Skip to content

Update RHEL 9 CCN profile #14321

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mab879 merged 8 commits into from
Jan 23, 2026
Merged

Update RHEL 9 CCN profile #14321

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
490c6a2
align section A.5.SEC-RHEL5
vojtapolasek Jan 22, 2026
b0f0cba
align section A.3.SEC-RHEL6
vojtapolasek Jan 22, 2026
60b5cba
align section A.4.SEC-RHEL3
vojtapolasek Jan 22, 2026
f352e06
align section A.11.SEC-RHEL3
vojtapolasek Jan 22, 2026
a6dc76e
align section A.11.SEC-RHEL4
vojtapolasek Jan 22, 2026
005b4a6
update profile stability data files
vojtapolasek Jan 22, 2026
8c3da84
enforce minimal length for new passwords as well
vojtapolasek Jan 22, 2026
5b3ef8a
check for nosuid flag also on /boot/efi partition
vojtapolasek Jan 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .../system/accounts/accounts-pam/locking_out_password_attempts/var_password_pam_remember.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,6 @@ options:
7: 7
8: 8
9: 9
20: 20
24: 24
default: 5
29 changes: 21 additions & 8 deletions products/rhel9/controls/ccn_rhel9.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ controls:
status: automated
rules:
- auditd_data_retention_max_log_file_action
- var_auditd_max_log_file_action=keep_logs
- var_auditd_max_log_file_action=rotate

- id: A.3.SEC-RHEL7
title: Modifications to the Sudoers File Are Audited, As Are Changes to Permissions, Users, Groups,
Expand Down Expand Up @@ -242,9 +242,16 @@ controls:
- basic
- intermediate
- advanced
status: pending
notes: |-
Related to nosuid, noexec and nodev options but in /boot. More context is needed.
status: partial
notes: Remaining rules for /boot/efi are not implemented yet.
rules:
Copy link
Copy Markdown
Member

@Mab879 Mab879 Jan 22, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we also need to check /boot/efi as well. The PDF says we do. If we not checking /boot/efi we should add a note about why.

Copy link
Copy Markdown
Collaborator Author

@vojtapolasek vojtapolasek Jan 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACtually I Google translated the guide and it seems /boot/efi should be checked as well. We have only one rule, I added it and I also added a note. I think this should be investigated separately, because I find it suspicious that we do not have other rules... maybe they do not make sense?

- mount_option_boot_efi_nosuid
- mount_option_boot_nodev
- mount_option_boot_noexec
- mount_option_boot_nosuid
# the noauto option could block proper evaluation of other mount options on /boot
related_rules:
- mount_option_boot_noauto

- id: A.5.SEC-RHEL1
title: Login and Impersonation Permissions Are Controlled
Expand Down Expand Up @@ -311,6 +318,9 @@ controls:
- var_accounts_maximum_age_login_defs=45
- var_accounts_minimum_age_login_defs=2
- var_accounts_password_warn_age_login_defs=10
- accounts_password_pam_pwhistory_remember_password_auth
- accounts_password_pam_pwhistory_remember_system_auth
- var_password_pam_remember=20

- id: A.5.SEC-RHEL6
title: Secure Protocols Are Used For the Network Authentication Processes
Expand Down Expand Up @@ -601,11 +611,15 @@ controls:
- advanced
status: automated
rules:
- accounts_password_pam_minclass
- accounts_password_pam_lcredit
- accounts_password_pam_ocredit
- accounts_password_pam_ucredit
- accounts_password_pam_dcredit
- accounts_password_pam_minlen
- accounts_password_minlen_login_defs
- accounts_password_pam_retry
- var_password_pam_minclass=4
- var_password_pam_minlen=14
- var_password_pam_minlen=12
- var_accounts_password_minlen_login_defs=12

- id: A.11.SEC-RHEL4
title: During Login, the System Displays a Text in Compliance With the Organization's Standards
Expand All @@ -625,7 +639,6 @@ controls:
- dconf_gnome_login_banner_text
- sshd_enable_warning_banner_net
- login_banner_text=cis_banners
- motd_banner_text=cis_banners
- remote_login_banner_text=cis_banners

- id: A.11.SEC-RHEL5
Expand Down
20 changes: 15 additions & 5 deletions tests/data/profile_stability/rhel9/ccn_advanced.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,14 @@
accounts_maximum_age_login_defs
accounts_minimum_age_login_defs
accounts_password_pam_minclass
accounts_password_minlen_login_defs
accounts_password_pam_dcredit
accounts_password_pam_lcredit
accounts_password_pam_minlen
accounts_password_pam_ocredit
accounts_password_pam_pwhistory_remember_password_auth
accounts_password_pam_pwhistory_remember_system_auth
accounts_password_pam_retry
accounts_password_pam_ucredit
accounts_password_set_max_life_existing
accounts_password_set_min_life_existing
accounts_password_set_warn_age_existing
Expand Down Expand Up @@ -85,7 +91,10 @@ kernel_module_squashfs_disabled
kernel_module_udf_disabled
kernel_module_usb-storage_disabled
login_banner_text=cis_banners
motd_banner_text=cis_banners
mount_option_boot_efi_nosuid
mount_option_boot_nodev
mount_option_boot_noexec
mount_option_boot_nosuid
no_empty_passwords_etc_shadow
no_password_auth_for_systemaccounts
no_shelllogin_for_systemaccounts
Expand Down Expand Up @@ -147,18 +156,19 @@ usbguard_generate_policy
use_pam_wheel_for_su
var_accounts_maximum_age_login_defs=45
var_accounts_minimum_age_login_defs=2
var_accounts_password_minlen_login_defs=12
var_accounts_password_warn_age_login_defs=10
var_accounts_passwords_pam_faillock_deny=8
var_accounts_passwords_pam_faillock_unlock_time=never
var_accounts_tmout=5_min
var_accounts_user_umask=027
var_auditd_max_log_file_action=keep_logs
var_auditd_max_log_file_action=rotate
var_authselect_profile=sssd
var_multiple_time_servers=rhel
var_password_hashing_algorithm=SHA512
var_password_hashing_algorithm_pam=sha512
var_password_pam_minclass=4
var_password_pam_minlen=14
var_password_pam_minlen=12
var_password_pam_remember=20
var_screensaver_lock_delay=immediate
var_selinux_policy_name=targeted
var_selinux_state=enforcing
Expand Down
20 changes: 15 additions & 5 deletions tests/data/profile_stability/rhel9/ccn_basic.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,14 @@
accounts_maximum_age_login_defs
accounts_minimum_age_login_defs
accounts_password_pam_minclass
accounts_password_minlen_login_defs
accounts_password_pam_dcredit
accounts_password_pam_lcredit
accounts_password_pam_minlen
accounts_password_pam_ocredit
accounts_password_pam_pwhistory_remember_password_auth
accounts_password_pam_pwhistory_remember_system_auth
accounts_password_pam_retry
accounts_password_pam_ucredit
accounts_password_set_max_life_existing
accounts_password_set_min_life_existing
accounts_password_set_warn_age_existing
Expand Down Expand Up @@ -51,7 +57,10 @@ firewalld_loopback_traffic_restricted
firewalld_loopback_traffic_trusted
grub2_password
login_banner_text=cis_banners
motd_banner_text=cis_banners
mount_option_boot_efi_nosuid
mount_option_boot_nodev
mount_option_boot_noexec
mount_option_boot_nosuid
package_firewalld_installed
package_usbguard_installed
remote_login_banner_text=cis_banners
Expand Down Expand Up @@ -95,12 +104,13 @@ sysctl_net_ipv6_conf_default_accept_source_route
usbguard_generate_policy
var_accounts_maximum_age_login_defs=45
var_accounts_minimum_age_login_defs=2
var_accounts_password_minlen_login_defs=12
var_accounts_password_warn_age_login_defs=10
var_auditd_max_log_file_action=keep_logs
var_auditd_max_log_file_action=rotate
var_authselect_profile=sssd
var_password_hashing_algorithm=SHA512
var_password_hashing_algorithm_pam=sha512
var_password_pam_minclass=4
var_password_pam_minlen=14
var_password_pam_minlen=12
var_password_pam_remember=20
var_sshd_set_keepalive=1
var_system_crypto_policy=default_policy
20 changes: 15 additions & 5 deletions tests/data/profile_stability/rhel9/ccn_intermediate.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,14 @@
accounts_maximum_age_login_defs
accounts_minimum_age_login_defs
accounts_password_pam_minclass
accounts_password_minlen_login_defs
accounts_password_pam_dcredit
accounts_password_pam_lcredit
accounts_password_pam_minlen
accounts_password_pam_ocredit
accounts_password_pam_pwhistory_remember_password_auth
accounts_password_pam_pwhistory_remember_system_auth
accounts_password_pam_retry
accounts_password_pam_ucredit
accounts_password_set_max_life_existing
accounts_password_set_min_life_existing
accounts_password_set_warn_age_existing
Expand Down Expand Up @@ -73,7 +79,10 @@ kernel_module_squashfs_disabled
kernel_module_udf_disabled
kernel_module_usb-storage_disabled
login_banner_text=cis_banners
motd_banner_text=cis_banners
mount_option_boot_efi_nosuid
mount_option_boot_nodev
mount_option_boot_noexec
mount_option_boot_nosuid
no_empty_passwords_etc_shadow
no_password_auth_for_systemaccounts
no_shelllogin_for_systemaccounts
Expand Down Expand Up @@ -134,14 +143,15 @@ usbguard_generate_policy
use_pam_wheel_for_su
var_accounts_maximum_age_login_defs=45
var_accounts_minimum_age_login_defs=2
var_accounts_password_minlen_login_defs=12
var_accounts_password_warn_age_login_defs=10
var_auditd_max_log_file_action=keep_logs
var_auditd_max_log_file_action=rotate
var_authselect_profile=sssd
var_multiple_time_servers=rhel
var_password_hashing_algorithm=SHA512
var_password_hashing_algorithm_pam=sha512
var_password_pam_minclass=4
var_password_pam_minlen=14
var_password_pam_minlen=12
var_password_pam_remember=20
var_screensaver_lock_delay=immediate
var_selinux_policy_name=targeted
var_selinux_state=enforcing
Expand Down
Loading