Update RHEL 8 STIG to V1R13

[Mab879]

Description:

• Update RHEL 8 STIG to V1R13
• Allow sssd_offline_cred_expiration to be configured by drop in files.

The other fixes for this version are covered by #11475

Rationale:

Keep the STIG up-to-date.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_package_mcafeetp_installed'.
--- xccdf_org.ssgproject.content_rule_package_mcafeetp_installed
+++ xccdf_org.ssgproject.content_rule_package_mcafeetp_installed
@@ -31,7 +31,7 @@
 RHEL-08-010001
 
 [reference]:
-SV-245540r754730_rule
+SV-245540r942951_rule
 
 [rationale]:
 Virus scanning software can be used to detect if a system has been compromised by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_agent_mfetpd_running'.
--- xccdf_org.ssgproject.content_rule_agent_mfetpd_running
+++ xccdf_org.ssgproject.content_rule_agent_mfetpd_running
@@ -27,7 +27,7 @@
 RHEL-08-010001
 
 [reference]:
-SV-245540r754730_rule
+SV-245540r942951_rule
 
 [rationale]:
 Virus scanning software can be used to detect if a system has been compromised by

New content has different text for rule 'xccdf_org.ssgproject.content_rule_logind_session_timeout'.
--- xccdf_org.ssgproject.content_rule_logind_session_timeout
+++ xccdf_org.ssgproject.content_rule_logind_session_timeout
@@ -304,7 +304,7 @@
 RHEL-08-020035
 
 [reference]:
-SV-257258r917891_rule
+SV-257258r942953_rule
 
 [rationale]:
 Terminating an idle session within a short time period reduces the window of

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny'.
--- xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny
+++ xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny
@@ -20,7 +20,7 @@
 RHEL-08-040090
 
 [reference]:
-SV-230504r854047_rule
+SV-230504r942942_rule
 
 [rationale]:
 Failure to restrict network connectivity only to authorized systems permits inbound connections from malicious systems.

New content has different text for rule 'xccdf_org.ssgproject.content_rule_set_firewalld_default_zone'.
--- xccdf_org.ssgproject.content_rule_set_firewalld_default_zone
+++ xccdf_org.ssgproject.content_rule_set_firewalld_default_zone
@@ -259,7 +259,7 @@
 3.4.1.5
 
 [reference]:
-SV-230504r854047_rule
+SV-230504r942942_rule
 
 [rationale]:
 In firewalld the default zone is applied only after all

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_atm_disabled
@@ -37,7 +37,7 @@
 RHEL-08-040021
 
 [reference]:
-SV-230494r792911_rule
+SV-230494r942918_rule
 
 [rationale]:
 Disabling ATM protects the system against exploitation of any

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_can_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_can_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_can_disabled
@@ -37,7 +37,7 @@
 RHEL-08-040022
 
 [reference]:
-SV-230495r792914_rule
+SV-230495r942921_rule
 
 [rationale]:
 Disabling CAN protects the system against exploitation of any

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_firewire-core_disabled
@@ -30,7 +30,7 @@
 RHEL-08-040026
 
 [reference]:
-SV-230499r792924_rule
+SV-230499r942933_rule
 
 [rationale]:
 Disabling FireWire protects the system against exploitation of any

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_sctp_disabled
@@ -248,7 +248,7 @@
 3.1.2
 
 [reference]:
-SV-230496r792917_rule
+SV-230496r942924_rule
 
 [rationale]:
 Disabling SCTP protects

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_tipc_disabled
@@ -235,7 +235,7 @@
 RHEL-08-040024
 
 [reference]:
-SV-230497r792920_rule
+SV-230497r942927_rule
 
 [rationale]:
 Disabling TIPC protects

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_bluetooth_disabled
@@ -319,7 +319,7 @@
 RHEL-08-040111
 
 [reference]:
-SV-230507r833336_rule
+SV-230507r942939_rule
 
 [rationale]:
 If Bluetooth functionality must be disabled, preventing the kernel

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_cramfs_disabled
@@ -235,7 +235,7 @@
 1.1.1.1
 
 [reference]:
-SV-230498r792922_rule
+SV-230498r942930_rule
 
 [rationale]:
 Removing support for unneeded filesystem types reduces the local attack surface

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled
@@ -259,7 +259,7 @@
 1.1.1.8
 
 [reference]:
-SV-230503r809319_rule
+SV-230503r942936_rule
 
 [rationale]:
 USB storage devices such as thumb drives can be used to introduce

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled'.
--- xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled
+++ xccdf_org.ssgproject.content_rule_kernel_module_uvcvideo_disabled
@@ -24,7 +24,7 @@
 RHEL-08-040020
 
 [reference]:
-SV-230493r809316_rule
+SV-230493r942915_rule
 
 [rationale]:
 Failing to disconnect from collaborative computing devices (i.e., cameras) can result in subsequent compromises of organizational information.

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_smartcards'.
--- xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
+++ xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
@@ -101,7 +101,7 @@
 RHEL-08-020250
 
 [reference]:
-SV-230372r627750_rule
+SV-230372r942945_rule
 
 [rationale]:
 Using an authentication device, such as a CAC or token that is separate from

New content has different text for rule 'xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration'.
--- xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
+++ xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
@@ -178,7 +178,7 @@
 RHEL-08-020290
 
 [reference]:
-SV-230376r854036_rule
+SV-230376r942948_rule
 
 [rationale]:
 If cached authentication information is out-of-date, the validity of the

[codeclimate]

Code Climate has analyzed commit ee4a3e3 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5% (0.0% change).

View more on Code Climate.

[jan-cerny]

I have run TSs locally.

jcerny@fedora:~/work/git/scap-security-guide (pr/11478)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 sssd_offline_cred_expiration
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-01-25-0940/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
INFO - Script cache_credentials_false.pass.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_section.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_value_dropin.pass.sh using profile (all) OK
jcerny@fedora:~/work/git/scap-security-guide (pr/11478)$ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 --remediate-using ansible sssd_offline_cred_expiration
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2024-01-25-0943/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_sssd_offline_cred_expiration
INFO - Script cache_credentials_false.pass.sh using profile (all) OK
INFO - Script comment.fail.sh using profile (all) OK
INFO - Script correct_value.pass.sh using profile (all) OK
INFO - Script wrong_section.fail.sh using profile (all) OK
INFO - Script wrong_value.fail.sh using profile (all) OK
INFO - Script correct_value_dropin.pass.sh using profile (all) OK