---
# In BSI Basic Protection are multiple Requirements in one control.
# i.e. there are multiple sentences, some including a RFC2119 keyword
# Since we must increase granularity to create a precise control,
# we number each sentence with a RFC2119 keyword as a section, grouping sentences, which are logically connected.
# we number inline in brackets, so the lookup is easy
# we reference these numbers in comments over each rule or group of rules
policy: 'BSI-SYS-1-3-RHEL10'
title: 'SYS.1.3 Linux Server (RHEL10)'
id: bsi_sys_1_3_rhel10
version: '1.0'
source: https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Grundschutz/International/bsi_it_gs_comp_2022.pdf

levels:
    - id: basic
    - id: standard
      inherits_from:
          - basic
    - id: elevated
      inherits_from:
          - standard

reference_type: bsi
product: rhel10

controls:
    - id: SYS.1.3.A1
      title: ELIMINATED
      levels:
          - basic
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A2
      title: Careful Allocation of IDs
      levels:
          - basic
      description: |-
          (1) Each login name, each user ID (UID) and each group ID (GID) MUST ONLY be used once.
          (2) Every user MUST be a member of at least one group. (3) Every GID mentioned in the /etc/passwd
          file MUST be defined in the /etc/group file. (4) Every group SHOULD only contain the users that
          are absolutely necessary. (5) In networked systems, care MUST also be taken to ensure that user
          and group names (UIDs and GIDs) are assigned consistently in the system network if there is a
          possibility that the same UIDs or GIDs could be assigned to different user or group names on
          the systems during cross-system access.
      notes: |-
          Section 2: System accounts do not always have a group
          Section 4 is a manual control
          Section 5 this cant be checked on a per system base, and therefore is an organizational control
      status: partial
      rules:
      # Section 1
          - account_unique_id
          - account_unique_name
          - group_unique_id
          - group_unique_name
      # Section 2
      # this could be automated
      # Section 3
          - gid_passwd_group_same

    - id: SYS.1.3.A3
      title: No Automatic Integration of Removable Drives
      levels:
          - basic
      description: |-
          (1) Removable media such as USB pen drives or CDs/DVDs MUST NOT be integrated automatically.
      notes: |-
          https://access.redhat.com/solutions/18978
      status: automated
      rules:
      # USB
          - grub2_nousb_argument
          - bios_disable_usb_boot
          - kernel_module_usb-storage_disabled
      # Automount
          - service_autofs_disabled

    - id: SYS.1.3.A4
      title: Protection from Exploitation of Vulnerabilities in Applications
      levels:
          - basic
      description: |-
          (1) ASLR and DEP/NX MUST be activated in the kernel and used by applications to make it harder
          to exploit vulnerabilities in applications. (2) Security functions of the kernel and of the standard
          libraries (such as heap and stack protection) MUST NOT be disabled.
      notes: |-
          This should be the default on all modern platforms
          Section 2: organizational requirement towards the admin
      status: automated
      rules:
          - bios_enable_execution_restrictions
          - package_libselinux_installed
          - grub2_enable_selinux
          - selinux_not_disabled

    - id: SYS.1.3.A5
      title: Secure Installation of Software Packages
      levels:
          - basic
      description: |-
          (1) If software to be installed is to be compiled from source code, it MUST ONLY be unpacked,
          configured, and compiled using an unprivileged user account. (2) The software to be installed
          MUST NOT then be installed in the root file system of the server in question in an
          uncontrolled manner.

          (3) If the software is compiled from the source text, the selected parameters SHOULD be
          documented appropriately. (4) Based on this documentation, it SHOULD be possible to compile
          the software in a transparent and reproducible manner at any time. (5) All further installation
          steps SHOULD also be documented.
      notes: |-
          This requirement must be implemented organizationally.
      status: manual

    - id: SYS.1.3.A6
      title: Managing Users and Groups
      levels:
          - standard
      description: |-
          (1) The corresponding management tools SHOULD be used for managing users and groups. (2) The
          configuration files /etc/passwd, /etc/shadow, /etc/group, and /etc/sudoers SHOULD NOT be
          edited directly.
      notes: |-
          This requirement must be implemented organizationally.
          We could add auditing rules for these files, which shows edits, but do not prevent the users
          in the toolings they use for editing.
      status: partial
      rules:
          - audit_rules_usergroup_modification_passwd
          - audit_rules_usergroup_modification_shadow
          - audit_rules_usergroup_modification_group
          - audit_rules_usergroup_modification_gshadow
          - audit_rules_usergroup_modification_opasswd

    - id: SYS.1.3.A7
      title: ELIMINATED
      levels:
          - standard
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A8
      title: Encrypted Access via Secure Shell
      levels:
          - standard
      description: |-
          (1) Only Secure Shell (SSH) SHOULD be used to create an encrypted and authenticated interactive
          connection between two IT systems. (2) All other protocols whose functions are covered by
          Secure Shell SHOULD be disabled completely. (3) For authentication, users SHOULD primarily
          use certificates instead of passwords.
      notes: |-
          Section 1: this should be the default
          Section 2: this should be the default
          Section 3: The requirement says PRIMARILY use certificate, not disallow PasswordAuthentication
          completely
      status: automated
      rules:
      # Section 1
          - service_sshd_enabled
          - sshd_allow_only_protocol2
          - firewalld_sshd_port_enabled
      # Section 2
          - package_telnet-server_removed
          - package_telnet_removed
      # Section 3
          - sshd_disable_empty_passwords
          - sshd_disable_root_password_login
          - sshd_enable_pubkey_auth

    - id: SYS.1.3.A9
      title: ELIMINATED
      levels:
          - standard
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A10
      title: Preventing Further Intrusion When Vulnerabilities Are Exploited
      levels:
          - standard
      description: |-
          (1) Services and applications SHOULD be protected with individual security architecture (e.g.
          with AppArmor or SELinux). (2) In addition, chroot environments and LXC or Docker containers
          SHOULD be taken into account here. (3) It SHOULD be ensured that the standard profiles and
          rules provided are activated.
      notes: |-
          Section 2: we could add podman specific tasks, but it would be hard to evaluate if they are
          used properly
      status: partial
      rules:
      # Section 1
      # SELinux
          - package_libselinux_installed
          - grub2_enable_selinux
          - selinux_not_disabled
      # Section 3
          - var_selinux_policy_name=targeted
          - selinux_policytype
          - var_selinux_state=enforcing
          - selinux_state
          - selinux_confinement_of_daemons

    - id: SYS.1.3.A11
      title: ELIMINATED
      levels:
          - standard
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A12
      title: ELIMINATED
      levels:
          - standard
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A13
      title: ELIMINATED
      levels:
          - elevated
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A14
      title: Preventing Unauthorised Collection of System and User Information
      levels:
          - standard
      description: |-
          (1) Information output for users regarding the operating system and access to protocol and
          configuration files SHOULD be limited to the required minimum. (2) Moreover, confidential
          information SHOULD NOT be provided as parameters when commands are issued.
      notes: |-
          Section 2: This requirement must be implemented organizationally.
      status: partial
      rules:
      # Section 1
          - file_groupowner_grub2_cfg
          - file_owner_grub2_cfg
          - file_permissions_grub2_cfg

          - file_groupowner_user_cfg
          - file_owner_user_cfg
          - file_permissions_user_cfg

          - file_groupowner_efi_grub2_cfg
          - file_owner_efi_grub2_cfg
          - file_permissions_efi_grub2_cfg

          - file_groupowner_efi_user_cfg
          - file_owner_efi_user_cfg
          - file_permissions_efi_user_cfg

          - file_groupowner_etc_motd
          - file_owner_etc_motd
          - file_permissions_etc_motd

          - file_groupowner_etc_issue
          - file_owner_etc_issue
          - file_permissions_etc_issue

          - file_groupowner_etc_issue_net
          - file_owner_etc_issue_net
          - file_permissions_etc_issue_net

          - file_groupowner_crontab
          - file_owner_crontab
          - file_permissions_crontab

          - file_groupowner_cron_hourly
          - file_owner_cron_hourly
          - file_permissions_cron_hourly

          - file_groupowner_cron_daily
          - file_owner_cron_daily
          - file_permissions_cron_daily

          - file_groupowner_cron_weekly
          - file_owner_cron_weekly
          - file_permissions_cron_weekly

          - file_groupowner_cron_monthly
          - file_owner_cron_monthly
          - file_permissions_cron_monthly

          - file_groupowner_cron_yearly
          - file_owner_cron_yearly
          - file_permissions_cron_yearly

          - file_groupowner_cron_d
          - file_owner_cron_d
          - file_permissions_cron_d

          - file_groupowner_cron_allow
          - file_owner_cron_allow
          - file_permissions_cron_allow

          - file_groupowner_at_allow
          - file_owner_at_allow
          - file_permissions_at_allow

          - file_groupowner_sshd_config
          - file_owner_sshd_config
          - file_permissions_sshd_config

          - directory_groupowner_sshd_config_d
          - directory_owner_sshd_config_d
          - directory_permissions_sshd_config_d

          - file_owner_sshd_drop_in_config
          - file_groupowner_sshd_drop_in_config
          - file_permissions_sshd_drop_in_config

          - file_groupownership_sshd_private_key
          - file_ownership_sshd_private_key
          - file_permissions_sshd_private_key

          - file_groupownership_sshd_pub_key
          - file_ownership_sshd_pub_key
          - file_permissions_sshd_pub_key

          - file_group_ownership_var_log_audit
          - file_ownership_var_log_audit
          - file_permissions_var_log_audit

          - file_groupownership_audit_configuration
          - file_ownership_audit_configuration
          - file_permissions_audit_configuration

          - file_groupownership_audit_binaries
          - file_ownership_audit_binaries
          - file_permissions_audit_binaries

          - file_groupowner_etc_passwd
          - file_owner_etc_passwd
          - file_permissions_etc_passwd

          - file_groupowner_backup_etc_passwd
          - file_owner_backup_etc_passwd
          - file_permissions_backup_etc_passwd

          - file_groupowner_etc_group
          - file_owner_etc_group
          - file_permissions_etc_group

          - file_groupowner_backup_etc_group
          - file_owner_backup_etc_group
          - file_permissions_backup_etc_group

          - file_groupowner_etc_shadow
          - file_owner_etc_shadow
          - file_permissions_etc_shadow

          - file_groupowner_backup_etc_shadow
          - file_owner_backup_etc_shadow
          - file_permissions_backup_etc_shadow

          - file_groupowner_etc_gshadow
          - file_owner_etc_gshadow
          - file_permissions_etc_gshadow

          - file_groupowner_backup_etc_gshadow
          - file_owner_backup_etc_gshadow
          - file_permissions_backup_etc_gshadow

          - file_groupowner_etc_shells
          - file_owner_etc_shells
          - file_permissions_etc_shells

          - file_permissions_unauthorized_world_writable

          - no_files_or_dirs_unowned_by_user
          - no_files_or_dirs_ungroupowned
          - file_permissions_ungroupowned

          - file_permissions_unauthorized_suid
          - file_permissions_unauthorized_sgid

          - file_groupownership_home_directories
          - file_ownership_home_directories
          - file_permissions_home_directories

          - file_groupowner_etc_security_opasswd
          - file_owner_etc_security_opasswd
          - file_permissions_etc_security_opasswd

          - file_groupowner_etc_security_opasswd_old
          - file_owner_etc_security_opasswd_old
          - file_permissions_etc_security_opasswd_old

          - file_permission_user_bash_history


    - id: SYS.1.3.A15
      title: ELIMINATED
      levels:
          - elevated
      description: |-
          This requirement has been eliminated.
      notes: |-
          This requirement has been eliminated.
      status: not applicable

    - id: SYS.1.3.A16
      title: Additional Prevention of Further Intrusion When Vulnerabilities Are Exploited
      levels:
          - elevated
      description: |-
          (1) The use of system calls SHOULD be limited to those absolutely necessary, particularly for
          exposed services and applications. (2) The standard profiles and/or rules (e.g. of SELinux or
          AppArmor) SHOULD be checked manually and, if necessary, adapted to an organisation's own
          security policies. (3) If necessary, new rules and profiles SHOULD be drawn up.
      notes: |-
          This requirement must be implemented organizationally.
      status: manual

    - id: SYS.1.3.A17
      title: Additional Kernel Protection
      levels:
          - elevated
      description: |-
          (1) Specially hardened kernels (e.g. grsecurity, PaX) and appropriate protective safeguards such as
          memory protection or file system protection SHOULD be implemented to prevent
          exploitation of vulnerabilities and propagation in operating systems.
      notes: |-
          Section 1: Red Hat does not provide specifically hardened kernels. If using them, please be
          aware of the support policy for 3rd Party software (https://access.redhat.com/third-party-software-support).
      status: does not meet
      rules: []
