-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathRHEL-8-DISA-STIG.toml
122 lines (91 loc) · 2.07 KB
/
RHEL-8-DISA-STIG.toml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# https://osbuild.org/docs/user-guide/blueprint-reference
version = '1.0.0'
name = 'RHEL-8-DISA-STIG'
# https://public.cyber.mil/stigs
description = '''
Red Hat Enterprise Linux (RHEL) 8
Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG)
Profile ID: xccdf_org.ssgproject.content_profile_stig
Benchmark ID: xccdf_org.ssgproject.content_benchmark_RHEL-8
'''
distro = 'rhel-8'
[customizations]
partitioning_mode = 'auto-lvm'
fips = true
[customizations.kernel]
append = 'slub_debug=P page_poison=1 vsyscall=none pti=on audit_backlog_limit=8192 audit=1'
[customizations.openscap]
profile_id = 'xccdf_org.ssgproject.content_profile_stig'
[customizations.services]
enabled = ['usbguard', 'sshd', 'rngd', 'fapolicyd', 'firewalld', 'rsyslog', 'auditd']
disabled = ['kdump', 'autofs', 'debug-shell']
masked = []
[[customizations.filesystem]]
mountpoint = '/'
size = 3221225472
[[customizations.filesystem]]
mountpoint = '/boot'
size = 805306368
[[customizations.filesystem]]
mountpoint = '/home'
size = 1073741824
[[customizations.filesystem]]
mountpoint = '/tmp'
size = 1073741824
[[customizations.filesystem]]
mountpoint = '/var'
size = 2147483648
[[customizations.filesystem]]
mountpoint = '/var/log'
size = 1073741824
[[customizations.filesystem]]
mountpoint = '/var/log/audit'
size = 536870912
[[customizations.filesystem]]
mountpoint = '/var/tmp'
size = 536870912
[[packages]]
name = 'aide'
version = '*'
[[packages]]
name = 'audit'
version = '*'
[[packages]]
name = 'fapolicyd'
version = '*'
[[packages]]
name = 'firewalld'
version = '*'
[[packages]]
name = 'mailx'
version = '*'
[[packages]]
name = 'opensc'
version = '*'
[[packages]]
name = 'openssl-pkcs11'
version = '*'
[[packages]]
name = 'openssh-server'
version = '*'
[[packages]]
name = 'policycoreutils'
version = '*'
[[packages]]
name = 'postfix'
version = '*'
[[packages]]
name = 'rng-tools'
version = '*'
[[packages]]
name = 'rsyslog'
version = '*'
[[packages]]
name = 'rsyslog-gnutls'
version = '*'
[[packages]]
name = 'tmux'
version = '*'
[[packages]]
name = 'usbguard'
version = '*'