sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Tightening Stig hardening

Browse Source
This commit is contained in:
Audiobuzz
2026-06-20 00:05:19 +00:00
parent b9258e7490
commit b67a23e718
8 changed files with 847 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/diskless-tailoring.xml
+58
View File
@@ -99,5 +99,63 @@
prompt for one — NOPASSWD is required for it to function. Documented. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sudo_remove_nopasswd" selected="false"/>
<!-- ================================================================== -->
<!-- Report triage 2026-06-19 (scan app-9f7d8d1): dispositions for the -->
<!-- remaining REVIEW rows. Every entry here is justified in -->
<!-- docs/stig-deviations.md #12. -->
<!-- ================================================================== -->
<!-- Bucket A — covered by an existing register entry. -->
<!-- Partitions (#1): single erofs+tmpfs root, no separate partitions. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_encrypt_partitions" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_sufficiently_large_partition" selected="false"/>
<!-- Bootloader (#2): UKI, no GRUB. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_grub2_password" selected="false"/>
<!-- FIPS off (#5): crypto.fips_enabled + FIPS-validated SSH MACs. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_crypto_fips_enabled" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_macs_openssh_conf_crypto_policy" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_harden_sshd_macs_opensshserver_conf_crypto_policy" selected="false"/>
<!-- Firewall off for the isolated lab boot LAN (#4). -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_configured_firewalld_default_deny" selected="false"/>
<!-- No SSSD/PKI/smartcard (#7): host is local key-only, no domain join. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_enable_certmap" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sssd_has_trust_anchor" selected="false"/>
<!-- Bucket B — architecturally absent (notchecked); N/A, justified #12. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_account_temp_expire_date" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_user_home_paths_only" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_libreswan_approved_tunnels" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_security_patches_up_to_date" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_ssh_keys_passphrase_protected" selected="false"/>
<!-- Bucket C — decisions, justified #12. -->
<!-- Rocky IS vendor-supported; the rule only fails because the RHEL
datastream checks for an RHEL subscription/CPE. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_installed_OS_is_vendor_supported" selected="false"/>
<!-- Single DHCP-provided resolver by design (boot LAN); multi-DNS N/A. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_network_configure_name_resolution" selected="false"/>
<!-- KEEP user namespaces enabled — the Chromium kiosk sandbox needs them
(this is the check-only "_no_remediation" variant). -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_sysctl_user_max_user_namespaces_no_remediation" selected="false"/>
<!-- Authorized-local-users check doesn't know the key-only appliance
accounts (fleetadmin, kiosk); see #10. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_accounts_authorized_local_users" selected="false"/>
<!-- postfix removed (no MTA needed on the appliance; audit-failure
notification is via remote offload, not email) -> the rule that
requires postfix installed becomes N/A. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_postfix_installed" selected="false"/>
<!-- USBGuard (decision: ENABLE with a hardware-independent allowlist).
usbguard is already installed + the service enabled, but its policy was
generated on the build VM, which has no real USB input — under the
default block target a physical console keyboard/mouse would be blocked.
SELECT the HID + hub allow rules (class-based, hardware-independent) so
the eval of record verifies them; the provisioner writes these + the
LinuxAudit backend before that eval. NOTE: bench-verify physical console
input on real hardware. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid" selected="true"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hub" selected="true"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_usbguard_allow_hid_and_hub" selected="true"/>
</xccdf:Profile>
</xccdf:Tailoring>