Add initial NIST 800-53 artifacts for RHEL8, RHEL9, RHEL10. - #53
Add initial NIST 800-53 artifacts for RHEL8, RHEL9, RHEL10.#53ggbecker wants to merge 2 commits into
Conversation
|
Hey @ggbecker, could you propose someone from your team to review the content of artifacts? |
Adds Gemara-compliant artifacts for NIST SP 800-53 Revision 5 compliance evaluation on Fedora systems. Source: ComplianceAsCode/content Branch: add-nist-800-53-fedora-control Testing: Validated with Complytime scan on Fedora 39 Artifacts: - Bundle manifest (3 layers) - Control catalog (1,196 controls, 439 rules, 539 mappings) - Policy (439 assessment plans with OpenSCAP evaluation) Scan results: 17 requirements tested (9 passed, 8 failed) Controls verified: AC, AU, IA, SC, SI families This PR complements the RHEL artifacts and enables Complytime compliance scanning for Fedora distributions.
| objective: 'Require that users log out when {{ insert: param, ac-02.05_odp }}.' | ||
| group: ac | ||
| assessment-requirements: | ||
| - id: accounts_tmout |
There was a problem hiding this comment.
@jpower432 The assessment-requirements in this particular ControlCatalog include &id001 address lookup and *id001 pointers written inline with applicability. Those values may have been copied over from CaC/content and may need to be expanded into the applicability-groups. It may be worth asking the author if there was a particular value intended for those assessment-requirements.applicability or if it was meant to reference the fedora-low, fedora-moderate, and fedora-high values.
Note: Cross-checking withComplianceAsCode/content accounts_tmout rule_yml referencing NIST 800-53 AC 2(5)
There was a problem hiding this comment.
@jpower432 actually, when taking a closer look in vscode, the pointers reference a single value defined in the applicability-groups and it appears to be used to reduce the number of lines in the file. This is technically fine for assembling the catalog, but I'd be curious on your thoughts for readability. It may serve better to separate by control family (e.g., ac-catalog.yaml, governance/catalogs/nist-800-53-rhel9/*-catalog.yaml) if we're looking to keep the files within a certain size-range.
applicability: &id001
- fedora-moderate
- id: no_invalid_shell_accounts_unlocked
state: Active
text: Rule 'no_invalid_shell_accounts_unlocked' MUST be verified
applicability: *id001 # Ctrl + click = fedora-moderate read through id001
- id: no_password_auth_for_systemaccounts
state: Active
text: Rule 'no_password_auth_for_systemaccounts' MUST be verified
marcusburghardt
left a comment
marcusburghardt
left a comment
There was a problem hiding this comment.
LGTM. Looking forward to see the follow-up syncs.
|
This PR will probably be updated based on proposal from #55 |
5 participants
Summary
Add initial NIST 800-53 artifacts for RHEL8, RHEL9, RHEL10 and Fedora.
This is the first initial manual submission of the files. Later on this sync should be automated by the workflow introduced by 14797
Related Issues
ComplianceAsCode/content#14797
ComplianceAsCode/content#15014