controls:
    -   id: SRG-OS-000480-GPOS-00227
        levels:
            - medium
        title: {{{ full_name }}} must be configured in accordance with the security configuration
            settings based on DoD security configuration or implementation guidance, including
            STIGs, NSA configuration guides, CTOs, and DTMs.
        rules:
            # file permissions
            - file_groupowner_cron_d
            - file_groupowner_cron_daily
            - file_groupowner_cron_hourly
            - file_groupowner_cron_monthly
            - file_groupowner_cron_weekly
            - file_groupowner_crontab
            - file_groupowner_etc_group
            - file_groupowner_etc_gshadow
            - file_groupowner_etc_passwd
            - file_groupowner_etc_shadow
            - file_owner_grub2_cfg
            - file_groupowner_grub2_cfg
            - file_owner_cron_d
            - file_owner_cron_daily
            - file_owner_cron_hourly
            - file_owner_cron_monthly
            - file_owner_cron_weekly
            - file_owner_etc_group
            - file_owner_etc_gshadow
            - file_owner_etc_passwd
            - file_owner_etc_shadow
            - file_groupowner_backup_etc_group
            - file_groupowner_backup_etc_gshadow
            - file_groupowner_backup_etc_passwd
            - file_groupowner_backup_etc_shadow
            - file_owner_backup_etc_group
            - file_owner_backup_etc_gshadow
            - file_owner_backup_etc_passwd
            - file_owner_backup_etc_shadow
            - file_permissions_backup_etc_group
            - file_permissions_backup_etc_gshadow
            - file_permissions_backup_etc_passwd
            - file_permissions_backup_etc_shadow
            - file_owner_crontab
            - file_permissions_etc_group
            - file_permissions_etc_gshadow
            - file_permissions_etc_passwd
            - file_permissions_etc_shadow
            - file_permissions_cron_d
            - file_permissions_cron_daily
            - file_permissions_cron_hourly
            - file_permissions_cron_monthly
            - file_permissions_cron_weekly
            - file_permissions_crontab
            - file_permissions_cron_allow
            - file_owner_cron_allow
            - file_groupowner_cron_allow
            - file_groupowner_sshd_config
            - file_owner_sshd_config
            - file_permissions_sshd_config
            - file_groupowner_sshd_drop_in_config
            - directory_groupowner_sshd_config_d
            - directory_permissions_sshd_config_d
            - file_permissions_sshd_private_key
            - file_permissions_sshd_pub_key
            - file_groupownership_home_directories
            - file_permission_user_init_files
            - file_permissions_home_directories
            - file_permissions_ungroupowned
            - dir_perms_world_writable_root_owned
            - no_files_unowned_by_user
            - file_owner_cron_deny
            - file_groupowner_cron_deny
            - file_permission_user_init_files_root
            - var_user_initialization_files_regex=all_dotfiles
            - rootfiles_configured
            - directory_owner_sshd_config_d
            - file_owner_sshd_drop_in_config
            - file_permissions_sshd_drop_in_config

            # service disabled
            - service_kdump_disabled
            - service_debug-shell_disabled
            - service_autofs_disabled
            - service_systemd-coredump_disabled

            # service enabled
            - service_auditd_enabled
            - service_rsyslog_enabled
            - service_firewalld_enabled

            # package removed
            - package_unbound_removed
            - package_vsftpd_removed
            - package_tftp-server_removed
            - package_gssproxy_removed
            - package_tuned_removed
            - package_gdm_removed
            - package_nfs-utils_removed

            # package installed
            - package_openssh-clients_installed
            - package_libreswan_installed
            - package_audit_installed
            - package_rsyslog-gnutls_installed
            - package_rsyslog_installed
            - package_firewalld_installed
            - package_gnutls-utils_installed
            - package_nss-tools_installed
            - package_policycoreutils-python-utils_installed
            - package_policycoreutils_installed
            - package_cron_installed

            # mount options
            - mount_option_nodev_remote_filesystems
            - mount_option_noexec_remote_filesystems
            - mount_option_nosuid_remote_filesystems
            - mount_option_boot_nosuid
            - mount_option_home_noexec
            - mount_option_home_nosuid
            - mount_option_nodev_nonroot_local_partitions
            - mount_option_nodev_removable_partitions
            - mount_option_noexec_removable_partitions
            - mount_option_nosuid_removable_partitions
            - mount_option_krb_sec_remote_filesystems
            - use_kerberos_security_all_exports

            # sshd config
            - sshd_disable_compression
            - sshd_disable_empty_passwords
            - sshd_disable_gssapi_auth
            - sshd_disable_kerb_auth
            - sshd_disable_rhosts
            - sshd_disable_root_login
            - sshd_disable_user_known_hosts
            - sshd_disable_x11_forwarding
            - sshd_enable_strictmodes
            - sshd_print_last_log
            - sshd_rekey_limit
            - sshd_x11_use_localhost

            # auditd config
            - auditd_local_events
            - auditd_log_format
            - auditd_write_logs

            # sysctl
            - sysctl_net_ipv6_conf_all_accept_ra
            - sysctl_net_ipv6_conf_all_accept_redirects
            - sysctl_net_ipv6_conf_all_accept_source_route
            - sysctl_net_ipv6_conf_all_forwarding
            - sysctl_net_ipv6_conf_default_accept_ra
            - sysctl_net_ipv6_conf_default_accept_redirects
            - sysctl_net_ipv6_conf_default_accept_source_route
            - sysctl_net_ipv4_conf_all_accept_redirects
            - sysctl_net_ipv4_conf_all_accept_source_route
            - sysctl_net_ipv4_conf_all_forwarding
            - sysctl_net_ipv4_conf_default_accept_source_route
            - sysctl_net_ipv4_conf_all_rp_filter
            - sysctl_net_ipv4_conf_default_rp_filter
            - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
            - sysctl_net_ipv4_tcp_syncookies
            - sysctl_net_ipv4_conf_all_send_redirects
            - sysctl_net_ipv4_conf_default_accept_redirects
            - sysctl_net_ipv4_conf_default_send_redirects
            - sysctl_net_ipv4_ip_forward
            - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
            - sysctl_kernel_core_pattern
            - sysctl_kernel_kexec_load_disabled
            - sysctl_kernel_unprivileged_bpf_disabled
            - sysctl_kernel_yama_ptrace_scope
            - sysctl_net_core_bpf_jit_harden
            - sysctl_kernel_kptr_restrict
            - sysctl_kernel_randomize_va_space

            # accounts
            - accounts_have_homedir_login_defs
            - accounts_user_dot_no_world_writable_programs
            - accounts_user_home_paths_only
            - accounts_user_interactive_home_directory_defined
            - accounts_user_interactive_home_directory_exists
            - accounts_umask_etc_bashrc
            - accounts_umask_interactive_users
            - accounts_authorized_local_users
            - accounts_no_uid_except_zero
            - no_empty_passwords
            - no_shelllogin_for_systemaccounts
            - sudoers_validate_passwd
            - sudo_restrict_privilege_elevation_to_authorized
            - no_empty_passwords_etc_shadow
            - xwindows_runlevel_target

            # dconf
            - dconf_gnome_disable_automount_open
            - dconf_gnome_disable_autorun
            - dconf_gnome_disable_ctrlaltdel_reboot
            - dconf_gnome_disable_user_list
            - dconf_gnome_disable_restart_shutdown
            - dconf_db_up_to_date

            # partition
            - partition_for_home
            - partition_for_tmp
            - partition_for_var
            - partition_for_var_log
            - partition_for_var_log_audit
            - partition_for_var_tmp

            # rsyslog
            - rsyslog_cron_logging
            - rsyslog_nolisten
            - rsyslog_remote_loghost

            # disable misc
            - kernel_module_usb-storage_disabled
            - coredump_disable_backtraces
            - coredump_disable_storage
            - disable_users_coredumps
            - disable_ctrlaltdel_burstaction
            - disable_ctrlaltdel_reboot

            # aide
            - aide_verify_acls
            - aide_verify_ext_attributes

            # grub2
            - grub2_vsyscall_argument
            - grub2_page_poison_argument
            - grub2_disable_interactive_boot

            # network
            - configured_firewalld_default_deny
            - network_configure_name_resolution
            - network_sniffer_disabled
            - postfix_prevent_unrestricted_relay
            - set_firewalld_default_zone
            - firewalld_sshd_port_enabled

            # NetworkManger
            - networkmanager_dns_mode
            - var_networkmanager_dns_mode=explicit_default

            # misc
            - no_host_based_files
            - no_user_host_based_files
            - display_login_attempts
            - installed_OS_is_vendor_supported
            - selinux_all_devicefiles_labeled
            - chrony_set_nts
            - tftp_uses_secure_mode_systemd
            - grub2_pti_argument
            - chronyd_client_only
            - chronyd_no_chronyc_network

        status: automated
