750450060
      title: Enable auditd Service
      levels:
          - medium
      status: automated
      rules:
          - service_auditd_enabled

    - id: SLES-15-750450075
      title: Configure auditd Max Log File Size
      levels:
          - medium
      status: automated
      rules:
          - auditd_data_retention_max_log_file
          - var_auditd_max_log_file=6

    - id: SLES-15-750450090
      title: Configure auditd max_log_file_action Upon Reaching Maximum Log Size
      levels:
          - medium
      status: automated
      rules:
          - auditd_data_retention_max_log_file_action
          - var_auditd_max_log_file_action=keep_logs

    - id: SLES-15-750450105
      title: Disable the system when audit logs are full
      levels:
          - medium
      status: automated
      rules:
          - auditd_data_retention_space_left_action
          - var_auditd_space_left_action=email
          - auditd_data_retention_action_mail_acct
          - var_auditd_action_mail_acct=root
          - auditd_data_retention_admin_space_left_action
          - var_auditd_admin_space_left_action=halt

    - id: SLES-15-750450120
      title: Configure auditd mail_acct Action on Low Disk Space
      levels:
          - medium
      status: automated
      rules:
          - auditd_data_retention_action_mail_acct
          - auditd_data_retention_admin_space_left_action
          - auditd_data_retention_space_left_action
          - var_auditd_action_mail_acct=root
          - var_auditd_admin_space_left_action=cis_sle15
          - var_auditd_space_left_action=cis_sle15

    - id: SLES-15-750450135
      title: Ensure auditd Collects System Administrator Actions
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_sysadmin_actions

    - id: SLES-15-750450150
      title: Record Events When Executables Are Run As Another User
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_suid_auid_privilege_function

    - id: SLES-15-750450165
      title: Record Attempts to perform maintenance activities
      levels:
          - medium
      status: automated
      rules:
          - audit_sudo_log_events

    - id: SLES-15-750450180
      title: Record attempts to alter the date and time
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_time_adjtimex
          - audit_rules_time_settimeofday
          - audit_rules_time_stime
          - audit_rules_time_watch_localtime

    - id: SLES-15-750450195
      title: Record Events that Modify the System's Network Environment
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_networkconfig_modification

    - id: SLES-15-750450210
      title: Record Events of Use of Privileged Commands
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands

    - id: SLES-15-750450225
      title: Record Events of unsuccessful file access attempts
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_unsuccessful_file_modification_creat
          - audit_rules_unsuccessful_file_modification_open
          - audit_rules_unsuccessful_file_modification_openat
          - audit_rules_unsuccessful_file_modification_truncate
          - audit_rules_unsuccessful_file_modification_ftruncate

    - id: SLES-15-750450240
      title: Record Events that modify user/group information
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow

    - id: SLES-15-750450255
      title: Record Events of discretionary access control permission modification
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_lchown
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr

    - id: SLES-15-750450270
      title: Ensure auditd Collects Information on Exporting to Media (successful)
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_media_export

    - id: SLES-15-750450285
      title: Record Attempts to Alter Process and Session Initiation Information
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_session_events

    - id: SLES-15-750450300
      title: Record Attempts to Alter Logon and Logout Events
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_login_events_faillog
          - audit_rules_login_events_lastlog
          - audit_rules_login_events_tallylog

    - id: SLES-15-750450315
      title: Ensure auditd Collects File Deletion Events by User
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_file_deletion_events_rename
          - audit_rules_file_deletion_events_renameat
          - audit_rules_file_deletion_events_unlink
          - audit_rules_file_deletion_events_unlinkat

    - id: SLES-15-750450330
      title: Record Events that Modify the System''s Mandatory Access Controls
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_mac_modification
          - audit_rules_mac_modification_usr_share

    - id: SLES-15-750450345
      title: Record Any Attempts to Run chcon
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_execution_chcon

    - id: SLES-15-750450360
      title: Record Any Attempts to Run setfacl
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_execution_setfacl

    - id: SLES-15-750450375
      title: Record Any Attempts to Run chacl
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_execution_chacl

    - id: SLES-15-750450390
      title: Ensure auditd Collects Information on the Use of Privileged Commands - usermod
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_usermod

    - id: SLES-15-750450405
      title: Ensure auditd Collects Information on the Use of Privileged Commands
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_insmod
          - audit_rules_privileged_commands_rmmod
          - audit_rules_privileged_commands_modprobe
          - audit_rules_kernel_module_loading_delete
          - audit_rules_kernel_module_loading_init
          - audit_rules_kernel_module_loading

    - id: SLES-15-750450420
      title: Make the auditd Configuration Immutable
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_immutable

    - id: SLES-15-750450435
      title: Verify that the running and on disk configuration is the same
      levels:
          - medium
      status: manual

    - id: SLES-15-750450450
      title: Remove Default Configuration to Disable Syscall Auditing
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_enable_syscall_auditing

    - id: SLES-15-750450465
      title: Ensure auditd Collects Information on the Use of Privileged Commands - chage
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_chage

    - id: SLES-15-750450480
      title: Ensure auditd Collects Information on the Use of Privileged Commands - chfn
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_chfn

    - id: SLES-15-750450495
      title: Ensure auditd Collects Information on the Use of Privileged Commands - chsh
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_chsh

    - id: SLES-15-750450510
      title: Ensure auditd Collects Information on the Use of Privileged Commands - crontab
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_crontab

    - id: SLES-15-750450525
      title: Ensure auditd Collects Information on the Use of Privileged Commands - newgrp
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_newgrp

    - id: SLES-15-750450540
      title: System Audit Logs Must Have Mode 0750 or Less Permissive
      levels:
          - medium
      status: automated
      rules:
          - directory_permissions_var_log_audit

    - id: SLES-15-750450555
      title: System Audit Logs Must Have Mode 0640 or Less Permissive
      levels:
          - medium
      status: automated
      rules:
          - file_permissions_var_log_audit

    - id: SLES-15-750450570
      title: System Audit Logs Must Be Owned By Root
      levels:
          - medium
      status: automated
      rules:
          - file_ownership_var_log_audit_stig

    - id: SLES-15-750450585
      title: System Audit Logs Must Be Group Owned By Root
      levels:
          - medium
      status: automated
      rules:
          - file_group_ownership_var_log_audit

    - id: SLES-15-750450600
      title: Audit Configuration Files Permissions are 640 or More Restrictive
      levels:
          - medium
      status: automated
      rules:
          - file_permissions_audit_configuration

    - id: SLES-15-750450615
      title: Audit Configuration Files Must Be Owned By Root
      levels:
          - medium
      status: automated
      rules:
          - file_ownership_audit_configuration

    - id: SLES-15-750450630
      title: Audit Configuration Files Must Be Owned By Group root
      levels:
          - medium
      status: automated
      rules:
          - file_groupownership_audit_configuration

    - id: SLES-15-750450645
      title: Verify that audit tools Have Mode 0755 or less
      levels:
          - medium
      status: automated
      rules:
          - file_permissions_audit_binaries

    - id: SLES-15-750450660
      title: Verify that audit tools are owned by root
      levels:
          - medium
      status: automated
      rules:
          - file_ownership_audit_binaries

    - id: SLES-15-750450675
      title: Verify that audit tools are owned by group root
      levels:
          - medium
      status: automated
      rules:
          - file_groupownership_audit_binaries

    - id: SLES-15-750450690
      title: Record Any Attempts to Run ssh-agent
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_ssh_agent

    - id: SLES-15-750450705
      title: Ensure auditd Collects Information on the Use of Privileged Commands - ssh-keysign
      levels:
          - medium
      status: automated
      rules:
          - audit_rules_privileged_commands_ssh_keysign

    - id: SLES-15-900150000
      title: Verify and Correct File Permissions and Ownership with RPM
      levels:
          - high
      status: automated
      rules:
          - rpm_verify_permissions
          - rpm_verify_ownership

    - id: SLES-15-900150015
      title: Configure access to /etc/passwd
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_passwd
          - file_owner_etc_passwd
          - file_permissions_etc_passwd
          - file_permissions_etc_gshadow
          - file_groupowner_etc_gshadow
          - file_owner_etc_gshadow

    - id: SLES-15-900150030
      title: Configure access to /etc/passwd-
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_backup_etc_passwd
          - file_owner_backup_etc_passwd
          - file_permissions_backup_etc_passwd
          - file_permissions_backup_etc_gshadow
          - file_groupowner_backup_etc_gshadow
          - file_owner_backup_etc_gshadow

    - id: SLES-15-900150045
      title: Configure access to /etc/group
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_group
          - file_owner_etc_group
          - file_permissions_etc_group

    - id: SLES-15-900150060
      title: Configure access to /etc/group-
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_backup_etc_group
          - file_owner_backup_etc_group
          - file_permissions_backup_etc_group

    - id: SLES-15-900150075
      title: Configure access to /etc/shadow
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_shadow
          - file_owner_etc_shadow
          - file_permissions_etc_shadow

    - id: SLES-15-900150090
      title: Configure access to /etc/shadow-
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_backup_etc_shadow
          - file_owner_backup_etc_shadow
          - file_permissions_backup_etc_shadow

    - id: SLES-15-900150105
      title: Configure access to /etc/gshadow
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_etc_gshadow
          - file_owner_etc_gshadow
          - file_permissions_etc_gshadow

    - id: SLES-15-900150120
      title: Configure access to /etc/gshadow-
      levels:
          - medium
      status: automated
      rules:
          - file_groupowner_backup_etc_gshadow
          - file_owner_backup_etc_gshadow
          - file_permissions_backup_etc_gshadow

    - id: SLES-15-900150135
      title: Configure access to /etc/shells
      levels:
          - medium
      status: automated
      rules:
          - file_owner_etc_shells
          - file_groupowner_etc_shells
          - file_permissions_etc_shells

    - id: SLES-15-900150150
      title: Configure access to /etc/security/opasswd
      levels:
          - medium
      status: automated
      rules:
          - file_owner_etc_security_opasswd
          - file_groupowner_etc_security_opasswd
          - file_permissions_etc_security_opasswd
          - file_owner_etc_security_opasswd_old
          - file_groupowner_etc_security_opasswd_old
          - file_permissions_etc_security_opasswd_old

    - id: SLES-15-900150165
      title: Verify that No World-Writable Files Exist
      levels:
          - medium
      status: automated
      rules:
          - file_permissions_unauthorized_world_writable

    - id: SLES-15-900150180
      title: Verify that All Files Are Owned by a User
      levels:
          - medium
      status: automated
      rules:
          - no_files_unowned_by_user

    - id: SLES-15-900150195
      title: Ensure All SUID Executables Are Authorized
      levels:
          - medium
      status: automated
      rules:
          - file_permissions_unauthorized_suid

    - id: SLES-15-900150210
      title: Verify access to /etc/ipsec
      levels:
          - medium
      status: automated
      rules:
          - directory_groupowner_etc_ipsecd
          - directory_owner_etc_ipsecd
          - directory_permissions_etc_ipsecd
          - file_groupowner_etc_ipsec_conf
          - file_groupowner_etc_ipsec_secrets

    - id: SLES-15-900150225
      title: Verify access to /etc/nftables
      levels:
          - medium
      status: automated
      rules:
          - directory_groupowner_etc_nftables
          - directory_owner_etc_nftables
          - directory_permissions_etc_nftables

    - id: SLES-15-900150240
      title: Verify access to /etc/selinux
      levels:
          - medium
      status: automated
      rules:
          - directory_groupowner_etc_selinux
          - directory_owner_etc_selinux
          - directory_permissions_etc_selinux

    - id: SLES-15-900150255
      title: Verify access to /etc/sudoers.d
      levels:
          - medium
      status: automated
      rules:
          - directory_groupowner_etc_sudoersd
          - directory_owner_etc_sudoersd
          - directory_permissions_etc_sudoersd

    - id: SLES-15-900150270
      title: Verify access to /etc/sysctl.d
      levels:
          - medium
      status: automated
      rules:
          - directory_groupowner_etc_sysctld
          - directory_owner_etc_sysctld
          - directory_permissions_etc_sysctld

    - id: SLES-15-900300015
      title: Verify All Account Password Hashes are Shadowed
      levels:
          - medium
      status: automated
      rules:
          - accounts_password_all_shadowed

    - id: SLES-15-900300030
      title: Verify that /etc/shadow password fields are not empty
      levels:
          - medium
      status: automated
      rules:
          - no_legacy_plus_entries_etc_passwd
          - no_legacy_plus_entries_etc_shadow

    - id: SLES-15-900300045
      title: Verify that all groups in /etc/passwd exist in /etc/group
      levels:
          - low
      status: automated
      rules:
          - gid_passwd_group_same

    - id: SLES-15-900300060
      title: Verify that no duplicate UIDs exist
      levels:
          - medium
      status: automated
      rules:
          - account_unique_id

    - id: SLES-15-900300075
      title: Verify that no duplicate GIDs exist
      levels:
          - medium
      status: automated
      rules:
          - group_unique_id

    - id: SLES-15-900300090
      title: Verify that no duplicate user names exist
      levels:
          - medium
      status: automated
      rules:
          - account_unique_name

    - id: SLES-15-900300105
      title: Verify that no duplicate group names exist
      levels:
          - medium
      status: automated
      rules:
          - group_unique_name

    - id: SLES-15-900300120
      title: Configure local interactive user home directories
      levels:
          - medium
      status: automated
      rules:
          - accounts_user_interactive_home_directory_exists
          - file_groupownership_home_directories
          - file_ownership_home_directories
          - file_permissions_home_directories

    - id: SLES-15-900300135
      title: Configure local interactive user dot files access
      levels:
          - medium
      status: automated
      rules:
          - no_rsh_trust_files
          - no_forward_files
          - no_netrc_files
          - accounts_user_dot_user_ownership
          - accounts_user_dot_group_ownership
          - var_user_initialization_files_regex=all_dotfiles
          - file_permission_user_init_files
          - file_permission_user_bash_history
