---
policy: 'Standard Benchmark for TencentOS 4'
title: 'Standard Benchmark for TencentOS 4'
id: std_tencentos4
version: '1.0'

levels:
    - id: l1_server
    - id: l2_server
      inherits_from:
          - l1_server

controls:
  # 1 Initial Setup
  # 1.1 Filesystem Configuration
    - id: 1.1.1
      title: Ensure mounting of cramfs filesystems is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - kernel_module_cramfs_disabled

    - id: 1.1.2
      title: Ensure mounting of squashfs filesystems is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - kernel_module_squashfs_disabled

    - id: 1.1.3
      title: Ensure USB Disabled
      levels:
          - l2_server
      status: automated
      rules:
          - kernel_module_usb-storage_disabled

    - id: 1.1.4
      title: Ensure a separate partition exists for /tmp
      levels:
          - l2_server
      status: automated
      rules:
          - partition_for_tmp

    - id: 1.1.5
      title: Ensure correct mounting options set on /tmp partition
      levels:
          - l2_server
      status: automated
      rules:
          - mount_option_tmp_nodev
          - mount_option_tmp_nosuid

    - id: 1.1.6
      title: Ensure a separate partition exists for /dev/shm
      levels:
          - l2_server
      status: automated
      rules:
          - partition_for_dev_shm

    - id: 1.1.7
      title: Ensure correct mounting options set on /dev/shm partition
      levels:
          - l2_server
      status: automated
      rules:
          - mount_option_dev_shm_nodev
          - mount_option_dev_shm_noexec
          - mount_option_dev_shm_nosuid

  # 1.2 Filesystem Integrity Checking
    - id: 1.2.1
      title: Ensure AIDE is installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_aide_installed

    - id: 1.2.2
      title: Ensure filesystem integrity is regularly checked
      levels:
          - l2_server
      status: automated
      rules:
          - aide_periodic_cron_checking

    - id: 1.2.3
      title: Ensure IMA is enabled
      levels:
          - l2_server
      status: planned

  # 1.3 Configure Software Updates
    - id: 1.3.1
      title: Ensure gpgcheck is globally activated
      levels:
          - l1_server
      status: automated
      rules:
          - ensure_gpgcheck_globally_activated
          - ensure_gpgcheck_never_disabled

  # 1.4 Warning Banners
    - id: 1.4.1
      title: Ensure message of the day is configured properly
      levels:
          - l1_server
      status: automated
      rules:
          - banner_etc_motd
          - motd_banner_text=cis_banners

    - id: 1.4.2
      title: Ensure local login warning banner is configured properly
      levels:
          - l1_server
      status: automated
      rules:
          - banner_etc_issue
          - login_banner_text=cis_banners

    - id: 1.4.3
      title: Ensure remote login warning banner is configured properly
      levels:
          - l1_server
      status: automated
      rules:
          - banner_etc_issue_net
          - remote_login_banner_text=cis_banners

    - id: 1.4.4
      title: Ensure permissions on /etc/motd are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_etc_motd
          - file_owner_etc_motd
          - file_groupowner_etc_motd

    - id: 1.4.5
      title: Ensure permissions on /etc/issue are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_etc_issue
          - file_owner_etc_issue
          - file_groupowner_etc_issue

    - id: 1.4.6
      title: Ensure permissions on /etc/issue.net are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_etc_issue_net
          - file_owner_etc_issue_net
          - file_groupowner_etc_issue_net

  # 1.5 Secure Boot Settings
    - id: 1.5.1
      title: Ensure Secure Boot is enabled
      levels:
          - l2_server
      status: planned

    - id: 1.5.2
      title: Ensure bootloader password is set
      levels:
          - l2_server
      status: automated
      rules:
          - grub2_password
          - grub2_uefi_password

    - id: 1.5.3
      title: Ensure permissions on bootloader config are configured
      levels:
          - l2_server
      status: automated
      rules:
          - file_groupowner_grub2_cfg
          - file_owner_grub2_cfg
          - file_permissions_grub2_cfg

  # 1.6 Mandatory Access Control
    - id: 1.6.1
      title: Ensure SELinux is enabled by grub2
      levels:
          - l2_server
      status: automated
      rules:
          - grub2_enable_selinux

    - id: 1.6.2
      title: Ensure SELinux is set to enforcing mode
      levels:
          - l2_server
      status: automated
      rules:
          - selinux_not_disabled
          - selinux_state
          - var_selinux_state=enforcing

    - id: 1.6.3
      title: Ensure SELinux policy is configured
      levels:
          - l2_server
      status: automated
      rules:
          - selinux_policytype
          - var_selinux_policy_name=targeted

    - id: 1.6.4
      title: Ensure no unconfined services exist
      levels:
          - l2_server
      status: automated
      rules:
          - selinux_confinement_of_daemons

  # 2 Services
  # 2.1 Time Synchronization
    - id: 2.1.1
      title: Ensure time synchronization is in use
      levels:
          - l1_server
      status: automated
      rules:
          - package_chrony_installed

    - id: 2.1.3
      title: Ensure chrony is configured
      levels:
          - l1_server
      status: automated
      rules:
          - service_chronyd_enabled
          - chronyd_run_as_chrony_user
          - chronyd_configure_pool_and_server

  # 2.2 Firewall Configuration
    - id: 2.2.1
      title: Ensure firewalld is installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_firewalld_installed

    - id: 2.2.2
      title: Ensure firewalld is enabled and configured
      levels:
          - l2_server
      status: automated
      rules:
          - service_firewalld_enabled
          - set_firewalld_default_zone

    - id: 2.2.3
      title: Ensure nftables is installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_nftables_installed

    - id: 2.2.4
      title: Ensure nftables is enabled and configured
      levels:
          - l2_server
      status: automated
      rules:
          - service_nftables_enabled
          - nftables_ensure_default_deny_policy
          - set_nftables_loopback_traffic

  # 2.3 Network Services Configuration
    - id: 2.3.1
      title: Ensure Avahi Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_avahi_removed

    - id: 2.3.2
      title: Ensure CUPS is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_cups_disabled
          - package_cups_removed

    - id: 2.3.3
      title: Ensure Rsync Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_rsyncd_disabled
          - package_rsync_removed

    - id: 2.3.4
      title: Ensure LDAP Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_openldap-servers_removed

    - id: 2.3.5
      title: Ensure xinetd is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_xinetd_disabled
          - package_xinetd_removed

    - id: 2.3.6
      title: Ensure NIS Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_ypserv_disabled
          - package_ypserv_removed

    - id: 2.3.7
      title: Ensure telnet Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_telnet_removed
          - package_telnet-server_removed

    - id: 2.3.8
      title: Ensure DNS Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_named_disabled
          - package_bind_removed

    - id: 2.3.9
      title: Ensure FTP Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_vsftpd_disabled
          - package_vsftpd_removed

    - id: 2.3.10
      title: Ensure TFTP Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_tftp_disabled
          - package_tftp_removed
          - package_tftp-server_removed

    - id: 2.3.11
      title: Ensure HTTP Server is not installed
      levels:
          - l1_server
      status: automated
      rules:
          - service_httpd_disabled
          - package_httpd_removed

    - id: 2.3.12
      title: Ensure Samba is not installed
      levels:
          - l2_server
      status: automated
      rules:
          - service_smb_disabled
          - package_samba_removed

    - id: 2.3.13
      title: Ensure HTTP Proxy Server is not installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_squid_removed

    - id: 2.3.14
      title: Ensure SNMP Server is not installed
      levels:
          - l2_server
      status: automated
      rules:
          - package_net-snmp_removed

    - id: 2.3.15
      title: Ensure rsh is not installed
      levels:
          - l2_server
      status: automated
      rules:
          - service_rsh_disabled
          - package_rsh_removed

    - id: 2.3.16
      title: Ensure IMAP and POP3 Server is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_dovecot_disabled
          - package_dovecot_removed

    - id: 2.3.17
      title: Ensure RPC Service is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_rpcbind_disabled

    - id: 2.3.18
      title: Ensure DHCP Service is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_dhcpd_disabled
          - package_dhcp_removed

    - id: 2.3.19
      title: Ensure NFS Service is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_nfs_disabled

  # 3 Network Configuration
  # 3.1 Network Parameters
    - id: 3.1.1
      title: Ensure IP forwarding is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_ip_forward
          - sysctl_net_ipv6_conf_all_forwarding
          - sysctl_net_ipv6_conf_all_forwarding_value=disabled

    - id: 3.1.2
      title: Ensure packet redirect sending is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_send_redirects
          - sysctl_net_ipv4_conf_default_send_redirects

    - id: 3.1.3
      title: Ensure source routed packets are not accepted
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_source_route
          - sysctl_net_ipv4_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv4_conf_default_accept_source_route
          - sysctl_net_ipv4_conf_default_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_all_accept_source_route
          - sysctl_net_ipv6_conf_all_accept_source_route_value=disabled
          - sysctl_net_ipv6_conf_default_accept_source_route
          - sysctl_net_ipv6_conf_default_accept_source_route_value=disabled

    - id: 3.1.4
      title: Ensure ICMP redirects are not accepted
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_accept_redirects
          - sysctl_net_ipv4_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_accept_redirects
          - sysctl_net_ipv4_conf_default_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_all_accept_redirects
          - sysctl_net_ipv6_conf_all_accept_redirects_value=disabled
          - sysctl_net_ipv6_conf_default_accept_redirects
          - sysctl_net_ipv6_conf_default_accept_redirects_value=disabled

    - id: 3.1.5
      title: Ensure secure ICMP redirects are not accepted
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_secure_redirects
          - sysctl_net_ipv4_conf_all_secure_redirects_value=disabled
          - sysctl_net_ipv4_conf_default_secure_redirects
          - sysctl_net_ipv4_conf_default_secure_redirects_value=disabled

    - id: 3.1.6
      title: Ensure suspicious packets are logged
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_log_martians
          - sysctl_net_ipv4_conf_all_log_martians_value=enabled
          - sysctl_net_ipv4_conf_default_log_martians
          - sysctl_net_ipv4_conf_default_log_martians_value=enabled

    - id: 3.1.7
      title: Ensure broadcast ICMP requests are ignored
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts
          - sysctl_net_ipv4_icmp_echo_ignore_broadcasts_value=enabled

    - id: 3.1.8
      title: Ensure bogus ICMP responses are ignored
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses
          - sysctl_net_ipv4_icmp_ignore_bogus_error_responses_value=enabled

    - id: 3.1.9
      title: Ensure Reverse Path Filtering is enabled
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_conf_all_rp_filter
          - sysctl_net_ipv4_conf_all_rp_filter_value=enabled
          - sysctl_net_ipv4_conf_default_rp_filter
          - sysctl_net_ipv4_conf_default_rp_filter_value=enabled

    - id: 3.1.10
      title: Ensure TCP SYN Cookies is enabled
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv4_tcp_syncookies
          - sysctl_net_ipv4_tcp_syncookies_value=enabled

    - id: 3.1.11
      title: Ensure IPv6 router advertisements are not accepted
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_net_ipv6_conf_all_accept_ra
          - sysctl_net_ipv6_conf_all_accept_ra_value=disabled
          - sysctl_net_ipv6_conf_default_accept_ra
          - sysctl_net_ipv6_conf_default_accept_ra_value=disabled

  # 3.2 Uncommon Network Protocols
    - id: 3.2.1
      title: Ensure DCCP is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - kernel_module_dccp_disabled

    - id: 3.2.2
      title: Ensure SCTP is disabled
      levels:
          - l2_server
      status: automated
      rules:
          - kernel_module_sctp_disabled

    - id: 3.2.3
      title: Ensure wireless interfaces are disabled
      levels:
          - l2_server
      status: automated
      rules:
          - wireless_disable_interfaces

  # 4 Logging and Auditing
  # 4.1 Configure auditd
    - id: 4.1.1
      title: Ensure auditd is installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_audit_installed
          - package_audit-libs_installed

    - id: 4.1.2
      title: Ensure auditd service is enabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_auditd_enabled

    - id: 4.1.3
      title: Ensure auditing for processes that start prior to auditd is enabled
      levels:
          - l2_server
      status: automated
      rules:
          - grub2_audit_argument

    - id: 4.1.4
      title: Ensure audit_backlog_limit is sufficient
      levels:
          - l2_server
      status: automated
      rules:
          - grub2_audit_backlog_limit_argument
          - var_audit_backlog_limit=8192

    - id: 4.1.5
      title: Ensure audit rules are immutable
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_immutable

    - id: 4.1.6
      title: Ensure audit log size is configured
      levels:
          - l2_server
      status: automated
      rules:
          - auditd_data_retention_max_log_file

    - id: 4.1.7
      title: Ensure audit logs are not automatically deleted
      levels:
          - l2_server
      status: automated
      rules:
          - auditd_data_retention_max_log_file_action
          - var_auditd_max_log_file_action=keep_logs

    - id: 4.1.8
      title: Ensure system is disabled when audit logs are full
      levels:
          - l2_server
      status: automated
      rules:
          - auditd_data_retention_space_left
          - auditd_data_retention_space_left_action
          - var_auditd_space_left_action=syslog
          - auditd_data_retention_admin_space_left_percentage
          - var_auditd_admin_space_left_percentage=50pc
          - var_auditd_admin_space_left_action=suspend
          - auditd_audispd_disk_full_action
          - auditd_data_disk_full_action
          - var_auditd_disk_full_action=suspend
          - auditd_data_disk_error_action
          - var_auditd_disk_error_action=suspend

    - id: 4.1.9
      title: Ensure auditd log rotation is configured
      levels:
          - l2_server
      status: automated
      rules:
          - auditd_data_retention_max_log_file_action
          - var_auditd_max_log_file_action=rotate
          - auditd_data_retention_num_logs
          - var_auditd_num_logs=5

    - id: 4.1.10
      title: Ensure login and logout events are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_login_events_lastlog
          - audit_rules_login_events_faillog
          - audit_rules_login_events_tallylog

    - id: 4.1.11
      title: Ensure session events are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_session_events

    - id: 4.1.12
      title: Ensure events that modify user/group information are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow

    - id: 4.1.13
      title: Ensure kernel module loading and unloading is collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_privileged_commands_insmod
          - audit_rules_privileged_commands_rmmod
          - audit_rules_privileged_commands_modprobe
          - audit_rules_kernel_module_loading_delete
          - audit_rules_kernel_module_loading_init
          - audit_rules_kernel_module_loading

    - id: 4.1.14
      title: Ensure sudo commands are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_privileged_commands_sudo

    - id: 4.1.15
      title: Ensure the events that modify the sudoers file are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_sudoers
          - audit_rules_sysadmin_actions

    - id: 4.1.16
      title: Ensure events that modify date and time information are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_time_adjtimex
          - audit_rules_time_settimeofday
          - audit_rules_time_stime
          - audit_rules_time_clock_settime

    - id: 4.1.17
      title: Ensure events that modify the system's network configuration are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_networkconfig_modification

    - id: 4.1.18
      title: Ensure events that modify the systems Mandatory Access Control (MAC) settings are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_mac_modification
          - audit_rules_mac_modification_usr_share

    - id: 4.1.19
      title: Ensure discretionary access control permission modification events are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_dac_modification_fchmod
          - audit_rules_dac_modification_fchmodat
          - audit_rules_dac_modification_chmod
          - audit_rules_dac_modification_fchown
          - audit_rules_dac_modification_fchownat
          - audit_rules_dac_modification_chown
          - audit_rules_dac_modification_lchown
          - audit_rules_dac_modification_fremovexattr
          - audit_rules_dac_modification_fsetxattr
          - audit_rules_dac_modification_lremovexattr
          - audit_rules_dac_modification_lsetxattr
          - audit_rules_dac_modification_removexattr
          - audit_rules_dac_modification_setxattr

    - id: 4.1.20
      title: Ensure successful file access is audited
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_successful_file_modification_chmod
          - audit_rules_successful_file_modification_fchmod
          - audit_rules_successful_file_modification_fchmodat
          - audit_rules_successful_file_modification_chown
          - audit_rules_successful_file_modification_fchown
          - audit_rules_successful_file_modification_fchownat
          - audit_rules_successful_file_modification_setxattr
          - audit_rules_successful_file_modification_lsetxattr
          - audit_rules_successful_file_modification_fsetxattr
          - audit_rules_successful_file_modification_removexattr
          - audit_rules_successful_file_modification_lremovexattr
          - audit_rules_successful_file_modification_fremovexattr

    - id: 4.1.21
      title: Ensure unsuccessful file access attempts are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_unsuccessful_file_modification

    - id: 4.1.22
      title: Ensure file deletion events by users are collected
      levels:
          - l2_server
      status: automated
      rules:
          - audit_rules_successful_file_modification_rename
          - audit_rules_successful_file_modification_renameat
          - audit_rules_successful_file_modification_unlink
          - audit_rules_successful_file_modification_unlinkat

  # 4.2 Configure rsyslog
    - id: 4.2.1
      title: Ensure rsyslog is installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_rsyslog_installed

    - id: 4.2.2
      title: Ensure rsyslog is enabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_rsyslog_enabled

    - id: 4.2.3
      title: Ensure rsyslog default file permissions are configured
      levels:
          - l2_server
      status: automated
      rules:
          - rsyslog_files_permissions
          - rsyslog_files_ownership
          - rsyslog_files_groupownership

  # 4.3 Configure journald
    - id: 4.3.1
      title: Ensure journald is enabled
      levels:
          - l2_server
      status: automated
      rules:
          - service_systemd-journald_enabled

    - id: 4.3.2
      title: Ensure journald is configured to send logs to rsyslog
      levels:
          - l2_server
      status: automated
      rules:
          - journald_forward_to_syslog

    - id: 4.3.3
      title: Ensure journald is configured to compress large log files
      levels:
          - l2_server
      status: automated
      rules:
          - journald_compress

    - id: 4.3.4
      title: Ensure journald is configured to write logfiles to persistent disk
      levels:
          - l2_server
      status: automated
      rules:
          - journald_storage

    - id: 4.3.5
      title: Ensure journald is disabled from receiving logs from a remote client
      levels:
          - l2_server
      status: automated
      rules:
          - socket_systemd-journal-remote_disabled

  # 5 Access, Authentication and Authorization
  # 5.1 Configure cron
    - id: 5.1.1
      title: Ensure cron daemon is enabled
      levels:
          - l1_server
      status: automated
      rules:
          - service_crond_enabled

    - id: 5.1.2
      title: Ensure permissions on /etc/crontab are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_crontab
          - file_owner_crontab
          - file_permissions_crontab

    - id: 5.1.3
      title: Ensure permissions on /etc/cron.hourly are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_cron_hourly
          - file_owner_cron_hourly
          - file_permissions_cron_hourly

    - id: 5.1.4
      title: Ensure permissions on /etc/cron.daily are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_cron_daily
          - file_owner_cron_daily
          - file_permissions_cron_daily

    - id: 5.1.5
      title: Ensure permissions on /etc/cron.weekly are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_cron_weekly
          - file_owner_cron_weekly
          - file_permissions_cron_weekly

    - id: 5.1.6
      title: Ensure permissions on /etc/cron.monthly are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_cron_monthly
          - file_owner_cron_monthly
          - file_permissions_cron_monthly

    - id: 5.1.7
      title: Ensure permissions on /etc/cron.d are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_cron_d
          - file_owner_cron_d
          - file_permissions_cron_d

    - id: 5.1.8
      title: Ensure cron is restricted to authorized users
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_cron_allow
          - file_owner_cron_allow
          - file_permissions_cron_allow
          - file_cron_deny_not_exist

    - id: 5.1.9
      title: Ensure at is restricted to authorized users
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_at_allow
          - file_owner_at_allow
          - file_permissions_at_allow
          - file_at_deny_not_exist

  # 5.2 SSH Server Configuration
    - id: 5.2.1
      title: Ensure permissions on /etc/ssh/sshd_config are configured
      levels:
          - l1_server
      status: automated
      rules:
          - file_groupowner_sshd_config
          - file_owner_sshd_config
          - file_permissions_sshd_config

    - id: 5.2.2
      title: Ensure SSH PermitEmptyPasswords is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_disable_empty_passwords

    - id: 5.2.3
      title: Ensure SSH root login from remote is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_disable_root_login

    - id: 5.2.4
      title: Ensure SSH PermitUserEnvironment is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_do_not_permit_user_env

    - id: 5.2.5
      title: Ensure SSH Protocol is set to 2
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_allow_only_protocol2

    - id: 5.2.6
      title: Ensure SSH X11 forwarding is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_disable_x11_forwarding

    - id: 5.2.7
      title: Ensure SSH disallows TCP forwarding
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_disable_tcp_forwarding

    - id: 5.2.8
      title: Ensure SSH IgnoreRhosts is enabled
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_disable_rhosts

    - id: 5.2.9
      title: Ensure SSH HostbasedAuthentication is disabled
      levels:
          - l1_server
      status: automated
      rules:
          - disable_host_auth

    - id: 5.2.10
      title: Ensure SSH PAM is enabled
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_enable_pam

    - id: 5.2.11
      title: Ensure SSH warning banner is configured
      levels:
          - l1_server
      status: automated
      rules:
          - sshd_enable_warning_banner_net

    - id: 5.2.12
      title: Ensure SSH access is limited to authorized users
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_limit_user_access

    - id: 5.2.13
      title: Ensure SSH LogLevel is appropriate
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_loglevel_verbose

    - id: 5.2.14
      title: Ensure SSH MaxAuthTries is set to 4 or less
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_max_auth_tries
          - sshd_max_auth_tries_value=4

    - id: 5.2.15
      title: Ensure SSH MaxSessions is set to 10 or less
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_max_sessions
          - var_sshd_max_sessions=10

    - id: 5.2.16
      title: Ensure SSH MaxStartups is set properly
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_maxstartups
          - var_sshd_set_maxstartups=10:30:60

    - id: 5.2.17
      title: Ensure SSH LoginGraceTime is set to 1 minute or less
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_login_grace_time
          - var_sshd_set_login_grace_time=60

    - id: 5.2.18
      title: Ensure SSH Idle Timeout Interval is configured
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_set_idle_timeout
          - sshd_idle_timeout_value=15_minutes

    - id: 5.2.19
      title: Ensure SSH MACs are configured
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_strong_macs=cis_tencentos4
          - sshd_use_strong_macs

    - id: 5.2.20
      title: Ensure SSH Ciphers are configured
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_use_strong_ciphers

    - id: 5.2.21
      title: Ensure SSH Key Exchange Algorithms are configured
      levels:
          - l2_server
      status: automated
      rules:
          - sshd_use_strong_kex

  # 5.3 Configure PAM
    - id: 5.3.1
      title: Ensure password creation requirements are configured
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_password_pam_minclass
          - var_password_pam_minclass=3
          - accounts_password_pam_minlen
          - var_password_pam_minlen=8
          - accounts_password_pam_dcredit
          - var_password_pam_dcredit=0
          - accounts_password_pam_ucredit
          - var_password_pam_ucredit=0
          - accounts_password_pam_lcredit
          - var_password_pam_lcredit=0
          - accounts_password_pam_ocredit
          - var_password_pam_ocredit=0
          - accounts_password_pam_retry
          - var_password_pam_retry=3
          - accounts_password_pam_enforce_root

    - id: 5.3.2
      title: Ensure password hashing algorithm is SHA-512
      levels:
          - l1_server
      status: automated
      rules:
          - set_password_hashing_algorithm_systemauth
          - set_password_hashing_algorithm_passwordauth
          - var_password_hashing_algorithm_pam=sha512

    - id: 5.3.3
      title: Ensure password expiration is 180 days or less
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_maximum_age_login_defs
          - var_accounts_maximum_age_login_defs=180
          - accounts_password_set_max_life_existing

    - id: 5.3.4
      title: Ensure minimum days between password changes is configured
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_minimum_age_login_defs
          - var_accounts_minimum_age_login_defs=1
          - accounts_password_set_min_life_existing

    - id: 5.3.5
      title: Ensure password expiration warning days is 7 or more
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_password_warn_age_login_defs
          - var_accounts_password_warn_age_login_defs=7
          - accounts_password_set_warn_age_existing

    - id: 5.3.6
      title: Ensure inactive password lock is 30 days or less
      levels:
          - l1_server
      status: automated
      rules:
          - account_disable_post_pw_expiration
          - var_account_disable_post_pw_expiration=30
          - accounts_set_post_pw_existing

    - id: 5.3.7
      title: Ensure all users last password change date is in the past
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_password_last_change_is_in_past

    - id: 5.3.8
      title: Ensure accounts locked after 5 failed logins is configured
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_passwords_pam_faillock_deny
          - var_accounts_passwords_pam_faillock_deny=5
          - accounts_passwords_pam_faillock_unlock_time
          - var_accounts_passwords_pam_faillock_unlock_time=300

  # 5.4 System Accounts
    - id: 5.4.1
      title: Ensure system accounts are secured
      levels:
          - l1_server
      status: automated
      rules:
          - no_shelllogin_for_systemaccounts

    - id: 5.4.2
      title: Ensure default group for the root account is GID 0
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_root_gid_zero

    - id: 5.4.3
      title: Ensure default user shell timeout is configured
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_tmout
          - var_accounts_tmout=15_min

    - id: 5.4.4
      title: Ensure default user umask is configured
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_umask_etc_bashrc
          - var_accounts_user_umask=027

    - id: 5.4.5
      title: Ensure passwords are set in single user mode
      levels:
          - l1_server
      status: automated
      rules:
          - require_emergency_target_auth

    - id: 5.4.6
      title: Ensure display of failed login attempts is configured
      levels:
          - l1_server
      status: automated
      rules:
          - display_login_attempts

    - id: 5.4.7
      title: Ensure every UID is unique
      levels:
          - l1_server
      status: automated
      rules:
          - account_unique_id

    - id: 5.4.8
      title: Ensure account name is unique
      levels:
          - l1_server
      status: automated
      rules:
          - account_unique_name

    - id: 5.4.9
      title: Ensure every GID is unique
      levels:
          - l1_server
      status: automated
      rules:
          - group_unique_id

    - id: 5.4.10
      title: Ensure every group name is unique
      levels:
          - l1_server
      status: automated
      rules:
          - group_unique_name

    - id: 5.4.11
      title: Ensure accounts related files have correct permissions
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_etc_passwd
          - file_owner_etc_passwd
          - file_groupowner_etc_passwd
          - file_permissions_etc_shadow
          - file_owner_etc_shadow
          - file_groupowner_etc_shadow
          - file_permissions_etc_group
          - file_owner_etc_group
          - file_groupowner_etc_group
          - file_permissions_etc_gshadow
          - file_owner_etc_gshadow
          - file_groupowner_etc_gshadow
          - file_permissions_backup_etc_passwd
          - file_owner_backup_etc_passwd
          - file_groupowner_backup_etc_passwd
          - file_permissions_backup_etc_shadow
          - file_owner_backup_etc_shadow
          - file_groupowner_backup_etc_shadow
          - file_permissions_backup_etc_group
          - file_owner_backup_etc_group
          - file_groupowner_backup_etc_group
          - file_permissions_backup_etc_gshadow
          - file_owner_backup_etc_gshadow
          - file_groupowner_backup_etc_gshadow

    - id: 5.4.12
      title: Ensure all users' home directories exist
      levels:
          - l1_server
      status: automated
      rules:
          - accounts_user_interactive_home_directory_exists

    - id: 5.4.13
      title: Ensure all users' home directories permissions are 750 or more restrictive
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_home_directories
          - accounts_users_home_files_permissions

  # 5.5 Configure sudo
    - id: 5.5.1
      title: Ensure sudo is installed
      levels:
          - l1_server
      status: automated
      rules:
          - package_sudo_installed

    - id: 5.5.2
      title: Ensure sudo commands use pty
      levels:
          - l1_server
      status: automated
      rules:
          - sudo_add_use_pty

    - id: 5.5.3
      title: Ensure sudo log file exists
      levels:
          - l1_server
      status: automated
      rules:
          - sudo_custom_logfile

    - id: 5.5.4
      title: Ensure sudo is limited to authorized users
      levels:
          - l1_server
      status: automated
      rules:
          - sudo_restrict_privilege_elevation_to_authorized

    - id: 5.5.5
      title: Ensure users must provide password for privilege escalation
      levels:
          - l1_server
      status: automated
      rules:
          - sudo_require_authentication

  # 6 System Maintenance
  # 6.1 System File Permissions
    - id: 6.1.1
      title: Ensure no world writable files exist
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_unauthorized_world_writable

    - id: 6.1.2
      title: Ensure no unowned files or directories exist
      levels:
          - l1_server
      status: automated
      rules:
          - no_files_unowned_by_user

    - id: 6.1.3
      title: Ensure no ungrouped files or directories exist
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_ungroupowned

    - id: 6.1.4
      title: Audit SUID executables
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_unauthorized_suid

    - id: 6.1.5
      title: Audit SGID executables
      levels:
          - l1_server
      status: automated
      rules:
          - file_permissions_unauthorized_sgid

    - id: 6.1.6
      title: Ensure no users have .forward files
      levels:
          - l1_server
      status: automated
      rules:
          - no_forward_files

    - id: 6.1.7
      title: Ensure no users have .netrc files
      levels:
          - l1_server
      status: automated
      rules:
          - no_netrc_files

  # 6.2 Configure kernel parameters
    - id: 6.2.1
      title: Ensure address space layout randomization (ASLR) is enabled
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_kernel_randomize_va_space

    - id: 6.2.2
      title: Ensure core dumps are restricted
      levels:
          - l1_server
      status: automated
      rules:
          - disable_users_coredumps
          - sysctl_fs_suid_dumpable
          - coredump_disable_backtraces
          - coredump_disable_storage

    - id: 6.2.3
      title: Ensure dmesg access permission is correct
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_kernel_dmesg_restrict

    - id: 6.2.4
      title: Ensure kernel kptr_restrict is configured
      levels:
          - l1_server
      status: automated
      rules:
          - sysctl_kernel_kptr_restrict
          - sysctl_kernel_kptr_restrict_value=1
