inspec.yml

name: disa_stig-el7
title: DISA RedHat Enterprise Linux 7 STIG - v1r4
maintainer: SIMP Team
copyright: SIMP Team
copyright_email: simp-dev@googlegroups.com
license: Apache-2.0
summary: 'The `disa_stig-el7` inspec profile helps scan your system aginst the DISA RHEL7 STIG'
version: 0.2.0

# The following defines the default inputs for the configurable controls used in the RHEL 7 DISA STIG.
inputs:
- name: disable_slow_controls
  description: Controls that are known to consistently have long run times can be disabled with this attribute
  # muted until https://github.com/inspec/inspec/issues/4799 is resolved
  #type: Boolean
  value: false

# V-72081
- name: monitor_kernel_log
  description: Set this to false if your system availability concern is not documented or there is no monitoring of the kernel log
  # muted until https://github.com/inspec/inspec/issues/4799 is resolved
  #type: Boolean
  value: true

# V-71849
- name: rpm_verify_perms_except
  description: List of system files that should be allowed to change from an rpm verify point of view
  type: Array
  value: []

# V-71855
- name: rpm_verify_integrity_except
  description: List of system files that should be allowed to change from an rpm verify point of view
  type: Array
  value: []

# V-71859
- name: banner_message_enabled
  description: Set to 'true' if the login banner message should be enabled
  type: String
  value: 'true'

# V-72211
- name: log_aggregation_server
  description: Set to 'true' if the system is being used as a log aggregation server
  # muted until https://github.com/inspec/inspec/issues/4799 is resolved
  #type: Boolean
  value: false

# V-72047
- name: application_groups
  description: Known application groups that are allowed to have world-writeable files or directories
  type: Array
  value: []

# V-72307
- name: x11_enabled
  description: Set to 'true' if X11 is needed on the system.
  # muted until https://github.com/inspec/inspec/issues/4799 is resolved
  #type: Boolean
  value: false

- name: disallowed_accounts
  description: Accounts that are not allowed on the system
  type: Array
  value: [
  'games',
  'gopher',
  'ftp'
  ]

- name: user_accounts
  description: Accounts of known managed users
  type: Array
  value: []

- name: known_system_accounts
  description: System accounts that support approved system activities.
  type: Array
  value: [
    'root',
    'bin',
    'daemon',
    'adm',
    'lp',
    'sync',
    'shutdown',
    'halt',
    'mail',
    'operator',
    'nobody',
    'systemd-bus-proxy'
    ]


# V-71859/V-77819
- name: dconf_user
  description: User to use to check dconf settings. Nil means to use whatever user is running inspec currently.
  type: String
  value: nil

#  You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only.
#  By using this IS (which includes any device attached to this IS), you consent to the following conditions:
#    - The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.
#    - At any time, the USG may inspect and seize data stored on this IS.
#    - Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.
#    - This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.
#    - Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.

# V-71861
- name: banner_message_text_gui
  description: Banner message text for graphical user interface logins.
  type: String
  value: "You are accessing a U.S. Government (USG) Information System (IS) that is \
  provided for USG-authorized use only. By using this IS (which includes any \
  device attached to this IS), you consent to the following conditions: -The USG \
  routinely intercepts and monitors communications on this IS for purposes \
  including, but not limited to, penetration testing, COMSEC monitoring, network \
  operations and defense, personnel misconduct (PM), law enforcement (LE), and \
  counterintelligence (CI) investigations. -At any time, the USG may inspect and \
  seize data stored on this IS. -Communications using, or data stored on, this \
  IS are not private, are subject to routine monitoring, interception, and \
  search, and may be disclosed or used for any USG-authorized purpose. -This IS \
  includes security measures (e.g., authentication and access controls) to \
  protect USG interests--not for your personal benefit or privacy. \
  -Notwithstanding the above, using this IS does not constitute consent to PM, \
  LE or CI investigative searching or monitoring of the content of privileged \
  communications, or work product, related to personal representation or \
  services by attorneys, psychotherapists, or clergy, and their assistants. Such \
  communications and work product are private and confidential. See User \
  Agreement for details."

- name: banner_message_text_gui_limited
  description: Banner message text for limited-resource graphical user interface logins.
  type: String
  value: "I've read & consent to terms in IS user agreem't."

# V-71863
- name: banner_message_text_cli
  description: Banner message text for command line interface logins.
  type: String
  value: "You are accessing a U.S. Government (USG) Information System (IS) that is \
  provided for USG-authorized use only. By using this IS (which includes any \
  device attached to this IS), you consent to the following conditions: -The USG \
  routinely intercepts and monitors communications on this IS for purposes \
  including, but not limited to, penetration testing, COMSEC monitoring, network \
  operations and defense, personnel misconduct (PM), law enforcement (LE), and \
  counterintelligence (CI) investigations. -At any time, the USG may inspect and \
  seize data stored on this IS. -Communications using, or data stored on, this \
  IS are not private, are subject to routine monitoring, interception, and \
  search, and may be disclosed or used for any USG-authorized purpose. -This IS \
  includes security measures (e.g., authentication and access controls) to \
  protect USG interests--not for your personal benefit or privacy. \
  -Notwithstanding the above, using this IS does not constitute consent to PM, \
  LE or CI investigative searching or monitoring of the content of privileged \
  communications, or work product, related to personal representation or \
  services by attorneys, psychotherapists, or clergy, and their assistants. Such \
  communications and work product are private and confidential. See User \
  Agreement for details."

- name: banner_message_text_cli_limited
  description: Banner message text for resource-limited command line interface logins.
  type: String
  value: "I've read & consent to terms in IS user agreem't."

# V-72225
- name: banner_message_text_ral
  description: Banner message text for remote access logins.
  type: String
  value: "You are accessing a U.S. Government (USG) Information System (IS) that is \
  provided for USG-authorized use only. By using this IS (which includes any \
  device attached to this IS), you consent to the following conditions: -The USG \
  routinely intercepts and monitors communications on this IS for purposes \
  including, but not limited to, penetration testing, COMSEC monitoring, network \
  operations and defense, personnel misconduct (PM), law enforcement (LE), and \
  counterintelligence (CI) investigations. -At any time, the USG may inspect and \
  seize data stored on this IS. -Communications using, or data stored on, this \
  IS are not private, are subject to routine monitoring, interception, and \
  search, and may be disclosed or used for any USG-authorized purpose. -This IS \
  includes security measures (e.g., authentication and access controls) to \
  protect USG interests--not for your personal benefit or privacy. \
  -Notwithstanding the above, using this IS does not constitute consent to PM, \
  LE or CI investigative searching or monitoring of the content of privileged \
  communications, or work product, related to personal representation or \
  services by attorneys, psychotherapists, or clergy, and their assistants. Such \
  communications and work product are private and confidential. See User \
  Agreement for details."

- name: banner_message_text_ral_limited
  description: Banner message text for resource-limited remote access logins.
  type: String
  value: "I've read & consent to terms in IS user agreem't."

# V-71901
- name: lock_delay
  description: The scereensaver lock-delay must be less than or equal to the specified value
  type: Numeric
  value: 5

# V-71911
- name: difok
  description: Minimum number of characters that must be different from previous password
  type: Numeric
  value: 8

# V-71933
- name: min_reuse_generations
  description: Number of reuse generations
  type: Numeric
  value: 5

# V-71935
- name: min_len
  description: Number of characters
  type: Numeric
  value: 15

# V-71941
- name: days_of_inactivity
  description: Number of days
  type: Numeric
  value: 0

# V-71943
- name: unsuccessful_attempts
  description: number of unsuccessful attempts
  type: Numeric
  value: 3

- name: fail_interval
  description: Interval of time in which the consecutive failed logon attempts must occur in order for the account to be locked out (time in seconds)
  type: Numeric
  value: 900

- name: lockout_time
  description: Minimum amount of time account must be locked out after failed logins. This attribute should never be set greater than 604800 (time in seconds).
  value: 604800

# V-71973
- name: file_integrity_tool
  description: Name of tool
  type: String
  value: 'aide'

- name: file_integrity_interval
  description: Interval to run the file integrity tool (monthly, weekly, or daily).
  type: String
  value: 'weekly'

# V-72223
- name: system_activity_timeout
  description: System activity timeout (time in seconds).
  type: Numeric
  value: 600

# V-72237
- name: client_alive_interval
  description: Client alive interval (time in seconds).
  type: Numeric
  value: 600

# V-71965, V-72417, V-72433
- name: smart_card_status
  description: Smart card status (enabled or disabled)
  type: String
  value: 'enabled'

# V-72051/V-72209
- name: log_pkg_path
  description: The path to the logging package
  type: String
  value: '/etc/rsyslog.conf'

# V-72011, V-72015, V-72017, V-72019, V-72021, V-72023, V-72025
# V-72027, V-72029, V-72031, V-72033, V-72035, V-72037, V-72059
- name: exempt_home_users
  description: Users exempt from home directory-based controls in array format
  type: Array
  value: []

# V-71961
- name: grub_main_cfg
  description: Main grub boot config file
  type: String
  value: '/boot/grub2/grub.cfg'

- name: grub_superuser
  description: superusers for grub boot
  type: String
  value: 'root'

- name: grub_user_boot_files
  description: Grub boot config files
  type: Array
  value: ['/boot/grub2/user.cfg']

# V-71963
- name: efi_superusers
  description: Superusers for efi boot
  type: Array
  value: ['root']

- name: efi_user_boot_files
  description: Efi boot config files
  type: Array
  value: ['/boot/efi/EFI/redhat/user.cfg']

- name: efi_main_cfg
  description: Main efi boot config file
  type: String
  value: '/boot/efi/EFI/redhat/grub.cfg'

# V-71971
- name: admin_logins
  description: System accounts that support approved system activities
  type: Array
  value: []

# V-73159
- name: max_rety
  description: Maximum number of times to prompt user for new password
  type: Numeric
  value: 3

# V-72417
- name: mfa_pkg_list
  description: The list of packages needed for MFA on RHEL
  type: Array
  value: [
    'nss-tools',
    'nss-pam-ldapd',
    'esc',
    'pam_pkcs11',
    'pam_krb5',
    'opensc',
    'pcsc-lite-ccid',
    'gdm',
    'authconfig',
    'authconfig-gtk',
    'krb5-libs',
    'krb5-workstation',
    'krb5-pkinit',
    'pcsc-lite',
    'pcsc-lite-libs'
    ]

# V-77819
- name: multifactor_enabled
  description: Should dconf have smart card authentication
  type: String
  value: 'true'

- name: non_interactive_shells
  description: These shells do not allow a user to login
  type: Array
  value: ["/sbin/nologin", "/sbin/halt", "/sbin/shutdown", "/bin/false", "/bin/sync", "/bin/true"]

# V-72059
- name: randomize_va_space
  description: Randomize virtual address space kernel parameter
  type: Numeric
  value: 2

# V-72043
- name: non_removable_media_fs
  description: File systems that don't correspond to removable media
  type: Array
  value: ['xfs', 'ext4', 'swap', 'tmpfs']

# V-72317
- name: approved_tunnels
  description: Approved configured tunnels prepended with word 'conn' (e.g., ['conn myTunnel'])
  type: Array
  value: []

# V-72039
- name: virtual_machine
  description: Is the target expected to be a virtual machine
  # muted until https://github.com/inspec/inspec/issues/4799 is resolved
  #type: Boolean
  value: false