inspec.yml

name: canonical-ubuntu-22.04-lts-stig-baseline
title: canonical-ubuntu-22.04-lts-stig-baseline
maintainer: MITRE SAF Team
copyright: MITRE
license: Apache-2.0
summary: "InSpec profile aligned to DISA STIG for Canonical Ubuntu 22.0.4"
version: 1.0.0
inspec_version: ">= 6.0"

supports:
  - platform-name: ubuntu
    release: 22.*

### INPUTS ###
# Inputs are variables that can be referenced by any control in the profile, 
# and are defined and given a default value in this file.

# By default, each parameter is set to exactly comply with the STIG baseline
# wherever possible. Some STIG controls will require you to update an input
# to provide the profile with necessary context for your system.

# For example, control SV-230379 checks that only 'necessary accounts' exist
# on the system. The list of 'necessary' accounts depends on the function of
# the system, and you will likely need to add approved accounts to the 
# 'known_system_accounts' input. Also, depending on your local organizational
# security policy, you may need to deviate from the STIG on some controls to
# make the test profile 'stricter' or 'looser.'

# In both cases, you can override the default values given in this file
# using an input file or a CLI flag at execution time. See InSpec's Inputs docs
# at https://docs.chef.io/inspec/profiles/inputs/ for details.

# NOTE: DO NOT directly change the default values by editing this file. Use
# overrides instead.
###

inputs:
  # SV-258085, SV-258106, SV-258084, SV-258087, SV-258086
  - name: sudoers_config_files
    description: 'The files and directories you keep your sudoers configs'
    type: Array
    value:
      - '/etc/sudoers'
      - '/etc/sudoers.d/*'

  # SV-258106
  - name: passwordless_admins
    description: List of administrative groups permitted by ISSO to have NOPASSWD set in sudoers files
    type: Array
    value: []

  # SV-258003, SV-257996
  - name: sshd_config_values
    description: 'The agreed sshd server config values for the organization'
    type: Hash
    value:
      GSSAPIAuthentication: 'no'
      ClientAliveInterval: '600'

  # SV-258123
  - name: alternate_mfa_method
    description: Name of the MFA method in place on the system (leave blank if using the default SSSD, give the name if using an approved alternate method)
    type: String
    value: ''

  # SV-258122, SV-258123
  - name: sssd_conf_files
    description: File and directory globs to check for SSSD configuration
    type: Array
    value:
      - /etc/sssd/sssd.conf
      - /etc/sssd/conf.d/*.conf

  # SV-258001, SV-258000
  - name: ssh_host_key_dirs
    description: Directories where public host SSH keys for the server are stored
    type: Array
    value:
      - /etc/ssh/
      - /home/

  # SV-258001
  - name: ssh_pub_key_mode
    description: All public ssh keyfiles on the filesystem should be equal or less permissive than this octet
    type: String
    value: '0644'


  # SV-258000
  - name: ssh_private_key_mode
    description: All private ssh keyfiles on the filesystem should be equal or less permissive than this octet
    type: String
    value: '0640'

  # SV-258171
  - name: audit_conf_mode
    description: All audit config files on the filesystem should be equal or less permissive than this octet
    type: String
    value: '0640'

  # SV-257887
  - name: audit_tool_mode
    description: All audit config tools on the filesystem should be equal or less permissive than this octet
    type: String
    value: '0755'

  # SV-257894, SV-257890, SV-257933, SV-257891, SV-258172, SV-257895, SV-257892, SV-257896, SV-257897, SV-257934, SV-257893, SV-257999, SV-257888
  - name: expected_modes
    description: Expected modes of system files and/or directories
    type: Hash
    value:
      home_dirs: "0750"
      cron_dirs: "0700"
      /etc/group: "0644"
      /etc/group-: "0644"
      /etc/gshadow: "0000"
      /etc/gshadow-: "0000"
      /etc/passwd: "0644"
      /etc/passwd-: "0644"
      /etc/shadow: "0000"
      /etc/shadow-: "0000"
      /etc/crontab: "0600"
      /etc/ssh/sshd_config: "0600"
      auditd_conf: "0640"
      journal: "2640"

  # SV-257889 TODO: fold this into expected_system_file_mode
  - name: initialization_file_mode
    description: All initialization files (.bash_profile etc) should have permissions equal to or less than this octet
    type: String
    value: '0740'

  # SV-257889
  - name: exempt_ini_files
    description: List of initialization files that are exempt from permissions checks
    type: Array
    value: [] 
    
  # SV-257889
  - name: alternate_ini_file_dirs
    description: List of directories, other than a user's homedir, to search for initialization files
    type: Array
    value: []

  # SV-258157
  - name: alert_method
    description: 'The method used to provide real-time information to the ISSO or AO'
    type: String
    value: email

  # SV-258038, SV-258035
  - name: peripherals_package
    description: "The name of the package used to managed connected peripherals"
    type: String
    value: "usbguard"

  # SV-258036
  - name: peripherals_service
    description: "The name of the service used to managed connected peripherals"
    type: String
    value: "usbguard"

  # SV-257978, SV-258003, SV-257987, SV-257996
  - name: allow_container_openssh_server
    description: "If the OpenSSH Server has been approved outside standard container guidance to default transprots"
    type: Boolean
    value: false

  # SV-258113
  - name: maxclassrepeat
    description: "The maximum number of repeating characters of the same character class for passwords"
    type: Numeric
    value: 4

  # SV-258114
  - name: maxrepeat
    description: "The maximum number of repeating characters when passwords are updated"
    type: Numeric
    value: 3

  # SV-258115
  - name: minclass
    description: "The minimum number of character classes that should change when passwords are updated"
    type: Numeric
    value: 4

  # SV-258112
  - name: difok
    description: "The minimum number of required changed characters when passwords are updated."
    type: Numeric
    value: 8

  # SV-258104
  - name: pass_min_days
    description: "The minimum password lifetime restriction in days"
    type: Numeric
    value: 1

  # SV-258042, SV-258041
  - name: pass_max_days
    description: "The maximum password lifetime restriction in days"
    type: Numeric
    value: 60

  # SV-257843
  - name: separate_filesystem_exempt
    description: "The system manages file system useage, LVM/XFS etc. or is managed by the service provider"
    type: Boolean
    value: false

  # SV-258062, SV-257931, SV-257930, SV-257778
  - name: disable_slow_controls
    description: Controls that are known to consistently have long run times can be disabled with this attribute
    type: Boolean
    value: false

  # SV-257778
  - name: disconnected_system
    description: The system is not connected to the public internet or doesn't have access to a RPM package server
    type: Boolean
    value: false

  # SV-257782, SV-258230
  - name: use_fips
    description: "'(boolean)' Set to true if the system is required to use FIPS Encryption"
    type: Boolean
    value: true

  # SV-257879
  - name: data_at_rest_exempt
    description: "'(boolean) Set to true if the system is exempt from using Data at Rest"
    type: Boolean
    value: false

  # SV-258093, SV-258092
  - name: min_reuse_generations
    description: Number of reuse generations
    type: Numeric
    value: 5

  # SV-258091
  - name: min_retry
    description: Number of permitted password retries
    type: Numeric
    value: 3

  # SV-258108, SV-258107
  - name: pass_min_len
    description: Minimum number of characters for a new password
    type: Numeric
    value: 15

  # SV-258080
  - name: faillock_tally
    description: The default SELinux security context type of the non-default tally directory
    type: String
    value: "faillog_t"

  # SV-257969, SV-257970
  - name: network_router
    description: This indicates if the system is acting as a rounter on the network
    type: Boolean
    value: false

  # SV-257814
  - name: core_dump_expected_value
    description: Expected value for the core dump setting
    type: Numeric
    value: 0

  # SV-258069
  - name: concurrent_sessions_permitted
    description: Number of permitted concurrent sessions on this system
    type: Numeric
    value: 10

  # SV-257789, SV-257787, SV-257791, SV-257790
  - name: grub_conf_path
    description: Grub config filepath
    type: String
    value: '/etc/grub2.cfg'

  # SV-257787
  - name: grub_user_conf_path
    description: Grub user config filepath
    type: String
    value: '/boot/grub2/user.cfg'

  # SV-257789
  - name: disallowed_grub_superusers
    description: List of default users that cannot be the default GRUB superuser
    type: Array
    value:
      - root
      - admin
      - administrator

  # SV-258042, SV-258052, SV-257890, SV-258053, SV-258044, SV-258050, SV-258051, SV-258105
  - name: exempt_home_users
    description: Users exempt from home directory-based controls in array format
    type: Array
    value:
      - root

  # SV-258048, SV-257843, SV-258046, SV-258050, SV-258051, SV-257889
  - name: non_interactive_shells
    description: These shells do not allow a user to login
    type: Array
    value:
      - "/sbin/nologin"
      - "/sbin/halt"
      - "/sbin/shutdown"
      - "/bin/false"
      - "/bin/sync"
      - "/bin/true"

  # SV-258046
  - name: interactive_system_account_exemptions
    description: System accounts that are exempt from the non-interactive shell requirement
    type: Array
    value:
      - root

  # SV-258058
  - name: user_accounts
    description: Accounts of known managed users
    type: Array
    value: ["vagrant"]

  # SV-258238
  - name: unapproved_ssl_tls_versions
    description:
    type: Array
    value: 
      - -VERS-DTLS0.9
      - -VERS-SSL3.0
      - -VERS-TLS1.0
      - -VERS-TLS1.1
      - -VERS-DTLS1.0

  # SV-258054
  - name: unsuccessful_attempts
    description: The number of allowed failed login attempts
    type: Numeric
    value: 3

  # SV-258039
  - name: bluetooth_installed
    description: "Device or operating system has a Bluetooth adapter installed"
    type: Boolean
    value: true

  # SV-258058
  - name: known_system_accounts
    description: System accounts that support approved system activities.
    type: Array
    value:
      - adm
      - bin
      - chrony
      - daemon
      - dbus
      - halt
      - lp
      - mail
      - nobody
      - ntp
      - operator
      - polkitd
      - postfix
      - root
      - shutdown
      - sshd
      - sssd
      - sync
      - systemd-bus-proxy
      - systemd-network

  # SV-258019, SV-257838, SV-258126, SV-258122, SV-258133, SV-258124, SV-258125, SV-258131, SV-258121
  - name: smart_card_enabled
    description: Smart card status of the system
    type: Boolean
    value: false

  # SV-258136, SV-258134, SV-258135
  - name: file_integrity_tool
    description: Name of tool
    type: String
    value: "aide"

  # SV-257945
  - name: authoritative_timeserver
    description: Timeserver used in /etc/chrony.conf
    type: String
    value: 0.us.pool.ntp.mil

  # SV-257859, SV-257858, SV-257857
  - name: non_removable_media_fs
    description: File systems listed in /etc/fstab which are not removable media devices
    type: Array
    value: ["/", "/tmp", "none", "/home", "/tmpfs"]

  # SV-258127
  - name: private_key_files
    description: List of full paths to private key files on the system
    type: Array
    value: []

  # SV-258131
  - name: root_ca_file
    description: Path to an accepted trust anchor certificate file (DoD)
    type: String
    value: "/etc/sssd/pki/sssd_auth_ca_db.pem"

  # SV-258054
  - name: unsuccessful_attempts
    description: Maximum number of unsuccessful attempts before lockout
    type: Numeric
    value: 3

  # SV-258023
  - name: system_inactivity_timeout
    description: Maximum system inactivity timeout (time in seconds).
    type: Numeric
    value: 900

  # SV-258049
  - name: days_of_inactivity
    description: Maximum number of days if account inactivity before account lockout
    type: Numeric
    value: 35

  # SV-258047
  - name: temporary_accounts
    description: Temporary user accounts
    type: Array
    value: []

  # SV-258047
  - name: temporary_account_max_days
    description: Max number of days a temporary account should be permitted to exist
    type: Numeric
    value: 3

  # SV-257779
  - name: banner_message_text_cli
    description: Banner message text for command line interface logins.
    type: String
    value:
      "You are accessing a U.S. Government (USG) Information System (IS) that is \
      provided for USG-authorized use only. By using this IS (which includes any \
      device attached to this IS), you consent to the following conditions: -The USG \
      routinely intercepts and monitors communications on this IS for purposes \
      including, but not limited to, penetration testing, COMSEC monitoring, network \
      operations and defense, personnel misconduct (PM), law enforcement (LE), and \
      counterintelligence (CI) investigations. -At any time, the USG may inspect and \
      seize data stored on this IS. -Communications using, or data stored on, this \
      IS are not private, are subject to routine monitoring, interception, and \
      search, and may be disclosed or used for any USG-authorized purpose. -This IS \
      includes security measures (e.g., authentication and access controls) to \
      protect USG interests--not for your personal benefit or privacy. \
      -Notwithstanding the above, using this IS does not constitute consent to PM, \
      LE or CI investigative searching or monitoring of the content of privileged \
      communications, or work product, related to personal representation or \
      services by attorneys, psychotherapists, or clergy, and their assistants. Such \
      communications and work product are private and confidential. See User \
      Agreement for details."

  # SV-257981
  - name: banner_message_text_ral
    description: Banner message text for remote access logins.
    type: String
    value:
      "You are accessing a U.S. Government (USG) Information System (IS) that is \
      provided for USG-authorized use only. By using this IS (which includes any \
      device attached to this IS), you consent to the following conditions: -The USG \
      routinely intercepts and monitors communications on this IS for purposes \
      including, but not limited to, penetration testing, COMSEC monitoring, network \
      operations and defense, personnel misconduct (PM), law enforcement (LE), and \
      counterintelligence (CI) investigations. -At any time, the USG may inspect and \
      seize data stored on this IS. -Communications using, or data stored on, this \
      IS are not private, are subject to routine monitoring, interception, and \
      search, and may be disclosed or used for any USG-authorized purpose. -This IS \
      includes security measures (e.g., authentication and access controls) to \
      protect USG interests--not for your personal benefit or privacy. \
      -Notwithstanding the above, using this IS does not constitute consent to PM, \
      LE or CI investigative searching or monitoring of the content of privileged \
      communications, or work product, related to personal representation or \
      services by attorneys, psychotherapists, or clergy, and their assistants. Such \
      communications and work product are private and confidential. See User \
      Agreement for details."

  # SV-258056
  - name: fail_interval
    description: Interval of time in which the consecutive failed logon attempts must occur in order for the account to be locked out (time in seconds)
    type: Numeric
    value: 900

  # SV-258057
  - name: lockout_time
    description: Minimum amount of time account must be locked out after failed logins. '0' indicates an account should not unlock until reset by an admin.
    type: Numeric
    value: 0

  # SV-258066
  - name: system_activity_timeout
    description: The expected maximum delay in seconds before the system will lock the session
    type: Numeric
    value: 900

  # SV-258060
  - name: log_directory
    description: Documented tally log directory
    type: String
    value: /var/log/faillock

  # SV-257995
  - name: sshd_client_alive_count_max
    description: all network connections associated with SSH traffic are terminated at the end of the session or after 10 minutes of inactivity
    type: Numeric
    value: 1

  # SV-257780
  - name: linux_threat_prevention_package
    description: Endpoint Security Linux Threat Prevention Tool Package
    type: String
    value: mcafeetp

  # SV-257780
  - name: linux_threat_prevention_service
    description: Endpoint Security Linux Threat Prevention Tool Service
    type: String
    value: mfetpd

  # SV-257837
  - name: remove_xorg_x11_server_packages
    description: Graphical Display Manager must not be installed
    type: Array
    value:
      - xorg-x11-server-common
      - xorg-x11-server-Xorg
      - xorg-x11-server-utils
      - xorg-x11-server-Xwayland

  # SV-257781
  - name: gui_required
    description: Set to true if there is a documented requirement for the target system to have a graphical user interface enabled
    type: Boolean
    value: false

  # SV-258153
  - name: disk_error_action
    description: Must take appropriate action when an audit processing failure occurs.
    type: Array
    value:
      - SYSLOG
      - SINGLE
      - HALT

  # SV-258154
  - name: disk_full_action
    description: Audit system must take appropriate action when the audit storage volume is full.
    type: Array
    value:
      - SYSLOG
      - SINGLE
      - HALT

  # SV-258158
  - name: admin_space_left
    description: The percentage of space left on the audit storage volume that will trigger the system to take action
    type: String
    value: "5%"

  # SV-258159
  - name: admin_space_left_action
    description: Action the system should take when the audit storage volume is full
    type: String
    value: "SINGLE"

  # SV-258160
  - name: max_log_file_action
    description: Action the system should take when the audit files have reached maximum size
    type: String
    value: "ROTATE"

  # SV-258168
  - name: audit_flush_threshold
    description: Threshold at which the audit system should flush the audit logs to disk
    type: Numeric
    value: 100

  # SV-257985
  - name: permit_root_login
    description: Whether to permit direct logons to the root account using remote access via SSH
    type: String
    value: "no"

  # SV-258072, SV-258073, SV-258044, SV-258074, SV-258075
  - name: permissions_for_shells
    description: Define default permissions for logon and non-logon shells.
    type: Hash
    value:
      default_umask: "077"
      bashrc_umask: "077"
      cshrc_umask: "077"
      profile_umask: "077"

  # SV-257883
  - name: permissions_for_libs
    description: Define default permissions for system libraries
    type: String
    value: "0755"

  # SV-257884, SV-257923, SV-257922, SV-257921, SV-257920, SV-257883
  - name: system_libraries
    description: Define system libraries which should have strict permissions enforced
    type: Array
    value:
      - /lib
      - /lib64
      - /usr/lib
      - /usr/lib64

  # SV-257919, SV-257918, SV-257882
  - name: system_command_dirs
    description: Directories containing system command executables
    type: Array
    value:
      - /bin
      - /sbin
      - /usr/bin
      - /usr/sbin
      - /usr/libexec
      - /usr/local/bin
      - /usr/local/sbin

  # SV-257887
  - name: audit_tools
    description: Paths to tools related to audit function
    tpye: Array
    value:
      - /sbin/auditctl
      - /sbin/aureport
      - /sbin/ausearch
      - /sbin/autrace
      - /sbin/auditd
      - /sbin/rsyslogd
      - /sbin/augenrules

  # SV-257923
  - name: required_system_accounts
    description: List of system accounts permitted to group-own system libraries
    type: Array
    value:
      - root

  # SV-257917
  - name: var_log_messages_group
    description: Group owner of /var/log/messages file
    type: Array
    value:
      - root

  # SV-258123
  - name: sssd_certificate_verification
    description: Certificate status checking for multifactor authentication.
    type: String
    value: "ocsp_dgst=sha1"

  # SV-258165
  - name: var_log_audit_group
    description: Group owner of /var/log/audit/audit.log
    type: Array
    value:
      - root

  # SV-258090, SV-258089
  - name: use_fapolicyd
    description: Whether to use fapolicyd, similar to SELinux whitelisting
    type: Boolean
    value: true

  # SV-258095, SV-258122, SV-258094, SV-258093, SV-258233, SV-258100, SV-258097, SV-258092, SV-258099, SV-258098
  - name: pam_auth_files
    description: THe pam.d auth paths
    type: Hash
    value:
      system-auth: /etc/pam.d/system-auth
      password-auth: /etc/pam.d/password-auth
      smartcard-auth: /etc/pam.d/smartcard-auth

  # SV-258056
  - name: security_faillock_conf
    description: The security faillock configuration file
    type: String
    value: /etc/security/faillock.conf

  # SV-257936
  - name: external_firewall
    description: "The system use an external firewall or service vs a local firewall service"
    type: Boolean
    value: false

  # SV-257940
  - name: firewalld_properties
    description: Ports, Protocols and Services Rules
    type: Hash
    value:
      default_zone: public
      ports: []
      protocols: []
      services:
        - cockpit
        - dhcpv6-client
        - ssh

  # SV-257869, SV-257868, SV-257867, SV-257866
  - name: mount_tmp_options
    description: rhel_08_04012[3-5] - RHEL 9 must mount /tmp with the (nodev|nosuid|noexec) option.
    type: Hash
    value:
      nodev: false
      nosuid: false
      noexec: false

  # SV-257780
  - name: skip_endpoint_security_tool
    description: rhel_08_010001 - The RHEL 8 operating system must implement the Endpoint Security for Linux Threat Prevention tool.
    type: Boolean
    value: false

  # SV-258080
  - name: non_default_tally_dir
    description: The directory used by pam_faillock
    type: String
    value: /var/log/faillock

  # SV-258120
  - name: users_allowed_blank_passwords
    description: Users allowed to not have a password set
    type: Array
    value: []

  # SV-257842
  - name: mail_package
    description: Command that is used to send email messages
    type: String
    value: mailx

  # SV-257819
  - name: rpm_gpg_file
    description: Red Hat uses GPG keys labels defined in file
    type: String
    value: /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

  # SV-257819
  - name: rpm_gpg_keys
    description: Red Hat uses GPG keys labels with matching fingerprints
    type: Hash
    value:
      "release key 2": "567E 347A D004 4ADE 55BA  8A5F 199E 2F91 FD43 1D51"
      "auxiliary key": "6A6A A7C9 7C88 90AE C6AE  BFE2 F76F 66C3 D408 2792"

  # SV-258068, SV-258077
  - name: stop_idle_session_sec
    description: Number of seconds the system can be idle before session timeout
    type: Numeric
    value: 900

  # SV-258071
  - name: login_prompt_delay
    description: Delay in seconds before the login prompt is displayed again after a failed login attempt
    type: Numeric
    value: 4

  # SV-258149, SV-258147, SV-258146, SV-258150
  - name: logging_conf_files
    description: Configuration files for the logging service
    type: Array
    value:
      - /etc/rsyslog.conf
      - /etc/rsyslog.d/*.conf

  # SV-258174
  - name: alternative_logging
    description: Flag to indicate that a non-standard logging method is in use (instead of auditd and other built-in OS logging features)
    type: Boolean
    value: false

  # SV-258149, SV-258147, SV-258156, SV-258162, SV-258146, SV-258141, SV-258140
  - name: alternative_logging_method
    description: Alternative tool for logging (instead of auditd and other built-in OS logging features) - leave blank if using default OS tools
    type: String
    value: ""

  # SV-258156
  - name: audit_storage_threshold
    description: The percentage threshold of space remaining in the audit storage volume before the system should take action
    type: Numeric
    value: 25

  # SV-257849
  - name: autofs_required
    description: Set to true if there is a documented requirement for the target system to have autofs enabled
    type: Boolean
    value: false

  # SV-258034
  - name: usb_storage_required
    description: Set to true if there is a documented requirement for the target system to use USB storage
    type: Boolean
    value: false

  # SV-257952, SV-257835
  - name: tftp_required
    description: Set to true if there is a documented requirement for the target system to use TFTP
    type: Boolean
    value: false

  # SV-257826
  - name: ftp_required
    description: Set to true if there is a documented requirement for the target system to use FTP
    type: Boolean
    value: false

  # SV-257832
  - name: gssproxy_required
    description: Set to true if there is a documented requirement for the target system to use gss_proxy
    type: Boolean
    value: false

  # SV-257833
  - name: iprutils_required
    description: Set to true if there is a documented requirement for the target system to use iprutils
    type: Boolean
    value: false
  
  # SV-257834
  - name: tuned_required
    description: Set to true if there is a documented requirement for the target system to use tuned
    type: Boolean
    value: false

  # SV-257836
  - name: quagga_required
    description: Set to true if there is a documented requirement for the target system to use quagga
    type: Boolean
    value: false

    # SV-230640
  # SV-257935
  - name: alternate_firewall_tool
    description: Alternate firewall tool (other than firewalld) in use for the system - leave blank if using default OS tools
    type: String
    value: ""

  # SV-258040
  - name: wifi_hardware
    description: Set to false if there is no wireless network capability on board the system
    type: Boolean
    value: true

  # Default values for expected keynames for all audit rules
  # NOTE: DO NOT override this hash
  # If you need to override these values, do so via adding the desired key/value to
  # the `audit_rule_keynames_overrides` input instead -- overriding `audit_rule_keynames`
  # directly will lose the values for any key you do not explictly define.
  # SV-258179, SV-258178, SV-258194, SV-258205, SV-258221, SV-258215, SV-258184, SV-258177, SV-258201, SV-258190, SV-258180, SV-258211, SV-258225, SV-258191, SV-258200, SV-258210, SV-258181, SV-258224, SV-258204, SV-258195, SV-258220, SV-258185, SV-258214, SV-258176, SV-258203, SV-258192, SV-258182, SV-258213, SV-258196, SV-258207, SV-258223, SV-258217, SV-258186, SV-258206, SV-258197, SV-258222, SV-258187, SV-258216, SV-258193, SV-258202, SV-258212, SV-258183, SV-258226, SV-258198, SV-258209, SV-258219, SV-258188, SV-258208, SV-258199, SV-258189, SV-258218
  - name: audit_rule_keynames
    description: The audit rules to be applied to the system
    type: Hash
    value: {
      'execve'                        : 'execpriv',
      '/etc/shadow'                   : 'identity',
      '/etc/security/opasswd'         : 'identity',
      '/etc/passwd'                   : 'identity',
      '/etc/gshadow'                  : 'identity',
      '/etc/group'                    : 'identity',
      '/etc/sudoers'                  : 'identity',
      '/etc/sudoers.d'                : 'identity',
      '/usr/bin/su'                   : 'privileged-priv_change',
      'setxattr'                      : 'perm_mod',
      'fsetxattr'                     : 'perm_mod',
      'lsetxattr'                     : 'perm_mod',
      'removexattr'                   : 'perm_mod',
      'fremovexattr'                  : 'perm_mod',
      'lremovexattr'                  : 'perm_mod',
      '/usr/bin/chage'                : 'privileged-chage',
      '/usr/bin/chcon'                : 'perm_mod',
      '/usr/bin/ssh-agent'            : 'privileged-ssh',
      '/usr/bin/passwd'               : 'privileged-passwd',
      '/usr/bin/mount'                : 'privileged-mount',
      '/usr/bin/umount'               : 'privileged-mount',
      'mount'                         : 'privileged-mount',
      '/usr/sbin/unix_update'         : 'privileged-unix-update',
      '/usr/sbin/postdrop'            : 'privileged-unix-update',
      '/usr/sbin/postqueue'           : 'privileged-unix-update',
      '/usr/sbin/semanage'            : 'privileged-unix-update',
      '/usr/sbin/setfiles'            : 'privileged-unix-update',
      '/usr/sbin/userhelper'          : 'privileged-unix-update',
      '/usr/sbin/setsebool'           : 'privileged-unix-update',
      '/usr/sbin/unix_chkpwd'         : 'privileged-unix-update',
      '/usr/libexec/openssh/ssh-keysign' : 'privileged-ssh',
      '/usr/bin/setfacl'              : 'perm_mod',
      '/usr/sbin/pam_timestamp_check' : 'privileged-pam_timestamp_check',
      '/usr/bin/newgrp'               : 'priv_cmd',
      'init_module'                   : 'module_chng',
      'finit_module'                  : 'module_chng',
      'rename'                        : 'delete',
      'unlink'                        : 'delete',
      'rmdir'                         : 'delete',
      'renameat'                      : 'delete',
      'unlinkat'                      : 'delete',
      '/usr/bin/gpasswd'              : 'privileged-gpasswd',
      'delete_module'                 : 'module_chng',
      '/usr/bin/crontab'              : 'privileged-crontab',
      '/usr/bin/chsh'                 : 'priv_cmd',
      'truncate'                      : 'perm_access',
      'ftruncate'                     : 'perm_access',
      'creat'                         : 'perm_access',
      'open'                          : 'perm_access',
      'openat'                        : 'perm_access',
      'open_by_handle_at'             : 'perm_access',
      'chown'                         : 'perm_mod',
      'fchown'                        : 'perm_mod',
      'fchownat'                      : 'perm_mod',
      'lchown'                        : 'perm_mod',
      'chmod'                         : 'perm_mod',
      'fchmod'                        : 'perm_mod',
      'fchmodat'                      : 'perm_mod',
      '/usr/bin/sudo'                 : 'priv_cmd',
      '/usr/sbin/usermod'             : 'privileged-usermod',
      '/usr/bin/chacl'                : 'perm_mod',
      '/usr/bin/kmod'                 : 'modules',
      '/var/log/faillock'             : 'logins',
      '/var/log/lastlog'              : 'logins',
      '/usr/bin/sudoedit'             : 'priv_cmd',
      '/usr/sbin/init'                : 'privileged-init',
      '/usr/sbin/poweroff'            : 'privileged-poweroff',
      '/usr/sbin/reboot'              : 'privileged-reboot',
      '/usr/sbin/shutdown'            : 'privileged-shutdown',
      '/usr/bin/umount'              : 'privileged-mount',
      'umount2'                       : 'perm_mod',
      '/var/log/faillock'             : 'logins',
      '/var/log/tallylog'             : 'logins'
    }

  # Override values for expected keynames for all audit rules
  # Override this hash to change the default values for the audit_rule_keynames
  # Any keys you do not explictly add to this input will use the default values
  # as given in `audit_rule_keynames`
  # Example:
  # {
  #   'execve': 'my_org_specific_keyname_for_auditing_execve'
  # }
  # SV-258179, SV-258178, SV-258194, SV-258205, SV-258221, SV-258215, SV-258184, SV-258177, SV-258201, SV-258190, SV-258180, SV-258211, SV-258225, SV-258191, SV-258200, SV-258210, SV-258181, SV-258224, SV-258204, SV-258195, SV-258220, SV-258185, SV-258214, SV-258176, SV-258203, SV-258192, SV-258182, SV-258213, SV-258196, SV-258207, SV-258223, SV-258217, SV-258186, SV-258206, SV-258197, SV-258222, SV-258187, SV-258216, SV-258193, SV-258202, SV-258212, SV-258183, SV-258226, SV-258198, SV-258209, SV-258219, SV-258188, SV-258208, SV-258199, SV-258189, SV-258218
  - name: audit_rule_keynames_overrides
    description: The audit rules to be applied to the system
    type: Hash
    value: {
      '/etc/sudoers.d'                : 'privilege_modification',
      '/etc/sudoers'                  : 'privilege_modification',
      '/var/log/journal'              : 'systemd_journal',
      'chown'                         : 'perm_chng',
      'fchown'                        : 'perm_chng',
      'fchownat'                      : 'perm_chng',
      'lchown'                        : 'perm_chng',
      '/usr/bin/chacl'                : 'perm_chng',
      '/usr/bin/chcon'                : 'perm_chng',
      '/usr/bin/setfacl'              : 'perm_chng',
    }

  # SV-257932
  - name: device_file_locations
    description: Directories where device files live
    type: Array
    value: 
      - /dev

  # SV-257932
  - name: exempt_device_files
    description: Full filepaths of files that are exempt from device file checks if the target host is a virtual machine
    type: Array
    value:
      - /dev/vmci

  # SV-257938
  - name: approved_ppsm_clsa
    description: Defines allowed ports, protocols, and services as defined in the approved site or program Ports, Protocols, and Services Management Component Local Service Assessment (PPSM CLSA)
    type: Hash
    value:
      ports: []
      protocols: []
      services:
        - ssh

  # SV-257991, SV-257990, SV-257989
  - name: approved_openssh_server_conf
    description: Config values expected for openssh server (order matters, so these values are comma-delimited strings and not arrays)
    type: Hash
    value: 
      ciphers: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
      macs: hmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha2-512-etm@openssh.com,hmac-sha2-512

  # SV-258100, SV-258099
  - name: password_hash_rounds
    description: Number of rounds for hashing passwords
    type: Numeric
    value: 5000

  # SV-258227
  - name: expected_panic_value
    description: Expected value for the audit.rules '-f' flag
    type: Numeric
    value: 2

  # SV-258227
  - name: high_availability_required
    description: Set to true if there is a documented requirement for the target system to have high availability (and therefore cannot panic on audit failure)
    type: Boolean
    value: false

  # SV-258232
  - name: approved_crypto_backend
    description: FIPS 140-2/140-3 approved cryptographic module conf file
    type: String
    value: /etc/crypto-policies/back-ends/libreswan.config

  # SV-258173
  - name: expected_audit_backlog_limit
    description: Expected value for the audit backlog limit
    type: Numeric
    value: 8192

  # SV-257968, SV-257969
  - name: send_redirects
    description: Set to true if there is a requirement for this system to be able to send redirects that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257970, SV-257974
  - name: forwarding
    description: Set to true if there is a requirement for this system to be able forward packets that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257792
  - name: vsyscall_required
    description: Set to true if there is a requirement for this system to allow virtual system calls that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257803
  - name: storing_core_dumps_required
    description: Set to true if there is a requirement for this system to store core dumps that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257812
  - name: core_dumps_required
    description: Set to true if there is a requirement for this system to enable core dumps that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257804
  - name: atm_required
    description: Set to true if there is a requirement for this system to enable the Asynchronous Transfer Mode kernel module that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257805
  - name: can_required
    description: Set to true if there is a requirement for this system to enable the Controller Area Network kernel module that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257806
  - name: firewire_required
    description: Set to true if there is a requirement for this system to enable the FireWire kernel module that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257807
  - name: sctp_required
    description: Set to true if there is a requirement for this system to enable the Stream Control Transmission Protocol (SCTP) kernel module that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257808
  - name: tipc_required
    description: Set to true if there is a requirement for this system to enable the Transparent Inter Process Communication (TIPC) kernel module that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257880
  - name: cramfs_required
    description: Set to true if there is a requirement for this system to enable the Compressed ROM/RAM file system (cramfs) that is documented with the ISSO
    type: Boolean
    value: false

  # SV-258039
  - name: bluetooth_required
    description: Set to true if there is a requirement for this system to enable Bluetooth that is documented with the ISSO
    type: Boolean
    value: false

  # SV-257971, SV-257975
  - name: accept_ra_required
    description: Set to true if there is a requirement for this system to accept router advertisements that is documented with the ISSO
    type: Boolean
    value: false

  # SV-258007
  - name: x11_forwarding_required
    description: Set to true if there is a requirement for this system to enable X11 forwarding that is documented with the ISSO
    type: Boolean
    value: false

  # SV-258014
  - name: gui_automount_required
    description: Set to true if there is a requirement for this system to enable graphical user interface automount function that is documented with the ISSO
    type: Boolean
    value: false

  # SV-258014
  - name: gui_autorun_required
    description: Set to true if there is a requirement for this system to enable graphical user interface autorun function that is documented with the ISSO
    type: Boolean
    value: false
  
  # SV-260520
  - name: chrony_config_file
    description: File to sync internal information system clocks
    type: String
    value: "/etc/chrony/chrony.conf"
  
  #SV-260526
  - name: disable_fips
    description: Boolean to disable/enable FIPS testing
    type: Boolean
    value: false

  #SV-260559
  - name: sudo_accounts
    description: Array of users who need access to security functions are part of the sudo group.
    type: Array
    value: [ "ubuntu" ]

  #SV-260575
  - name: pki_disabled
    description: Is PKI authentication used for this system
    type: boolean
    value: false

  #SV-260580
  - name: allowed_ca_fingerprints_regex
    description: Certificate fingerprint regex for DoD PKI-established certificate authorities
    type: string
    value: (9676F287356C89A12683D65234098CB77C4F1C18F23C0E541DE0E196725B7EBE|B107B33F453E5510F68E513110C6F6944BACC263DF0137F821C1B3C2F8F863D2|559A5189452B13F8233F0022363C06F26E3C517C1D4B77445035959DF3244F74|1F4EDE9DC2A241F6521BF518424ACD49EBE84420E69DAF5BAC57AF1F8EE294A9)

  #SV-260587
  - name: auditoffload_config_file
    description: Location of audit offload config file
    type: String
    value: '/etc/cron.weekly/audit-offload'
  
  #SV-260599, SV-260603 
  - name: admin_groups
    description: Array of groups that have administrative privileges
    type: Array
    value: ['root']