RHEL-8-CIS-L2-WORKSTATION.toml

# https://osbuild.org/docs/user-guide/blueprint-reference

version = '1.0.0'

name = 'RHEL-8-CIS-L2-WORKSTATION'

# https://www.cisecurity.org/cis-benchmarks
# https://resources.cisecurity.org/benchmarks
description = '''
Red Hat Enterprise Linux (RHEL) 8
Center for Internet Security® (CIS) Level 2 Workstation
Profile ID:  xccdf_org.ssgproject.content_profile_cis_workstation_l2
Benchmark ID:  xccdf_org.ssgproject.content_benchmark_RHEL-8
'''

distro = 'rhel-8'

[customizations]
partitioning_mode = 'auto-lvm'

[customizations.kernel]
append = 'audit_backlog_limit=8192 audit=1'

[customizations.openscap]
profile_id = 'xccdf_org.ssgproject.content_profile_cis_workstation_l2'

[customizations.services]
enabled = ['crond', 'firewalld', 'systemd-journald', 'rsyslog', 'auditd']
disabled = ['nfs-server', 'rpcbind', 'autofs', 'bluetooth', 'nftables']
masked = []

[[customizations.filesystem]]
mountpoint = '/'
size = 3221225472

[[customizations.filesystem]]
mountpoint = '/boot'
size = 805306368

[[customizations.filesystem]]
mountpoint = '/home'
size = 1073741824

[[customizations.filesystem]]
mountpoint = '/tmp'
size = 1073741824

[[customizations.filesystem]]
mountpoint = '/var'
size = 2147483648

[[customizations.filesystem]]
mountpoint = '/var/log'
size = 1073741824

[[customizations.filesystem]]
mountpoint = '/var/log/audit'
size = 536870912

[[customizations.filesystem]]
mountpoint = '/var/tmp'
size = 536870912

[[packages]]
name = 'aide'
version = '*'

[[packages]]
name = 'audit'
version = '*'

[[packages]]
name = 'chrony'
version = '*'

[[packages]]
name = 'firewalld'
version = '*'

[[packages]]
name = 'libpwquality'
version = '*'

[[packages]]
name = 'libselinux'
version = '*'

[[packages]]
name = 'nftables'
version = '*'

[[packages]]
name = 'rsyslog'
version = '*'

[[packages]]
name = 'sudo'
version = '*'