Add STIG hrdening
This commit is contained in:
Audiobuzz
@@ -0,0 +1,93 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!--
|
||||
STIG tailoring for the diskless fleet image.
|
||||
|
||||
Extends the SSG RHEL9 STIG profile and UNSELECTS rules that are structurally
|
||||
inapplicable to this architecture (immutable erofs+dm-verity root on a tmpfs
|
||||
overlay, UKI/no-GRUB, autologin kiosk, key-only admin, no per-host state) or
|
||||
that would be dangerous to auto-remediate (FIPS off per decision; firewall off;
|
||||
AIDE = nondeterministic db; smartcard = login lockout). Every unselect here has
|
||||
a matching entry in docs/stig-deviations.md with its compensating control.
|
||||
|
||||
Hand-written (not autotailor) on purpose: oscap reads this directly as a
|
||||
tailoring file and silently ignores idrefs that don't exist in the installed
|
||||
datastream, so a renamed rule can't break the build — it just won't be waived
|
||||
(and will then surface in the generated deviations report for review).
|
||||
|
||||
Used by oscap xccdf eval against ssg-rhel9-ds.xml, selecting the tailored
|
||||
profile id below and passing this file as the tailoring file.
|
||||
-->
|
||||
<xccdf:Tailoring xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2"
|
||||
id="xccdf_org.ssgproject.content_tailoring_diskless">
|
||||
<xccdf:benchmark href="/usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml"/>
|
||||
<xccdf:version time="2026-06-18T00:00:00">1</xccdf:version>
|
||||
|
||||
<xccdf:Profile id="xccdf_org.ssgproject.content_profile_stig_diskless"
|
||||
extends="xccdf_org.ssgproject.content_profile_stig">
|
||||
<xccdf:title>DISA STIG for RHEL 9 — diskless fleet tailoring</xccdf:title>
|
||||
<xccdf:description>STIG with rules inapplicable to the diskless/UKI/kiosk architecture unselected; see docs/stig-deviations.md.</xccdf:description>
|
||||
|
||||
<!-- FIPS: disabled for now (decision). Revisit with signing/Secure Boot. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_enable_fips_mode" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_enable_fips_mode" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_dracut-fips_installed" selected="false"/>
|
||||
|
||||
<!-- AIDE / file integrity: dm-verity is the compensating control (whole RO
|
||||
root cryptographically verified). AIDE would also add a nondeterministic
|
||||
db, breaking the reproducible verity hash. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_aide_installed" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_build_database" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_scan_notification" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_acls" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_aide_verify_ext_attributes" selected="false"/>
|
||||
|
||||
<!-- Bootloader: UKI, no GRUB. The audit/slub/page-poison/vsyscall/etc kernel
|
||||
params are set in the signed UKI cmdline (extract-artifacts.sh) instead —
|
||||
the compensating control. GRUB password rules are N/A. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_uefi_password" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_admin_username" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_argument" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_audit_backlog_limit_argument" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_slub_debug_argument" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_page_poison_argument" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_vsyscall_argument" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_init_on_alloc_argument" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_pti_argument" selected="false"/>
|
||||
|
||||
<!-- Partitioning: single erofs root + tmpfs overlay; cannot create separate
|
||||
/var,/home,/tmp,... partitions. Intent met via nodev/nosuid/noexec tmpfs
|
||||
mount options (see provisioner). -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_log_audit" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_tmp" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_home" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_partition_for_var_tmp" selected="false"/>
|
||||
|
||||
<!-- Firewall: disabled on the isolated boot LAN (egress controlled at the
|
||||
serving/firewall layer). Auto-enabling firewalld/nftables risks the
|
||||
NVMe/TCP (4420) + NM paths. Re-enable as future hardening. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_service_firewalld_enabled" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false"/>
|
||||
|
||||
<!-- Remote audit offload: LOCAL-only for now (decision). auditd runs and logs
|
||||
to the overlay; audisp-remote/rsyslog remote loghost waived. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_network_failure_action" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
|
||||
|
||||
<!-- Smart card: diskless, key-based admin; no PKI/smartcard reader. Enabling
|
||||
smartcard-required login would lock the host out. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_require_smart_card_login" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_smartcard" selected="false"/>
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_install_smartcard_packages" selected="false"/>
|
||||
|
||||
<!-- Admin sudo: the baked admin is key-only (no password), so sudo can't
|
||||
prompt for one — NOPASSWD is required for it to function. Documented. -->
|
||||
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="false"/>
|
||||
|
||||
</xccdf:Profile>
|
||||
</xccdf:Tailoring>
|
||||
Reference in New Issue
Block a user