---
policy: 'Standard Benchmark for Kylin Server 10'
title: 'Standard Benchmark for Kylin Server 10'
id: std_kylinserver10
version: '1.0'

levels:
    - id: l1_server
    - id: l2_server

controls:

  ##1.Security Services

    - id: 1.1
      title: Ensure a print server is not installed (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - package_cups_removed
      related_rules:
          - service_cups_disabled

    - id: 1.1
      levels:
          - l2_server
      title: system must not have the sendmail package installed.
      status: automated
      rules:
          - package_sendmail_removed

    - id: 1.3
      title: Ensure NFS Service Disabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_nfs_disabled
          - service_nfs_disabled.severity=low

    - id: 1.4
      title: Ensure nfs-utils is not installed or the nfs-server service is masked (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - service_nfs_disabled
          - package_nfs-utils_removed

    - id: 1.5
      title: ident{auth.socket}
      levels:
          - l2_server
      status: planned

    - id: 1.6
      title: ntalk
      levels:
          - l2_server
      status: planned

    - id: 1.7
      title: Ensure DHCP Service Disabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_dhcpd_disabled
          - service_dhcpd_disabled.severity=low

    - id: 1.8
      title: Ensure NIS Client Not Installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_ypbind_removed
          - package_ypbind_removed.severity=high

    - id: 1.9
      title: Ensure TFTP Server Not Installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_tftp_removed
          - package_tftp_removed.severity=high
          - package_tftp-server_removed
          - package_tftp-server_removed.severity=high

    - id: 1.10
      title: Ensure rsync-daemon is not installed or the rsyncd service is masked (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - package_rsync_removed
      related_rules:
          - service_rsyncd_disabled

    - id: 1.11
      title: Prohibit anonymous VSFTP user login
      levels:
          - l2_server
      status: planned

    - id: 1.12
      title: Prohibit root login to VSFTP
      levels:
          - l2_server
      status: planned

    - id: 1.13
      title: ensure-local-login-warning-banner-is-configured-properly
      levels:
          - l2_server
      status: automated
      rules:
          - banner_etc_issue
          - login_banner_text=cis_banners

    - id: 1.14
      title: ensure-message-of-the-day-is-configured-properly
      levels:
          - l2_server
      status: automated
      rules:
          - banner_etc_motd
          - login_banner_text=cis_banners

    - id: 1.15
      title: Ensure sshd PermitRootLogin is disabled (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_disable_root_login

    - id: 1.16
      title: Ensure SSHd Protocol Version Is 2
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_allow_only_protocol2
          - sshd_allow_only_protocol2.severity=high

    - id: 1.17
      title: Ensure SSHd Log Level Correct
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_loglevel_verbose
          - sshd_set_loglevel_verbose.severity=low

    - id: 1.18
      title: Ensure SSHd MaxAuthTries Correct
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_max_auth_tries
          - sshd_set_max_auth_tries.severity=low
          - sshd_max_auth_tries_value=3

    - id: 1.19
      title: ensure-ssh-permitemptypasswords-is-disabled
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_disable_empty_passwords

    - id: 1.20
      title: Ensure SSHd PermitUserEnvironment Forbidden
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_do_not_permit_user_env
          - sshd_do_not_permit_user_env.severity=high

    - id: 1.21
      title: Ensure SSHd Ciphers Algorithm Correct
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_use_strong_ciphers
          - sshd_use_strong_ciphers.severity=high

    - id: 1.22
      title: check is installed chkrootkit
      levels:
          - l2_server
      status: planned

    - id: 1.23
      title: Check for the existence of rootkit programs
      levels:
          - l2_server
      status: planned

    - id: 1.24
      title: Restricting the directories that FTP users can access after logging in
      levels:
          - l2_server
      status: planned

    - id: 1.25
      title: operating system must use SSH to protect the confidentiality and integrity of transmitted
          information.
      levels:
          - l2_server
      status: automated
      rules:
          - package_openssh-server_installed
          - service_sshd_enabled

    - id: 1.26
      title: Ensure telnet server services are not in use (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - package_telnet-server_removed
      related_rules:
          - service_telnet_disabled

    - id: 1.27
      title: Prohibit remote telnet login for root user
      levels:
          - l2_server
      status: planned

    - id: 1.28
      title: Set warning banner before telnet login
      levels:
          - l2_server
      status: planned

    - id: 1.29
      title: Set warning banner after telnet login
      levels:
          - l2_server
      status: planned

    - id: 1.30
      title: Disable unnecessary xinetd services
      levels:
          - l2_server
      status: planned

    - id: 1.31
      title: Ensure Unnecessary Service And Port Disabled (Manual)
      levels:
          - l2_server
      status: planned

    - id: 1.32
      title: Ensure SSH access is limited (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_limit_user_access

    - id: 1.33
      title: SSH daemon must display the date and time of the last successful account logon upon an SSH
          logon.
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_print_last_log

  ##2 Kernel parameters

    - id: 2.1
      title: Ensure ICMP Redirect Package Not Received
      levels:
          - l2_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
          - sysctl_net_ipv4_conf_all_accept_redirects.severity=high
          - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv4_conf_all_secure_redirects
          - sysctl_net_ipv4_conf_all_secure_redirects.severity=high
          - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_secure_redirects
          - sysctl_net_ipv4_conf_default_secure_redirects.severity=high
          - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled

    - id: 2.2
      title: Ensure packet redirect sending is disabled (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
          - sysctl_net_ipv4_conf_default_send_redirects

    - id: 2.3
      title: Ensure ICMP Broadcast Package Not Responsed
      levels:
          - l2_server
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts.severity=high

    - id: 2.4
      title: Ensure Source Route Disabled
      levels:
          - l2_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
          - sysctl_net_ipv4_conf_all_accept_source_route.severity=high
          - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv4_conf_default_accept_source_route
          - sysctl_net_ipv4_conf_default_accept_source_route.severity=high
          - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled

    - id: 2.5
      title: Ensure IP Forwarding Disabled
      levels:
          - l2_server
      status: automated
      rules:
          - sysctl_net_ipv4_ip_forward
          - sysctl_net_ipv4_ip_forward.severity=high

  ##3 safe net
    - id: 3.1
      title: Modify SNMP default group characters
      levels:
          - l2_server
      status: planned

    - id: 3.2
      title: Disable multi IP binding
      levels:
          - l2_server
      status: planned

    - id: 3.3
      title: Ensure Reverse Proxy Filter Enabled
      levels:
          - l2_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
          - sysctl_net_ipv4_conf_all_rp_filter.severity=high
          - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
          - sysctl_net_ipv4_conf_default_rp_filter
          - sysctl_net_ipv4_conf_default_rp_filter.severity=high
          - sysctl_net_ipv4_conf_default_rp_filter_value=enabled

  ##4 System commands

    - id: 4.1
      title: Ensure sudo log file exists (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - sudo_custom_logfile

    - id: 4.2
      title: Ensure sudo commands use pty (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - sudo_add_use_pty

    - id: 4.3
      title: must use the invoking user's password for privilege escalation when using "sudo".
      levels:
          - l2_server
      status: automated
      rules:
          - sudoers_validate_passwd

    - id: 4.4
      title: Ensure Important Services Logged
      levels:
          - l1_server
      status: automated
      rules:
          - rsyslog_logging_configured
          - rsyslog_logging_configured.severity=low

    - id: 4.5
      title: Ensure HISTSIZE and HISTFILESIZE Limited
      levels:
          - l1_server
      status: planned

  ##5 System Audit

    - id: 5.1
      title: check is installed swatch
      levels:
          - l1_server
      status: planned

    - id: 5.2
      title: Ensure Auditd Enabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_auditd_enabled
          - service_auditd_enabled.severity=high

    - id: 5.3
      title: Set system audit log rules
      levels:
          - l1_server
      status: planned

    - id: 5.4
      title: Ensure Audit Disk Space Set Correct
      levels:
          - l1_server
      status: automated
      rules:
          - auditd_data_retention_space_left
          - auditd_data_retention_space_left.severity=low

    - id: 5.5
      title: Ensure cron is restricted to authorized users (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - file_cron_allow_exists

    - id: 5.6
      title: Ensure Rsyslog Enabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_rsyslog_enabled
          - service_rsyslog_enabled.severity=high

    - id: 5.7
      title: Record user operations on the device
      levels:
          - l2_server
      status: automated
      rules:
          - package_psacct_installed
          - service_psacct_enabled

    - id: 5.8
      title: Record user login logs
      levels:
          - l1_server
      status: planned

    - id: 5.9
      title: Configure security event logs
      levels:
          - l1_server
      status: planned

    - id: 5.10
      title: Ensure Cron Logged
      levels:
          - l2_server
      status: automated
      rules:
          - rsyslog_cron_logging
          - rsyslog_cron_logging.severity=high

    - id: 5.11
      title: Ensure AIDE Enabled
      levels:
          - l1_server
      status: automated
      rules:
          - package_aide_installed
          - package_aide_installed.severity=low

    - id: 5.12
      title: Ensure filesystem integrity is regularly checked (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - aide_periodic_cron_checking

  ##6 System settings

    - id: 6.1
      title: Ensure TIMOUT Set Correct
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_tmout
          - accounts_tmout.severity=high
          - var_accounts_tmout=5_min

    - id: 6.2
      title: Ensure Grub Password Set
      levels:
          - l2_server
      status: automated
      rules:
          - grub2_password
          - grub2_password.severity=high
          - grub2_uefi_password
          - grub2_uefi_password.severity=high

    - id: 6.3
      title: Ensure Use Sudo To Run
      levels:
          - l2_server
      status: automated
      rules:
          - sudo_restrict_privilege_elevation_to_authorized
          - sudo_restrict_privilege_elevation_to_authorized.severity=high
          - sudoers_no_root_target

    - id: 6.4
      title: Ensure SU Usage Limited
      levels:
          - l2_server
      status: automated
      rules:
          - use_pam_wheel_for_su
          - use_pam_wheel_for_su.severity=high

    - id: 6.5
      title: Ensure time synchronization is in use (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - package_chrony_installed
          - package_ntp_installed

    - id: 6.6
      title: Ensure chrony is running as user _chrony (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - service_chronyd_or_ntpd_enabled
          - chronyd_configure_pool_and_server

    - id: 6.7
      title: must disable core dumps for all users.
      levels:
          - l2_server
      status: automated
      rules:
          - disable_users_coredumps

    - id: 6.8
      title: operating system must disable the x86 Ctrl-Alt-Delete key sequence if a graphical user interface
          is installed.
      levels:
          - l2_server
      status: automated
      rules:
          - dconf_gnome_disable_ctrlaltdel_reboot

    - id: 6.9
      title: Enable idle screen lock time
      levels:
          - l2_server
      status: automated
      rules:
          - dconf_gnome_screensaver_idle_delay

    - id: 6.10
      title: via the session lock, information previously visible on the display with a publicly viewable
          image.
      levels:
          - l2_server
      status: automated
      rules:
          - dconf_gnome_screensaver_mode_blank

    - id: 6.11
      title: Prohibit automatic system login
      levels:
          - l1_server
      status: planned

    - id: 6.12
      title: Prohibit SSH password free login
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_disable_pubkey_auth

    - id: 6.13
      title: Set the umask value of the daemon process
      levels:
          - l1_server
      status: planned

    - id: 6.14
      title: limit the number of concurrent sessions to ten for all accounts and/or account types.
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_max_concurrent_login_sessions
          - var_accounts_max_concurrent_login_sessions=10

  ##7 potential risk

    - id: 7.1
      title: Ensure No Empty Symlink
      levels:
          - l2_server
      status: planned

    - id: 7.2
      title: Ensure SNMP Not Installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_net-snmp_removed
          - package_net-snmp_removed.severity=high

    - id: 7.3
      title: Check the debuggable components
      levels:
          - l2_server
      status: automated
      rules:
          - package_binutils_installed

    - id: 7.4
      title: /etc/aliases Disable unnecessary aliases
      levels:
          - l2_server
      status: automated
      rules:
          - postfix_client_configure_mail_alias

    - id: 7.5
      title: /etc/mail/aliases Disable unnecessary aliases
      levels:
          - l2_server
      status: planned

    - id: 7.6
      title: Ensure No .netrc Files In Home Folder
      levels:
          - l1_server
      status: automated
      rules:
          - no_netrc_files
          - no_netrc_files.severity=low

    - id: 7.7
      title: Ensure No hosts.equiv Files In Home Folder
      levels:
          - l2_server
      status: planned

    - id: 7.8
      title: Ensure No .rhosts Files In Home Folder
      levels:
          - l2_server
      status: manual  # we have a rule but it removes additionally /etc/hosts.equiv
      related_rules:
          - no_rsh_trust_files

    - id: 7.9
      title: Ensure No equiv Files In Home Folder
      levels:
          - l2_server
      status: planned

    - id: 7.10
      title: Ensure No rhosts Files In Home Folder
      levels:
          - l2_server
      status: planned

  ##8 file right

    - id: 8.1
      title: Ensure All Files Have Owner And Group
      levels:
          - l2_server
      status: automated
      rules:
          - no_files_unowned_by_user
          - no_files_unowned_by_user.severity=high
          - file_permissions_ungroupowned
          - file_permissions_ungroupowned.severity=high

    - id: 8.2
      title: Ensure UMASK Correct
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_umask_etc_bashrc
          - accounts_umask_etc_bashrc.severity=high
          - var_accounts_user_umask=027

    - id: 8.3
      title: Ensure File Permission Minimize
      levels:
          - l2_server
      status: planned

    - id: 8.4
      title: Ensure permissions on /etc/passwd are configured (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - file_groupowner_etc_passwd
          - file_owner_etc_passwd
          - file_permissions_etc_passwd

    - id: 8.5
      title: Ensure permissions on /etc/group are configured (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - file_groupowner_etc_group
          - file_owner_etc_group
          - file_permissions_etc_group

    - id: 8.6
      title: Ensure permissions on /etc/shadow are configured (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - file_owner_etc_shadow
          - file_groupowner_etc_shadow
          - file_permissions_etc_shadow

    - id: 8.7
      title: Ensure all logfiles have appropriate permissions(Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - rsyslog_files_permissions

    - id: 8.8
      title: Restrict the permissions of FTP users to upload files
      levels:
          - l2_server
      status: planned

    - id: 8.9
      title: Prohibit global read-write of log files
      levels:
          - l2_server
      status: planned

  ##9 Risk account

    - id: 9.1
      title: Delete accounts unrelated to device operation, maintenance, and other work
      levels:
          - l2_server
      status: planned

    - id: 9.2
      title: Ensure pam_unix does not include nullok (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - no_empty_passwords

    - id: 9.3
      title: Ensure /etc/shadow password fields are not empty (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - no_empty_passwords_etc_shadow

    - id: 9.4
      title: Prohibit interactive login of system accounts
      levels:
          - l2_server
      status: planned

    - id: 9.5
      title: Ensure UID Unique
      levels:
          - l2_server
      status: automated
      rules:
          - account_unique_id
          - account_unique_id.severity=high

  ##10 Disk inspection

    - id: 10.1
      title: Check the usage rate of system disk partitions
      levels:
          - l2_server
      status: planned

  ##11 Password strength

    - id: 11.1
      title: Ensure Set Correct Password Complexity
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_password_pam_minclass
          - accounts_password_pam_minclass.severity=high
          - var_password_pam_minclass=3
          - accounts_password_pam_retry
          - accounts_password_pam_retry.severity=high
          - var_password_pam_retry=3
          - accounts_password_pam_dcredit
          - accounts_password_pam_dcredit.severity=high
          - var_password_pam_dcredit=0
          - accounts_password_pam_ucredit
          - accounts_password_pam_ucredit.severity=high
          - var_password_pam_ucredit=0
          - accounts_password_pam_lcredit
          - accounts_password_pam_lcredit.severity=high
          - var_password_pam_lcredit=0
          - accounts_password_pam_ocredit
          - accounts_password_pam_ocredit.severity=high
          - var_password_pam_ocredit=0
          - accounts_password_pam_enforce_root
          - accounts_password_pam_enforce_root.severity=high

    - id: 11.2
      title: Ensure Password Expiration Warning Days
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_password_warn_age_login_defs
          - accounts_password_warn_age_login_defs.severity=high
          - var_accounts_password_warn_age_login_defs=7

    - id: 11.3
      title: Enable password complexity policy
      levels:
          - l2_server
      status: planned

    - id: 11.4
      title: Ensure Password Expire Correct
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_maximum_age_login_defs
          - accounts_maximum_age_login_defs.severity=high
          - var_accounts_maximum_age_login_defs=90

    - id: 11.5
      title: Ensure Set Correct Password Complexity
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_password_pam_minlen
          - accounts_password_pam_minlen.severity=high
          - var_password_pam_minlen=8

    - id: 11.6
      title: Minimum Days Between Password Change
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_minimum_age_login_defs
          - accounts_minimum_age_login_defs.severity=high
          - var_accounts_minimum_age_login_defs=0

    - id: 11.7
      title: Ensure No History Password Used
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_password_pam_unix_remember
          - accounts_password_pam_unix_remember.severity=high
          - var_password_pam_unix_remember=5

    - id: 11.8
      title: Ensure Using Strong Hash Algorithm To Encipher Password
      levels:
          - l2_server
      status: automated
      rules:
          - set_password_hashing_algorithm_systemauth
          - set_password_hashing_algorithm_systemauth.severity=high
          - set_password_hashing_algorithm_passwordauth
          - set_password_hashing_algorithm_passwordauth.severity=high

  ##12 Account lockout

    - id: 12.1
      title: Ensure Account Locked After Accessing Fail
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_passwords_pam_faillock_deny
          - accounts_passwords_pam_faillock_deny.severity=high
          - var_accounts_passwords_pam_faillock_deny=3
          - accounts_passwords_pam_faillock_unlock_time
          - accounts_passwords_pam_faillock_unlock_time.severity=high
          - var_accounts_passwords_pam_faillock_unlock_time=300

  ##13 system safety

    - id: 13.1
      title: Ensure Firewalld Enabled
      levels:
          - l1_server
      status: automated
      rules:
          - service_firewalld_enabled
          - service_firewalld_enabled.severity=low

    - id: 13.2
      title: Ensure the SELinux mode is not disabled (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - selinux_not_disabled

    - id: 13.3
      title: Ensure firewalld default zone is set (Automated)
      levels:
          - l1_server
      status: automated
      rules:
          - set_firewalld_default_zone

  ##14 system maintenance

    - id: 14.1
      title: Ensure authentication required for single user mode (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - require_emergency_target_auth
          - require_singleuser_auth

  ##15 resource allocation

    - id: 15.1
      title: Check system resource usage control
      levels:
          - l2_server
      status: automated
      rules:
          - project_config_and_template_resource_quota

  ##16 others

    - id: 16.1
      title: Ensure root path integrity (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_root_path_dirs_no_write
          - root_path_no_dot

    - id: 16.2
      title: Ensure GPG Check Configured
      levels:
          - l2_server
      status: automated
      rules:
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_globally_activated.severity=high
          - ensure_gpgcheck_never_disabled
          - ensure_gpgcheck_never_disabled.severity=high

    - id: 16.3
      title: ensure-permissions-on-ssh-private-host-key-files-are-configured
      levels:
          - l2_server
      status: automated
      rules:
          - file_permissions_sshd_private_key

    - id: 16.4
      title: Ensure SSH IgnoreRhosts is enabled (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_disable_rhosts

    - id: 16.5
      title: Ensure that SSH X11 forwarding is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_disable_x11_forwarding

    - id: 16.6
      title: Ensure sshd Hostl2_serverdAuthentication is disabled (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - disable_host_auth

    - id: 16.7
      title: interactive user accounts must be assigned a home directory upon creation.
      levels:
          - l2_server
      status: automated
      rules:
          - accounts_have_homedir_login_defs

    - id: 16.8
      title: Ensure autofs services are not in use (Automated)
      levels:
          - l2_server
      status: automated
      rules:
          - service_autofs_disabled
