Skip to content

Commit dfce952

Browse files
author
Bryan Schneiders
committed
Add debian10 content
1 parent ff3c3fe commit dfce952

File tree

56 files changed

+532
-37
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+532
-37
lines changed

‎CMakeLists.txt

+5
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ option(SSG_PRODUCT_DEFAULT "If enabled, all default release products will be bui
6363
option(SSG_PRODUCT_CHROMIUM "If enabled, the Chromium SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
6464
option(SSG_PRODUCT_DEBIAN8 "If enabled, the Debian 8 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
6565
option(SSG_PRODUCT_DEBIAN9 "If enabled, the Debian 9 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
66+
option(SSG_PRODUCT_DEBIAN10 "If enabled, the Debian 10 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
6667
option(SSG_PRODUCT_EAP6 "If enabled, the JBoss EAP6 SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
6768
option(SSG_PRODUCT_EXAMPLE "If enabled, the Example SCAP content will be built" FALSE)
6869
option(SSG_PRODUCT_FEDORA "If enabled, the Fedora SCAP content will be built" ${SSG_PRODUCT_DEFAULT})
@@ -230,6 +231,7 @@ message(STATUS "Products:")
230231
message(STATUS "Chromium: ${SSG_PRODUCT_CHROMIUM}")
231232
message(STATUS "Debian 8: ${SSG_PRODUCT_DEBIAN8}")
232233
message(STATUS "Debian 9: ${SSG_PRODUCT_DEBIAN9}")
234+
message(STATUS "Debian 10: ${SSG_PRODUCT_DEBIAN10}")
233235
message(STATUS "JBoss EAP 6: ${SSG_PRODUCT_EAP6}")
234236
message(STATUS "Example: ${SSG_PRODUCT_EXAMPLE}")
235237
message(STATUS "Fedora: ${SSG_PRODUCT_FEDORA}")
@@ -294,6 +296,9 @@ endif()
294296
if (SSG_PRODUCT_DEBIAN9)
295297
add_subdirectory("debian9")
296298
endif()
299+
if (SSG_PRODUCT_DEBIAN10)
300+
add_subdirectory("debian10")
301+
endif()
297302
if (SSG_PRODUCT_EAP6)
298303
add_subdirectory("eap6")
299304
endif()

‎build_product

+1
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,7 @@ all_cmake_products=(
265265
CHROMIUM
266266
DEBIAN8
267267
DEBIAN9
268+
DEBIAN10
268269
EAP6
269270
EXAMPLE
270271
FEDORA

‎debian10/CMakeLists.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# Sometimes our users will try to do: "cd debian10; cmake ." That needs to error in a nice way.
2+
if ("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
3+
message(FATAL_ERROR "cmake has to be used on the root CMakeLists.txt, see the developer_guide.adoc for more details!")
4+
endif()
5+
6+
ssg_build_product("debian10")

‎debian10/cpe/debian10-cpe-dictionary.xml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<cpe-list xmlns="http://cpe.mitre.org/dictionary/2.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
5+
<cpe-item name="cpe:/o:debian:debian_linux:10">
6+
<title xml:lang="en-us">Debian Linux 10</title>
7+
<!-- the check references an OVAL file that contains an inventory definition -->
8+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_OS_is_debian10</check>
9+
</cpe-item>
10+
<cpe-item name="cpe:/a:container">
11+
<title xml:lang="en-us">Container</title>
12+
<!-- the check references an OVAL file that contains an inventory definition -->
13+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_is_a_container</check>
14+
</cpe-item>
15+
<cpe-item name="cpe:/a:machine">
16+
<title xml:lang="en-us">Bare-metal or Virtual Machine</title>
17+
<!-- the check references an OVAL file that contains an inventory definition -->
18+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_is_a_machine</check>
19+
</cpe-item>
20+
<cpe-item name="cpe:/a:gdm">
21+
<title xml:lang="en-us">Package gdm is installed</title>
22+
<!-- the check references an OVAL file that contains an inventory definition -->
23+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_gdm_package</check>
24+
</cpe-item>
25+
<cpe-item name="cpe:/a:libuser">
26+
<title xml:lang="en-us">Package libuser is installed</title>
27+
<!-- the check references an OVAL file that contains an inventory definition -->
28+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_libuser_package</check>
29+
</cpe-item>
30+
<cpe-item name="cpe:/a:nss-pam-ldapd">
31+
<title xml:lang="en-us">Package nss-pam-ldapd is installed</title>
32+
<!-- the check references an OVAL file that contains an inventory definition -->
33+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_nss-pam-ldapd_package</check>
34+
</cpe-item>
35+
<cpe-item name="cpe:/a:pam">
36+
<title xml:lang="en-us">Package pam is installed</title>
37+
<!-- the check references an OVAL file that contains an inventory definition -->
38+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_pam_package</check>
39+
</cpe-item>
40+
<cpe-item name="cpe:/a:shadow-utils">
41+
<title xml:lang="en-us">Package shadow-utils is installed</title>
42+
<!-- the check references an OVAL file that contains an inventory definition -->
43+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_shadow-utils_package</check>
44+
</cpe-item>
45+
<cpe-item name="cpe:/a:sssd">
46+
<title xml:lang="en-us">Package sssd-common is installed</title>
47+
<!-- the check references an OVAL file that contains an inventory definition -->
48+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_sssd-common_package</check>
49+
</cpe-item>
50+
<cpe-item name="cpe:/a:systemd">
51+
<title xml:lang="en-us">Package systemd is installed</title>
52+
<!-- the check references an OVAL file that contains an inventory definition -->
53+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_systemd_package</check>
54+
</cpe-item>
55+
<cpe-item name="cpe:/a:yum">
56+
<title xml:lang="en-us">Package yum is installed</title>
57+
<!-- the check references an OVAL file that contains an inventory definition -->
58+
<check system="http://oval.mitre.org/XMLSchema/oval-definitions-5" href="filename">installed_env_has_yum_package</check>
59+
</cpe-item>
60+
</cpe-list>

‎debian10/overlays/.gitkeep

Whitespace-only changes.

‎debian10/product.yml

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
product: debian10
2+
full_name: Debian 10
3+
type: platform
4+
5+
benchmark_root: "../linux_os/guide"
6+
7+
profiles_root: "./profiles"
8+
9+
pkg_manager: "apt_get"
10+
11+
init_system: "systemd"

‎debian10/profiles/anssi_np_nt28_average.profile

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
documentation_complete: true
2+
3+
title: 'Profile for ANSSI DAT-NT28 Average (Intermediate) Level'
4+
5+
description: 'This profile contains items for GNU/Linux installations already protected by multiple higher level security
6+
stacks.'
7+
8+
extends: anssi_np_nt28_minimal
9+
10+
selections:
11+
- partition_for_tmp
12+
- partition_for_var
13+
- partition_for_var_log
14+
- partition_for_var_log_audit
15+
- partition_for_home
16+
- package_ntp_installed
17+
- package_ntpdate_removed
18+
- sshd_idle_timeout_value=5_minutes
19+
- sshd_set_idle_timeout
20+
- sshd_disable_root_login
21+
- sshd_disable_empty_passwords
22+
- sshd_allow_only_protocol2
23+
- sshd_set_keepalive
24+
- file_owner_logfiles_value=adm
25+
- rsyslog_files_ownership
26+
- file_groupowner_logfiles_value=adm
27+
- rsyslog_files_groupownership
28+
- rsyslog_files_permissions
29+
- "!rsyslog_remote_loghost"
30+
- ensure_logrotate_activated
31+
- file_permissions_systemmap
32+
- sysctl_fs_protected_symlinks
33+
- sysctl_fs_protected_hardlinks
34+
- sysctl_fs_suid_dumpable
35+
- sysctl_kernel_randomize_va_space

‎debian10/profiles/anssi_np_nt28_high.profile

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
documentation_complete: true
2+
3+
title: 'Profile for ANSSI DAT-NT28 High (Enforced) Level'
4+
5+
description: 'This profile contains items for GNU/Linux installations storing sensitive informations that can be accessible
6+
from unauthenticated or uncontroled networks.'
7+
8+
extends: anssi_np_nt28_restrictive
9+
10+
selections:
11+
- grub2_enable_iommu_force

‎debian10/profiles/anssi_np_nt28_minimal.profile

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
documentation_complete: true
2+
3+
title: 'Profile for ANSSI DAT-NT28 Minimal Level'
4+
5+
description: 'This profile contains items to be applied systematically.'
6+
7+
selections:
8+
- sudo_remove_nopasswd
9+
- sudo_remove_no_authenticate
10+
- package_telnetd_removed
11+
- package_inetutils-telnetd_removed
12+
- package_telnetd-ssl_removed
13+
- package_nis_removed
14+
- package_rsyslog_installed
15+
- service_rsyslog_enabled
16+
- package_syslogng_installed
17+
- service_syslogng_enabled
18+
- apt_conf_disallow_unauthenticated
19+
- apt_sources_list_official
20+
- file_permissions_etc_shadow
21+
- file_owner_etc_shadow
22+
- file_groupowner_etc_shadow
23+
- file_permissions_etc_gshadow
24+
- file_owner_etc_gshadow
25+
- file_groupowner_etc_gshadow
26+
- file_permissions_etc_passwd
27+
- file_owner_etc_passwd
28+
- file_groupowner_etc_passwd
29+
- file_permissions_etc_group
30+
- file_owner_etc_group
31+
- file_groupowner_etc_group

‎debian10/profiles/anssi_np_nt28_restrictive.profile

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
documentation_complete: true
2+
3+
title: 'Profile for ANSSI DAT-NT28 Restrictive Level'
4+
5+
description: 'This profile contains items for GNU/Linux installations exposed to unauthenticated flows or multiple sources.'
6+
7+
extends: anssi_np_nt28_average
8+
9+
selections:
10+
- partition_for_tmp
11+
- partition_for_var
12+
- partition_for_var_log
13+
- partition_for_var_log_audit
14+
- partition_for_home
15+
- package_audit_installed
16+
- package_cron_installed
17+
- service_auditd_enabled
18+
- service_ntp_enabled

‎debian10/profiles/standard.profile

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
documentation_complete: true
2+
3+
title: 'Standard System Security Profile for Debian 10'
4+
5+
description: |-
6+
This profile contains rules to ensure standard security baseline
7+
of a Debian 10 system. Regardless of your system's workload
8+
all of these checks should pass.
9+
10+
selections:
11+
- partition_for_tmp
12+
- partition_for_var
13+
- partition_for_var_log
14+
- partition_for_var_log_audit
15+
- partition_for_home
16+
- package_audit_installed
17+
- package_cron_installed
18+
- package_ntp_installed
19+
- package_rsyslog_installed
20+
- package_telnetd_removed
21+
- package_inetutils-telnetd_removed
22+
- package_telnetd-ssl_removed
23+
- package_nis_removed
24+
- package_ntpdate_removed
25+
- service_auditd_enabled
26+
- service_cron_enabled
27+
- service_ntp_enabled
28+
- service_rsyslog_enabled
29+
- sshd_idle_timeout_value=5_minutes
30+
- sshd_set_idle_timeout
31+
- sshd_disable_root_login
32+
- sshd_disable_empty_passwords
33+
- sshd_allow_only_protocol2
34+
- sshd_set_keepalive
35+
- file_owner_logfiles_value=adm
36+
- rsyslog_files_ownership
37+
- file_groupowner_logfiles_value=adm
38+
- rsyslog_files_groupownership
39+
- rsyslog_files_permissions
40+
- "!rsyslog_remote_loghost"
41+
- ensure_logrotate_activated
42+
- file_permissions_systemmap
43+
- file_permissions_etc_shadow
44+
- file_owner_etc_shadow
45+
- file_groupowner_etc_shadow
46+
- file_permissions_etc_gshadow
47+
- file_owner_etc_gshadow
48+
- file_groupowner_etc_gshadow
49+
- file_permissions_etc_passwd
50+
- file_owner_etc_passwd
51+
- file_groupowner_etc_passwd
52+
- file_permissions_etc_group
53+
- file_owner_etc_group
54+
- file_groupowner_etc_group
55+
- sysctl_fs_protected_symlinks
56+
- sysctl_fs_protected_hardlinks
57+
- sysctl_fs_suid_dumpable
58+
- sysctl_kernel_randomize_va_space

‎debian10/transforms/constants.xslt

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
2+
3+
<xsl:include href="../../shared/transforms/shared_constants.xslt"/>
4+
5+
<xsl:variable name="product_long_name">Debian 10</xsl:variable>
6+
<xsl:variable name="product_short_name">Debian 10</xsl:variable>
7+
<xsl:variable name="product_stig_id_name">DEBIAN_10_STIG</xsl:variable>
8+
<xsl:variable name="product_guide_id_name">DEBIAN-10</xsl:variable>
9+
<xsl:variable name="prod_type">debian10</xsl:variable>
10+
11+
<!-- Define URI of official Center for Internet Security Benchmark for Debian Linux v1.0 -->
12+
<xsl:variable name="cisuri">https://benchmarks.cisecurity.org/tools2/linux/CIS_Debian_Benchmark_v1.0.pdf</xsl:variable>
13+
<xsl:variable name="disa-stigs-uri" select="$disa-stigs-os-unix-linux-uri"/>
14+
<xsl:variable name="os-stigid-concat" />
15+
16+
<!-- Define URI for custom CCE identifier which can be used for mapping to corporate policy -->
17+
<!--xsl:variable name="custom-cce-uri">https://www.example.org</xsl:variable-->
18+
19+
<!-- Define URI for custom policy reference which can be used for linking to corporate policy -->
20+
<!--xsl:variable name="custom-ref-uri">https://www.example.org</xsl:variable-->
21+
22+
</xsl:stylesheet>

‎debian10/transforms/shorthand2xccdf.xslt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
2+
3+
<xsl:import href="../../shared/transforms/shared_shorthand2xccdf.xslt"/>
4+
5+
<xsl:include href="constants.xslt"/>
6+
<xsl:param name="ssg_version">unknown</xsl:param>
7+
<xsl:variable name="ovalfile">unlinked-debian10-oval.xml</xsl:variable>
8+
9+
</xsl:stylesheet>

‎debian10/transforms/table-srgmap.xslt

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
2+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
3+
4+
<xsl:include href="../../shared/transforms/shared_table-srgmap.xslt"/>
5+
<xsl:include href="constants.xslt"/>
6+
<xsl:include href="table-style.xslt"/>
7+
8+
<xsl:variable name="items" select="document($map-to-items)//*[cdf:reference]" />
9+
<xsl:variable name="title" select="document($map-to-items)/cdf:Benchmark/cdf:title" />
10+
11+
</xsl:stylesheet>

‎debian10/transforms/table-style.xslt

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
2+
3+
<xsl:import href="../../shared/transforms/shared_table-style.xslt"/>
4+
5+
</xsl:stylesheet>

‎debian10/transforms/xccdf-apply-overlay-stig.xslt

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0"?>
2+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:xccdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml" exclude-result-prefixes="xccdf">
3+
4+
<xsl:include href="../../shared/transforms/shared_xccdf-apply-overlay-stig.xslt"/>
5+
<xsl:include href="constants.xslt"/>
6+
<xsl:variable name="overlays" select="document($overlay)/xccdf:overlays" />
7+
8+
</xsl:stylesheet>

‎debian10/transforms/xccdf2table-byref.xslt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
2+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
3+
4+
<xsl:import href="../../shared/transforms/shared_xccdf2table-byref.xslt"/>
5+
6+
<xsl:include href="constants.xslt"/>
7+
<xsl:include href="table-style.xslt"/>
8+
9+
</xsl:stylesheet>

‎debian10/transforms/xccdf2table-cce.xslt

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
2+
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:cce="http://cce.mitre.org" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:xhtml="http://www.w3.org/1999/xhtml">
3+
4+
<xsl:import href="../../shared/transforms/shared_xccdf2table-cce.xslt"/>
5+
6+
<xsl:include href="constants.xslt"/>
7+
<xsl:include href="table-style.xslt"/>
8+
9+
</xsl:stylesheet>

0 commit comments

Comments
 (0)