Update Rhel10 stig v1r2 to v1r3

controls/srg_gpos/SRG-OS-000250-GPOS-00093.yml

@@ -1,16 +1,17 @@
 controls:
-    -   id: SRG-OS-000250-GPOS-00093
-        levels:
-            - high
-        title: {{{ full_name }}} must implement cryptography to protect the integrity
-            of remote access sessions.
-        rules:
-            - file_sshd_50_redhat_exists
-            - sshd_include_crypto_policy
-            - harden_sshd_ciphers_openssh_conf_crypto_policy
-            - harden_sshd_ciphers_opensshserver_conf_crypto_policy
-            - harden_sshd_macs_openssh_conf_crypto_policy
-            - harden_sshd_macs_opensshserver_conf_crypto_policy
-            - sshd_approved_ciphers=stig_rhel9
-            - sshd_approved_macs=stig_rhel9
-        status: automated
+    - id: SRG-OS-000250-GPOS-00093
+      levels:
+          - high
+      title: {{{ full_name }}} must implement cryptography to protect the integrity
+          of remote access sessions.
+      rules:
+          - configure_openssl_crypto_policy
+          - file_sshd_50_redhat_exists
+          - sshd_include_crypto_policy
+          - harden_sshd_ciphers_openssh_conf_crypto_policy
+          - harden_sshd_ciphers_opensshserver_conf_crypto_policy
+          - harden_sshd_macs_openssh_conf_crypto_policy
+          - harden_sshd_macs_opensshserver_conf_crypto_policy
+          - sshd_approved_ciphers=stig_rhel9
+          - sshd_approved_macs=stig_rhel9
+      status: automated

linux_os/guide/auditing/configure_auditd_data_retention/auditd_data_retention_admin_space_left_percentage/policy/stig/rhel10.yml

@@ -18,7 +18,7 @@ checktext: |-
 
     If the value of the "admin_space_left" keyword is not set to 5 percent of the storage volume allocated to audit logs, or if the line is commented out, ask the system administrator to indicate how the system is taking action if the allocated storage is about to reach capacity.
 
-    If the "space_left" value is not configured to the correct value, this is a finding.
+    If the "admin_space_left" value is not configured to the correct value, this is a finding.
 
 vuldiscussion: |-
     If action is not taken when storage volume reaches 95 percent utilization, the auditing system may fail when the storage volume reaches capacity.

linux_os/guide/services/ftp/disabling_vsftpd/package_vsftpd_removed/policy/stig/rhel10.yml

@@ -2,17 +2,17 @@ srg_requirement: |-
     {{{ full_name }}} must not have a File Transfer Protocol (FTP) server package installed.
 
 fixtext: |-
-    Configure {{{ full_name }}} to not have the FTP package installed with the following command (using "vsftpd" as an example):
+    Configure {{{ full_name }}} to not have the FTP package installed with the following command:
 
     $ sudo dnf -y remove vsftpd
 
 checktext: |-
     Verify {{{ full_name }}} does not have an FTP server package installed with the following command:
 
-    $ sudo dnf list --installed vsftp
+    $ sudo dnf list --installed vsftpd
     Error: No matching Packages to list
 
-    If the "vsftp" package is installed, this is a finding.
+    If the "vsftpd" package is installed, this is a finding.
 
 vuldiscussion: |-
     The FTP service provides an unencrypted remote access that does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to log in using this service, the privileged user password could be compromised. Secure Shell (SSH) or other encrypted file transfer methods must be used in place of this service.

linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_logindefs/policy/stig/rhel10.yml

@@ -6,6 +6,8 @@ vuldiscussion: |-
 
     This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the "crypt_style" configuration option ensures the use of a strong hashing algorithm that makes password cracking attacks more difficult.
 
+    The default for Red Hat 10 is yescrypt. Although yescrypt is structurally built using an outer layer of SHA-256 (which is a NIST-approved algorithm), the yescrypt algorithm as a whole is not recognized or validated by the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP).
+
 checktext: |-
     Verify {{{ full_name }}} is configured so that the shadow file stores only encrypted representations of passwords with a hash value of SHA512 with the following command:
 

linux_os/guide/system/accounts/accounts-session/accounts_tmout/policy/stig/rhel10.yml

@@ -1,5 +1,5 @@
 srg_requirement: |-
-    {{{ full_name }}} must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
+    {{{ full_name }}} must automatically exit interactive command shell user sessions after 10 minutes of inactivity.
 
 fixtext: |-
     Configure {{{ full_name }}} to exit interactive command shell user sessions after 10 minutes of inactivity.

linux_os/guide/system/logging/package_rsyslog_installed/policy/stig/rhel10.yml

@@ -1,11 +1,11 @@
 checktext: |-
-    Verify {{{ full_name }}} has the "rsyslogd" package installed with the following command:
+    Verify {{{ full_name }}} has the "rsyslog" package installed with the following command:
 
     $ sudo dnf list --installed rsyslog
     Installed Packages
     rsyslog.x86_64                                        8.2412.0-1.el10                                         @AppStream
 
-    If the "rsyslogd" package is not installed, this is a finding.
+    If the "rsyslog" package is not installed, this is a finding.
 
 srg_requirement: |-
     {{{ full_name }}} must have the "rsyslog" package installed.
@@ -16,9 +16,9 @@ vuldiscussion: |-
 
 
 fixtext: |-
-    Configure {{{ full_name }}} to have the "rsyslogd" package installed with the following command:
+    Configure {{{ full_name }}} to have the "rsyslog" package installed with the following command:
 
-    $ sudo dnf -y install rsyslogd
+    $ sudo dnf -y install rsyslog
 
 
 

linux_os/guide/system/permissions/mounting/service_autofs_disabled/policy/stig/rhel10.yml

@@ -1,5 +1,5 @@
 srg_requirement: |-
-    {{{ full_name }}} must disable file system automount function unless required.
+    {{{ full_name }}} must disable file system automount function.
 
 fixtext: |-
     Configure {{{ full_name }}} to disable the ability to automount devices.
@@ -14,11 +14,13 @@ checktext: |-
     Verify {{{ full_name }}} is configured so that the file system automount function has been disabled with the following command:
 
     $ systemctl is-enabled  autofs
-    masked
+    not-found
 
-    If the returned value is not "masked", "disabled", or "not-found" and is not documented as an operational requirement with the information system security officer, this is a finding.
+    If the returned value is not "masked", "disabled", or "not-found", this is a finding.
 
 vuldiscussion: |-
-    An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message.
+    Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity.
+
+    Peripherals include, but are not limited to, such devices as flash drives, external storage, and printers.
 
 

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/ansible/shared.yml

@@ -11,11 +11,16 @@
   {{%- set openssl_cnf_dir="/etc/pki/tls" %}}
 {{% endif %}}
 
-{{% if product in ["fedora", "ol9", "rhel9"] %}}
+{{% if "rhel" in families or product in ["fedora", "ol9"] %}}
     {{% set ansible_openssl_include_directive = ".include = /etc/crypto-policies/back-ends/opensslcnf.config" %}}
 {{% else %}}
     {{% set ansible_openssl_include_directive = ".include /etc/crypto-policies/back-ends/opensslcnf.config" %}}
 {{% endif %}}
+{{% if "rhel" in families %}}
+    {{% set ansible_openssl_include_directive_regex = '^\s*\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$' %}}
+{{% else %}}
+    {{% set ansible_openssl_include_directive_regex = '^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$' %}}
+{{% endif %}}
 {{% set full_config_section = "[crypto_policy]\n" + ansible_openssl_include_directive %}}
 
 
@@ -30,7 +35,7 @@
   ansible.builtin.find:
     paths: "{{{ openssl_cnf_dir }}}"
     patterns: "{{{ openssl_cnf_file }}}"
-    contains: '^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'
+    contains: '{{{ ansible_openssl_include_directive_regex }}}'
   register: test_crypto_policy_include_directive
 
 - name: "{{{ rule_title }}} - Add .include Line for opensslcnf.config File in crypto_policy Section"

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/bash/shared.sh

@@ -2,12 +2,16 @@
 
 OPENSSL_CRYPTO_POLICY_SECTION='[ crypto_policy ]'
 OPENSSL_CRYPTO_POLICY_SECTION_REGEX='\[\s*crypto_policy\s*\]'
-{{% if product in ["fedora", "ol9", "rhel9"] %}}
+{{% if "rhel" in families or product in ["fedora", "ol9"] %}}
 OPENSSL_CRYPTO_POLICY_INCLUSION='.include = /etc/crypto-policies/back-ends/opensslcnf.config'
 {{% else %}}
 OPENSSL_CRYPTO_POLICY_INCLUSION='.include /etc/crypto-policies/back-ends/opensslcnf.config'
 {{%endif %}}
+{{% if "rhel" in families %}}
+OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$'
+{{% else %}}
 OPENSSL_CRYPTO_POLICY_INCLUSION_REGEX='^\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config$'
+{{% endif %}}
 
 
 {{% if 'sle' in product %}}

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/oval/shared.xml

@@ -3,6 +3,11 @@
 {{%- else %}}
   {{%- set openssl_cnf_path="/etc/pki/tls/openssl.cnf" %}}
 {{%- endif %}}
+{{% if "rhel" in families %}}
+  {{% set openssl_include_pattern="\\s*\\.include\\s*=\\s*/etc/crypto-policies/back-ends/opensslcnf.config\\s*$" %}}
+{{% else %}}
+  {{% set openssl_include_pattern="\\s*\\.include\\s*(?:=\\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\\s*$" %}}
+{{% endif %}}
 <def-group>
   <definition class="compliance" id="configure_openssl_crypto_policy" version="1">
     {{{ oval_metadata("OpenSSL should be configured to use the system-wide crypto policy setting.", rule_title=rule_title) }}}
@@ -21,7 +26,7 @@
   <ind:textfilecontent54_object id="object_configure_openssl_crypto_policy"
   version="1">
     <ind:filepath>{{{ openssl_cnf_path }}}</ind:filepath>
-    <ind:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*\s*\.include\s*(?:=\s*)?/etc/crypto-policies/back-ends/opensslcnf.config\s*$</ind:pattern>
+    <ind:pattern operation="pattern match">^\s*\[\s*crypto_policy\s*\]\s*\n*{{{ openssl_include_pattern }}}</ind:pattern>
     <ind:instance datatype="int" operation="greater than or equal">1</ind:instance>
   </ind:textfilecontent54_object>
 </def-group>

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/policy/stig/rhel10.yml

@@ -0,0 +1,27 @@
+srg_requirement: |-
+    {{{ full_name }}} must implement DOD-approved encryption in the OpenSSL package.
+
+vuldiscussion: |-
+    Without cryptographic integrity protections, information can be altered by unauthorized users without detection.
+
+    Remote access (e.g., RDP) is access to DOD nonpublic information systems by an authorized user (or an information system) communicating through an external, nonorganization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.
+
+    Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.
+
+    The employed algorithms can be viewed in the /etc/crypto-policies/back-ends/openssl.config file.
+
+checktext: |-
+    Verify that {{{ full_name }}} OpenSSL library is configured to use only ciphers employing FIPS 140-3-approved algorithms with the following command:
+
+    $ sudo grep -i opensslcnf.config /etc/pki/tls/openssl.cnf
+
+    .include = /etc/crypto-policies/back-ends/opensslcnf.config
+
+    If the "opensslcnf.config" is not defined in the "/etc/pki/tls/openssl.cnf" file, this is a finding.
+
+fixtext: |-
+    Configure the {{{ full_name }}} OpenSSL library to use the systemwide cryptographic policy.
+
+    Edit the "/etc/pki/tls/openssl.cnf" and add or modify the following line:
+
+    .include = /etc/crypto-policies/back-ends/opensslcnf.config

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/rule.yml

@@ -9,7 +9,7 @@ title: 'Configure OpenSSL library to use System Crypto Policy'
   {{%- set openssl_cnf_path="/etc/pki/tls/openssl.cnf" %}}
 {{%- endif %}}
 
-{{% if product in ["fedora", "ol9", "rhel9"] %}}
+{{% if "rhel" in families or product in ["fedora", "ol9"] %}}
     {{% set include_directive = ".include = /etc/crypto-policies/back-ends/opensslcnf.config" %}}
 {{% else %}}
     {{% set include_directive = ".include /etc/crypto-policies/back-ends/opensslcnf.config" %}}
@@ -54,7 +54,11 @@ ocil: |-
     <pre>{{{ openssl_cnf_path }}}</pre> contains the <pre>[ crypto_policy ]</pre> section with the
     <pre>{{{ include_directive }}}</pre> directive:
 
+    {{% if "rhel" in families %}}
+    <pre>$ sudo grep '\.include\s*=\s*/etc/crypto-policies/back-ends/opensslcnf.config$' {{{ openssl_cnf_path }}}</pre>.
+    {{% else %}}
     <pre>$ sudo grep '\.include\s* /etc/crypto-policies/back-ends/opensslcnf.config$' {{{ openssl_cnf_path }}}</pre>.
+    {{% endif %}}
 
 fixtext: |-
     Configure OpenSSL to use the system cryptography policy.

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/include_with_equal_sign.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9
+# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,Red Hat Enterprise Linux 10
 
 . common.sh
 

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/include_without_equal_sign.fail.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 10
+
+. common.sh
+
+create_config_file_with "[ crypto_policy ]
+
+.include /etc/crypto-policies/back-ends/opensslcnf.config
+"

linux_os/guide/system/software/integrity/crypto/configure_openssl_crypto_policy/tests/ok.pass.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,Red Hat Enterprise Linux 8,Red Hat Enterprise Linux 9,multi_platform_sle
+# platform = multi_platform_fedora,Oracle Linux 8,Oracle Linux 9,multi_platform_sle
 
 . common.sh
 

linux_os/guide/system/software/integrity/crypto/crypto_policy_not_overridden/policy/stig/rhel10.yml

@@ -46,8 +46,6 @@ checktext: |-
 
     If the paths do not point to the respective files under "/usr/share/crypto-policies/FIPS" path, this is a finding.
 
-    Note: nss.config should not be symlinked.
-
     Note: If there is an operational need to use a subpolicy that causes the links to the crypto backends to break, this is a finding, and exceptions must be made by the authorizing official and documented with the information system security officer.
 
 vuldiscussion: |-

products/rhel10/controls/stig_rhel10.yml

@@ -2,7 +2,7 @@
 policy: Red Hat Enterprise Linux 10 Security Technical Implementation Guide
 title: Red Hat Enterprise Linux 10 Security Technical Implementation Guide
 id: stig_rhel10
-version: V1R2
+version: V1R3
 source: https://www.cyber.mil/stigs/downloads/
 reference_type: stigid
 product: rhel10
@@ -646,6 +646,13 @@ controls:
       rules:
           - configure_bind_crypto_policy
       status: automated
+    - id: RHEL-10-300085
+      levels:
+          - high
+      title: RHEL 10 must implement DOD-approved encryption in the OpenSSL package.
+      rules:
+          - configure_openssl_crypto_policy
+      status: automated
     - id: RHEL-10-300090
       levels:
           - high
@@ -1762,7 +1769,7 @@ controls:
       levels:
           - medium
       title: RHEL 10 must generate audit records for all account creations, modifications, disabling,
-          and termination events that affect "/etc/opasswd".
+          and termination events that affect "/etc/security/opasswd".
       rules:
           - audit_rules_usergroup_modification_opasswd
       status: automated
@@ -2834,7 +2841,7 @@ controls:
     - id: RHEL-10-700920
       levels:
           - medium
-      title: RHEL 10 must automatically exit interactive command shell user sessions after 15 minutes
+      title: RHEL 10 must automatically exit interactive command shell user sessions after 10 minutes
           of inactivity.
       rules:
           - accounts_tmout
@@ -3034,7 +3041,7 @@ controls:
     - id: RHEL-10-701210
       levels:
           - medium
-      title: RHEL 10 must disable file system automount function unless required.
+      title: RHEL 10 must disable file system automount function.
       rules:
           - service_autofs_disabled
       status: automated

products/rhel10/profiles/stig.profile

@@ -2,7 +2,7 @@
 documentation_complete: true
 
 metadata:
-    version: V1R2
+    version: V1R3
     SMEs:
         - mab879
 
@@ -12,7 +12,7 @@ title: 'DISA STIG for Red Hat Enterprise Linux 10'
 
 description: >-
     This profile contains configuration checks that align to the
-    DISA STIG for Red Hat Enterprise Linux 10 V1R2.
+    DISA STIG for Red Hat Enterprise Linux 10 V1R3.
 
     In addition to being applicable to Red Hat Enterprise Linux 10, this
     configuration baseline is applicable to the operating system tier of

products/rhel10/profiles/stig_gui.profile

@@ -2,7 +2,7 @@
 documentation_complete: true
 
 metadata:
-    version: V1R2
+    version: V1R3
     SMEs:
         - mab879
 
@@ -12,7 +12,7 @@ title: 'DISA STIG with GUI for Red Hat Enterprise Linux 10'
 
 description: >-
     This profile contains configuration checks that align to the
-    DISA STIG for Red Hat Enterprise Linux 10 V1R2.
+    DISA STIG for Red Hat Enterprise Linux 10 V1R3.
 
     In addition to being applicable to Red Hat Enterprise Linux 10, this
     configuration baseline is applicable to the operating system tier of