sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/main' into poam-hardening

Browse Source 
# Conflicts:
#	CLAUDE.md
This commit is contained in:
Audiobuzz
2026-07-12 05:54:41 +00:00
parent 5bc6d27f77 7bd42abf4d
commit dd3a672a82
18 changed files with 1277 additions and 84 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/diskless-tailoring.xml
+15
View File
@@ -171,5 +171,20 @@
<xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_reboot" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_disable_ctrlaltdel_burstaction" selected="false"/>
<!-- NTP time source (secure_ntp): the fleet configures chrony's time source
DYNAMICALLY at runtime — a fleet-CA-authenticated NTS server derived from
the DHCP domain (secure_ntp=true) or DHCP option-42 (false) — via the NM
dispatcher + `sourcedir /run/chrony-dhcp`, NOT a static baked `server`
line. These rules remediate by INJECTING an unauthenticated
`server <pool> maxpoll 16` into chrony.conf; under secure_ntp that plain
server is a silent fallback that DEFEATS the NTS DoS-only guarantee (a
DNS/NTP spoofer could shift the clock through it — the exact F-03 risk).
Unselect so remediation adds no plain server; 2c-STIG-postfix also
re-strips any server/pool when secure_ntp=true (belt-and-suspenders).
The STIG intent (time IS synchronised, authenticated under NTS) is met.
Justified in docs/stig-deviations.md #17. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_chronyd_or_ntpd_set_maxpoll" selected="false"/>
</xccdf:Profile>
</xccdf:Tailoring>